dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
Nanne Baars 2019-09-13 16:42:13 +02:00
parent 361249c666
commit 5e6f825e64
56 changed files with 338 additions and 489 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
webgoat-container/src/test/java/org/owasp/webgoat/service/HintServiceTest.java
View File

@ -7,7 +7,7 @@ import org.junit.Test;
import org.junit.runner.RunWith; import org.junit.runner.RunWith;
import org.mockito.Mock; import org.mockito.Mock;
import org.mockito.Mockito; import org.mockito.Mockito;
import org.mockito.runners.MockitoJUnitRunner; import org.mockito.junit.MockitoJUnitRunner;
import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.Assignment; import org.owasp.webgoat.lessons.Assignment;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
@ -48,7 +48,6 @@ public class HintServiceTest {
@Test @Test
public void hintsPerAssignment() throws Exception { public void hintsPerAssignment() throws Exception {
when(lesson.getName()).thenReturn("Test lesson");
Assignment assignment = Mockito.mock(Assignment.class); Assignment assignment = Mockito.mock(Assignment.class);
when(assignment.getPath()).thenReturn("/HttpBasics/attack1"); when(assignment.getPath()).thenReturn("/HttpBasics/attack1");
when(assignment.getHints()).thenReturn(Lists.newArrayList("hint 1", "hint 2")); when(assignment.getHints()).thenReturn(Lists.newArrayList("hint 1", "hint 2"));

3
webgoat-container/src/test/java/org/owasp/webgoat/service/LabelServiceTest.java
View File

@ -4,6 +4,7 @@ import org.hamcrest.CoreMatchers;
import org.junit.Test; import org.junit.Test;
import org.junit.runner.RunWith; import org.junit.runner.RunWith;
import org.owasp.webgoat.session.Course; import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.users.UserService;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest; import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.boot.test.mock.mockito.MockBean; import org.springframework.boot.test.mock.mockito.MockBean;
@ -53,6 +54,8 @@ public class LabelServiceTest {
public MockMvc mockMvc; public MockMvc mockMvc;
@MockBean @MockBean
private Course course; private Course course;
@MockBean
private UserService userService;
@Test @Test
@WithMockUser(username = "guest", password = "guest") @WithMockUser(username = "guest", password = "guest")

2
webgoat-container/src/test/java/org/owasp/webgoat/service/LessonMenuServiceTest.java
View File

@ -7,7 +7,7 @@ import org.junit.Test;
import org.junit.runner.RunWith; import org.junit.runner.RunWith;
import org.mockito.Mock; import org.mockito.Mock;
import org.mockito.Mockito; import org.mockito.Mockito;
import org.mockito.runners.MockitoJUnitRunner; import org.mockito.junit.MockitoJUnitRunner;
import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.lessons.Category; import org.owasp.webgoat.lessons.Category;
import org.owasp.webgoat.lessons.NewLesson; import org.owasp.webgoat.lessons.NewLesson;

6
webgoat-lessons/http-proxies/src/main/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequest.java
View File

@ -39,10 +39,10 @@ import org.springframework.web.bind.annotation.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/HttpProxies/intercept-request") @RestController
public class HttpBasicsInterceptRequest extends AssignmentEndpoint { public class HttpBasicsInterceptRequest extends AssignmentEndpoint {
@GetMapping @GetMapping("/HttpProxies/intercept-request")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestHeader(value = "x-request-intercepted", required = false) Boolean headerValue, public AttackResult completed(@RequestHeader(value = "x-request-intercepted", required = false) Boolean headerValue,
@RequestParam(value = "changeMe", required = false) String paramValue) { @RequestParam(value = "changeMe", required = false) String paramValue) {
@ -53,7 +53,7 @@ public class HttpBasicsInterceptRequest extends AssignmentEndpoint {
} }
} }
@PostMapping @PostMapping("/HttpProxies/intercept-request")
@ResponseBody @ResponseBody
public AttackResult post() { public AttackResult post() {
return trackProgress(failed().feedback("http-proxies.intercept.failure").build()); return trackProgress(failed().feedback("http-proxies.intercept.failure").build());

14
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORDiffAttributes.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.io.IOException; import java.io.IOException;
@ -41,14 +38,13 @@ import java.io.IOException;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
@AssignmentPath("IDOR/diff-attributes")
@AssignmentHints({"idor.hints.idorDiffAttributes1","idor.hints.idorDiffAttributes2","idor.hints.idorDiffAttributes3"}) @AssignmentHints({"idor.hints.idorDiffAttributes1","idor.hints.idorDiffAttributes2","idor.hints.idorDiffAttributes3"})
public class IDORDiffAttributes extends AssignmentEndpoint { public class IDORDiffAttributes extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("IDOR/diff-attributes")
public @ResponseBody @ResponseBody
AttackResult completed(@RequestParam String attributes, HttpServletRequest request) throws IOException { public AttackResult completed(@RequestParam String attributes, HttpServletRequest request) throws IOException {
attributes = attributes.trim(); attributes = attributes.trim();
String[] diffAttribs = attributes.split(","); String[] diffAttribs = attributes.split(",");
if (diffAttribs.length < 2) { if (diffAttribs.length < 2) {

9
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDOREditOtherProfiile.java
View File

@ -37,17 +37,16 @@ import org.springframework.web.bind.annotation.*;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
@AssignmentPath("IDOR/profile/{userId}")
@AssignmentHints({"idor.hints.otherProfile1","idor.hints.otherProfile2","idor.hints.otherProfile3","idor.hints.otherProfile4","idor.hints.otherProfile5","idor.hints.otherProfile6","idor.hints.otherProfile7","idor.hints.otherProfile8","idor.hints.otherProfile9"}) @AssignmentHints({"idor.hints.otherProfile1","idor.hints.otherProfile2","idor.hints.otherProfile3","idor.hints.otherProfile4","idor.hints.otherProfile5","idor.hints.otherProfile6","idor.hints.otherProfile7","idor.hints.otherProfile8","idor.hints.otherProfile9"})
public class IDOREditOtherProfiile extends AssignmentEndpoint { public class IDOREditOtherProfiile extends AssignmentEndpoint {
@Autowired @Autowired
private UserSessionData userSessionData; private UserSessionData userSessionData;
@PutMapping(consumes = "application/json") @PutMapping(path = "IDOR/profile/{userId}", consumes = "application/json")
public @ResponseBody @ResponseBody
AttackResult completed(@PathVariable("userId") String userId, @RequestBody UserProfile userSubmittedProfile) { public AttackResult completed(@PathVariable("userId") String userId, @RequestBody UserProfile userSubmittedProfile) {
String authUserId = (String)userSessionData.getValue("idor-authenticated-user-id"); String authUserId = (String)userSessionData.getValue("idor-authenticated-user-id");
// this is where it starts ... accepting the user submitted ID and assuming it will be the same as the logged in userId and not checking for proper authorization // this is where it starts ... accepting the user submitted ID and assuming it will be the same as the logged in userId and not checking for proper authorization

13
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORLogin.java
View File

@ -40,8 +40,7 @@ import java.util.Map;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
@AssignmentPath("/IDOR/login")
@AssignmentHints({"idor.hints.idor_login"}) @AssignmentHints({"idor.hints.idor_login"})
public class IDORLogin extends AssignmentEndpoint { public class IDORLogin extends AssignmentEndpoint {
@ -63,7 +62,7 @@ public class IDORLogin extends AssignmentEndpoint {
} }
@PostMapping @PostMapping("/IDOR/login")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String username, @RequestParam String password) { public AttackResult completed(@RequestParam String username, @RequestParam String password) {
initIDORInfo(); initIDORInfo();
@ -81,12 +80,4 @@ public class IDORLogin extends AssignmentEndpoint {
return trackProgress(failed().feedback("idor.login.failure").build()); return trackProgress(failed().feedback("idor.login.failure").build());
} }
} }
// userSessionData.setValue("foo","bar");
// System.out.println("*** value set");
// System.out.println("*** fetching value");
// System.out.println(userSessionData.getValue("foo"));
// System.out.println("*** DONE fetching value");
// return trackProgress(AttackResult.failed("You are close, try again"));
} }

11
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORViewOtherProfile.java
View File

@ -7,10 +7,7 @@ import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.UserSessionData; import org.owasp.webgoat.session.UserSessionData;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
import java.util.HashMap; import java.util.HashMap;
@ -45,15 +42,14 @@ import java.util.Map;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
@AssignmentPath("IDOR/profile/{userId}")
@AssignmentHints({"idor.hints.otherProfile1","idor.hints.otherProfile2","idor.hints.otherProfile3","idor.hints.otherProfile4","idor.hints.otherProfile5","idor.hints.otherProfile6","idor.hints.otherProfile7","idor.hints.otherProfile8","idor.hints.otherProfile9"}) @AssignmentHints({"idor.hints.otherProfile1","idor.hints.otherProfile2","idor.hints.otherProfile3","idor.hints.otherProfile4","idor.hints.otherProfile5","idor.hints.otherProfile6","idor.hints.otherProfile7","idor.hints.otherProfile8","idor.hints.otherProfile9"})
public class IDORViewOtherProfile extends AssignmentEndpoint{ public class IDORViewOtherProfile extends AssignmentEndpoint{
@Autowired @Autowired
UserSessionData userSessionData; UserSessionData userSessionData;
@RequestMapping(produces = {"application/json"}, method = RequestMethod.GET) @GetMapping(path = "IDOR/profile/{userId}", produces = {"application/json"})
@ResponseBody @ResponseBody
public AttackResult completed(@PathVariable("userId") String userId, HttpServletResponse resp) { public AttackResult completed(@PathVariable("userId") String userId, HttpServletResponse resp) {
Map<String,Object> details = new HashMap<>(); Map<String,Object> details = new HashMap<>();
@ -76,5 +72,4 @@ public class IDORViewOtherProfile extends AssignmentEndpoint{
} }
return trackProgress(failed().build()); return trackProgress(failed().build());
} }
} }

15
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORViewOwnProfile.java
View File

