dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Renamed XMLInjection to XPATHInjection

Browse Source 
Made some changes to the lesson according to Jeff's comments

git-svn-id: http://webgoat.googlecode.com/svn/trunk@36 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
sherif.fathy 2006-12-16 23:38:02 +00:00
parent 296254e279
commit 60d65681ff
3 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/XMLInjection.java → webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/XPATHInjection.java
View File

@ -39,7 +39,7 @@ import org.owasp.webgoat.session.ECSFactory;
* @author sherif
*
*/
public class XMLInjection extends LessonAdapter {
public class XPATHInjection extends LessonAdapter {
private final static Integer DEFAULT_RANKING = new Integer(74);
private final static String USERNAME = "Username";
@ -99,7 +99,7 @@ public class XMLInjection extends LessonAdapter {
return ec;
}
String dir = s.getContext().getRealPath( "/lessons/XMLInjection/EmployeesData.xml" );
String dir = s.getContext().getRealPath( "/lessons/XPATHInjection/EmployeesData.xml" );
File d = new File( dir );
XPathFactory factory = XPathFactory.newInstance();
XPath xPath = factory.newXPath();
@ -195,7 +195,7 @@ public class XMLInjection extends LessonAdapter {
public String getTitle() {
return "How to Perform XML Injection";
return "How to Perform XPATH Injection";
}
}

8
webgoat/main/project/WebContent/lesson_plans/XMLInjection.html → webgoat/main/project/WebContent/lesson_plans/XPATHInjection.html
View File

@ -1,15 +1,15 @@
<div align="Center">
<p><b>Lesson Plan Title:</b> Cross Site Request Forgery. </p>
<p><b>Lesson Plan Title:</b> XPATH Injection Attacks. </p>
</div>
<p><b>Concept / Topic To Teach:</b> </p>
This lesson teaches how to perform XPath (XML) Injection attacks.
This lesson teaches how to perform XPath Injection attacks.
<br>
<div align="Left">
<p>
<b>How the attacks works:</b>
</p>
Similar to SQL Injection, XML Injection attacks occur when a web site uses user supplied information to query XML data. By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured or access data that they may not normally have access to.
Similar to SQL Injection, XPATH Injection attacks occur when a web site uses user supplied information to query XML data. By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured or access data that they may not normally have access to.
They may even be able to elevate their privileges on the web site if the xml data is being used for authentication (such as an xml based user file).
Querying XML is done with XPath, a type of simple descriptive statement that allows the xml query to locate a piece of information. Like SQL you can specify certain attributes to find and patterns to match. When using XML for a web site it is common to accept some form of input on the query string to identify the content to locate and display on the page. This input must be sanitized to verify that it doesn't mess up the XPath query and return the wrong data.
@ -18,5 +18,5 @@ Querying XML is done with XPath, a type of simple descriptive statement that all
</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
The form below allows employees to see all their personal data including their salaries. Your goal is to try to see other employees data as well.
The form below allows employees to see all their personal data including their salaries. Your account is Mike/test123. Your goal is to try to see other employees data as well.
<!-- Stop Instructions -->

0
webgoat/main/project/WebContent/lessons/XMLInjection/EmployeesData.xml → webgoat/main/project/WebContent/lessons/XPATHInjection/EmployeesData.xml
View File