Restructured the baseline to remove extra src/main directory structure. Added eclipes project file
git-svn-id: http://webgoat.googlecode.com/svn/branches/webgoat-6.0@485 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64@gmail.com
50
webapp/WEB-INF/mvc-dispatcher-servlet.xml
Normal file
50
webapp/WEB-INF/mvc-dispatcher-servlet.xml
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:p="http://www.springframework.org/schema/p"
|
||||
xmlns:context="http://www.springframework.org/schema/context"
|
||||
xmlns:mvc="http://www.springframework.org/schema/mvc"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/context
|
||||
http://www.springframework.org/schema/context/spring-context-3.0.xsd
|
||||
http://www.springframework.org/schema/mvc
|
||||
http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
|
||||
|
||||
<context:component-scan base-package="org.owasp.webgoat.lessons" />
|
||||
|
||||
<!--
|
||||
put custom validators here. E.g.:
|
||||
<bean class="org.owasp.webgoat.validators.MyCustomValidator" />
|
||||
-->
|
||||
|
||||
<!-- Activates various annotations to be detected in bean classes -->
|
||||
<context:annotation-config />
|
||||
|
||||
<!-- Configures the annotation-driven Spring MVC Controller programming model. -->
|
||||
<mvc:annotation-driven />
|
||||
|
||||
<!-- Import Tiles-related configuration -->
|
||||
<import resource="tiles-context.xml" />
|
||||
|
||||
|
||||
<!-- Declare a view resolver -->
|
||||
<!-- Take note of the order. Since we're using TilesViewResolver as well
|
||||
We need to define which ViewResolver is called first.
|
||||
We chose this InternalResourceViewResolver to be at the bottom order -->
|
||||
<bean
|
||||
id="viewResolver"
|
||||
class="org.springframework.web.servlet.view.InternalResourceViewResolver"
|
||||
p:prefix="/WEB-INF/pages/"
|
||||
p:suffix=".jsp"
|
||||
p:order="1"/>
|
||||
|
||||
|
||||
<!-- Register the Customer.properties
|
||||
<bean id="messageSource"
|
||||
class="org.springframework.context.support.ResourceBundleMessageSource">
|
||||
<property name="basename" value="org/owasp/webgoat/properties/Customer" />
|
||||
</bean>
|
||||
-->
|
||||
|
||||
</beans>
|
||||
70
webapp/WEB-INF/pages/layouts/genericLesson.jsp
Normal file
70
webapp/WEB-INF/pages/layouts/genericLesson.jsp
Normal file
@ -0,0 +1,70 @@
|
||||
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
|
||||
<%@ taglib uri="http://tiles.apache.org/tags-tiles" prefix="tiles"%>
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
|
||||
<title><tiles:insertAttribute name="title-content" /></title>
|
||||
<link rel="stylesheet" href="css/webgoat.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/lesson.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/menu.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/layers.css" type="text/css" />
|
||||
<script language="JavaScript1.2" src="javascript/javascript.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/menu_system.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/lessonNav.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/makeWindow.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/toggle.js" type="text/javascript"></script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
|
||||
// pcs 8/29/2012 - HACK
|
||||
//
|
||||
// Legacy lessons result in a call to WebSession.update(). Among other things, that call
|
||||
// sets the previous and current screens. The latter determines the title that is displayed
|
||||
// in the webgoat banner.
|
||||
//
|
||||
// The new Spring-MVC jsps, among which is this genericLesson.jsp, are loaded via our dispatcher servlet
|
||||
// and does not pass through the code path that results in that update() call.
|
||||
//
|
||||
// As a result, we must call update() explicitly here. If we refactor away that legacy code as part
|
||||
// of webgoat 6 development, we will need to get rid of the call below.