@ -3,9 +3,7 @@ package org.owasp.webgoat.plugin;
import org.owasp.webgoat.session.UserSessionData; import org.owasp.webgoat.session.UserSessionData;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -43,15 +41,15 @@ import java.util.Map;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
public class IDORViewOwnProfile { public class IDORViewOwnProfile {
@Autowired @Autowired
UserSessionData userSessionData; UserSessionData userSessionData;
@RequestMapping(produces = {"application/json"}, method = RequestMethod.GET) @GetMapping(produces = {"application/json"})
@ResponseBody @ResponseBody
public Map<String, Object> invoke(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { public Map<String, Object> invoke() {
Map<String,Object> details = new HashMap<>(); Map<String,Object> details = new HashMap<>();
try { try {
if (userSessionData.getValue("idor-authenticated-as").equals("tom")) { if (userSessionData.getValue("idor-authenticated-as").equals("tom")) {
@ -71,9 +69,4 @@ public class IDORViewOwnProfile {
} }
return details; return details;
} }
// @Override
// public String getPath() {
// return "/IDOR/profile";
// }
} }

16
webgoat-lessons/idor/src/main/java/org/owasp/webgoat/plugin/IDORViewOwnProfileAltUrl.java
View File

@ -45,22 +45,20 @@ import java.util.Map;
* @version $Id: $Id * @version $Id: $Id
* @since January 3, 2017 * @since January 3, 2017
*/ */
@RestController
@AssignmentPath("IDOR/profile/alt-path") @AssignmentHints({"idor.hints.ownProfileAltUrl1", "idor.hints.ownProfileAltUrl2", "idor.hints.ownProfileAltUrl3"})
@AssignmentHints({"idor.hints.ownProfileAltUrl1","idor.hints.ownProfileAltUrl2","idor.hints.ownProfileAltUrl3"}) public class IDORViewOwnProfileAltUrl extends AssignmentEndpoint {
public class IDORViewOwnProfileAltUrl extends AssignmentEndpoint{
@Autowired @Autowired
UserSessionData userSessionData; UserSessionData userSessionData;
@RequestMapping(method = RequestMethod.POST) @PostMapping("IDOR/profile/alt-path")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String url, HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { public AttackResult completed(@RequestParam String url) {
Map<String,Object> details = new HashMap<>();
try { try {
if (userSessionData.getValue("idor-authenticated-as").equals("tom")) { if (userSessionData.getValue("idor-authenticated-as").equals("tom")) {
//going to use session auth to view this one //going to use session auth to view this one
String authUserId = (String)userSessionData.getValue("idor-authenticated-user-id"); String authUserId = (String) userSessionData.getValue("idor-authenticated-user-id");
//don't care about http://localhost:8080 ... just want WebGoat/ //don't care about http://localhost:8080 ... just want WebGoat/
String[] urlParts = url.split("/"); String[] urlParts = url.split("/");
if (urlParts[0].equals("WebGoat") && urlParts[1].equals("IDOR") && urlParts[2].equals("profile") && urlParts[3].equals(authUserId)) { if (urlParts[0].equals("WebGoat") && urlParts[1].equals("IDOR") && urlParts[2].equals("profile") && urlParts[3].equals(authUserId)) {
@ -74,9 +72,7 @@ public class IDORViewOwnProfileAltUrl extends AssignmentEndpoint{
return trackProgress(failed().feedback("idor.view.own.profile.failure2").build()); return trackProgress(failed().feedback("idor.view.own.profile.failure2").build());
} }
} catch (Exception ex) { } catch (Exception ex) {
System.out.println(ex.getMessage());
return failed().feedback("an error occurred with your request").build(); return failed().feedback("an error occurred with your request").build();
} }
} }
} }

43
webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/plugin/InsecureDeserializationTask.java
View File

@ -1,61 +1,58 @@
package org.owasp.webgoat.plugin; package org.owasp.webgoat.plugin;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import javax.servlet.http.HttpServletRequest; import java.io.ByteArrayInputStream;
import java.io.IOException; import java.io.IOException;
import java.io.ObjectInputStream; import java.io.ObjectInputStream;
import java.io.ByteArrayInputStream;
import java.util.Base64; import java.util.Base64;
/** /**
* ************************************************************************************************* * *************************************************************************************************
* * <p>
* * <p>
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* * <p>
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* * <p>
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software * the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later * Foundation; either version 2 of the License, or (at your option) any later
* version. * version.
* * <p>
* This program is distributed in the hope that it will be useful, but WITHOUT * This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details. * details.
* * <p>
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA. * Place - Suite 330, Boston, MA 02111-1307, USA.
* * <p>
* Getting Source ============== * Getting Source ==============
* * <p>
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects. * for free software projects.
* * <p>
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/InsecureDeserialization/task") @RestController
public class InsecureDeserializationTask extends AssignmentEndpoint { public class InsecureDeserializationTask extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/InsecureDeserialization/task")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String token) throws IOException { public AttackResult completed(@RequestParam String token) throws IOException {
String b64token; String b64token;
byte [] data; byte[] data;
ObjectInputStream ois; ObjectInputStream ois;
Object o; Object o;
long before, after; long before, after;
@ -64,7 +61,7 @@ public class InsecureDeserializationTask extends AssignmentEndpoint {
b64token = token.replace('-', '+').replace('_', '/'); b64token = token.replace('-', '+').replace('_', '/');
try { try {
data = Base64.getDecoder().decode(b64token); data = Base64.getDecoder().decode(b64token);
ois = new ObjectInputStream( new ByteArrayInputStream(data) ); ois = new ObjectInputStream(new ByteArrayInputStream(data));
} catch (Exception e) { } catch (Exception e) {
return trackProgress(failed().build()); return trackProgress(failed().build());
} }
@ -78,11 +75,11 @@ public class InsecureDeserializationTask extends AssignmentEndpoint {
after = System.currentTimeMillis(); after = System.currentTimeMillis();
ois.close(); ois.close();
delay = (int)(after - before); delay = (int) (after - before);
if ( delay > 7000 ) { if (delay > 7000) {
return trackProgress(failed().build()); return trackProgress(failed().build());
} }
if ( delay < 3000 ) { if (delay < 3000) {
return trackProgress(failed().build()); return trackProgress(failed().build());
} }
return trackProgress(success().build()); return trackProgress(success().build());

12
webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java
View File

@ -3,10 +3,7 @@ package org.owasp.webgoat.plugin;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.io.IOException; import java.io.IOException;
@ -44,13 +41,12 @@ import java.io.IOException;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/InsecureLogin/task") @RestController
public class InsecureLoginTask extends AssignmentEndpoint { public class InsecureLoginTask extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/InsecureLogin/task")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String username, @RequestParam String password) throws IOException { public AttackResult completed(@RequestParam String username, @RequestParam String password) {
if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) { if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) {
return trackProgress(success().build()); return trackProgress(success().build());
} }

11
webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTFinalEndpoint.java
View File

@ -11,10 +11,7 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.sql.Connection; import java.sql.Connection;
import java.sql.ResultSet; import java.sql.ResultSet;
@ -44,14 +41,14 @@ import java.sql.SQLException;
* @author nbaars * @author nbaars
* @since 4/23/17. * @since 4/23/17.
*/ */
@AssignmentPath("/JWT/final") @RestController
@AssignmentHints({"jwt-final-hint1", "jwt-final-hint2", "jwt-final-hint3", "jwt-final-hint4", "jwt-final-hint5", "jwt-final-hint6"}) @AssignmentHints({"jwt-final-hint1", "jwt-final-hint2", "jwt-final-hint3", "jwt-final-hint4", "jwt-final-hint5", "jwt-final-hint6"})
public class JWTFinalEndpoint extends AssignmentEndpoint { public class JWTFinalEndpoint extends AssignmentEndpoint {
@Autowired @Autowired
private WebSession webSession; private WebSession webSession;
@PostMapping("follow/{user}") @PostMapping("/JWT/final/follow/{user}")
public @ResponseBody public @ResponseBody
String follow(@PathVariable("user") String user) { String follow(@PathVariable("user") String user) {
if ("Jerry".equals(user)) { if ("Jerry".equals(user)) {
@ -61,7 +58,7 @@ public class JWTFinalEndpoint extends AssignmentEndpoint {
} }
} }
@PostMapping("delete") @PostMapping("/JWT/final/delete")
public @ResponseBody public @ResponseBody
AttackResult resetVotes(@RequestParam("token") String token) { AttackResult resetVotes(@RequestParam("token") String token) {
if (StringUtils.isEmpty(token)) { if (StringUtils.isEmpty(token)) {

26
webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTRefreshEndpoint.java
View File

@ -13,10 +13,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus; import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity; import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.ResponseBody;
import java.util.Date; import java.util.Date;
import java.util.List; import java.util.List;
@ -27,7 +24,7 @@ import java.util.concurrent.TimeUnit;
* @author nbaars * @author nbaars
* @since 4/23/17. * @since 4/23/17.
*/ */
@AssignmentPath("/JWT/refresh/") @RestController
@AssignmentHints({"jwt-refresh-hint1", "jwt-refresh-hint2", "jwt-refresh-hint3", "jwt-refresh-hint4"}) @AssignmentHints({"jwt-refresh-hint1", "jwt-refresh-hint2", "jwt-refresh-hint3", "jwt-refresh-hint4"})
public class JWTRefreshEndpoint extends AssignmentEndpoint { public class JWTRefreshEndpoint extends AssignmentEndpoint {
@ -35,9 +32,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
private static final String JWT_PASSWORD = "bm5n3SkxCX4kKRy4"; private static final String JWT_PASSWORD = "bm5n3SkxCX4kKRy4";
private static final List<String> validRefreshTokens = Lists.newArrayList(); private static final List<String> validRefreshTokens = Lists.newArrayList();
@PostMapping(value = "login", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @PostMapping(value = "/JWT/refresh/login", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
public @ResponseBody @ResponseBody
ResponseEntity follow(@RequestBody Map<String, Object> json) { public ResponseEntity follow(@RequestBody Map<String, Object> json) {
String user = (String) json.get("user"); String user = (String) json.get("user");
String password = (String) json.get("password"); String password = (String) json.get("password");
@ -64,9 +61,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
return tokenJson; return tokenJson;
} }
@PostMapping("checkout") @PostMapping("/JWT/refresh/checkout")
public @ResponseBody @ResponseBody
AttackResult checkout(@RequestHeader("Authorization") String token) { public AttackResult checkout(@RequestHeader("Authorization") String token) {
try { try {
Jwt jwt = Jwts.parser().setSigningKey(JWT_PASSWORD).parse(token.replace("Bearer ", "")); Jwt jwt = Jwts.parser().setSigningKey(JWT_PASSWORD).parse(token.replace("Bearer ", ""));
Claims claims = (Claims) jwt.getBody(); Claims claims = (Claims) jwt.getBody();
@ -82,9 +79,9 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
} }
} }
@PostMapping("newToken") @PostMapping("/JWT/refresh/newToken")
public @ResponseBody @ResponseBody
ResponseEntity newToken(@RequestHeader("Authorization") String token, @RequestBody Map<String, Object> json) { public ResponseEntity newToken(@RequestHeader("Authorization") String token, @RequestBody Map<String, Object> json) {
String user; String user;
String refreshToken; String refreshToken;
try { try {
@ -105,5 +102,4 @@ public class JWTRefreshEndpoint extends AssignmentEndpoint {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build(); return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
} }
} }
} }

