();
+ hints.add("Check the javascript in the HTML source.");
+ hints.add("Check how the application calls a specific javascript function to execute the transaction.");
+ hints.add("Try to navigate to 'javascript:submitData(1234556,11000);'");
+ return hints;
+
+ }
+
+ protected Integer getDefaultRanking()
+ {
+ return DEFAULT_RANKING;
+ }
+
+ /**
+ * Gets the title attribute of the HelloScreen object
+ *
+ * @return The title value
+ */
+ public String getTitle()
+ {
+ return ( "Silent Transactions Attacks" );
+ }
+
+
+}
diff --git a/ webgoat/main/project/WebContent/lesson_plans/DOMInjection.html b/ webgoat/main/project/WebContent/lesson_plans/DOMInjection.html
index 3428c2e93..7287be2e2 100644
--- a/ webgoat/main/project/WebContent/lesson_plans/DOMInjection.html
+++ b/ webgoat/main/project/WebContent/lesson_plans/DOMInjection.html
@@ -10,13 +10,13 @@ How to perform DOM injection attacks.
How the attacks works:
Some applications specially the ones that uses AJAX manipulates and updates the DOM
-directly using javascript, DHTML and eval.
+directly using javascript, DHTML and eval() method.
An attacker may take advantage of that by intercepting the reply and try to inject some
javascript commands to exploit his attacks.
General Goal(s):
-* Your victim is a system that takes an activatation key to allow you to use it.
+* Your victim is a system that takes an activatation key to allow you to use it.
* Your goal should be to try to get to enable the activate button.
-* Take some time to see the HTML source in order to understand how does it work.
+* Take some time to see the HTML source in order to understand how the key validation process works.
diff --git a/ webgoat/main/project/WebContent/lesson_plans/JSONInjection.html b/ webgoat/main/project/WebContent/lesson_plans/JSONInjection.html
new file mode 100644
index 000000000..7a1e08e40
--- /dev/null
+++ b/ webgoat/main/project/WebContent/lesson_plans/JSONInjection.html
@@ -0,0 +1,23 @@
+
+
Lesson Plan Title: How to Perform JSON Injection
+
Concept / Topic To Teach:
+This lesson teaches how to perform JSON Injection Attacks.
+
+
+
+How the attacks works:
+
+JavaScript Object Notation (JSON) is a simple and effective lightweight data exchange format. JSON can be in a lot of forms such as arrays, lists, hashtables and other data structures.
+JSON is widely used in AJAX and Web2.0 application and is favored by programmers over XML because of its ease of use and speed.
+However, JSON, like XML is prone to Injection attacks. A malacious attackers can inject the reply from the server and inject some aribtrary values in there.
+
+
General Goal(s):
+
+* You are travelling from Boston, MA- Airport code BOS to Seattle, WA - Airport code SEA.
+* Once you enter the three digits code of the airport, an AJAX request will be executed asking for the tickets price.
+* You will notice that there are two flights available, an expensive one with no stops and another cheaper one with 2 stops.
+* Your goal is to try to get the one with no stops but for a cheaper price.
+
diff --git a/ webgoat/main/project/WebContent/lesson_plans/SilentTransactions.html b/ webgoat/main/project/WebContent/lesson_plans/SilentTransactions.html
new file mode 100644
index 000000000..7f052b18f
--- /dev/null
+++ b/ webgoat/main/project/WebContent/lesson_plans/SilentTransactions.html
@@ -0,0 +1,24 @@
+
+
Lesson Plan Title: How to Perform Silent Transactions Attacks.
+
Concept / Topic To Teach:
+This lesson teaches how to perform silent transactions attacks.
+
+
+
+How the attacks works:
+
+Any system that silently processes transactions using a single submission is dangerous to the client.
+For example, if a normal web application allows a simple URL submission, a preset session attack will
+allow the attacker to complete a transaction without the user’s authorization.
+In Ajax, it gets worse: the transaction is silent; it happens with no user feedback on the page,
+so an injected attack script may be able to steal money from the client without authorization.
+
General Goal(s):
+
+* This is a sample internet banking application - money transfers page.
+* It shows below your balance, the account you are transferring to and amount you will transfer.
+* The application uses AJAX to submit the transaction after doing some basic client side validations.
+* Your goal is to try to bypass the user's authorization and silently execute the transaction
+
diff --git a/ webgoat/main/project/doc/WebGoatv4UsersGuide_DRAFT.doc b/ webgoat/main/project/doc/WebGoatv4UsersGuide_DRAFT.doc
index 1933d6d80..a755343bf 100644
Binary files a/ webgoat/main/project/doc/WebGoatv4UsersGuide_DRAFT.doc and b/ webgoat/main/project/doc/WebGoatv4UsersGuide_DRAFT.doc differ