dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: cleanup IT tests (#2040)

Browse Source
This commit is contained in:
Nanne Baars
2025-02-28 18:39:23 +01:00
committed by GitHub
parent b5af30c819
commit 55bd0a49db
24 changed files with 233 additions and 297 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pom.xml
View File

@ -242,18 +242,6 @@
<scope>provided</scope> <scope>provided</scope>
<optional>true</optional> <optional>true</optional>
</dependency> </dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
<version>1.20.5</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>junit-jupiter</artifactId>
<version>1.20.5</version>
<scope>test</scope>
</dependency>
<dependency> <dependency>
<groupId>javax.xml.bind</groupId> <groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId> <artifactId>jaxb-api</artifactId>

14
src/it/java/org/owasp/webgoat/integration/AccessControlIntegrationTest.java
View File

@ -29,7 +29,7 @@ class AccessControlIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("access-control/users-admin-fix")) .get(webGoatUrlConfig.url("access-control/users-admin-fix"))
.then() .then()
.statusCode(HttpStatus.SC_FORBIDDEN); .statusCode(HttpStatus.SC_FORBIDDEN);
@ -44,7 +44,7 @@ class AccessControlIntegrationTest extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.body(String.format(userTemplate, this.getUser(), this.getUser())) .body(String.format(userTemplate, this.getUser(), this.getUser()))
.post(url("access-control/users")) .post(webGoatUrlConfig.url("access-control/users"))
.then() .then()
.statusCode(HttpStatus.SC_OK); .statusCode(HttpStatus.SC_OK);
@ -55,14 +55,14 @@ class AccessControlIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("access-control/users-admin-fix")) .get(webGoatUrlConfig.url("access-control/users-admin-fix"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
.jsonPath() .jsonPath()
.get("find { it.username == \"Jerry\" }.userHash"); .get("find { it.username == \"Jerry\" }.userHash");
checkAssignment(url("access-control/user-hash-fix"), Map.of("userHash", userHash), true); checkAssignment(webGoatUrlConfig.url("access-control/user-hash-fix"), Map.of("userHash", userHash), true);
} }
private void assignment2() { private void assignment2() {
@ -72,18 +72,18 @@ class AccessControlIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("access-control/users")) .get(webGoatUrlConfig.url("access-control/users"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
.jsonPath() .jsonPath()
.get("find { it.username == \"Jerry\" }.userHash"); .get("find { it.username == \"Jerry\" }.userHash");
checkAssignment(url("access-control/user-hash"), Map.of("userHash", userHash), true); checkAssignment(webGoatUrlConfig.url("access-control/user-hash"), Map.of("userHash", userHash), true);
} }
private void assignment1() { private void assignment1() {
var params = Map.of("hiddenMenu1", "Users", "hiddenMenu2", "Config"); var params = Map.of("hiddenMenu1", "Users", "hiddenMenu2", "Config");
checkAssignment(url("access-control/hidden-menu"), params, true); checkAssignment(webGoatUrlConfig.url("access-control/hidden-menu"), params, true);
} }
} }

39
src/it/java/org/owasp/webgoat/integration/CSRFIntegrationTest.java
View File

@ -5,7 +5,7 @@
package org.owasp.webgoat.integration; package org.owasp.webgoat.integration;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.DynamicTest.dynamicTest; import static org.junit.jupiter.api.DynamicTest.dynamicTest;
import io.restassured.RestAssured; import io.restassured.RestAssured;
@ -68,12 +68,12 @@ public class CSRFIntegrationTest extends IntegrationTest {
public void init() { public void init() {
startLesson("CSRF"); startLesson("CSRF");
webwolfFileDir = getWebWolfFileServerLocation(); webwolfFileDir = getWebWolfFileServerLocation();
uploadTrickHtml("csrf3.html", trickHTML3.replace("WEBGOATURL", url("csrf/basic-get-flag"))); uploadTrickHtml("csrf3.html", trickHTML3.replace("WEBGOATURL", webGoatUrlConfig.url("csrf/basic-get-flag")));
uploadTrickHtml("csrf4.html", trickHTML4.replace("WEBGOATURL", url("csrf/review"))); uploadTrickHtml("csrf4.html", trickHTML4.replace("WEBGOATURL", webGoatUrlConfig.url("csrf/review")));
uploadTrickHtml("csrf7.html", trickHTML7.replace("WEBGOATURL", url("csrf/feedback/message"))); uploadTrickHtml("csrf7.html", trickHTML7.replace("WEBGOATURL", webGoatUrlConfig.url("csrf/feedback/message")));
uploadTrickHtml( uploadTrickHtml(
"csrf8.html", "csrf8.html",
trickHTML8.replace("WEBGOATURL", url("login")).replace("USERNAME", this.getUser())); trickHTML8.replace("WEBGOATURL", webGoatUrlConfig.url("login")).replace("USERNAME", this.getUser()));
} }
@TestFactory @TestFactory
@ -107,7 +107,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.multiPart("file", htmlName, htmlContent.getBytes()) .multiPart("file", htmlName, htmlContent.getBytes())
.post(new WebWolfUrlBuilder().path("fileupload").build()) .post(webWolfUrlConfig.url("fileupload"))
.then() .then()
.extract() .extract()
.response() .response()
@ -122,7 +122,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("files/%s/%s", this.getUser(), htmlName).build()) .get(webWolfUrlConfig.url("files/%s/%s".formatted(this.getUser(), htmlName)))
.then() .then()
.extract() .extract()
.response() .response()
@ -140,7 +140,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("Referer", new WebWolfUrlBuilder().path("files/fake.html").build()) .header("Referer", webWolfUrlConfig.url("files/fake.html"))
.post(goatURL) .post(goatURL)
.then() .then()
.extract() .extract()
@ -148,15 +148,13 @@ public class CSRFIntegrationTest extends IntegrationTest {
.toString(); .toString();
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear();
params.put("confirmFlagVal", flag); params.put("confirmFlagVal", flag);
checkAssignment(url("csrf/confirm-flag-1"), params, true); checkAssignment(webGoatUrlConfig.url("csrf/confirm-flag-1"), params, true);
} }
private void checkAssignment4(String goatURL) { private void checkAssignment4(String goatURL) {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear();
params.put("reviewText", "test review"); params.put("reviewText", "test review");
params.put("stars", "5"); params.put("stars", "5");
params.put( params.put(
@ -167,13 +165,13 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("Referer", new WebWolfUrlBuilder().path("files/fake.html").build()) .header("Referer", webWolfUrlConfig.url("files/fake.html"))
.formParams(params) .formParams(params)
.post(goatURL) .post(goatURL)
.then() .then()
.extract() .extract()
.path("lessonCompleted"); .path("lessonCompleted");
assertEquals(true, result); assertTrue(result);
} }
private void checkAssignment7(String goatURL) { private void checkAssignment7(String goatURL) {
@ -188,7 +186,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("Referer", new WebWolfUrlBuilder().path("files/fake.html").build()) .header("Referer", webWolfUrlConfig.url("files/fake.html"))
.contentType(ContentType.TEXT) .contentType(ContentType.TEXT)
.body( .body(
"{\"name\":\"WebGoat\",\"email\":\"webgoat@webgoat.org\",\"content\":\"WebGoat is" "{\"name\":\"WebGoat\",\"email\":\"webgoat@webgoat.org\",\"content\":\"WebGoat is"
@ -202,7 +200,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("confirmFlagVal", flag); params.put("confirmFlagVal", flag);
checkAssignment(url("csrf/feedback"), params, true); checkAssignment(webGoatUrlConfig.url("csrf/feedback"), params, true);
} }
private void checkAssignment8(String goatURL) { private void checkAssignment8(String goatURL) {
@ -211,7 +209,6 @@ public class CSRFIntegrationTest extends IntegrationTest {
registerCSRFUser(); registerCSRFUser();
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear();
params.put("username", "csrf-" + this.getUser()); params.put("username", "csrf-" + this.getUser());
params.put("password", "password"); params.put("password", "password");
@ -221,7 +218,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("Referer", new WebWolfUrlBuilder().path("files/fake.html").build()) .header("Referer", webWolfUrlConfig.url("files/fake.html"))
.params(params) .params(params)
.post(goatURL) .post(goatURL)
.then() .then()
@ -233,7 +230,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", newCookie) .cookie("JSESSIONID", newCookie)
.get(url("CSRF.lesson.lesson")) .get(webGoatUrlConfig.url("CSRF.lesson.lesson"))
.then() .then()
.statusCode(200); .statusCode(200);
@ -243,7 +240,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", newCookie) .cookie("JSESSIONID", newCookie)
.post(url("csrf/login")) .post(webGoatUrlConfig.url("csrf/login"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -258,7 +255,7 @@ public class CSRFIntegrationTest extends IntegrationTest {
RestAssured.given() RestAssured.given()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.get(url("service/lessonoverview.mvc/CSRF")) .get(webGoatUrlConfig.url("service/lessonoverview.mvc/CSRF"))
.then() .then()
.extract() .extract()
.jsonPath() .jsonPath()
@ -285,6 +282,6 @@ public class CSRFIntegrationTest extends IntegrationTest {
.formParam("password", "password") .formParam("password", "password")
.formParam("matchingPassword", "password") .formParam("matchingPassword", "password")
.formParam("agree", "agree") .formParam("agree", "agree")
.post(url("register.mvc")); .post(webGoatUrlConfig.url("register.mvc"));
} }
} }