5
webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTSecretKeyEndpoint.java
View File

@ -13,6 +13,7 @@ import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwt; import io.jsonwebtoken.Jwt;
import io.jsonwebtoken.Jwts; import io.jsonwebtoken.Jwts;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import java.util.List; import java.util.List;
@ -20,7 +21,7 @@ import java.util.List;
* @author nbaars * @author nbaars
* @since 4/23/17. * @since 4/23/17.
*/ */
@AssignmentPath("/JWT/secret") @RestController
@AssignmentHints({"jwt-secret-hint1", "jwt-secret-hint2", "jwt-secret-hint3"}) @AssignmentHints({"jwt-secret-hint1", "jwt-secret-hint2", "jwt-secret-hint3"})
public class JWTSecretKeyEndpoint extends AssignmentEndpoint { public class JWTSecretKeyEndpoint extends AssignmentEndpoint {
@ -28,7 +29,7 @@ public class JWTSecretKeyEndpoint extends AssignmentEndpoint {
private static final String WEBGOAT_USER = "WebGoat"; private static final String WEBGOAT_USER = "WebGoat";
private static final List<String> expectedClaims = Lists.newArrayList("iss", "iat", "exp", "aud", "sub", "username", "Email", "Role"); private static final List<String> expectedClaims = Lists.newArrayList("iss", "iat", "exp", "aud", "sub", "username", "Email", "Role");
@PostMapping @PostMapping("/JWT/secret")
@ResponseBody @ResponseBody
public AttackResult login(@RequestParam String token) { public AttackResult login(@RequestParam String token) {
try { try {

14
webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java
View File

@ -35,7 +35,7 @@ import static java.util.stream.Collectors.toList;
* @author nbaars * @author nbaars
* @since 4/23/17. * @since 4/23/17.
*/ */
@AssignmentPath("/JWT/votings") @RestController
@AssignmentHints({"jwt-change-token-hint1", "jwt-change-token-hint2", "jwt-change-token-hint3", "jwt-change-token-hint4", "jwt-change-token-hint5"}) @AssignmentHints({"jwt-change-token-hint1", "jwt-change-token-hint2", "jwt-change-token-hint3", "jwt-change-token-hint4", "jwt-change-token-hint5"})
public class JWTVotesEndpoint extends AssignmentEndpoint { public class JWTVotesEndpoint extends AssignmentEndpoint {
@ -64,7 +64,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
"challenge3-small.png", "challenge3.png", 10000, totalVotes)); "challenge3-small.png", "challenge3.png", 10000, totalVotes));
} }
@GetMapping("/login") @GetMapping("/JWT/votings/login")
public void login(@RequestParam("user") String user, HttpServletResponse response) { public void login(@RequestParam("user") String user, HttpServletResponse response) {
if (validUsers.contains(user)) { if (validUsers.contains(user)) {
Claims claims = Jwts.claims().setIssuedAt(Date.from(Instant.now().plus(Duration.ofDays(10)))); Claims claims = Jwts.claims().setIssuedAt(Date.from(Instant.now().plus(Duration.ofDays(10))));
@ -86,7 +86,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
} }
} }
@GetMapping @GetMapping("/JWT/votings")
@ResponseBody @ResponseBody
public MappingJacksonValue getVotes(@CookieValue(value = "access_token", required = false) String accessToken) { public MappingJacksonValue getVotes(@CookieValue(value = "access_token", required = false) String accessToken) {
MappingJacksonValue value = new MappingJacksonValue(votes.values().stream().sorted(comparingLong(Vote::getAverage).reversed()).collect(toList())); MappingJacksonValue value = new MappingJacksonValue(votes.values().stream().sorted(comparingLong(Vote::getAverage).reversed()).collect(toList()));
@ -109,7 +109,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
return value; return value;
} }
@PostMapping(value = "{title}") @PostMapping(value = "/JWT/votings/{title}")
@ResponseBody @ResponseBody
@ResponseStatus(HttpStatus.ACCEPTED) @ResponseStatus(HttpStatus.ACCEPTED)
public ResponseEntity<?> vote(@PathVariable String title, @CookieValue(value = "access_token", required = false) String accessToken) { public ResponseEntity<?> vote(@PathVariable String title, @CookieValue(value = "access_token", required = false) String accessToken) {
@ -132,9 +132,9 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
} }
} }
@PostMapping("reset") @PostMapping("/JWT/votings/reset")
public @ResponseBody @ResponseBody
AttackResult resetVotes(@CookieValue(value = "access_token", required = false) String accessToken) { public AttackResult resetVotes(@CookieValue(value = "access_token", required = false) String accessToken) {
if (StringUtils.isEmpty(accessToken)) { if (StringUtils.isEmpty(accessToken)) {
return trackProgress(failed().feedback("jwt-invalid-token").build()); return trackProgress(failed().feedback("jwt-invalid-token").build());
} else { } else {

16
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACHiddenMenus.java
View File

@ -7,10 +7,7 @@ import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.UserSessionData; import org.owasp.webgoat.session.UserSessionData;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -24,8 +21,7 @@ import java.util.Map;
/** /**
* Created by jason on 1/5/17. * Created by jason on 1/5/17.
*/ */
@RestController
@AssignmentPath("/access-control/hidden-menu")
@AssignmentHints({"access-control.hidden-menus.hint1","access-control.hidden-menus.hint2","access-control.hidden-menus.hint3"}) @AssignmentHints({"access-control.hidden-menus.hint1","access-control.hidden-menus.hint2","access-control.hidden-menus.hint3"})
public class MissingFunctionACHiddenMenus extends AssignmentEndpoint { public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
//UserSessionData is bound to session and can be used to persist data across multiple assignments //UserSessionData is bound to session and can be used to persist data across multiple assignments
@ -33,10 +29,9 @@ public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
UserSessionData userSessionData; UserSessionData userSessionData;
@PostMapping(produces = {"application/json"}) @PostMapping(path = "/access-control/hidden-menu", produces = {"application/json"})
public @ResponseBody @ResponseBody
AttackResult completed(String hiddenMenu1, String hiddenMenu2, HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { public AttackResult completed(String hiddenMenu1, String hiddenMenu2) {
//overly simple example for success. See other existing lesssons for ways to detect 'success' or 'failure' //overly simple example for success. See other existing lesssons for ways to detect 'success' or 'failure'
if (hiddenMenu1.equals("Users") && hiddenMenu2.equals("Config")) { if (hiddenMenu1.equals("Users") && hiddenMenu2.equals("Config")) {
return trackProgress(success() return trackProgress(success()
@ -57,5 +52,4 @@ public class MissingFunctionACHiddenMenus extends AssignmentEndpoint {
.output("") .output("")
.build()); .build());
} }
} }

1
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
View File

@ -21,7 +21,6 @@ import java.util.List;
@Controller @Controller
public class MissingFunctionACUsers { public class MissingFunctionACUsers {
// this will actually put controllers on the /WebGoat/* path ... the jsp for list_users restricts what can be seen, but the add_user is not controlled carefully // this will actually put controllers on the /WebGoat/* path ... the jsp for list_users restricts what can be seen, but the add_user is not controlled carefully
@Autowired @Autowired
private UserService userService; private UserService userService;

9
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACYourHash.java
View File

@ -9,8 +9,9 @@ import org.owasp.webgoat.users.WebGoatUser;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
@AssignmentPath("/access-control/user-hash") @RestController
@AssignmentHints({"access-control.hash.hint1","access-control.hash.hint2","access-control.hash.hint3", @AssignmentHints({"access-control.hash.hint1","access-control.hash.hint2","access-control.hash.hint3",
"access-control.hash.hint4","access-control.hash.hint5","access-control.hash.hint6","access-control.hash.hint7", "access-control.hash.hint4","access-control.hash.hint5","access-control.hash.hint6","access-control.hash.hint7",
"access-control.hash.hint8","access-control.hash.hint9","access-control.hash.hint10","access-control.hash.hint11","access-control.hash.hint12"}) "access-control.hash.hint8","access-control.hash.hint9","access-control.hash.hint10","access-control.hash.hint11","access-control.hash.hint12"})
@ -19,9 +20,9 @@ public class MissingFunctionACYourHash extends AssignmentEndpoint {
@Autowired @Autowired
private UserService userService; private UserService userService;
@PostMapping(produces = {"application/json"}) @PostMapping(path = "/access-control/user-hash", produces = {"application/json"})
public @ResponseBody @ResponseBody
AttackResult completed(String userHash) { public AttackResult completed(String userHash) {
String currentUser = getWebSession().getUserName(); String currentUser = getWebSession().getUserName();
WebGoatUser user = userService.loadUserByUsername(currentUser); WebGoatUser user = userService.loadUserByUsername(currentUser);
DisplayUser displayUser = new DisplayUser(user); DisplayUser displayUser = new DisplayUser(user);

5
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/Users.java
View File

@ -4,6 +4,7 @@ import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.UserSessionData; import org.owasp.webgoat.session.UserSessionData;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
@ -20,9 +21,9 @@ public class Users {
@Autowired @Autowired
UserSessionData userSessionData; UserSessionData userSessionData;
@RequestMapping(produces = {"application/json"}, method = RequestMethod.GET) @GetMapping(produces = {"application/json"})
@ResponseBody @ResponseBody
protected HashMap<Integer, HashMap> getUsers (HttpServletRequest req) { protected HashMap<Integer, HashMap> getUsers() {
try { try {
Connection connection = DatabaseUtilities.getConnection(getWebSession()); Connection connection = DatabaseUtilities.getConnection(getWebSession());