|
||||
//
|
||||
webSession.update(request, response, "genericLesson");
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
%>
|
||||
|
||||
<div id="header-style"><tiles:insertAttribute name="header-content" /></div>
|
||||
<div><tiles:insertAttribute name="menu-content" /></div>
|
||||
<div id="lessonTitle" align="right"><%= currentLesson.getTitle() %></div>
|
||||
<div id="primary-style"">
|
||||
<div id="lessonArea">
|
||||
<tiles:insertAttribute name="hints-params-cookies" />
|
||||
<div id="twoCol">
|
||||
<div id="menuSpacer"></div>
|
||||
<div id="lessonAreaTop">
|
||||
<div id="training_wrap">
|
||||
<div id="training" class="info"><a href="http://yehg.net/lab/pr0js/training/webgoat.php" target="_blank"><%=WebGoatI18N.get("SolutionVideos")%></a></div>
|
||||
<div id="reset" class="info"><a href="<%=webSession.getRestartLink()%>"><%=WebGoatI18N.get("RestartLesson")%></a></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="lessonContent">
|
||||
<tiles:insertAttribute name="primary-content" />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="footer-style"><tiles:insertAttribute name="footer-content" /></div>
|
||||
</body>
|
||||
</html>
|
||||
77
webapp/WEB-INF/pages/lessons/httpBasics.jsp
Normal file
77
webapp/WEB-INF/pages/lessons/httpBasics.jsp
Normal file
@ -0,0 +1,77 @@
|
||||
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
|
||||
<%@ taglib uri="http://tiles.apache.org/tags-tiles" prefix="tiles"%>
|
||||
<%@taglib uri="http://www.springframework.org/tags/form" prefix="form"%>
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<div id="lessonPlans" style="visibility:hidden; height:1px; position:absolute; left:260px; top:130px; width:425px; z-index:105;">
|
||||
<div align="Center">
|
||||
<p><b>Lesson Plan Title:</b> Http Basics </p>
|
||||
</div>
|
||||
<p><b>Concept / Topic To Teach:</b> </p>
|
||||
This lesson presents the basics for understanding the transfer of data between the browser and the web application.<br>
|
||||
|
||||
<div align="Left">
|
||||
<p>
|
||||
<b>How HTTP works:</b>
|
||||
</p>
|
||||
All HTTP transactions follow the same general format. Each client request and server response has three parts: the request or response line, a header section, and the entity body. The client initiates a transaction as follows: <br>
|
||||
<br>
|
||||
The client contacts the server and sends a document request <br>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
<ul>GET /index.html?param=value HTTP/1.0</ul>
|
||||
Next, the client sends optional header information to inform the server of its configuration and the document formats it will accept.<br>
|
||||
<br>
|
||||
<ul>User-Agent: Mozilla/4.06 Accept: image/gif,image/jpeg, */*</ul>
|
||||
After sending the request and headers, the client may send additional data. This data is mostly used by CGI programs using the POST method.<br>
|
||||
<p><b>General Goal(s):</b> </p>
|
||||
<%-- Start Instructions --%>
|
||||
Enter your name in the input field below and press "go" to submit. The server will accept the request, reverse the input, and display it back to the user, illustrating the basics of handling an HTTP request.
|
||||
<br/><br/>
|
||||
The user should become familiar with the features of WebGoat by manipulating the above
|
||||
buttons to view hints, show the HTTP request parameters, the HTTP request cookies, and the Java source code. You may also try using WebScarab for the first time.
|
||||
<%-- Stop Instructions --%>
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
<a href="javascript:toggle('lessonPlans')" target="_top" onclick="MM_nbGroup('down','group1','plans','',1)">Close this Window</a>
|
||||
</div>
|
||||
|
||||
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
%>
|
||||
|
||||
<%--
|
||||
This form posts to httpBasics.do. However, we must append the "menu" request parameter in order
|
||||
for the current submenu to display properly, hence the getLink() call to build the form's
|
||||
action attribute below.
|
||||
--%>
|
||||
<form:form method="POST" action="<%= webSession.getCurrentLesson().getLink() %>">
|
||||
<p>
|
||||
Enter your name in the input field below and press "go" to submit.
|
||||
The server will accept the request, reverse the input, and display it back to the user,
|
||||
illustrating the basics of handling an HTTP request.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
The user should become familiar with the features of WebGoat by manipulating
|
||||
the above buttons to view hints, show the HTTP request parameters,
|
||||
the HTTP request cookies, and the Java source code.
