Concept / Topic To Teach:
-Web applications frequently provide their users the ability to retrieve a forgotten password. Unfortunately, most web applications fail to implement the mechanism properly. The information required to verify the integrity of the user is often overly simplistic. +Web applications frequently provide their users the ability to retrieve a forgotten password. Unfortunately, many web applications fail to implement the mechanism properly. The information required to verify the identity of the user is often overly simplistic.General Goal(s):
Users can retrieve their password if they can answer the secret question properly. There is no lock-out mechanism on this 'Forgot Password' page. Your username is 'webgoat' and your favorite color is 'red'. The goal is to retrieve the password of another user. \ No newline at end of file