13
webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/QuestionsAssignment.java
View File

@ -1,20 +1,13 @@
package org.owasp.webgoat.plugin; package org.owasp.webgoat.plugin;
import org.apache.commons.lang3.StringUtils;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.plugin.PasswordResetEmail;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.client.RestClientException; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestTemplate;
import java.time.LocalDateTime;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
@ -22,7 +15,7 @@ import java.util.Map;
* @author nbaars * @author nbaars
* @since 8/20/17. * @since 8/20/17.
*/ */
@AssignmentPath("/PasswordReset/questions") @RestController
public class QuestionsAssignment extends AssignmentEndpoint { public class QuestionsAssignment extends AssignmentEndpoint {
private final static Map<String, String> COLORS = new HashMap<>(); private final static Map<String, String> COLORS = new HashMap<>();
@ -35,7 +28,7 @@ public class QuestionsAssignment extends AssignmentEndpoint {
COLORS.put("webgoat", "red"); COLORS.put("webgoat", "red");
} }
@PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE) @PostMapping(path = "/PasswordReset/questions", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
@ResponseBody @ResponseBody
public AttackResult passwordReset(@RequestParam Map<String, Object> json) { public AttackResult passwordReset(@RequestParam Map<String, Object> json) {
String securityQuestion = (String) json.getOrDefault("securityQuestion", ""); String securityQuestion = (String) json.getOrDefault("securityQuestion", "");

8
webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignment.java
View File

@ -17,7 +17,7 @@ import java.util.Map;
* @author nbaars * @author nbaars
* @since 8/20/17. * @since 8/20/17.
*/ */
@AssignmentPath("/PasswordReset/reset") @RestController
@AssignmentHints({"password-reset-hint1", "password-reset-hint2", "password-reset-hint3", "password-reset-hint4", "password-reset-hint5", "password-reset-hint6"}) @AssignmentHints({"password-reset-hint1", "password-reset-hint2", "password-reset-hint3", "password-reset-hint4", "password-reset-hint5", "password-reset-hint6"})
public class ResetLinkAssignment extends AssignmentEndpoint { public class ResetLinkAssignment extends AssignmentEndpoint {
@ -37,7 +37,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
"Kind regards, \nTeam WebGoat"; "Kind regards, \nTeam WebGoat";
@PostMapping("/login") @PostMapping("/PasswordReset/reset/login")
@ResponseBody @ResponseBody
public AttackResult login(@RequestParam String password, @RequestParam String email) { public AttackResult login(@RequestParam String password, @RequestParam String email) {
if (TOM_EMAIL.equals(email)) { if (TOM_EMAIL.equals(email)) {
@ -51,7 +51,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
return trackProgress(failed().feedback("login_failed.tom").build()); return trackProgress(failed().feedback("login_failed.tom").build());
} }
@GetMapping("/reset-password/{link}") @GetMapping("/PasswordReset/reset/reset-password/{link}")
public String resetPassword(@PathVariable(value = "link") String link, Model model) { public String resetPassword(@PathVariable(value = "link") String link, Model model) {
if (this.resetLinks.contains(link)) { if (this.resetLinks.contains(link)) {
PasswordChangeForm form = new PasswordChangeForm(); PasswordChangeForm form = new PasswordChangeForm();
@ -63,7 +63,7 @@ public class ResetLinkAssignment extends AssignmentEndpoint {
} }
} }
@PostMapping("/change-password") @PostMapping("/PasswordReset/reset/change-password")
public String changePassword(@ModelAttribute("form") PasswordChangeForm form, BindingResult bindingResult) { public String changePassword(@ModelAttribute("form") PasswordChangeForm form, BindingResult bindingResult) {
if (!org.springframework.util.StringUtils.hasText(form.getPassword())) { if (!org.springframework.util.StringUtils.hasText(form.getPassword())) {
bindingResult.rejectValue("password", "not.empty"); bindingResult.rejectValue("password", "not.empty");

11
webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/ResetLinkAssignmentForgotPassword.java
View File

@ -7,9 +7,7 @@ import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpEntity; import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod; import org.springframework.http.HttpMethod;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.client.RestTemplate; import org.springframework.web.client.RestTemplate;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -25,7 +23,7 @@ import static org.springframework.web.bind.annotation.RequestMethod.POST;
* @author nbaars * @author nbaars
* @since 8/20/17. * @since 8/20/17.
*/ */
@AssignmentPath("/PasswordReset/ForgotPassword") @RestController
public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint { public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
private final RestTemplate restTemplate; private final RestTemplate restTemplate;
@ -37,7 +35,7 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
this.webWolfMailURL = webWolfMailURL; this.webWolfMailURL = webWolfMailURL;
} }
@RequestMapping(method = POST, value = "/create-password-reset-link") @PostMapping("/PasswordReset/ForgotPassword/create-password-reset-link")
@ResponseBody @ResponseBody
public AttackResult sendPasswordResetLink(@RequestParam String email, HttpServletRequest request) { public AttackResult sendPasswordResetLink(@RequestParam String email, HttpServletRequest request) {
String resetLink = UUID.randomUUID().toString(); String resetLink = UUID.randomUUID().toString();
@ -58,7 +56,7 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
return success().feedback("email.send").feedbackArgs(email).build(); return success().feedback("email.send").feedbackArgs(email).build();
} }
private void sendMailToUser(@RequestParam String email, String host, String resetLink) { private void sendMailToUser(String email, String host, String resetLink) {
int index = email.indexOf("@"); int index = email.indexOf("@");
String username = email.substring(0, index == -1 ? email.length() : index); String username = email.substring(0, index == -1 ? email.length() : index);
PasswordResetEmail mail = PasswordResetEmail.builder() PasswordResetEmail mail = PasswordResetEmail.builder()
@ -78,5 +76,4 @@ public class ResetLinkAssignmentForgotPassword extends AssignmentEndpoint {
//don't care //don't care
} }
} }
} }

9
webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SecurityQuestionAssignment.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
@ -20,7 +17,7 @@ import static java.util.Optional.of;
* @author Tobias Melzer * @author Tobias Melzer
* @since 11.12.18 * @since 11.12.18
*/ */
@AssignmentPath("/PasswordReset/SecurityQuestions") @RestController
public class SecurityQuestionAssignment extends AssignmentEndpoint { public class SecurityQuestionAssignment extends AssignmentEndpoint {
@Autowired @Autowired
@ -46,7 +43,7 @@ public class SecurityQuestionAssignment extends AssignmentEndpoint {
questions.put("What is your favorite color?", "Can easily be guessed."); questions.put("What is your favorite color?", "Can easily be guessed.");
} }
@RequestMapping(method = RequestMethod.POST) @PostMapping("/PasswordReset/SecurityQuestions")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String question) { public AttackResult completed(@RequestParam String question) {
var answer = of(questions.get(question)); var answer = of(questions.get(question));

8
webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/plugin/SimpleMailAssignment.java
View File

@ -9,6 +9,7 @@ import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestClientException; import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestTemplate; import org.springframework.web.client.RestTemplate;
@ -20,8 +21,7 @@ import static java.util.Optional.ofNullable;
* @author nbaars * @author nbaars
* @since 8/20/17. * @since 8/20/17.
*/ */
@AssignmentPath("/PasswordReset/simple-mail") @RestController
public class SimpleMailAssignment extends AssignmentEndpoint { public class SimpleMailAssignment extends AssignmentEndpoint {
private final String webWolfURL; private final String webWolfURL;
@ -32,7 +32,7 @@ public class SimpleMailAssignment extends AssignmentEndpoint {
this.webWolfURL = webWolfURL; this.webWolfURL = webWolfURL;
} }
@PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE) @PostMapping(path = "/PasswordReset/simple-mail", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
@ResponseBody @ResponseBody
public AttackResult login(@RequestParam String email, @RequestParam String password) { public AttackResult login(@RequestParam String email, @RequestParam String password) {
String emailAddress = ofNullable(email).orElse("unknown@webgoat.org"); String emailAddress = ofNullable(email).orElse("unknown@webgoat.org");
@ -45,7 +45,7 @@ public class SimpleMailAssignment extends AssignmentEndpoint {
} }
} }
@PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE, value = "/reset") @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE, value = "/PasswordReset/simple-mail/reset")
@ResponseBody @ResponseBody
public AttackResult resetPassword(@RequestParam String emailReset) { public AttackResult resetPassword(@RequestParam String emailReset) {
String email = ofNullable(emailReset).orElse("unknown@webgoat.org"); String email = ofNullable(emailReset).orElse("unknown@webgoat.org");

22
webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
View File

@ -1,35 +1,19 @@
package org.owasp.webgoat.plugin; package org.owasp.webgoat.plugin;
import com.nulabinc.zxcvbn.Feedback;
import com.nulabinc.zxcvbn.Strength; import com.nulabinc.zxcvbn.Strength;
import com.nulabinc.zxcvbn.Zxcvbn; import com.nulabinc.zxcvbn.Zxcvbn;
import org.jruby.RubyProcess;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.tools.*;
import java.io.IOException;
import java.net.URI;
import java.text.DecimalFormat; import java.text.DecimalFormat;
import java.text.DecimalFormatSymbols; import java.text.DecimalFormatSymbols;
import java.util.Arrays;
import java.util.List;
import java.util.Locale; import java.util.Locale;
import java.util.ResourceBundle;
import java.util.concurrent.TimeUnit;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@AssignmentPath("SecurePasswords/assignment") @RestController
public class SecurePasswordsAssignment extends AssignmentEndpoint { public class SecurePasswordsAssignment extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("SecurePasswords/assignment")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String password) { public AttackResult completed(@RequestParam String password) {
Zxcvbn zxcvbn = new Zxcvbn(); Zxcvbn zxcvbn = new Zxcvbn();