|
||||
You may also try using WebScarab for the first time.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Enter your name:
|
||||
<form:input path="personName" />
|
||||
<input name="SUBMIT" type="SUBMIT" value="Go!"/>
|
||||
</p>
|
||||
</form:form>
|
||||
7
webapp/WEB-INF/pages/sections/footer.jsp
Normal file
7
webapp/WEB-INF/pages/sections/footer.jsp
Normal file
@ -0,0 +1,7 @@
|
||||
<div id="bottom">
|
||||
<div align="center">
|
||||
<a href="http://www.owasp.org">OWASP Foundation</a> |
|
||||
<a href="http://www.owasp.org/index.php/OWASP_WebGoat_Project">Project WebGoat</a> |
|
||||
<a href="reportBug.jsp">Report Bug</a>
|
||||
</div>
|
||||
</div>
|
||||
2
webapp/WEB-INF/pages/sections/header.jsp
Normal file
2
webapp/WEB-INF/pages/sections/header.jsp
Normal file
@ -0,0 +1,2 @@
|
||||
<div id="top"/>
|
||||
<div id="topLeft">
|
||||
45
webapp/WEB-INF/pages/sections/hintsParamsAndCookies.jsp
Normal file
45
webapp/WEB-INF/pages/sections/hintsParamsAndCookies.jsp
Normal file
@ -0,0 +1,45 @@
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="java.util.Iterator, org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
|
||||
if (webSession.getHint() != null)
|
||||
{
|
||||
%>
|
||||
<div id="hint" class="info"> <%= webSession.getHint() %> </div><br>
|
||||
<%
|
||||
}
|
||||
|
||||
if (webSession.getParams() != null)
|
||||
{
|
||||
Iterator i = webSession.getParams().iterator();
|
||||
while (i.hasNext())
|
||||
{
|
||||
Parameter p = (Parameter) i.next();
|
||||
%>
|
||||
<div id="parameter" class="info"> <%= p.getName()%> = <%= p.getValue() %></div><br>
|
||||
<%
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (webSession.getCookies() != null)
|
||||
{
|
||||
Iterator i = webSession.getCookies().iterator();
|
||||
while (i.hasNext())
|
||||
{
|
||||
Cookie c = (Cookie) i.next();
|
||||
%>
|
||||
<div id="cookie" class="info"> <%= c.getName() %> <img src="images/icons/rightArrow.jpg" alt="\"><%= c.getValue() %></div><br>
|
||||
<%
|
||||
}
|
||||
}
|
||||
%>
|
||||
202
webapp/WEB-INF/pages/sections/menu.jsp
Normal file
202
webapp/WEB-INF/pages/sections/menu.jsp
Normal file
@ -0,0 +1,202 @@
|
||||
<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.Category, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*, java.util.*"
|
||||
errorPage="" %>
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
%>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<%@page import="org.owasp.webgoat.lessons.RandomLessonAdapter"%>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
|
||||
|
||||
<%
|
||||
final String menuPrefix = WebSession.MENU;
|
||||
final String submenuPrefix = "submenu";
|
||||
final String mbutPrefix = "mbut";
|
||||
String printHint = "";
|
||||
String printParameters = "";
|
||||
String printCookies = "";
|
||||
String lessonComplete = "<img src=\"images/buttons/lessonComplete.jpg\">";
|
||||
|
||||
List categories = course.getCategories();
|
||||
|
||||
StringBuffer buildList = new StringBuffer();
|
||||
|
||||
Iterator iter1 = categories.iterator();
|
||||
while(iter1.hasNext())
|
||||
{
|
||||
Category category = (Category)iter1.next();
|
||||
|
||||
buildList.append("'");
|
||||
buildList.append(menuPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("','");
|
||||
buildList.append(submenuPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("','");
|
||||
buildList.append(mbutPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("'");
|
||||
|
||||
if (iter1.hasNext())
|
||||
buildList.append(",");
|
||||
}%>
|
||||
<body class="page" onload="setMenuMagic1(10,40,10,'menubottom',<%=buildList%>);trigMM1url('<%= menuPrefix %>',1);MM_preloadImages('images/buttons/hintLeftOver.jpg','images/buttons/hintOver.jpg','images/buttons/hintRightOver.jpg','images/buttons/paramsOver.jpg','images/buttons/htmlOver.jpg','images/buttons/cookiesOver.jpg','images/buttons/javaOver.jpg','images/buttons/plansOver.jpg','images/buttons/logout.jpg','images/buttons/helpOver.jpg'); initIframe();">