26
src/it/java/org/owasp/webgoat/integration/ChallengeIntegrationTest.java
View File

@ -26,7 +26,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("challenge/logo")) .get(webGoatUrlConfig.url("challenge/logo"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -38,14 +38,14 @@ public class ChallengeIntegrationTest extends IntegrationTest {
params.put("username", "admin"); params.put("username", "admin");
params.put("password", "!!webgoat_admin_1234!!".replace("1234", pincode)); params.put("password", "!!webgoat_admin_1234!!".replace("1234", pincode));
checkAssignment(url("challenge/1"), params, true); checkAssignment(webGoatUrlConfig.url("challenge/1"), params, true);
String result = String result =
RestAssured.given() RestAssured.given()
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams(params) .formParams(params)
.post(url("challenge/1")) .post(webGoatUrlConfig.url("challenge/1"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -54,7 +54,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42); String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42);
params.clear(); params.clear();
params.put("flag", flag); params.put("flag", flag);
checkAssignment(url("challenge/flag/1"), params, true); checkAssignment(webGoatUrlConfig.url("challenge/flag/1"), params, true);
checkResults("Challenge1"); checkResults("Challenge1");
@ -63,7 +63,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("scoreboard-data")) .get(webGoatUrlConfig.url("scoreboard-data"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -87,7 +87,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams(params) .formParams(params)
.post(url("challenge/5")) .post(webGoatUrlConfig.url("challenge/5"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -96,7 +96,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42); String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42);
params.clear(); params.clear();
params.put("flag", flag); params.put("flag", flag);
checkAssignment(url("challenge/flag/5"), params, true); checkAssignment(webGoatUrlConfig.url("challenge/flag/5"), params, true);
checkResults("Challenge5"); checkResults("Challenge5");
@ -105,7 +105,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("scoreboard-data")) .get(webGoatUrlConfig.url("scoreboard-data"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -124,7 +124,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("challenge/7/.git")) .get(webGoatUrlConfig.url("challenge/7/.git"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -136,7 +136,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams("email", getUser() + "@webgoat.org") .formParams("email", getUser() + "@webgoat.org")
.post(url("challenge/7")) .post(webGoatUrlConfig.url("challenge/7"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -148,7 +148,7 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("mail").build()) .get(webWolfUrlConfig.url("mail"))
.then() .then()
.extract() .extract()
.response() .response()
@ -162,13 +162,13 @@ public class ChallengeIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("challenge/7/reset-password/{link}"), "375afe1104f4a487a73823c50a9292a2") .get(webGoatUrlConfig.url("challenge/7/reset-password/{link}"), "375afe1104f4a487a73823c50a9292a2")
.then() .then()
.statusCode(HttpStatus.ACCEPTED.value()) .statusCode(HttpStatus.ACCEPTED.value())
.extract() .extract()
.asString(); .asString();
String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42); String flag = result.substring(result.indexOf("flag") + 6, result.indexOf("flag") + 42);
checkAssignment(url("challenge/flag/7"), Map.of("flag", flag), true); checkAssignment(webGoatUrlConfig.url("challenge/flag/7"), Map.of("flag", flag), true);
} }
} }

18
src/it/java/org/owasp/webgoat/integration/CryptoIntegrationTest.java
View File

@ -56,7 +56,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("crypto/encoding/basic")) .get(webGoatUrlConfig.url("crypto/encoding/basic"))
.then() .then()
.extract() .extract()
.asString(); .asString();
@ -68,7 +68,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("answer_user", answer_user); params.put("answer_user", answer_user);
params.put("answer_pwd", answer_pwd); params.put("answer_pwd", answer_pwd);
checkAssignment(url("crypto/encoding/basic-auth"), params, true); checkAssignment(webGoatUrlConfig.url("crypto/encoding/basic-auth"), params, true);
} }
private void checkAssignment3() { private void checkAssignment3() {
@ -76,7 +76,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("answer_pwd1", answer_1); params.put("answer_pwd1", answer_1);
checkAssignment(url("crypto/encoding/xor"), params, true); checkAssignment(webGoatUrlConfig.url("crypto/encoding/xor"), params, true);
} }
private void checkAssignment4() throws NoSuchAlgorithmException { private void checkAssignment4() throws NoSuchAlgorithmException {
@ -86,7 +86,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("crypto/hashing/md5")) .get(webGoatUrlConfig.url("crypto/hashing/md5"))
.then() .then()
.extract() .extract()
.asString(); .asString();
@ -96,7 +96,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("crypto/hashing/sha256")) .get(webGoatUrlConfig.url("crypto/hashing/sha256"))
.then() .then()
.extract() .extract()
.asString(); .asString();
@ -116,7 +116,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("answer_pwd1", answer_1); params.put("answer_pwd1", answer_1);
params.put("answer_pwd2", answer_2); params.put("answer_pwd2", answer_2);
checkAssignment(url("crypto/hashing"), params, true); checkAssignment(webGoatUrlConfig.url("crypto/hashing"), params, true);
} }
private void checkAssignmentSigning() throws NoSuchAlgorithmException, InvalidKeySpecException { private void checkAssignmentSigning() throws NoSuchAlgorithmException, InvalidKeySpecException {
@ -126,7 +126,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("crypto/signing/getprivate")) .get(webGoatUrlConfig.url("crypto/signing/getprivate"))
.then() .then()
.extract() .extract()
.asString(); .asString();
@ -139,7 +139,7 @@ public class CryptoIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("modulus", modulus); params.put("modulus", modulus);
params.put("signature", signature); params.put("signature", signature);
checkAssignment(url("crypto/signing/verify"), params, true); checkAssignment(webGoatUrlConfig.url("crypto/signing/verify"), params, true);
} }
private void checkAssignmentDefaults() { private void checkAssignmentDefaults() {
@ -155,6 +155,6 @@ public class CryptoIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("secretText", text); params.put("secretText", text);
params.put("secretFileName", "default_secret"); params.put("secretFileName", "default_secret");
checkAssignment(url("crypto/secure/defaults"), params, true); checkAssignment(webGoatUrlConfig.url("crypto/secure/defaults"), params, true);
} }
} }

2
src/it/java/org/owasp/webgoat/integration/DeserializationIntegrationTest.java
View File