5
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
View File

@ -13,6 +13,7 @@ import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.PutMapping; import org.springframework.web.bind.annotation.PutMapping;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import java.sql.*; import java.sql.*;
@ -20,7 +21,7 @@ import java.sql.*;
* @author nbaars * @author nbaars
* @since 4/8/17. * @since 4/8/17.
*/ */
@AssignmentPath("/SqlInjectionAdvanced/challenge") @RestController
@AssignmentHints(value = {"SqlInjectionChallenge1", "SqlInjectionChallenge2", "SqlInjectionChallenge3"}) @AssignmentHints(value = {"SqlInjectionChallenge1", "SqlInjectionChallenge2", "SqlInjectionChallenge3"})
@Slf4j @Slf4j
public class SqlInjectionChallenge extends AssignmentEndpoint { public class SqlInjectionChallenge extends AssignmentEndpoint {
@ -36,7 +37,7 @@ public class SqlInjectionChallenge extends AssignmentEndpoint {
log.info("Challenge 6 tablename is: {}", USERS_TABLE_NAME); log.info("Challenge 6 tablename is: {}", USERS_TABLE_NAME);
} }
@PutMapping //assignment path is bounded to class so we use different http method :-) @PutMapping("/SqlInjectionAdvanced/challenge") //assignment path is bounded to class so we use different http method :-)
@ResponseBody @ResponseBody
public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception { public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception {
AttackResult attackResult = checkArguments(username_reg, email_reg, password_reg); AttackResult attackResult = checkArguments(username_reg, email_reg, password_reg);

9
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallengeLogin.java
View File

@ -7,23 +7,20 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.sql.*; import java.sql.*;
import static org.springframework.web.bind.annotation.RequestMethod.POST; import static org.springframework.web.bind.annotation.RequestMethod.POST;
@AssignmentPath("/SqlInjectionAdvanced/challenge_Login") @RestController
@AssignmentHints(value ={"SqlInjectionChallengeHint1", "SqlInjectionChallengeHint2", "SqlInjectionChallengeHint3", "SqlInjectionChallengeHint4"}) @AssignmentHints(value ={"SqlInjectionChallengeHint1", "SqlInjectionChallengeHint2", "SqlInjectionChallengeHint3", "SqlInjectionChallengeHint4"})
public class SqlInjectionChallengeLogin extends AssignmentEndpoint { public class SqlInjectionChallengeLogin extends AssignmentEndpoint {
@Autowired @Autowired
private WebSession webSession; private WebSession webSession;
@PostMapping("/SqlInjectionAdvanced/challenge_Login")
@RequestMapping(method = POST)
@ResponseBody @ResponseBody
public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception { public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {
Connection connection = DatabaseUtilities.getConnection(webSession); Connection connection = DatabaseUtilities.getConnection(webSession);

7
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java
View File

@ -42,15 +42,14 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjectionAdvanced/attack6a") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint-advanced-6a-1", "SqlStringInjectionHint-advanced-6a-2", "SqlStringInjectionHint-advanced-6a-3", @AssignmentHints(value = {"SqlStringInjectionHint-advanced-6a-1", "SqlStringInjectionHint-advanced-6a-2", "SqlStringInjectionHint-advanced-6a-3",
"SqlStringInjectionHint-advanced-6a-4"}) "SqlStringInjectionHint-advanced-6a-4"})
public class SqlInjectionLesson6a extends AssignmentEndpoint { public class SqlInjectionLesson6a extends AssignmentEndpoint {
@PostMapping @PostMapping("/SqlInjectionAdvanced/attack6a")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String userid_6a) throws IOException { public AttackResult completed(@RequestParam String userid_6a) throws IOException {
return injectableQuery(userid_6a); return injectableQuery(userid_6a);
// The answer: Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- // The answer: Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data --
} }

9
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6b.java
View File

@ -5,10 +5,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
import java.sql.Connection; import java.sql.Connection;
@ -47,10 +44,10 @@ import java.sql.Statement;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjectionAdvanced/attack6b") @RestController
public class SqlInjectionLesson6b extends AssignmentEndpoint { public class SqlInjectionLesson6b extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjectionAdvanced/attack6b")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String userid_6b) throws IOException { public AttackResult completed(@RequestParam String userid_6b) throws IOException {
if (userid_6b.toString().equals(getPassword())) { if (userid_6b.toString().equals(getPassword())) {

11
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionQuiz.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
import java.sql.Connection; import java.sql.Connection;
@ -21,13 +18,13 @@ import java.sql.Statement;
* 3. add Request param with name of question to method head * 3. add Request param with name of question to method head
* For a more detailed description how to implement the quiz go to the quiz.js file in webgoat-container -> js * For a more detailed description how to implement the quiz go to the quiz.js file in webgoat-container -> js
*/ */
@AssignmentPath("/SqlInjectionAdvanced/quiz") @RestController
public class SqlInjectionQuiz extends AssignmentEndpoint { public class SqlInjectionQuiz extends AssignmentEndpoint {
String[] solutions = {"Solution 4", "Solution 3", "Solution 2", "Solution 3", "Solution 4"}; String[] solutions = {"Solution 4", "Solution 3", "Solution 2", "Solution 3", "Solution 4"};
boolean[] guesses = new boolean[solutions.length]; boolean[] guesses = new boolean[solutions.length];
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjectionAdvanced/quiz")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String[] question_0_solution, @RequestParam String[] question_1_solution, @RequestParam String[] question_2_solution, @RequestParam String[] question_3_solution, @RequestParam String[] question_4_solution) throws IOException { public AttackResult completed(@RequestParam String[] question_0_solution, @RequestParam String[] question_1_solution, @RequestParam String[] question_2_solution, @RequestParam String[] question_3_solution, @RequestParam String[] question_4_solution) throws IOException {
int correctAnswers = 0; int correctAnswers = 0;
@ -52,7 +49,7 @@ public class SqlInjectionQuiz extends AssignmentEndpoint {
} }
} }
@RequestMapping(method = RequestMethod.GET) @GetMapping("/SqlInjectionAdvanced/quiz")
@ResponseBody @ResponseBody
public boolean[] getResults() { public boolean[] getResults() {
return this.guesses; return this.guesses;

12
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson10.java
View File

@ -6,21 +6,17 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.sql.*; import java.sql.*;
@AssignmentPath("/SqlInjection/attack10") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint.10.1", "SqlStringInjectionHint.10.2", "SqlStringInjectionHint.10.3", "SqlStringInjectionHint.10.4", "SqlStringInjectionHint.10.5", "SqlStringInjectionHint.10.6"}) @AssignmentHints(value = {"SqlStringInjectionHint.10.1", "SqlStringInjectionHint.10.2", "SqlStringInjectionHint.10.3", "SqlStringInjectionHint.10.4", "SqlStringInjectionHint.10.5", "SqlStringInjectionHint.10.6"})
public class SqlInjectionLesson10 extends AssignmentEndpoint { public class SqlInjectionLesson10 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack10")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String action_string) { public AttackResult completed(@RequestParam String action_string) {
return injectableQueryAvailability(action_string); return injectableQueryAvailability(action_string);
} }

12
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson2.java
View File

@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
import java.sql.*; import java.sql.*;
@ -45,14 +42,13 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/attack2") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint2-1", "SqlStringInjectionHint2-2", "SqlStringInjectionHint2-3", "SqlStringInjectionHint2-4"}) @AssignmentHints(value = {"SqlStringInjectionHint2-1", "SqlStringInjectionHint2-2", "SqlStringInjectionHint2-3", "SqlStringInjectionHint2-4"})
public class SqlInjectionLesson2 extends AssignmentEndpoint { public class SqlInjectionLesson2 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack2")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String query) { public AttackResult completed(@RequestParam String query) {
return injectableQuery(query); return injectableQuery(query);
} }

12
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson3.java
View File

@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
import java.sql.*; import java.sql.*;
@ -45,14 +42,13 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/attack3") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint3-1", "SqlStringInjectionHint3-2"}) @AssignmentHints(value = {"SqlStringInjectionHint3-1", "SqlStringInjectionHint3-2"})
public class SqlInjectionLesson3 extends AssignmentEndpoint { public class SqlInjectionLesson3 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack3")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String query) { public AttackResult completed(@RequestParam String query) {
return injectableQuery(query); return injectableQuery(query);
} }

14
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson4.java
View File

@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
import java.sql.*; import java.sql.*;
@ -45,22 +42,19 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/attack4") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint4-1", "SqlStringInjectionHint4-2", "SqlStringInjectionHint4-3"}) @AssignmentHints(value = {"SqlStringInjectionHint4-1", "SqlStringInjectionHint4-2", "SqlStringInjectionHint4-3"})
public class SqlInjectionLesson4 extends AssignmentEndpoint { public class SqlInjectionLesson4 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack4")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String query) { public AttackResult completed(@RequestParam String query) {
return injectableQuery(query); return injectableQuery(query);
} }
protected AttackResult injectableQuery(String _query) { protected AttackResult injectableQuery(String _query) {
try { try {
Connection connection = DatabaseUtilities.getConnection(getWebSession()); Connection connection = DatabaseUtilities.getConnection(getWebSession());
String query = _query;
try { try {
Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
ResultSet.CONCUR_READ_ONLY); ResultSet.CONCUR_READ_ONLY);

18
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5.java
View File

@ -3,16 +3,11 @@ package org.owasp.webgoat.plugin.introduction;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import java.io.IOException;
import java.sql.*;
/*************************************************************************************************** /***************************************************************************************************
@ -45,20 +40,18 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/attack5") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint5-a"}) @AssignmentHints(value = {"SqlStringInjectionHint5-a"})
public class SqlInjectionLesson5 extends AssignmentEndpoint { public class SqlInjectionLesson5 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack5")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String query) { public AttackResult completed(@RequestParam String query) {
return injectableQuery(query); return injectableQuery(query);
} }
protected AttackResult injectableQuery(String _query) { protected AttackResult injectableQuery(String _query) {
try { try {
String query = _query;
String regex = "(?i)^(grant alter table to unauthorizedUser)(?:[;]?)$"; String regex = "(?i)^(grant alter table to unauthorizedUser)(?:[;]?)$";
Boolean isCorrect = false; Boolean isCorrect = false;
StringBuffer output = new StringBuffer(); StringBuffer output = new StringBuffer();
@ -70,7 +63,6 @@ public class SqlInjectionLesson5 extends AssignmentEndpoint {
} else { } else {
return trackProgress(failed().output(output.toString()).build()); return trackProgress(failed().output(output.toString()).build());
} }
} catch (Exception e) { } catch (Exception e) {
return trackProgress(failed().output(this.getClass().getName() + " : " + e.getMessage()).build()); return trackProgress(failed().output(this.getClass().getName() + " : " + e.getMessage()).build());
} }