|
||||
|
||||
<div id="wrap">
|
||||
<%
|
||||
int topCord = 140;
|
||||
int zIndex = 105;
|
||||
|
||||
Iterator iter2 = categories.iterator();
|
||||
while(iter2.hasNext())
|
||||
{
|
||||
Category category = (Category)iter2.next();
|
||||
%>
|
||||
<div id="<%=menuPrefix + category.getRanking()%>" style="position:absolute; left:30px; top:<%=topCord%>px; width:160px; z-index:<%=zIndex%>"><a href="javascript:;" onclick="trigMenuMagic1('<%=menuPrefix + category.getRanking()%>',1);return false" onfocus="if(this.blur)this.blur()"><img src="images/menu_images/1x1.gif" width="1" height=1"20" name="mbut<%=category.getRanking()%>" border="0" alt=""/><%=category.getName()%></a></div>
|
||||
<%
|
||||
topCord=topCord + 30;
|
||||
zIndex=zIndex + 1;
|
||||
}
|
||||
|
||||
int topSubMenu = 72;
|
||||
|
||||
Iterator iter3 = categories.iterator();
|
||||
while(iter3.hasNext())
|
||||
{
|
||||
Category category = (Category)iter3.next();
|
||||
List lessons = webSession.getLessons(category);
|
||||
Iterator iter4 = lessons.iterator();
|
||||
%>
|
||||
<div id="submenu<%=category.getRanking()%>" class="pviimenudiv" style="position:absolute; left:200px; top:<%=topSubMenu%>px; width:150px; visibility: hidden; z-index:<%=zIndex%>">
|
||||
<table width="150" border="0" cellspacing="6" cellpadding="0"><%
|
||||
|
||||
topSubMenu=topSubMenu+30;
|
||||
zIndex=zIndex + 1;
|
||||
|
||||
while(iter4.hasNext())
|
||||
{
|
||||
AbstractLesson lesson = (AbstractLesson)iter4.next();
|
||||
|
||||
%><tr>
|
||||
<td><%=(lesson.isCompleted(webSession) ? lessonComplete : "")%><a href="<%=lesson.getLink()%>"><%=lesson.getTitle()%></a></td>
|
||||
</tr>
|
||||
<% if (lesson instanceof RandomLessonAdapter) {
|
||||
RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
|
||||
String[] stages = rla.getStages();
|
||||
if (stages != null)
|
||||
for (int i=0; i<stages.length; i++) {
|
||||
%>
|
||||
<tr><td class="pviimenudivstage"><%=(rla.isStageComplete(webSession, stages[i]) ? lessonComplete : "")%><a href="<%=lesson.getLink() + "&stage=" + (i+1) %>">Stage <%=i+1%>: <%=stages[i] %></a>
|
||||
</td></tr>
|
||||
<%
|
||||
}
|
||||
}
|
||||
%>
|
||||
<%
|
||||
}
|
||||
%>
|
||||
</table>
|
||||
</div><%
|
||||
}%>
|
||||
<div id="top"></div>
|
||||
<div id="topLeft">
|
||||
<div align="left">
|
||||
<% if (currentLesson.getAvailableLanguages().size() != 0 )
|
||||
{
|
||||
%>
|
||||
<form method="get" action="attack" style="display: inline;">
|
||||
Choose another language: <select name="language" size="1"
|
||||
onChange="changeLanguage();">
|
||||
<%
|
||||
for(String lang: currentLesson.getAvailableLanguages()){
|
||||
%>
|
||||
<option value="<%=lang%>"
|
||||
<% if(webSession.getCurrrentLanguage().equals(lang)) out.println("selected" );%>><%=lang%>
|
||||
</option>
|
||||
<%
|
||||
|
||||
}
|
||||
%>
|
||||
</select></form>
|
||||
<%
|
||||
} else {
|
||||
%>
|
||||
Internationalization is not available for this lesson
|
||||
<%
|
||||
}
|
||||
%>
|
||||
</div></div>
|
||||
<div align="right" id="topRight">
|
||||
<a href="attack?action=Logout" onmouseout="MM_swapImgRestore()"
|
||||
onmouseover="MM_swapImage('logout','','images/buttons/logoutOver.jpg',1)"><img
|
||||
src="images/buttons/logout.jpg" alt="LogOut" name="logout" width="45"
|
||||
height="22" border="0" id="logout" /></a> <a href="#getFAQ()"
|
||||
onmouseout="MM_swapImgRestore()"
|
||||
onmouseover="MM_swapImage('help','','images/buttons/helpOver.jpg',1)"><img
|
||||
src="images/buttons/help.jpg" alt="Help" name="help" width="22"
|
||||
height="22" border="0" id="help" /></a>