@ -30,7 +30,7 @@ public class DeserializationIntegrationTest extends IntegrationTest {
params.put( params.put(
"token", SerializationHelper.toString(new VulnerableTaskHolder("wait", "sleep 5"))); "token", SerializationHelper.toString(new VulnerableTaskHolder("wait", "sleep 5")));
} }
checkAssignment(url("InsecureDeserialization/task"), params, true); checkAssignment(webGoatUrlConfig.url("InsecureDeserialization/task"), params, true);
checkResults("InsecureDeserialization"); checkResults("InsecureDeserialization");
} }

32
src/it/java/org/owasp/webgoat/integration/GeneralLessonIntegrationTest.java
View File

@ -21,19 +21,19 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("person", "goatuser"); params.put("person", "goatuser");
checkAssignment(url("HttpBasics/attack1"), params, true); checkAssignment(webGoatUrlConfig.url("HttpBasics/attack1"), params, true);
params.clear(); params.clear();
params.put("answer", "POST"); params.put("answer", "POST");
params.put("magic_answer", "33"); params.put("magic_answer", "33");
params.put("magic_num", "4"); params.put("magic_num", "4");
checkAssignment(url("HttpBasics/attack2"), params, false); checkAssignment(webGoatUrlConfig.url("HttpBasics/attack2"), params, false);
params.clear(); params.clear();
params.put("answer", "POST"); params.put("answer", "POST");
params.put("magic_answer", "33"); params.put("magic_answer", "33");
params.put("magic_num", "33"); params.put("magic_num", "33");
checkAssignment(url("HttpBasics/attack2"), params, true); checkAssignment(webGoatUrlConfig.url("HttpBasics/attack2"), params, true);
checkResults("HttpBasics"); checkResults("HttpBasics");
} }
@ -45,7 +45,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("person", "goatuser"); params.put("person", "goatuser");
checkAssignment(url("HttpBasics/attack1"), params, true); checkAssignment(webGoatUrlConfig.url("HttpBasics/attack1"), params, true);
} }
@Test @Test
@ -58,7 +58,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("x-request-intercepted", "true") .header("x-request-intercepted", "true")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("HttpProxies/intercept-request?changeMe=Requests are tampered easily")) .get(webGoatUrlConfig.url("HttpProxies/intercept-request?changeMe=Requests are tampered easily"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -86,7 +86,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.put( params.put(
"question_3_solution", "question_3_solution",
"Solution 2: The systems security is compromised even if only one goal is harmed."); "Solution 2: The systems security is compromised even if only one goal is harmed.");
checkAssignment(url("cia/quiz"), params, true); checkAssignment(webGoatUrlConfig.url("cia/quiz"), params, true);
checkResults("CIA"); checkResults("CIA");
} }
@ -109,7 +109,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("payload", solution); params.put("payload", solution);
checkAssignment(url("VulnerableComponents/attack1"), params, true); checkAssignment(webGoatUrlConfig.url("VulnerableComponents/attack1"), params, true);
checkResults("VulnerableComponents"); checkResults("VulnerableComponents");
} }
} }
@ -121,7 +121,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("username", "CaptainJack"); params.put("username", "CaptainJack");
params.put("password", "BlackPearl"); params.put("password", "BlackPearl");
checkAssignment(url("InsecureLogin/task"), params, true); checkAssignment(webGoatUrlConfig.url("InsecureLogin/task"), params, true);
checkResults("InsecureLogin"); checkResults("InsecureLogin");
} }
@ -131,7 +131,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("password", "ajnaeliclm^&&@kjn."); params.put("password", "ajnaeliclm^&&@kjn.");
checkAssignment(url("SecurePasswords/assignment"), params, true); checkAssignment(webGoatUrlConfig.url("SecurePasswords/assignment"), params, true);
checkResults("SecurePasswords"); checkResults("SecurePasswords");
startLesson("AuthBypass"); startLesson("AuthBypass");
@ -141,7 +141,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.put("jsEnabled", "1"); params.put("jsEnabled", "1");
params.put("verifyMethod", "SEC_QUESTIONS"); params.put("verifyMethod", "SEC_QUESTIONS");
params.put("userId", "12309746"); params.put("userId", "12309746");
checkAssignment(url("auth-bypass/verify-account"), params, true); checkAssignment(webGoatUrlConfig.url("auth-bypass/verify-account"), params, true);
checkResults("AuthBypass"); checkResults("AuthBypass");
startLesson("HttpProxies"); startLesson("HttpProxies");
@ -152,7 +152,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("x-request-intercepted", "true") .header("x-request-intercepted", "true")
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("HttpProxies/intercept-request?changeMe=Requests are tampered easily")) .get(webGoatUrlConfig.url("HttpProxies/intercept-request?changeMe=Requests are tampered easily"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -178,7 +178,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
.header("webgoat-requested-by", "dom-xss-vuln") .header("webgoat-requested-by", "dom-xss-vuln")
.header("X-Requested-With", "XMLHttpRequest") .header("X-Requested-With", "XMLHttpRequest")
.formParams(params) .formParams(params)
.post(url("CrossSiteScripting/phone-home-xss")) .post(webGoatUrlConfig.url("CrossSiteScripting/phone-home-xss"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -187,12 +187,12 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("successMessage", secretNumber); params.put("successMessage", secretNumber);
checkAssignment(url("ChromeDevTools/dummy"), params, true); checkAssignment(webGoatUrlConfig.url("ChromeDevTools/dummy"), params, true);
params.clear(); params.clear();
params.put("number", "24"); params.put("number", "24");
params.put("network_num", "24"); params.put("network_num", "24");
checkAssignment(url("ChromeDevTools/network"), params, true); checkAssignment(webGoatUrlConfig.url("ChromeDevTools/network"), params, true);
checkResults("ChromeDevTools"); checkResults("ChromeDevTools");
} }
@ -207,7 +207,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.put("jsEnabled", "1"); params.put("jsEnabled", "1");
params.put("verifyMethod", "SEC_QUESTIONS"); params.put("verifyMethod", "SEC_QUESTIONS");
params.put("userId", "12309746"); params.put("userId", "12309746");
checkAssignment(url("auth-bypass/verify-account"), params, true); checkAssignment(webGoatUrlConfig.url("auth-bypass/verify-account"), params, true);
checkResults("AuthBypass"); checkResults("AuthBypass");
} }
@ -218,7 +218,7 @@ public class GeneralLessonIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("param1", "secr37Value"); params.put("param1", "secr37Value");
params.put("param2", "Main"); params.put("param2", "Main");
checkAssignment(url("lesson-template/sample-attack"), params, true); checkAssignment(webGoatUrlConfig.url("lesson-template/sample-attack"), params, true);
checkResults("LessonTemplate"); checkResults("LessonTemplate");
} }
} }

12
src/it/java/org/owasp/webgoat/integration/IDORIntegrationTest.java
View File

@ -43,7 +43,7 @@ public class IDORIntegrationTest extends IntegrationTest {
params.put("username", "tom"); params.put("username", "tom");
params.put("password", "cat"); params.put("password", "cat");
checkAssignment(url("IDOR/login"), params, true); checkAssignment(webGoatUrlConfig.url("IDOR/login"), params, true);
} }
private void profile() { private void profile() {
@ -54,7 +54,7 @@ public class IDORIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("IDOR/profile")) .get(webGoatUrlConfig.url("IDOR/profile"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -64,12 +64,12 @@ public class IDORIntegrationTest extends IntegrationTest {
// Show difference - assignment 3b // Show difference - assignment 3b
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.put("attributes", "userId,role"); params.put("attributes", "userId,role");
checkAssignment(url("IDOR/diff-attributes"), params, true); checkAssignment(webGoatUrlConfig.url("IDOR/diff-attributes"), params, true);
// View profile another way - assignment 4 // View profile another way - assignment 4
params.clear(); params.clear();
params.put("url", "WebGoat/IDOR/profile/2342384"); params.put("url", "WebGoat/IDOR/profile/2342384");
checkAssignment(url("IDOR/profile/alt-path"), params, true); checkAssignment(webGoatUrlConfig.url("IDOR/profile/alt-path"), params, true);
// assignment 5a // assignment 5a
MatcherAssert.assertThat( MatcherAssert.assertThat(
@ -77,7 +77,7 @@ public class IDORIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("IDOR/profile/2342388")) .get(webGoatUrlConfig.url("IDOR/profile/2342388"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -94,7 +94,7 @@ public class IDORIntegrationTest extends IntegrationTest {
.body( .body(
"{\"role\":\"1\", \"color\":\"red\", \"size\":\"large\", \"name\":\"Buffalo Bill\"," "{\"role\":\"1\", \"color\":\"red\", \"size\":\"large\", \"name\":\"Buffalo Bill\","
+ " \"userId\":\"2342388\"}") + " \"userId\":\"2342388\"}")
.put(url("IDOR/profile/2342388")) .put(webGoatUrlConfig.url("IDOR/profile/2342388"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()