7
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
View File

@ -41,7 +41,7 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/assignment5a") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint5a1"}) @AssignmentHints(value = {"SqlStringInjectionHint5a1"})
public class SqlInjectionLesson5a extends AssignmentEndpoint { public class SqlInjectionLesson5a extends AssignmentEndpoint {
@ -50,10 +50,9 @@ public class SqlInjectionLesson5a extends AssignmentEndpoint {
+ "So the injected query basically looks like this: <span style=\"font-style: italic\">SELECT * FROM user_data WHERE first_name = 'John' and last_name = '' or TRUE</span>, " + "So the injected query basically looks like this: <span style=\"font-style: italic\">SELECT * FROM user_data WHERE first_name = 'John' and last_name = '' or TRUE</span>, "
+ "which will always evaluate to true, no matter what came before it."; + "which will always evaluate to true, no matter what came before it.";
@PostMapping @PostMapping("/SqlInjection/assignment5a")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String account, @RequestParam String operator, @RequestParam String injection) { public AttackResult completed(@RequestParam String account, @RequestParam String operator, @RequestParam String injection) {
return injectableQuery(account + " " + operator + " " + injection); return injectableQuery(account + " " + operator + " " + injection);
} }

13
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
View File

@ -6,10 +6,7 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.io.IOException; import java.io.IOException;
@ -46,18 +43,16 @@ import java.sql.*;
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/SqlInjection/assignment5b") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint5b1", "SqlStringInjectionHint5b2", "SqlStringInjectionHint5b3", "SqlStringInjectionHint5b4"}) @AssignmentHints(value = {"SqlStringInjectionHint5b1", "SqlStringInjectionHint5b2", "SqlStringInjectionHint5b3", "SqlStringInjectionHint5b4"})
public class SqlInjectionLesson5b extends AssignmentEndpoint { public class SqlInjectionLesson5b extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/assignment5b")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String userid, @RequestParam String login_count, HttpServletRequest request) throws IOException { public AttackResult completed(@RequestParam String userid, @RequestParam String login_count, HttpServletRequest request) throws IOException {
return injectableQuery(login_count, userid); return injectableQuery(login_count, userid);
} }
protected AttackResult injectableQuery(String login_count, String accountName) { protected AttackResult injectableQuery(String login_count, String accountName) {
String queryString = "SELECT * From user_data WHERE Login_Count = ? and userid= " + accountName; String queryString = "SELECT * From user_data WHERE Login_Count = ? and userid= " + accountName;
try { try {

13
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson8.java
View File

@ -6,23 +6,20 @@ import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.util.Calendar; import java.util.Calendar;
import java.text.SimpleDateFormat; import java.text.SimpleDateFormat;
import java.sql.*; import java.sql.*;
@AssignmentPath("/SqlInjection/attack8") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint.8.1", "SqlStringInjectionHint.8.2", "SqlStringInjectionHint.8.3", "SqlStringInjectionHint.8.4", "SqlStringInjectionHint.8.5"}) @AssignmentHints(value = {"SqlStringInjectionHint.8.1", "SqlStringInjectionHint.8.2", "SqlStringInjectionHint.8.3", "SqlStringInjectionHint.8.4", "SqlStringInjectionHint.8.5"})
public class SqlInjectionLesson8 extends AssignmentEndpoint { public class SqlInjectionLesson8 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack8")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) { public AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
return injectableQueryConfidentiality(name, auth_tan); return injectableQueryConfidentiality(name, auth_tan);
} }

17
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson9.java
View File

@ -3,24 +3,25 @@ package org.owasp.webgoat.plugin.introduction;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import java.sql.*; import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
@AssignmentPath("/SqlInjection/attack9") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint.9.1", "SqlStringInjectionHint.9.2", "SqlStringInjectionHint.9.3", "SqlStringInjectionHint.9.4", "SqlStringInjectionHint.9.5"}) @AssignmentHints(value = {"SqlStringInjectionHint.9.1", "SqlStringInjectionHint.9.2", "SqlStringInjectionHint.9.3", "SqlStringInjectionHint.9.4", "SqlStringInjectionHint.9.5"})
public class SqlInjectionLesson9 extends AssignmentEndpoint { public class SqlInjectionLesson9 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SqlInjection/attack9")
public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) { public AttackResult completed(@RequestParam String name, @RequestParam String auth_tan) {
return injectableQueryIntegrity(name, auth_tan); return injectableQueryIntegrity(name, auth_tan);
} }

12
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10a.java
View File

@ -8,25 +8,19 @@ import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
@AssignmentPath("SqlInjectionMitigations/attack10a") @RestController
@Slf4j @Slf4j
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10a-1", "SqlStringInjectionHint-mitigation-10a-10a2"}) @AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10a-1", "SqlStringInjectionHint-mitigation-10a-10a2"})
public class SqlInjectionLesson10a extends AssignmentEndpoint { public class SqlInjectionLesson10a extends AssignmentEndpoint {
@Autowired @Autowired
private WebSession webSession; private WebSession webSession;
// @TODO: Maybe provide regex instead of "hard coded" strings
private String[] results = {"getConnection", "PreparedStatement", "prepareStatement", "?", "?", "setString", "setString"}; private String[] results = {"getConnection", "PreparedStatement", "prepareStatement", "?", "?", "setString", "setString"};
// @TODO Method head too big, better solution? @PostMapping("SqlInjectionMitigations/attack10a")
@RequestMapping(method = RequestMethod.POST)
@ResponseBody @ResponseBody
@SneakyThrows
public AttackResult completed(@RequestParam String field1, @RequestParam String field2, @RequestParam String field3, @RequestParam String field4, @RequestParam String field5, @RequestParam String field6, @RequestParam String field7) { public AttackResult completed(@RequestParam String field1, @RequestParam String field2, @RequestParam String field3, @RequestParam String field4, @RequestParam String field5, @RequestParam String field6, @RequestParam String field7) {
String[] userInput = {field1, field2, field3, field4, field5, field6, field7}; String[] userInput = {field1, field2, field3, field4, field5, field6, field7};
int position = 0; int position = 0;

9
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson10b.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.tools.*; import javax.tools.*;
@ -18,11 +15,11 @@ import java.util.List;
import java.util.regex.Matcher; import java.util.regex.Matcher;
import java.util.regex.Pattern; import java.util.regex.Pattern;
@AssignmentPath("SqlInjectionMitigations/attack10b") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10b-1", "SqlStringInjectionHint-mitigation-10b-2", "SqlStringInjectionHint-mitigation-10b-3", "SqlStringInjectionHint-mitigation-10b-4", "SqlStringInjectionHint-mitigation-10b-5"}) @AssignmentHints(value = {"SqlStringInjectionHint-mitigation-10b-1", "SqlStringInjectionHint-mitigation-10b-2", "SqlStringInjectionHint-mitigation-10b-3", "SqlStringInjectionHint-mitigation-10b-4", "SqlStringInjectionHint-mitigation-10b-5"})
public class SqlInjectionLesson10b extends AssignmentEndpoint { public class SqlInjectionLesson10b extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("SqlInjectionMitigations/attack10b")
@ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String editor) { public AttackResult completed(@RequestParam String editor) {
try { try {

15
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
View File

@ -4,23 +4,24 @@ import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.session.DatabaseUtilities; import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import java.sql.*; import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
/** /**
* @author nbaars * @author nbaars
* @since 6/13/17. * @since 6/13/17.
*/ */
@AssignmentPath("SqlInjectionMitigations/attack12a") @RestController
@AssignmentHints(value = {"SqlStringInjectionHint-mitigation-12a-1", "SqlStringInjectionHint-mitigation-12a-2", "SqlStringInjectionHint-mitigation-12a-3", "SqlStringInjectionHint-mitigation-12a-4"}) @AssignmentHints(value = {"SqlStringInjectionHint-mitigation-12a-1", "SqlStringInjectionHint-mitigation-12a-2", "SqlStringInjectionHint-mitigation-12a-3", "SqlStringInjectionHint-mitigation-12a-4"})
@Slf4j @Slf4j
public class SqlInjectionLesson12a extends AssignmentEndpoint { public class SqlInjectionLesson12a extends AssignmentEndpoint {
@ -28,7 +29,7 @@ public class SqlInjectionLesson12a extends AssignmentEndpoint {
@Autowired @Autowired
private WebSession webSession; private WebSession webSession;
@RequestMapping(method = RequestMethod.POST) @PostMapping("SqlInjectionMitigations/attack12a")
@ResponseBody @ResponseBody
@SneakyThrows @SneakyThrows
public AttackResult completed(@RequestParam String ip) { public AttackResult completed(@RequestParam String ip) {
@ -43,5 +44,3 @@ public class SqlInjectionLesson12a extends AssignmentEndpoint {
return trackProgress(failed().build()); return trackProgress(failed().build());
} }
} }