|
||||
</div>
|
||||
<div id="hMenuBar">
|
||||
<%
|
||||
if (webSession.isAuthorizedInLesson(webSession.getRole(), WebSession.SHOWHINTS))
|
||||
{
|
||||
%>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=PreviousHint" target="_top" onclick="MM_nbGroup('down','group1','hintLeft','',1)"
|
||||
onmouseover="MM_nbGroup('over','hintLeft','images/buttons/hintLeftOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hintLeft.jpg" alt="Previous Hint" name="hintLeft" width="20" height="20" border="0" id="hintLeft"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=NextHint" target="_top" onclick="MM_nbGroup('down','group1','hint','',1)"
|
||||
onmouseover="MM_nbGroup('over','hint','images/buttons/hintOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hint.jpg" alt="Hints" name="hint" width="35" height="20" border="0" id="hint"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=NextHint" target="_top" onclick="MM_nbGroup('down','group1','hintRight','',1)"
|
||||
onmouseover="MM_nbGroup('over','hintRight','images/buttons/hintRightOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hintRight.jpg" alt="Next Hint" name="hintRight" width="20" height="20" border="0" id="hintRight"/>
|
||||
</a>
|
||||
<%}%>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=Params" target="_top" onclick="MM_nbGroup('down','group1','params','',1)"
|
||||
onmouseover="MM_nbGroup('over','params','images/buttons/paramsOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/params.jpg" alt="Show Params" name="<%= webSession.getCurrentLesson().getLink() %>&show=Params" width="87" height="20" border="0" id="params"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=Cookies" target="_top" onclick="MM_nbGroup('down','group1','cookies','',1)"
|
||||
onmouseover="MM_nbGroup('over','cookies','images/buttons/cookiesOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/cookies.jpg" alt="Show Cookies" name="cookies" width="99" height="20" border="0" id="cookies"/>
|
||||
</a>
|
||||
<a href="javascript:toggle('lessonPlans')" target="_top" onclick="MM_nbGroup('down','group1','plans','',1)"
|
||||
onmouseover="MM_nbGroup('over','plans','images/buttons/plansOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/plans.jpg" alt="Lesson Plans" width="89" height="20" border="0" id="plans"/>
|
||||
</a>
|
||||
<%
|
||||
if (webSession.isAuthorizedInLesson(webSession.getRole(), WebSession.SHOWSOURCE))
|
||||
{
|
||||
%>
|
||||
<a href="source" onclick="makeWindow(this.href+ '?source=true', 'Java Source');return false;" target="javaWin"
|
||||
onmouseover="MM_nbGroup('over','java','images/buttons/javaOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/java.jpg" alt="Show Java" name="java" width="75" height="20" border="0" id="java"/>
|
||||
</a>
|
||||
<a href="source" onclick="makeWindow(this.href + '?solution=true', 'Java Solution');return false;" target="javaWin"
|
||||
onmouseover="MM_nbGroup('over','solutions','images/buttons/solutionsOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/solutions.jpg" alt="Show Solution" name="solutions" width="73" height="20" border="0" id="solutions"/>
|
||||
</a>
|
||||
<%}%>
|
||||
|
||||
</div>
|
||||
<div id="twoCol">
|
||||
<div id="menuSpacer"></div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
69
webapp/WEB-INF/server-config.wsdd
Normal file
69
webapp/WEB-INF/server-config.wsdd
Normal file
@ -0,0 +1,69 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<deployment xmlns="http://xml.apache.org/axis/wsdd/" xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
|
||||
<globalConfiguration>
|
||||
<parameter name="sendMultiRefs" value="true"/>
|
||||
<parameter name="disablePrettyXML" value="true"/>
|
||||
<parameter name="adminPassword" value="admin"/>
|
||||
<!--
|
||||