86
src/it/java/org/owasp/webgoat/integration/IntegrationTest.java
View File

@ -20,66 +20,13 @@ import org.springframework.http.HttpStatus;
public abstract class IntegrationTest { public abstract class IntegrationTest {
private final ServerUrlConfig webGoatUrlConfig = ServerUrlConfig.webGoat(); protected final ServerUrlConfig webGoatUrlConfig = ServerUrlConfig.webGoat();
@Getter private final ServerUrlConfig webWolfUrlConfig = ServerUrlConfig.webWolf(); protected final ServerUrlConfig webWolfUrlConfig = ServerUrlConfig.webWolf();
@Getter private String webGoatCookie; @Getter private String webGoatCookie;
@Getter private String webWolfCookie; @Getter private String webWolfCookie;
@Getter private final String user = "webgoat"; @Getter private final String user = "webgoat";
protected String url(String url) {
return webGoatUrlConfig.url(url);
}
protected class WebWolfUrlBuilder {
private boolean attackMode = false;
private String path = null;
protected String build() {
return webWolfUrlConfig.url(path != null ? path : "");
}
/**
* In attack mode it means WebGoat calls WebWolf to perform an attack. In this case we need to
* use port 9090 in a Docker environment.
*/
protected WebWolfUrlBuilder attackMode() {
attackMode = true;
return this;
}
protected WebWolfUrlBuilder path(String path) {
this.path = path;
return this;
}
protected WebWolfUrlBuilder path(String path, String... uriVariables) {
this.path = path.formatted(uriVariables);
return this;
}
}
/**
* Debugging options: install TestContainers Desktop and map port 5005 to the host machine with
* https://newsletter.testcontainers.com/announcements/set-fixed-ports-to-easily-debug-development-services
*
* <p>Start the test and connect a remote debugger in IntelliJ to localhost:5005 and attach it.
*/
// private static GenericContainer<?> webGoatContainer =
// new GenericContainer(new ImageFromDockerfile("webgoat").withFileFromPath("/",
// Paths.get(".")))
// .withLogConsumer(new Slf4jLogConsumer(LoggerFactory.getLogger("webgoat")))
// .withExposedPorts(8080, 9090, 5005)
// .withEnv(
// "_JAVA_OPTIONS",
// "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=0.0.0.0:5005")
// .waitingFor(Wait.forHealthcheck());
//
// static {
// webGoatContainer.start();
// }
@BeforeEach @BeforeEach
public void login() { public void login() {
login("webgoat"); login("webgoat");
@ -92,7 +39,7 @@ public abstract class IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.formParam("username", user) .formParam("username", user)
.formParam("password", "password") .formParam("password", "password")
.post(url("login")) .post(webGoatUrlConfig.url("login"))
.then() .then()
.log() .log()
.ifValidationFails(LogDetail.ALL) // Log the response details if validation fails .ifValidationFails(LogDetail.ALL) // Log the response details if validation fails
@ -109,7 +56,7 @@ public abstract class IntegrationTest {
.formParam("password", "password") .formParam("password", "password")
.formParam("matchingPassword", "password") .formParam("matchingPassword", "password")
.formParam("agree", "agree") .formParam("agree", "agree")
.post(url("register.mvc")) .post(webGoatUrlConfig.url("register.mvc"))
.then() .then()
.cookie("JSESSIONID") .cookie("JSESSIONID")
.statusCode(302) .statusCode(302)
@ -122,7 +69,7 @@ public abstract class IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.formParam("username", user) .formParam("username", user)
.formParam("password", "password") .formParam("password", "password")
.post(url("login")) .post(webGoatUrlConfig.url("login"))
.then() .then()
.cookie("JSESSIONID") .cookie("JSESSIONID")
.statusCode(302) .statusCode(302)
@ -136,7 +83,7 @@ public abstract class IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.formParam("username", user) .formParam("username", user)
.formParam("password", "password") .formParam("password", "password")
.post(new WebWolfUrlBuilder().path("login").build()) .post(webWolfUrlConfig.url("login"))
.then() .then()
.statusCode(302) .statusCode(302)
.cookie("WEBWOLFSESSION") .cookie("WEBWOLFSESSION")
@ -146,7 +93,12 @@ public abstract class IntegrationTest {
@AfterEach @AfterEach
public void logout() { public void logout() {
RestAssured.given().when().relaxedHTTPSValidation().get(url("logout")).then().statusCode(200); RestAssured.given()
.when()
.relaxedHTTPSValidation()
.get(webGoatUrlConfig.url("logout"))
.then()
.statusCode(200);
} }
public void startLesson(String lessonName) { public void startLesson(String lessonName) {
@ -158,7 +110,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url(lessonName + ".lesson.lesson")) .get(webGoatUrlConfig.url(lessonName + ".lesson.lesson"))
.then() .then()
.statusCode(200); .statusCode(200);
@ -167,7 +119,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/restartlesson.mvc/%s.lesson".formatted(lessonName))) .get(webGoatUrlConfig.url("service/restartlesson.mvc/%s.lesson".formatted(lessonName)))
.then() .then()
.statusCode(200); .statusCode(200);
} }
@ -209,7 +161,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/lessonoverview.mvc/%s.lesson".formatted(lesson))) .get(webGoatUrlConfig.url("service/lessonoverview.mvc/%s.lesson".formatted(lesson)))
.andReturn(); .andReturn();
MatcherAssert.assertThat( MatcherAssert.assertThat(
@ -223,7 +175,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/lessonoverview.mvc")) .get(webGoatUrlConfig.url("service/lessonoverview.mvc"))
.andReturn(); .andReturn();
MatcherAssert.assertThat( MatcherAssert.assertThat(
@ -269,7 +221,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("file-server-location").build()) .get(webWolfUrlConfig.url("file-server-location"))
.then() .then()
.extract() .extract()
.response() .response()
@ -284,7 +236,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("server-directory")) .get(webGoatUrlConfig.url("server-directory"))
.then() .then()
.extract() .extract()
.response() .response()
@ -297,7 +249,7 @@ public abstract class IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.delete(new WebWolfUrlBuilder().path("mail").build()) .delete(webWolfUrlConfig.url("mail"))
.then() .then()
.statusCode(HttpStatus.ACCEPTED.value()); .statusCode(HttpStatus.ACCEPTED.value());
} }

23
src/it/java/org/owasp/webgoat/integration/JWTLessonIntegrationTest.java
View File

