dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added JSONInjection, SilentTransactions

Browse Source 
Modified The install guide

git-svn-id: http://webgoat.googlecode.com/svn/trunk@48 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
sherif.fathy
2006-12-28 15:35:10 +00:00
parent af2df52e91
commit 5e061d5bad
6 changed files with 491 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
webgoat/main/project/WebContent/lesson_plans/DOMInjection.html
View File

@ -10,13 +10,13 @@ How to perform DOM injection attacks.
<b>How the attacks works:</b>
</p>
Some applications specially the ones that uses AJAX manipulates and updates the DOM
directly using javascript, DHTML and eval.<br>
directly using javascript, DHTML and eval() method.<br>
An attacker may take advantage of that by intercepting the reply and try to inject some
javascript commands to exploit his attacks.
</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
* Your victim is a system that takes an activatation key to allow you to use it.
* Your victim is a system that takes an activatation key to allow you to use it.<br>
* Your goal should be to try to get to enable the activate button.<br>
* Take some time to see the HTML source in order to understand how does it work.<br>
* Take some time to see the HTML source in order to understand how the key validation process works.<br>
<!-- Stop Instructions -->

23
webgoat/main/project/WebContent/lesson_plans/JSONInjection.html Normal file
View File

@ -0,0 +1,23 @@
<div align="Center">
<p><b>Lesson Plan Title:</b> How to Perform JSON Injection </p>
</div>
<p><b>Concept / Topic To Teach:</b> </p>
This lesson teaches how to perform JSON Injection Attacks.
<br>
<div align="Left">
<p>
<b>How the attacks works:</b>
</p>
JavaScript Object Notation (JSON) is a simple and effective lightweight data exchange format. JSON can be in a lot of forms such as arrays, lists, hashtables and other data structures.
JSON is widely used in AJAX and Web2.0 application and is favored by programmers over XML because of its ease of use and speed.
However, JSON, like XML is prone to Injection attacks. A malacious attackers can inject the reply from the server and inject some aribtrary values in there.
</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
* You are travelling from Boston, MA- Airport code BOS to Seattle, WA - Airport code SEA.<br>
* Once you enter the three digits code of the airport, an AJAX request will be executed asking for the tickets price.<br>
* You will notice that there are two flights available, an expensive one with no stops and another cheaper one with 2 stops.<br>
* Your goal is to try to get the one with no stops but for a cheaper price.
<!-- Stop Instructions -->

24
webgoat/main/project/WebContent/lesson_plans/SilentTransactions.html Normal file
View File

@ -0,0 +1,24 @@
<div align="Center">
<p><b>Lesson Plan Title:</b> How to Perform Silent Transactions Attacks. </p>
</div>
<p><b>Concept / Topic To Teach:</b> </p>
This lesson teaches how to perform silent transactions attacks.
<br>
<div align="Left">
<p>
<b>How the attacks works:</b>
</p>
Any system that silently processes transactions using a single submission is dangerous to the client.
For example, if a normal web application allows a simple URL submission, a preset session attack will
allow the attacker to complete a transaction without the user<65>s authorization.
In Ajax, it gets worse: the transaction is silent; it happens with no user feedback on the page,
so an injected attack script may be able to steal money from the client without authorization.
</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
* This is a sample internet banking application - money transfers page.<br>
* It shows below your balance, the account you are transferring to and amount you will transfer.<br>
* The application uses AJAX to submit the transaction after doing some basic client side validations.<br>
* Your goal is to try to bypass the user's authorization and silently execute the transaction<br>
<!-- Stop Instructions -->