<parameter name="attachments.Directory" value="C:\webgoat\tomcat\webapps\WebGoat\WEB-INF\attachments"/>
|
||||
-->
|
||||
<parameter name="dotNetSoapEncFix" value="true"/>
|
||||
<parameter name="enableNamespacePrefixOptimization" value="true"/>
|
||||
<parameter name="sendXMLDeclaration" value="true"/>
|
||||
<!--
|
||||
<parameter name="attachments.implementation" value="org.apache.axis.attachments.AttachmentsImpl"/>
|
||||
-->
|
||||
<parameter name="sendXsiTypes" value="true"/>
|
||||
<requestFlow>
|
||||
<handler type="java:org.apache.axis.handlers.JWSHandler">
|
||||
<parameter name="scope" value="session"/>
|
||||
</handler>
|
||||
<handler type="java:org.apache.axis.handlers.JWSHandler">
|
||||
<parameter name="scope" value="request"/>
|
||||
<parameter name="extension" value=".jwr"/>
|
||||
</handler>
|
||||
</requestFlow>
|
||||
</globalConfiguration>
|
||||
<handler name="LocalResponder" type="java:org.apache.axis.transport.local.LocalResponder"/>
|
||||
<handler name="URLMapper" type="java:org.apache.axis.handlers.http.URLMapper"/>
|
||||
<handler name="Authenticate" type="java:org.apache.axis.handlers.SimpleAuthenticationHandler"/>
|
||||
<service name="WSDLScanning" provider="java:RPC">
|
||||
<parameter name="allowedMethods" value="getFirstName, getLastName, getCreditCard, getLoginCount"/>
|
||||
<parameter name="className" value="org.owasp.webgoat.lessons.WSDLScanning"/>
|
||||
</service>
|
||||
<service name="SoapRequest" provider="java:RPC">
|
||||
<parameter name="allowedMethods" value="getFirstName, getLastName, getCreditCard, getLoginCount"/>
|
||||
<parameter name="className" value="org.owasp.webgoat.lessons.SoapRequest"/>
|
||||
</service>
|
||||
<service name="AdminService" provider="java:MSG">
|
||||
<parameter name="allowedMethods" value="AdminService"/>
|
||||
<parameter name="enableRemoteAdmin" value="false"/>
|
||||
<parameter name="className" value="org.apache.axis.utils.Admin"/>
|
||||
<namespace>http://xml.apache.org/axis/wsdd/</namespace>
|
||||
</service>
|
||||
<service name="Version" provider="java:RPC">
|
||||
<parameter name="allowedMethods" value="getVersion"/>
|
||||
<parameter name="className" value="org.apache.axis.Version"/>
|
||||
</service>
|
||||
<service name="WsSqlInjection" provider="java:RPC">
|
||||
<parameter name="allowedMethods" value="getCreditCard"/>
|
||||
<parameter name="className" value="org.owasp.webgoat.lessons.WsSqlInjection"/>
|
||||
</service>
|
||||
<transport name="http">
|
||||
<requestFlow>
|
||||
<handler type="URLMapper"/>
|
||||
<handler type="java:org.apache.axis.handlers.http.HTTPAuthHandler"/>
|
||||
</requestFlow>
|
||||
<parameter name="qs:list" value="org.apache.axis.transport.http.QSListHandler"/>
|
||||
<parameter name="qs:wsdl" value="org.apache.axis.transport.http.QSWSDLHandler"/>
|
||||
<parameter name="qs.list" value="org.apache.axis.transport.http.QSListHandler"/>
|
||||
<parameter name="qs.method" value="org.apache.axis.transport.http.QSMethodHandler"/>
|
||||
<parameter name="qs:method" value="org.apache.axis.transport.http.QSMethodHandler"/>
|
||||
<parameter name="qs.wsdl" value="org.apache.axis.transport.http.QSWSDLHandler"/>
|
||||
</transport>
|
||||
<transport name="local">
|
||||
<responseFlow>
|
||||
<handler type="LocalResponder"/>
|
||||
</responseFlow>
|
||||
</transport>
|
||||
</deployment>
|
||||
28
webapp/WEB-INF/spring-security.xml
Normal file
28
webapp/WEB-INF/spring-security.xml
Normal file
@ -0,0 +1,28 @@
|
||||
<beans:beans xmlns="http://www.springframework.org/schema/security"
|
||||
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
|
||||
|
||||
<!--
|
||||
PCS 8/27/2012
|
||||
NOTE: Without Spring security, HttpServletRequest.getUserPrincipal() returns null when called from pages under Spring's control.