@ -90,7 +90,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParam("jwt-encode-user", "user") .formParam("jwt-encode-user", "user")
.post(url("JWT/decode")) .post(webGoatUrlConfig.url("JWT/decode"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -105,7 +105,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("JWT/secret/gettoken")) .get(webGoatUrlConfig.url("JWT/secret/gettoken"))
.then() .then()
.extract() .extract()
.response() .response()
@ -119,7 +119,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParam("token", generateToken(secret)) .formParam("token", generateToken(secret))
.post(url("JWT/secret")) .post(webGoatUrlConfig.url("JWT/secret"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -133,7 +133,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("JWT/votings/login?user=Tom")) .get(webGoatUrlConfig.url("JWT/votings/login?user=Tom"))
.then() .then()
.extract() .extract()
.cookie("access_token"); .cookie("access_token");
@ -166,7 +166,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.cookie("access_token", replacedToken) .cookie("access_token", replacedToken)
.post(url("JWT/votings")) .post(webGoatUrlConfig.url("JWT/votings"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -207,7 +207,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.header("Authorization", "Bearer " + replacedToken) .header("Authorization", "Bearer " + replacedToken)
.post(url("JWT/refresh/checkout")) .post(webGoatUrlConfig.url("JWT/refresh/checkout"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -240,7 +240,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.post(url("JWT/kid/delete?token=" + token)) .post(webGoatUrlConfig.url("JWT/kid/delete?token=" + token))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -258,7 +258,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.multiPart("file", "jwks.json", jwks.toJson().getBytes()) .multiPart("file", "jwks.json", jwks.toJson().getBytes())
.post(new WebWolfUrlBuilder().path("fileupload").build()) .post(webWolfUrlConfig.url("fileupload"))
.then() .then()
.extract() .extract()
.response() .response()
@ -268,8 +268,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
Map<String, Object> header = new HashMap(); Map<String, Object> header = new HashMap();
header.put(Header.TYPE, Header.JWT_TYPE); header.put(Header.TYPE, Header.JWT_TYPE);
header.put( header.put(
JwsHeader.JWK_SET_URL, JwsHeader.JWK_SET_URL, webWolfUrlConfig.url("files/%s/jwks.json".formatted(getUser())));
new WebWolfUrlBuilder().attackMode().path("files/%s/jwks.json", getUser()).build());
String token = String token =
Jwts.builder() Jwts.builder()
@ -290,7 +289,7 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.post(url("JWT/jku/delete?token=" + token)) .post(webGoatUrlConfig.url("JWT/jku/delete?token=" + token))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -303,6 +302,6 @@ public class JWTLessonIntegrationTest extends IntegrationTest {
params.put("question_0_solution", "Solution 1"); params.put("question_0_solution", "Solution 1");
params.put("question_1_solution", "Solution 2"); params.put("question_1_solution", "Solution 2");
checkAssignment(url("JWT/quiz"), params, true); checkAssignment(webGoatUrlConfig.url("JWT/quiz"), params, true);
} }
} }

14
src/it/java/org/owasp/webgoat/integration/LabelAndHintIntegrationTest.java
View File

@ -28,7 +28,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.header("Accept-Language", "en") .header("Accept-Language", "en")
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/labels.mvc")) .get(webGoatUrlConfig.url("service/labels.mvc"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -46,7 +46,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.header("Accept-Language", "en") .header("Accept-Language", "en")
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/labels.mvc?lang=nl")) .get(webGoatUrlConfig.url("service/labels.mvc?lang=nl"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -62,7 +62,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.header("Accept-Language", "en") .header("Accept-Language", "en")
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/labels.mvc?lang=de")) .get(webGoatUrlConfig.url("service/labels.mvc?lang=de"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -79,7 +79,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.header("Accept-Language", "nl") .header("Accept-Language", "nl")
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/labels.mvc?lang=xx")) .get(webGoatUrlConfig.url("service/labels.mvc?lang=xx"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -95,7 +95,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.header("Accept-Language", "xx_YY") .header("Accept-Language", "xx_YY")
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/labels.mvc")) .get(webGoatUrlConfig.url("service/labels.mvc"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -207,7 +207,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.header("Accept-Language", lang) .header("Accept-Language", lang)
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
// .log().headers() // .log().headers()
.get(url("service/labels.mvc")) .get(webGoatUrlConfig.url("service/labels.mvc"))
.then() .then()
// .log().all() // .log().all()
.statusCode(200) .statusCode(200)
@ -222,7 +222,7 @@ public class LabelAndHintIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url("service/hint.mvc")) .get(webGoatUrlConfig.url("service/hint.mvc"))
.then() .then()
// .log().all() // .log().all()
.statusCode(200) .statusCode(200)

22
src/it/java/org/owasp/webgoat/integration/PasswordResetLessonIntegrationTest.java
View File

@ -36,11 +36,11 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
public void assignment2() { public void assignment2() {
checkAssignment( checkAssignment(
url("PasswordReset/simple-mail/reset"), webGoatUrlConfig.url("PasswordReset/simple-mail/reset"),
Map.of("emailReset", this.getUser() + "@webgoat.org"), Map.of("emailReset", this.getUser() + "@webgoat.org"),
false); false);
checkAssignment( checkAssignment(
url("PasswordReset/simple-mail"), webGoatUrlConfig.url("PasswordReset/simple-mail"),
Map.of( Map.of(
"email", "email",
this.getUser() + "@webgoat.org", this.getUser() + "@webgoat.org",
@ -51,18 +51,18 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
public void assignment4() { public void assignment4() {
checkAssignment( checkAssignment(
url("PasswordReset/questions"), webGoatUrlConfig.url("PasswordReset/questions"),
Map.of("username", "tom", "securityQuestion", "purple"), Map.of("username", "tom", "securityQuestion", "purple"),
true); true);
} }
public void assignment5() { public void assignment5() {
checkAssignment( checkAssignment(
url("PasswordReset/SecurityQuestions"), webGoatUrlConfig.url("PasswordReset/SecurityQuestions"),
Map.of("question", "What is your favorite animal?"), Map.of("question", "What is your favorite animal?"),
false); false);
checkAssignment( checkAssignment(
url("PasswordReset/SecurityQuestions"), webGoatUrlConfig.url("PasswordReset/SecurityQuestions"),
Map.of("question", "What is your favorite color?"), Map.of("question", "What is your favorite color?"),
true); true);
} }
@ -76,7 +76,7 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
// WebGoat // WebGoat
changePassword(link); changePassword(link);
checkAssignment( checkAssignment(
url("PasswordReset/reset/login"), webGoatUrlConfig.url("PasswordReset/reset/login"),
Map.of("email", "tom@webgoat-cloud.org", "password", "123456"), Map.of("email", "tom@webgoat-cloud.org", "password", "123456"),
true); true);
} }
@ -89,7 +89,7 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("mail").build()) .get(webWolfUrlConfig.url("mail"))
.then() .then()
.extract() .extract()
.response() .response()
@ -112,7 +112,7 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams("resetLink", link, "password", "123456") .formParams("resetLink", link, "password", "123456")
.post(url("PasswordReset/reset/change-password")) .post(webGoatUrlConfig.url("PasswordReset/reset/change-password"))
.then() .then()
.statusCode(200); .statusCode(200);
} }
@ -123,7 +123,7 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("requests").build()) .get(webWolfUrlConfig.url("requests"))
.then() .then()
.extract() .extract()
.response() .response()
@ -140,11 +140,11 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
private void clickForgotEmailLink(String user) { private void clickForgotEmailLink(String user) {
RestAssured.given() RestAssured.given()
.when() .when()
.header(HttpHeaders.HOST, String.format("%s:%s", "127.0.0.1", getWebWolfUrlConfig().port())) .header(HttpHeaders.HOST, String.format("%s:%s", "127.0.0.1", webWolfUrlConfig.port()))
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams("email", user) .formParams("email", user)
.post(url("PasswordReset/ForgotPassword/create-password-reset-link")) .post(webGoatUrlConfig.url("PasswordReset/ForgotPassword/create-password-reset-link"))
.then() .then()
.statusCode(200); .statusCode(200);
} }

12
src/it/java/org/owasp/webgoat/integration/PathTraversalIntegrationTest.java
View File