83
webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask1.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -22,77 +19,75 @@ import java.net.URLConnection;
/** /**
* ************************************************************************************************* * *************************************************************************************************
* * <p>
* * <p>
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* * <p>
* Copyright (c) 2002 - 2014 Bruce Mayhew * Copyright (c) 2002 - 2014 Bruce Mayhew
* * <p>
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software * the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later * Foundation; either version 2 of the License, or (at your option) any later
* version. * version.
* * <p>
* This program is distributed in the hope that it will be useful, but WITHOUT * This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details. * details.
* * <p>
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA. * Place - Suite 330, Boston, MA 02111-1307, USA.
* * <p>
* Getting Source ============== * Getting Source ==============
* * <p>
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects. * for free software projects.
* * <p>
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Alex Fry <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Alex Fry <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created December 26, 2018 * @created December 26, 2018
*/ */
@AssignmentPath("/SSRF/task1") @RestController
@AssignmentHints({"ssrf.hint1","ssrf.hint2"}) @AssignmentHints({"ssrf.hint1", "ssrf.hint2"})
public class SSRFTask1 extends AssignmentEndpoint { public class SSRFTask1 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SSRF/task1")
public @ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String url) {
AttackResult completed(@RequestParam String url) throws IOException {
return stealTheCheese(url); return stealTheCheese(url);
} }
protected AttackResult stealTheCheese(String url) { protected AttackResult stealTheCheese(String url) {
try { try {
StringBuffer html = new StringBuffer(); StringBuffer html = new StringBuffer();
if (url.matches("images/tom.png")) { if (url.matches("images/tom.png")) {
html.append("<img class=\"image\" alt=\"Tom\" src=\"images/tom.png\" width=\"25%\" height=\"25%\">"); html.append("<img class=\"image\" alt=\"Tom\" src=\"images/tom.png\" width=\"25%\" height=\"25%\">");
return trackProgress(failed()
.feedback("ssrf.tom")
.output(html.toString())
.build());
}else if (url.matches("images/jerry.png")){
html.append("<img class=\"image\" alt=\"Jerry\" src=\"images/jerry.png\" width=\"25%\" height=\"25%\">");
return trackProgress(success()
.feedback("ssrf.success")
.output(html.toString())
.build());
}else{
html.append("<img class=\"image\" alt=\"Silly Cat\" src=\"images/cat.jpg\">");
return trackProgress(failed()
.feedback("ssrf.failure")
.output(html.toString())
.build());
}
}catch(Exception e) {
e.printStackTrace();
return trackProgress(failed() return trackProgress(failed()
.output(e.getMessage()) .feedback("ssrf.tom")
.build()); .output(html.toString())
.build());
} else if (url.matches("images/jerry.png")) {
html.append("<img class=\"image\" alt=\"Jerry\" src=\"images/jerry.png\" width=\"25%\" height=\"25%\">");
return trackProgress(success()
.feedback("ssrf.success")
.output(html.toString())
.build());
} else {
html.append("<img class=\"image\" alt=\"Silly Cat\" src=\"images/cat.jpg\">");
return trackProgress(failed()
.feedback("ssrf.failure")
.output(html.toString())
.build());
} }
} catch (Exception e) {
e.printStackTrace();
return trackProgress(failed()
.output(e.getMessage())
.build());
}
} }
} }

81
webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/plugin/SSRFTask2.java
View File

@ -4,10 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -22,80 +19,78 @@ import java.net.URLConnection;
/** /**
* ************************************************************************************************* * *************************************************************************************************
* * <p>
* * <p>
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* * <p>
* Copyright (c) 2002 - 2014 Bruce Mayhew * Copyright (c) 2002 - 2014 Bruce Mayhew
* * <p>
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software * the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later * Foundation; either version 2 of the License, or (at your option) any later
* version. * version.
* * <p>
* This program is distributed in the hope that it will be useful, but WITHOUT * This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details. * details.
* * <p>
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA. * Place - Suite 330, Boston, MA 02111-1307, USA.
* * <p>
* Getting Source ============== * Getting Source ==============
* * <p>
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects. * for free software projects.
* * <p>
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Alex Fry <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Alex Fry <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created December 26, 2018 * @created December 26, 2018
*/ */
@AssignmentPath("/SSRF/task2") @RestController
@AssignmentHints({"ssrf.hint3"}) @AssignmentHints({"ssrf.hint3"})
public class SSRFTask2 extends AssignmentEndpoint { public class SSRFTask2 extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/SSRF/task2")
public @ResponseBody @ResponseBody
public AttackResult completed(@RequestParam String url) {
AttackResult completed(@RequestParam String url) throws IOException {
return furBall(url); return furBall(url);
} }
protected AttackResult furBall(String url) { protected AttackResult furBall(String url) {
try { try {
StringBuffer html = new StringBuffer(); StringBuffer html = new StringBuffer();
if (url.matches("http://ifconfig.pro")){ if (url.matches("http://ifconfig.pro")) {
URL u = new URL(url); URL u = new URL(url);
URLConnection urlConnection = u.openConnection(); URLConnection urlConnection = u.openConnection();
BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream()));
String inputLine; String inputLine;
while ((inputLine = in.readLine()) != null) { while ((inputLine = in.readLine()) != null) {
html.append(inputLine); html.append(inputLine);
}
in.close();
return trackProgress(success()
.feedback("ssrf.success")
.output(html.toString())
.build());
}else{
html.append("<img class=\"image\" alt=\"image post\" src=\"images/cat.jpg\">");
return trackProgress(failed()
.feedback("ssrf.failure")
.output(html.toString())
.build());
} }
in.close();
}catch(Exception e) { return trackProgress(success()
e.printStackTrace(); .feedback("ssrf.success")
.output(html.toString())
.build());
} else {
html.append("<img class=\"image\" alt=\"image post\" src=\"images/cat.jpg\">");
return trackProgress(failed() return trackProgress(failed()
.output(e.getMessage()) .feedback("ssrf.failure")
.build()); .output(html.toString())
.build());
} }
} catch (Exception e) {
e.printStackTrace();
return trackProgress(failed()
.output(e.getMessage())
.build());
}
} }
} }

45
webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
View File

@ -5,54 +5,50 @@ import com.thoughtworks.xstream.io.xml.DomDriver;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import java.io.IOException; import java.io.IOException;
/** /**
* ************************************************************************************************* * *************************************************************************************************
* * <p>
* * <p>
* This file is part of WebGoat, an Open Web Application Security Project * This file is part of WebGoat, an Open Web Application Security Project
* utility. For details, please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* * <p>
* Copyright (c) 2002 - 20014 Bruce Mayhew * Copyright (c) 2002 - 20014 Bruce Mayhew
* * <p>
* This program is free software; you can redistribute it and/or modify it under * This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software * the terms of the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option) any later * Foundation; either version 2 of the License, or (at your option) any later
* version. * version.
* * <p>
* This program is distributed in the hope that it will be useful, but WITHOUT * This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details. * details.
* * <p>
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* Place - Suite 330, Boston, MA 02111-1307, USA. * Place - Suite 330, Boston, MA 02111-1307, USA.
* * <p>
* Getting Source ============== * Getting Source ==============
* * <p>
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects. * for free software projects.
* * <p>
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
@AssignmentPath("/VulnerableComponents/attack1") @RestController
//@AssignmentHints({"http-basics.hints.http_basics_lesson.1"}) //@AssignmentHints({"http-basics.hints.http_basics_lesson.1"})
public class VulnerableComponentsLesson extends AssignmentEndpoint { public class VulnerableComponentsLesson extends AssignmentEndpoint {
@RequestMapping(method = RequestMethod.POST) @PostMapping("/VulnerableComponents/attack1")
public @ResponseBody AttackResult completed(@RequestParam String payload) throws IOException { public @ResponseBody
AttackResult completed(@RequestParam String payload) {
XStream xstream = new XStream(new DomDriver()); XStream xstream = new XStream(new DomDriver());
xstream.setClassLoader(Contact.class.getClassLoader()); xstream.setClassLoader(Contact.class.getClassLoader());
@ -85,16 +81,11 @@ public class VulnerableComponentsLesson extends AssignmentEndpoint {
// System.out.println("Payload:" + payload); // System.out.println("Payload:" + payload);
Contact expl = (Contact) xstream.fromXML(payload); Contact expl = (Contact) xstream.fromXML(payload);
return trackProgress(success().feedback("vulnerable-components.fromXML").feedbackArgs(expl.toString()).build()); return trackProgress(success().feedback("vulnerable-components.fromXML").feedbackArgs(expl.toString()).build());
} catch (com.thoughtworks.xstream.converters.ConversionException ex) { } catch (com.thoughtworks.xstream.converters.ConversionException ex) {
if (ex.getMessage().contains("Integer")) if (ex.getMessage().contains("Integer")) {
{
return trackProgress(success().feedback("vulnerable-components.success").build()); return trackProgress(success().feedback("vulnerable-components.success").build());
} }
return trackProgress(failed().feedback("vulnerable-components.close").build()); return trackProgress(failed().feedback("vulnerable-components.close").build());
} }
}
}
} }

11
webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
View File

@ -10,10 +10,7 @@ import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value; import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.annotation.PostConstruct; import javax.annotation.PostConstruct;
import java.io.File; import java.io.File;
@ -49,7 +46,7 @@ import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
* @version $Id: $Id * @version $Id: $Id
* @since November 18, 2016 * @since November 18, 2016
*/ */
@AssignmentPath("xxe/blind") @RestController
@AssignmentHints({"xxe.blind.hints.1","xxe.blind.hints.2","xxe.blind.hints.3","xxe.blind.hints.4","xxe.blind.hints.5"}) @AssignmentHints({"xxe.blind.hints.1","xxe.blind.hints.2","xxe.blind.hints.3","xxe.blind.hints.4","xxe.blind.hints.5"})
public class BlindSendFileAssignment extends AssignmentEndpoint { public class BlindSendFileAssignment extends AssignmentEndpoint {
@ -69,9 +66,9 @@ public class BlindSendFileAssignment extends AssignmentEndpoint {
Files.write(CONTENTS, new File(targetDirectory, "secret.txt"), Charsets.UTF_8); Files.write(CONTENTS, new File(targetDirectory, "secret.txt"), Charsets.UTF_8);
} }
@RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @PostMapping(path = "xxe/blind", consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody @ResponseBody
public AttackResult addComment(@RequestBody String commentStr) throws Exception { public AttackResult addComment(@RequestBody String commentStr) {
//Solution is posted as a separate comment //Solution is posted as a separate comment
if (commentStr.contains(CONTENTS)) { if (commentStr.contains(CONTENTS)) {
return trackProgress(success().build()); return trackProgress(success().build());

3
webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java
View File

@ -2,6 +2,7 @@ package org.owasp.webgoat.plugin;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
@ -21,7 +22,7 @@ public class CommentsEndpoint {
@Autowired @Autowired
private Comments comments; private Comments comments;
@RequestMapping(method = GET, produces = MediaType.APPLICATION_JSON_VALUE) @GetMapping(produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody @ResponseBody
public Collection<Comment> retrieveComments() { public Collection<Comment> retrieveComments() {
return comments.getComments(); return comments.getComments();