|
||||
That method is used extensively in legacy webgoat code. Integrating Spring security into the application resolves this issue.
|
||||
-->
|
||||
<http auto-config='true'>
|
||||
<intercept-url pattern="/**" access="ROLE_USER" />
|
||||
<http-basic/>
|
||||
</http>
|
||||
|
||||
<!-- Authentication Manager -->
|
||||
<authentication-manager alias="authenticationManager">
|
||||
<authentication-provider>
|
||||
<user-service>
|
||||
<!-- TODO: credentials in the config - this isn't something I'm proud of - get rid of this ASAP -->
|
||||
<user name="guest" password="guest" authorities="ROLE_USER" />
|
||||
</user-service>
|
||||
</authentication-provider>
|
||||
</authentication-manager>
|
||||
|
||||
</beans:beans>
|
||||
37
webapp/WEB-INF/tiles-context.xml
Normal file
37
webapp/WEB-INF/tiles-context.xml
Normal file
@ -0,0 +1,37 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:p="http://www.springframework.org/schema/p"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
|
||||
|
||||
<!--
|
||||
Note:
|
||||
Spring 3.0 requires Tiles 2.1.2 or above, with explicit support for Tiles 2.2.
|
||||
Tiles 2.1's EL support will be activated by default when running on JSP 2.1 or above
|
||||
and when the Tiles EL module is present in the classpath.
|
||||
|
||||
See:
|
||||
JIRA report for TilesViewResolver 2: https://jira.springsource.org/browse/SPR-5689
|
||||
Apache Tiles 2: http://tiles.apache.org/
|
||||
-->
|
||||
|
||||
<!-- Convenience subclass of UrlBasedViewResolver that supports TilesView (i.e. Tiles definitions) and custom subclasses of it. -->
|
||||
<!-- Don't forget to set the order if you declared other ViewResolvers -->
|
||||
<!-- See http://static.springsource.org/spring/docs/3.0.x/javadoc-api/org/springframework/web/servlet/view/tiles2/TilesViewResolver.html -->
|
||||
<bean id="tilesviewResolver" class="org.springframework.web.servlet.view.tiles2.TilesViewResolver"
|
||||
p:order="0"/>
|
||||
|
||||
<!-- Helper class to configure Tiles 2.x for the Spring Framework -->
|
||||
<!-- See http://static.springsource.org/spring/docs/3.0.x/javadoc-api/org/springframework/web/servlet/view/tiles2/TilesConfigurer.html -->
|
||||
<!-- The actual tiles templates are in the tiles-definitions.xml -->
|
||||
<bean id="tilesConfigurer" class="org.springframework.web.servlet.view.tiles2.TilesConfigurer">
|
||||
<property name="definitions">
|
||||
<list>
|
||||
<value>/WEB-INF/tiles-definitions.xml</value>
|
||||
</list>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
</beans>
|
||||
23
webapp/WEB-INF/tiles-definitions.xml
Normal file
23
webapp/WEB-INF/tiles-definitions.xml
Normal file
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE tiles-definitions PUBLIC
|
||||
"-//Apache Software Foundation//DTD Tiles Configuration 2.1//EN"
|
||||
"http://tiles.apache.org/dtds/tiles-config_2_1.dtd">
|
||||
<tiles-definitions>
|
||||
|
||||
<!-- template for generic lessons -->
|
||||
<definition name="generic-lesson" template="/WEB-INF/pages/layouts/genericLesson.jsp">
|
||||
<put-attribute name="header-content" value="/WEB-INF/pages/sections/header.jsp" />
|
||||
<put-attribute name="title-content" cascade="true" value="" />
|
||||
<put-attribute name="menu-content" value="/WEB-INF/pages/sections/menu.jsp" />
|
||||
