dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Link to the original lesson for the goal

Browse Source
This commit is contained in:
Nanne Baars 2020-10-20 22:00:29 +02:00 committed by Nanne Baars
parent e4ec90db8a
commit 641d75e734
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc
View File

@ -2,10 +2,12 @@
You need to do both use parametrized queries and validate the input received from the user. On StackOverflow you will You need to do both use parametrized queries and validate the input received from the user. On StackOverflow you will
see alot of answers stating that input validation is enough. *However* it only takes you so far before you know it see alot of answers stating that input validation is enough. *However* it only takes you so far before you know it
the validation is broken and you have an SQL injection in your application. the validation is broken, and you have an SQL injection in your application.
A nice read why it is not enough can be found https://twitter.com/marcan42/status/1238004834806067200?s=21 A nice read why it is not enough can be found https://twitter.com/marcan42/status/1238004834806067200?s=21
Let's repeat one of the previous assignments, the developer fixed the possible SQL injection with filtering, can you Let's repeat one of the previous assignments, the developer fixed the possible SQL injection with filtering, can you
spot the weakness in this approach? spot the weakness in this approach?
Read about the lesson goal link:start.mvc#lesson/SqlInjectionAdvanced.lesson/2[here].

1
webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12b.adoc
View File

@ -3,5 +3,6 @@
So the last attempt to validate if the query did not contain any spaces failed, the development team went further So the last attempt to validate if the query did not contain any spaces failed, the development team went further
into the direction of only performing input validation, can you find out where it went wrong this time? into the direction of only performing input validation, can you find out where it went wrong this time?
Read about the lesson goal link:start.mvc#lesson/SqlInjectionAdvanced.lesson/2[here].