@ -59,7 +59,7 @@ class PathTraversalIT extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.multiPart("uploadedFile", "test.jpg", Files.readAllBytes(fileToUpload.toPath())) .multiPart("uploadedFile", "test.jpg", Files.readAllBytes(fileToUpload.toPath()))
.param("fullName", "../John Doe") .param("fullName", "../John Doe")
.post(url("PathTraversal/profile-upload")) .post(webGoatUrlConfig.url("PathTraversal/profile-upload"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -75,7 +75,7 @@ class PathTraversalIT extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.multiPart("uploadedFileFix", "test.jpg", Files.readAllBytes(fileToUpload.toPath())) .multiPart("uploadedFileFix", "test.jpg", Files.readAllBytes(fileToUpload.toPath()))
.param("fullNameFix", "..././John Doe") .param("fullNameFix", "..././John Doe")
.post(url("PathTraversal/profile-upload-fix")) .post(webGoatUrlConfig.url("PathTraversal/profile-upload-fix"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -93,7 +93,7 @@ class PathTraversalIT extends IntegrationTest {
"uploadedFileRemoveUserInput", "uploadedFileRemoveUserInput",
"../test.jpg", "../test.jpg",
Files.readAllBytes(fileToUpload.toPath())) Files.readAllBytes(fileToUpload.toPath()))
.post(url("PathTraversal/profile-upload-remove-user-input")) .post(webGoatUrlConfig.url("PathTraversal/profile-upload-remove-user-input"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -108,13 +108,13 @@ class PathTraversalIT extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.get(url(uri)) .get(webGoatUrlConfig.url(uri))
.then() .then()
.statusCode(200) .statusCode(200)
.body(CoreMatchers.is("You found it submit the SHA-512 hash of your username as answer")); .body(CoreMatchers.is("You found it submit the SHA-512 hash of your username as answer"));
checkAssignment( checkAssignment(
url("PathTraversal/random"), webGoatUrlConfig.url("PathTraversal/random"),
Map.of("secret", Sha512DigestUtils.shaHex(this.getUser())), Map.of("secret", Sha512DigestUtils.shaHex(this.getUser())),
true); true);
} }
@ -137,7 +137,7 @@ class PathTraversalIT extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.multiPart("uploadedFileZipSlip", "upload.zip", Files.readAllBytes(zipFile.toPath())) .multiPart("uploadedFileZipSlip", "upload.zip", Files.readAllBytes(zipFile.toPath()))
.post(url("PathTraversal/zip-slip")) .post(webGoatUrlConfig.url("PathTraversal/zip-slip"))
.then() .then()
.log() .log()
.all() .all()

2
src/it/java/org/owasp/webgoat/integration/ProgressRaceConditionIntegrationTest.java
View File

@ -33,7 +33,7 @@ public class ProgressRaceConditionIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.formParams(Map.of("flag", "test")) .formParams(Map.of("flag", "test"))
.post(url("challenge/flag/1")); .post(webGoatUrlConfig.url("challenge/flag/1"));
}; };
ExecutorService executorService = Executors.newFixedThreadPool(NUMBER_OF_PARALLEL_THREADS); ExecutorService executorService = Executors.newFixedThreadPool(NUMBER_OF_PARALLEL_THREADS);
List<? extends Callable<Response>> flagCalls = List<? extends Callable<Response>> flagCalls =

4
src/it/java/org/owasp/webgoat/integration/SSRFIntegrationTest.java
View File

@ -18,11 +18,11 @@ public class SSRFIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("url", "images/jerry.png"); params.put("url", "images/jerry.png");
checkAssignment(url("SSRF/task1"), params, true); checkAssignment(webGoatUrlConfig.url("SSRF/task1"), params, true);
params.clear(); params.clear();
params.put("url", "http://ifconfig.pro"); params.put("url", "http://ifconfig.pro");
checkAssignment(url("SSRF/task2"), params, true); checkAssignment(webGoatUrlConfig.url("SSRF/task2"), params, true);
checkResults("SSRF"); checkResults("SSRF");
} }

2
src/it/java/org/owasp/webgoat/integration/SessionManagementIntegrationTest.java
View File

@ -19,7 +19,7 @@ class SessionManagementIT extends IntegrationTest {
startLesson("HijackSession"); startLesson("HijackSession");
checkAssignment( checkAssignment(
url(HIJACK_LOGIN_CONTEXT_PATH), webGoatUrlConfig.url(HIJACK_LOGIN_CONTEXT_PATH),
Map.of("username", "webgoat", "password", "webgoat"), Map.of("username", "webgoat", "password", "webgoat"),
false); false);
} }

12
src/it/java/org/owasp/webgoat/integration/SqlInjectionAdvancedIntegrationTest.java
View File

@ -20,27 +20,27 @@ public class SqlInjectionAdvancedIntegrationTest extends IntegrationTest {
params.put("password_reg", "password"); params.put("password_reg", "password");
params.put("email_reg", "someone@microsoft.com"); params.put("email_reg", "someone@microsoft.com");
params.put("confirm_password", "password"); params.put("confirm_password", "password");
checkAssignmentWithPUT(url("SqlInjectionAdvanced/challenge"), params, true); checkAssignmentWithPUT(webGoatUrlConfig.url("SqlInjectionAdvanced/challenge"), params, true);
params.clear(); params.clear();
params.put("username_login", "tom"); params.put("username_login", "tom");
params.put("password_login", "thisisasecretfortomonly"); params.put("password_login", "thisisasecretfortomonly");
checkAssignment(url("SqlInjectionAdvanced/challenge_Login"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionAdvanced/challenge_Login"), params, true);
params.clear(); params.clear();
params.put("userid_6a", "'; SELECT * FROM user_system_data;--"); params.put("userid_6a", "'; SELECT * FROM user_system_data;--");
checkAssignment(url("SqlInjectionAdvanced/attack6a"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionAdvanced/attack6a"), params, true);
params.clear(); params.clear();
params.put( params.put(
"userid_6a", "userid_6a",
"Smith' union select userid,user_name, user_name,user_name,password,cookie,userid from" "Smith' union select userid,user_name, user_name,user_name,password,cookie,userid from"
+ " user_system_data --"); + " user_system_data --");
checkAssignment(url("SqlInjectionAdvanced/attack6a"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionAdvanced/attack6a"), params, true);
params.clear(); params.clear();
params.put("userid_6b", "passW0rD"); params.put("userid_6b", "passW0rD");
checkAssignment(url("SqlInjectionAdvanced/attack6b"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionAdvanced/attack6b"), params, true);
params.clear(); params.clear();
params.put( params.put(
@ -58,7 +58,7 @@ public class SqlInjectionAdvancedIntegrationTest extends IntegrationTest {
params.put( params.put(
"question_4_solution", "question_4_solution",
"Solution 4: The database registers 'Robert' ); DROP TABLE Students;--'."); "Solution 4: The database registers 'Robert' ); DROP TABLE Students;--'.");
checkAssignment(url("SqlInjectionAdvanced/quiz"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionAdvanced/quiz"), params, true);
checkResults("SqlInjectionAdvanced"); checkResults("SqlInjectionAdvanced");
} }

18
src/it/java/org/owasp/webgoat/integration/SqlInjectionLessonIntegrationTest.java
View File

@ -38,44 +38,44 @@ public class SqlInjectionLessonIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("query", sql_2); params.put("query", sql_2);
checkAssignment(url("SqlInjection/attack2"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack2"), params, true);
params.clear(); params.clear();
params.put("query", sql_3); params.put("query", sql_3);
checkAssignment(url("SqlInjection/attack3"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack3"), params, true);
params.clear(); params.clear();
params.put("query", sql_4_add); params.put("query", sql_4_add);
checkAssignment(url("SqlInjection/attack4"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack4"), params, true);
params.clear(); params.clear();
params.put("query", sql_5); params.put("query", sql_5);
checkAssignment(url("SqlInjection/attack5"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack5"), params, true);
params.clear(); params.clear();
params.put("operator", sql_9_operator); params.put("operator", sql_9_operator);
params.put("account", sql_9_account); params.put("account", sql_9_account);
params.put("injection", sql_9_injection); params.put("injection", sql_9_injection);
checkAssignment(url("SqlInjection/assignment5a"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/assignment5a"), params, true);
params.clear(); params.clear();
params.put("login_count", sql_10_login_count); params.put("login_count", sql_10_login_count);
params.put("userid", sql_10_userid); params.put("userid", sql_10_userid);
checkAssignment(url("SqlInjection/assignment5b"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/assignment5b"), params, true);
params.clear(); params.clear();
params.put("name", sql_11_a); params.put("name", sql_11_a);
params.put("auth_tan", sql_11_b); params.put("auth_tan", sql_11_b);
checkAssignment(url("SqlInjection/attack8"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack8"), params, true);
params.clear(); params.clear();
params.put("name", sql_12_a); params.put("name", sql_12_a);
params.put("auth_tan", sql_12_b); params.put("auth_tan", sql_12_b);
checkAssignment(url("SqlInjection/attack9"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack9"), params, true);
params.clear(); params.clear();
params.put("action_string", sql_13); params.put("action_string", sql_13);
checkAssignment(url("SqlInjection/attack10"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjection/attack10"), params, true);
checkResults("SqlInjection"); checkResults("SqlInjection");
} }