5
webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
View File

@ -42,14 +42,13 @@ import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
* @version $Id: $Id * @version $Id: $Id
* @since November 17, 2016 * @since November 17, 2016
*/ */
@AssignmentPath("xxe/content-type") @RestController
@AssignmentHints({"xxe.hints.content.type.xxe.1", "xxe.hints.content.type.xxe.2"}) @AssignmentHints({"xxe.hints.content.type.xxe.1", "xxe.hints.content.type.xxe.2"})
public class ContentTypeAssignment extends AssignmentEndpoint { public class ContentTypeAssignment extends AssignmentEndpoint {
private final static String[] DEFAULT_LINUX_DIRECTORIES = {"usr", "etc", "var"}; private final static String[] DEFAULT_LINUX_DIRECTORIES = {"usr", "etc", "var"};
private final static String[] DEFAULT_WINDOWS_DIRECTORIES = {"Windows", "Program Files (x86)", "Program Files"}; private final static String[] DEFAULT_WINDOWS_DIRECTORIES = {"Windows", "Program Files (x86)", "Program Files"};
@Value("${webgoat.server.directory}") @Value("${webgoat.server.directory}")
private String webGoatHomeDirectory; private String webGoatHomeDirectory;
@Autowired @Autowired
@ -57,7 +56,7 @@ public class ContentTypeAssignment extends AssignmentEndpoint {
@Autowired @Autowired
private Comments comments; private Comments comments;
@RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @PostMapping(path = "xxe/content-type", consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody @ResponseBody
public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception {
AttackResult attackResult = failed().build(); AttackResult attackResult = failed().build();

24
webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
View File

@ -4,17 +4,16 @@ import org.apache.commons.exec.OS;
import org.apache.commons.lang.exception.ExceptionUtils; import org.apache.commons.lang.exception.ExceptionUtils;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value; import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import static org.springframework.http.MediaType.ALL_VALUE; import static org.springframework.http.MediaType.ALL_VALUE;
import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE; import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
import static org.springframework.web.bind.annotation.RequestMethod.POST;
/** /**
* ************************************************************************************************ * ************************************************************************************************
@ -50,7 +49,7 @@ import static org.springframework.web.bind.annotation.RequestMethod.POST;
* @author nbaars * @author nbaars
* @since 4/8/17. * @since 4/8/17.
*/ */
@AssignmentPath("xxe/simple") @RestController
@AssignmentHints({"xxe.hints.simple.xxe.1", "xxe.hints.simple.xxe.2", "xxe.hints.simple.xxe.3", "xxe.hints.simple.xxe.4", "xxe.hints.simple.xxe.5", "xxe.hints.simple.xxe.6"}) @AssignmentHints({"xxe.hints.simple.xxe.1", "xxe.hints.simple.xxe.2", "xxe.hints.simple.xxe.3", "xxe.hints.simple.xxe.4", "xxe.hints.simple.xxe.5", "xxe.hints.simple.xxe.6"})
public class SimpleXXE extends AssignmentEndpoint { public class SimpleXXE extends AssignmentEndpoint {
@ -62,7 +61,7 @@ public class SimpleXXE extends AssignmentEndpoint {
@Autowired @Autowired
private Comments comments; private Comments comments;
@RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE) @PostMapping(path = "xxe/simple", consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE)
@ResponseBody @ResponseBody
public AttackResult createNewComment(@RequestBody String commentStr) throws Exception { public AttackResult createNewComment(@RequestBody String commentStr) throws Exception {
String error = ""; String error = "";
@ -77,12 +76,13 @@ public class SimpleXXE extends AssignmentEndpoint {
} }
return trackProgress(failed().output(error).build()); return trackProgress(failed().output(error).build());
} }
private boolean checkSolution(Comment comment) { private boolean checkSolution(Comment comment) {
String[] directoriesToCheck = OS.isFamilyMac() || OS.isFamilyUnix() ? DEFAULT_LINUX_DIRECTORIES : DEFAULT_WINDOWS_DIRECTORIES; String[] directoriesToCheck = OS.isFamilyMac() || OS.isFamilyUnix() ? DEFAULT_LINUX_DIRECTORIES : DEFAULT_WINDOWS_DIRECTORIES;
boolean success = true; boolean success = true;
for (String directory : directoriesToCheck) { for (String directory : directoriesToCheck) {
success &= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory); success &= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory);
} }
return success; return success;
} }
} }

2
webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java
View File

@ -38,6 +38,4 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter {
file.mkdirs(); file.mkdirs();
} }
} }
} }

13
webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java
View File

@ -35,12 +35,14 @@ import org.owasp.webwolf.user.UserService;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
/** /**
* Security configuration for WebGoat. * Security configuration for WebGoat.
@ -81,4 +83,15 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
public UserDetailsService userDetailsServiceBean() throws Exception { public UserDetailsService userDetailsServiceBean() throws Exception {
return userDetailsService; return userDetailsService;
} }
@Override
@Bean
protected AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManager();
}
@Bean
public NoOpPasswordEncoder passwordEncoder() {
return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
}
} }

7
webwolf/src/main/java/org/owasp/webwolf/WebWolf.java
View File

@ -2,18 +2,15 @@ package org.owasp.webwolf;
import org.owasp.webwolf.requests.WebWolfTraceRepository; import org.owasp.webwolf.requests.WebWolfTraceRepository;
import org.springframework.boot.SpringApplication; import org.springframework.boot.SpringApplication;
import org.springframework.boot.actuate.trace.TraceRepository; import org.springframework.boot.actuate.trace.http.HttpTraceRepository;
import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
import java.util.Map;
@SpringBootApplication @SpringBootApplication
public class WebWolf { public class WebWolf {
@Bean @Bean
public TraceRepository traceRepository() { public HttpTraceRepository traceRepository() {
return new WebWolfTraceRepository(); return new WebWolfTraceRepository();
} }

15
webwolf/src/main/java/org/owasp/webwolf/requests/Requests.java
View File

@ -5,14 +5,13 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.AllArgsConstructor; import lombok.AllArgsConstructor;
import lombok.Getter; import lombok.Getter;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.springframework.boot.actuate.trace.Trace; import org.springframework.boot.actuate.trace.http.HttpTrace;
import org.springframework.stereotype.Controller; import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
import javax.servlet.http.HttpServletRequest; import java.time.Instant;
import java.util.Date;
import java.util.List; import java.util.List;
import static java.util.stream.Collectors.toList; import static java.util.stream.Collectors.toList;
@ -36,7 +35,7 @@ public class Requests {
@AllArgsConstructor @AllArgsConstructor
@Getter @Getter
private class Tracert { private class Tracert {
private final Date date; private final Instant date;
private final String path; private final String path;
private final String json; private final String json;
} }
@ -51,13 +50,13 @@ public class Requests {
return m; return m;
} }
private String path(Trace t) { private String path(HttpTrace t) {
return (String) t.getInfo().getOrDefault("path", ""); return (String) t.getRequest().getUri().getPath();
} }
private String toJsonString(Trace t) { private String toJsonString(HttpTrace t) {
try { try {
return objectMapper.writeValueAsString(t.getInfo()); return objectMapper.writeValueAsString(t);
} catch (JsonProcessingException e) { } catch (JsonProcessingException e) {
log.error("Unable to create json", e); log.error("Unable to create json", e);
} }

27
webwolf/src/main/java/org/owasp/webwolf/requests/WebWolfTraceRepository.java
View File

@ -2,15 +2,11 @@ package org.owasp.webwolf.requests;
import com.google.common.collect.EvictingQueue; import com.google.common.collect.EvictingQueue;
import com.google.common.collect.Lists; import com.google.common.collect.Lists;
import com.google.common.collect.Maps;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.springframework.boot.actuate.trace.Trace; import org.springframework.boot.actuate.trace.http.HttpTrace;
import org.springframework.boot.actuate.trace.TraceRepository; import org.springframework.boot.actuate.trace.http.HttpTraceRepository;
import java.util.Date;
import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map;
/** /**
* Keep track of all the incoming requests, we are only keeping track of request originating from * Keep track of all the incoming requests, we are only keeping track of request originating from
@ -20,20 +16,17 @@ import java.util.Map;
* @since 8/13/17. * @since 8/13/17.
*/ */
@Slf4j @Slf4j
public class WebWolfTraceRepository implements TraceRepository { public class WebWolfTraceRepository implements HttpTraceRepository {
private final EvictingQueue<Trace> traces = EvictingQueue.create(10000); private final EvictingQueue<HttpTrace> traces = EvictingQueue.create(10000);
private List<String> exclusionList = Lists.newArrayList("/WebWolf/home", "/WebWolf/mail", "/WebWolf/files", "/images/", "/login", "/favicon.ico", "/js/", "/webjars/", "/WebWolf/requests", "/css/", "/mail"); private List<String> exclusionList = Lists.newArrayList("/WebWolf/home", "/WebWolf/mail", "/WebWolf/files", "/images/", "/login", "/favicon.ico", "/js/", "/webjars/", "/WebWolf/requests", "/css/", "/mail");
@Override @Override
public List<Trace> findAll() { public List<HttpTrace> findAll() {
HashMap<String, Object> map = Maps.newHashMap(); return List.of();
map.put("nice", "Great you found the standard Spring Boot tracing endpoint!");
Trace trace = new Trace(new Date(), map);
return Lists.newArrayList(trace);
} }
public List<Trace> findAllTraces() { public List<HttpTrace> findAllTraces() {
return Lists.newArrayList(traces); return Lists.newArrayList(traces);
} }
@ -42,10 +35,10 @@ public class WebWolfTraceRepository implements TraceRepository {
} }
@Override @Override
public void add(Map<String, Object> map) { public void add(HttpTrace httpTrace) {
String path = (String) map.getOrDefault("path", ""); var path = httpTrace.getRequest().getUri().getPath();
if (!isInExclusionList(path)) { if (!isInExclusionList(path)) {
traces.add(new Trace(new Date(), map)); traces.add(httpTrace);
} }
} }
} }

1
webwolf/src/main/resources/application-webwolf.properties
View File

@ -21,7 +21,6 @@ endpoints.trace.sensitive=false
management.trace.include=REQUEST_HEADERS,RESPONSE_HEADERS,COOKIES,ERRORS,TIME_TAKEN,PARAMETERS,QUERY_STRING management.trace.include=REQUEST_HEADERS,RESPONSE_HEADERS,COOKIES,ERRORS,TIME_TAKEN,PARAMETERS,QUERY_STRING
endpoints.trace.enabled=true endpoints.trace.enabled=true
spring.resources.cache-period=0
spring.thymeleaf.cache=false spring.thymeleaf.cache=false
multipart.enabled=true multipart.enabled=true