15
src/it/java/org/owasp/webgoat/integration/SqlInjectionMitigationIntegrationTest.java
View File

@ -27,7 +27,7 @@ public class SqlInjectionMitigationIntegrationTest extends IntegrationTest {
params.put("field5", "?"); params.put("field5", "?");
params.put("field6", "prep.setString(1,\"\")"); params.put("field6", "prep.setString(1,\"\")");
params.put("field7", "prep.setString(2,\\\"\\\")"); params.put("field7", "prep.setString(2,\\\"\\\")");
checkAssignment(url("SqlInjectionMitigations/attack10a"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionMitigations/attack10a"), params, true);
params.put( params.put(
"editor", "editor",
@ -41,18 +41,18 @@ public class SqlInjectionMitigationIntegrationTest extends IntegrationTest {
+ "} catch (Exception e) {\r\n" + "} catch (Exception e) {\r\n"
+ " System.out.println(\"Oops. Something went wrong!\");\r\n" + " System.out.println(\"Oops. Something went wrong!\");\r\n"
+ "}"); + "}");
checkAssignment(url("SqlInjectionMitigations/attack10b"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionMitigations/attack10b"), params, true);
params.clear(); params.clear();
params.put( params.put(
"userid_sql_only_input_validation", "Smith';SELECT/**/*/**/from/**/user_system_data;--"); "userid_sql_only_input_validation", "Smith';SELECT/**/*/**/from/**/user_system_data;--");
checkAssignment(url("SqlOnlyInputValidation/attack"), params, true); checkAssignment(webGoatUrlConfig.url("SqlOnlyInputValidation/attack"), params, true);
params.clear(); params.clear();
params.put( params.put(
"userid_sql_only_input_validation_on_keywords", "userid_sql_only_input_validation_on_keywords",
"Smith';SESELECTLECT/**/*/**/FRFROMOM/**/user_system_data;--"); "Smith';SESELECTLECT/**/*/**/FRFROMOM/**/user_system_data;--");
checkAssignment(url("SqlOnlyInputValidationOnKeywords/attack"), params, true); checkAssignment(webGoatUrlConfig.url("SqlOnlyInputValidationOnKeywords/attack"), params, true);
RestAssured.given() RestAssured.given()
.when() .when()
@ -60,8 +60,7 @@ public class SqlInjectionMitigationIntegrationTest extends IntegrationTest {
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get( .get(
url( webGoatUrlConfig.url("SqlInjectionMitigations/servers?column=(case when (true) then hostname"
"SqlInjectionMitigations/servers?column=(case when (true) then hostname"
+ " else id end)")) + " else id end)"))
.then() .then()
.statusCode(200); .statusCode(200);
@ -71,7 +70,7 @@ public class SqlInjectionMitigationIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.contentType(ContentType.JSON) .contentType(ContentType.JSON)
.get(url("SqlInjectionMitigations/servers?column=unknown")) .get(webGoatUrlConfig.url("SqlInjectionMitigations/servers?column=unknown"))
.then() .then()
.statusCode(500) .statusCode(500)
.body( .body(
@ -82,7 +81,7 @@ public class SqlInjectionMitigationIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("ip", "104.130.219.202"); params.put("ip", "104.130.219.202");
checkAssignment(url("SqlInjectionMitigations/attack12a"), params, true); checkAssignment(webGoatUrlConfig.url("SqlInjectionMitigations/attack12a"), params, true);
checkResults("SqlInjectionMitigations"); checkResults("SqlInjectionMitigations");
} }

14
src/it/java/org/owasp/webgoat/integration/WebWolfIntegrationTest.java
View File

@ -20,14 +20,14 @@ public class WebWolfIntegrationTest extends IntegrationTest {
// Assignment 3 // Assignment 3
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.put("email", this.getUser() + "@webgoat.org"); params.put("email", this.getUser() + "@webgoat.org");
checkAssignment(url("WebWolf/mail/send"), params, false); checkAssignment(webGoatUrlConfig.url("WebWolf/mail/send"), params, false);
String responseBody = String responseBody =
RestAssured.given() RestAssured.given()
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("mail").build()) .get(webWolfUrlConfig.url("mail"))
.then() .then()
.extract() .extract()
.response() .response()
@ -41,7 +41,7 @@ public class WebWolfIntegrationTest extends IntegrationTest {
uniqueCode.lastIndexOf("your unique code is: ") + (21 + this.getUser().length())); uniqueCode.lastIndexOf("your unique code is: ") + (21 + this.getUser().length()));
params.clear(); params.clear();
params.put("uniqueCode", uniqueCode); params.put("uniqueCode", uniqueCode);
checkAssignment(url("WebWolf/mail"), params, true); checkAssignment(webGoatUrlConfig.url("WebWolf/mail"), params, true);
// Assignment 4 // Assignment 4
RestAssured.given() RestAssured.given()
@ -49,7 +49,7 @@ public class WebWolfIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("JSESSIONID", getWebGoatCookie()) .cookie("JSESSIONID", getWebGoatCookie())
.queryParams(params) .queryParams(params)
.get(url("WebWolf/landing/password-reset")) .get(webGoatUrlConfig.url("WebWolf/landing/password-reset"))
.then() .then()
.statusCode(200); .statusCode(200);
RestAssured.given() RestAssured.given()
@ -57,7 +57,7 @@ public class WebWolfIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.queryParams(params) .queryParams(params)
.get(new WebWolfUrlBuilder().path("landing").build()) .get(webWolfUrlConfig.url("landing"))
.then() .then()
.statusCode(200); .statusCode(200);
responseBody = responseBody =
@ -65,7 +65,7 @@ public class WebWolfIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("requests").build()) .get(webWolfUrlConfig.url("requests"))
.then() .then()
.extract() .extract()
.response() .response()
@ -74,7 +74,7 @@ public class WebWolfIntegrationTest extends IntegrationTest {
assertTrue(responseBody.contains(uniqueCode)); assertTrue(responseBody.contains(uniqueCode));
params.clear(); params.clear();
params.put("uniqueCode", uniqueCode); params.put("uniqueCode", uniqueCode);
checkAssignment(url("WebWolf/landing"), params, true); checkAssignment(webGoatUrlConfig.url("WebWolf/landing"), params, true);
checkResults("WebWolfIntroduction"); checkResults("WebWolfIntroduction");
} }

16
src/it/java/org/owasp/webgoat/integration/XSSIntegrationTest.java
View File

@ -18,7 +18,7 @@ public class XSSIntegrationTest extends IntegrationTest {
Map<String, Object> params = new HashMap<>(); Map<String, Object> params = new HashMap<>();
params.clear(); params.clear();
params.put("checkboxAttack1", "value"); params.put("checkboxAttack1", "value");
checkAssignment(url("CrossSiteScripting/attack1"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack1"), params, true);
params.clear(); params.clear();
params.put("QTY1", "1"); params.put("QTY1", "1");
@ -27,11 +27,11 @@ public class XSSIntegrationTest extends IntegrationTest {
params.put("QTY4", "1"); params.put("QTY4", "1");
params.put("field1", "<script>alert('XSS+Test')</script>"); params.put("field1", "<script>alert('XSS+Test')</script>");
params.put("field2", "111"); params.put("field2", "111");
checkAssignmentWithGet(url("CrossSiteScripting/attack5a"), params, true); checkAssignmentWithGet(webGoatUrlConfig.url("CrossSiteScripting/attack5a"), params, true);
params.clear(); params.clear();
params.put("DOMTestRoute", "start.mvc#test"); params.put("DOMTestRoute", "start.mvc#test");
checkAssignment(url("CrossSiteScripting/attack6a"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack6a"), params, true);
params.clear(); params.clear();
params.put("param1", "42"); params.put("param1", "42");
@ -45,7 +45,7 @@ public class XSSIntegrationTest extends IntegrationTest {
.header("webgoat-requested-by", "dom-xss-vuln") .header("webgoat-requested-by", "dom-xss-vuln")
.header("X-Requested-With", "XMLHttpRequest") .header("X-Requested-With", "XMLHttpRequest")
.formParams(params) .formParams(params)
.post(url("CrossSiteScripting/phone-home-xss")) .post(webGoatUrlConfig.url("CrossSiteScripting/phone-home-xss"))
.then() .then()
.statusCode(200) .statusCode(200)
.extract() .extract()
@ -54,7 +54,7 @@ public class XSSIntegrationTest extends IntegrationTest {
params.clear(); params.clear();
params.put("successMessage", secretNumber); params.put("successMessage", secretNumber);
checkAssignment(url("CrossSiteScripting/dom-follow-up"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/dom-follow-up"), params, true);
params.clear(); params.clear();
params.put( params.put(
@ -77,7 +77,7 @@ public class XSSIntegrationTest extends IntegrationTest {
"question_4_solution", "question_4_solution",
"Solution 4: No there are many other ways. Like HTML, Flash or any other type of code that" "Solution 4: No there are many other ways. Like HTML, Flash or any other type of code that"
+ " the browser executes."); + " the browser executes.");
checkAssignment(url("CrossSiteScripting/quiz"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/quiz"), params, true);
params.clear(); params.clear();
params.put( params.put(
@ -103,7 +103,7 @@ public class XSSIntegrationTest extends IntegrationTest {
+ "</table>" + "</table>"
+ "</body>" + "</body>"
+ "</html>"); + "</html>");
checkAssignment(url("CrossSiteScripting/attack3"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack3"), params, true);
params.clear(); params.clear();
params.put( params.put(
@ -113,7 +113,7 @@ public class XSSIntegrationTest extends IntegrationTest {
+ "s.scan(newComment,\"\");" + "s.scan(newComment,\"\");"
+ "CleanResults();" + "CleanResults();"
+ "MyCommentDAO.addComment(threadID, userID).getCleanHTML());"); + "MyCommentDAO.addComment(threadID, userID).getCleanHTML());");
checkAssignment(url("CrossSiteScripting/attack4"), params, true); checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack4"), params, true);
checkResults("CrossSiteScripting"); checkResults("CrossSiteScripting");
} }

16
src/it/java/org/owasp/webgoat/integration/XXEIntegrationTest.java
View File

@ -61,7 +61,7 @@ public class XXEIntegrationTest extends IntegrationTest {
*/ */
private String getSecret() { private String getSecret() {
String secretFile = webGoatHomeDirectory.concat("/XXE/" + getUser() + "/secret.txt"); String secretFile = webGoatHomeDirectory.concat("/XXE/" + getUser() + "/secret.txt");
String webWolfCallback = new WebWolfUrlBuilder().path("landing").attackMode().build(); String webWolfCallback = webWolfUrlConfig.url("landing");
String dtd7String = dtd7.replace("WEBWOLFURL", webWolfCallback).replace("SECRET", secretFile); String dtd7String = dtd7.replace("WEBWOLFURL", webWolfCallback).replace("SECRET", secretFile);
// upload DTD // upload DTD
@ -70,7 +70,7 @@ public class XXEIntegrationTest extends IntegrationTest {
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.multiPart("file", "blind.dtd", dtd7String.getBytes()) .multiPart("file", "blind.dtd", dtd7String.getBytes())
.post(new WebWolfUrlBuilder().path("fileupload").build()) .post(webWolfUrlConfig.url("fileupload"))
.then() .then()
.extract() .extract()
.response() .response()
@ -79,9 +79,9 @@ public class XXEIntegrationTest extends IntegrationTest {
// upload attack // upload attack
String xxe7String = String xxe7String =
xxe7.replace("WEBWOLFURL", new WebWolfUrlBuilder().attackMode().path("files").build()) xxe7.replace("WEBWOLFURL", webWolfUrlConfig.url("files"))
.replace("USERNAME", this.getUser()); .replace("USERNAME", this.getUser());
checkAssignment(url("xxe/blind"), ContentType.XML, xxe7String, false); checkAssignment(webGoatUrlConfig.url("xxe/blind"), ContentType.XML, xxe7String, false);
// read results from WebWolf // read results from WebWolf
String result = String result =
@ -89,7 +89,7 @@ public class XXEIntegrationTest extends IntegrationTest {
.when() .when()
.relaxedHTTPSValidation() .relaxedHTTPSValidation()
.cookie("WEBWOLFSESSION", getWebWolfCookie()) .cookie("WEBWOLFSESSION", getWebWolfCookie())
.get(new WebWolfUrlBuilder().path("requests").build()) .get(webWolfUrlConfig.url("requests"))
.then() .then()
.extract() .extract()
.response() .response()
@ -109,10 +109,10 @@ public class XXEIntegrationTest extends IntegrationTest {
public void runTests() throws IOException { public void runTests() throws IOException {
startLesson("XXE", true); startLesson("XXE", true);
webGoatHomeDirectory = webGoatServerDirectory(); webGoatHomeDirectory = webGoatServerDirectory();
checkAssignment(url("xxe/simple"), ContentType.XML, xxe3, true); checkAssignment(webGoatUrlConfig.url("xxe/simple"), ContentType.XML, xxe3, true);
checkAssignment(url("xxe/content-type"), ContentType.XML, xxe4, true); checkAssignment(webGoatUrlConfig.url("xxe/content-type"), ContentType.XML, xxe4, true);
checkAssignment( checkAssignment(
url("xxe/blind"), webGoatUrlConfig.url("xxe/blind"),
ContentType.XML, ContentType.XML,
"<comment><text>" + getSecret() + "</text></comment>", "<comment><text>" + getSecret() + "</text></comment>",
true); true);

4
src/main/java/org/owasp/webgoat/lessons/missingac/DisplayUser.java
View File

@ -13,8 +13,8 @@ import lombok.Getter;
public class DisplayUser { public class DisplayUser {
// intended to provide a display version of WebGoatUser for admins to view user attributes // intended to provide a display version of WebGoatUser for admins to view user attributes
private String username; private final String username;
private boolean admin; private final boolean admin;
private String userHash; private String userHash;
public DisplayUser(User user, String passwordSalt) { public DisplayUser(User user, String passwordSalt) {

3
src/test/java/org/owasp/webgoat/lessons/hijacksession/HijackSessionAssignmentTest.java
View File

@ -31,7 +31,8 @@ class HijackSessionAssignmentTest extends LessonTest {
private static final String COOKIE_NAME = "hijack_cookie"; private static final String COOKIE_NAME = "hijack_cookie";
private static final String LOGIN_CONTEXT_PATH = "/HijackSession/login"; private static final String LOGIN_CONTEXT_PATH = "/HijackSession/login";
@MockBean Authentication authenticationMock; @MockBean
Authentication authenticationMock;
@MockBean HijackSessionAuthenticationProvider providerMock; @MockBean HijackSessionAuthenticationProvider providerMock;