<put-attribute name="hints-params-cookies" value="/WEB-INF/pages/sections/hintsParamsAndCookies.jsp" />
|
||||
<put-attribute name="primary-content" value="" />
|
||||
<put-attribute name="footer-content" value="/WEB-INF/pages/sections/footer.jsp" />
|
||||
</definition>
|
||||
|
||||
<!-- vulnerability-specific lesson pages -->
|
||||
<definition name="http-basics" extends="generic-lesson">
|
||||
<put-attribute name="title-content" cascade="true" value="HTTP Basics"/>
|
||||
<put-attribute name="primary-content" value="/WEB-INF/pages/lessons/httpBasics.jsp" />
|
||||
</definition>
|
||||
|
||||
</tiles-definitions>
|
||||
401
webapp/WEB-INF/web.xml
Normal file
401
webapp/WEB-INF/web.xml
Normal file
@ -0,0 +1,401 @@
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<web-app
|
||||
xmlns="http://java.sun.com/xml/ns/javaee"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
|
||||
version="2.5">
|
||||
|
||||
<!-- General description of your web application -->
|
||||
<display-name>WebGoat</display-name>
|
||||
<description>
|
||||
This web application is designed to demonstrate web
|
||||
application security flaws for the purpose of educating
|
||||
developers and security professionals about web
|
||||
application security problems. Please contact Bruce Mayhew
|
||||
(webgoat@owasp.org) if you have any questions.
|
||||
</description>
|
||||
|
||||
|
||||
|
||||
<!-- Context initialization parameters that define shared
|
||||
String constants used within your application, which
|
||||
can be customized by the system administrator who is
|
||||
installing your application. The values actually
|
||||
assigned to these parameters can be retrieved in a
|
||||
servlet or JSP page by calling:
|
||||
|
||||
String value =
|
||||
getServletContext().getInitParameter("name");
|
||||
|
||||
where "name" matches the <param-name> element of
|
||||
one of these initialization parameters.
|
||||
|
||||
You can define any number of context initialization
|
||||
parameters, including zero.
|
||||
-->
|
||||
|
||||
<context-param>
|
||||
<param-name>email</param-name>
|
||||
<param-value>WebGoat@owasp.org</param-value>
|
||||
<description>
|
||||
The EMAIL address of the administrator to whom questions
|
||||
and comments about this application should be addressed.
|
||||
</description>
|
||||
</context-param>
|
||||
|
||||
<!-- spring MVC -->
|
||||
<context-param>
|
||||
<param-name>contextConfigLocation</param-name>
|
||||
<param-value>
|
||||
/WEB-INF/mvc-dispatcher-servlet.xml,
|
||||
/WEB-INF/spring-security.xml
|
||||
</param-value>
|
||||
</context-param>
|
||||
|
||||
|
||||
<!-- Servlet definitions for the servlets that make up
|
||||
your web application, including initialization
|
||||
parameters. With Tomcat, you can also send requests
|
||||
to servlets not listed here with a request like this:
|
||||
|
||||
http://localhost:8080/{context-path}/servlet/{classname}
|
||||
|
||||
but this usage is not guaranteed to be portable. It also
|
||||
makes relative references to images and other resources
|
||||
required by your servlet more complicated, so defining
|
||||
all of your servlets (and defining a mapping to them with
|
||||
a servlet-mapping element) is recommended.
|
||||
|
||||
Servlet initialization parameters can be retrieved in a
|
||||
servlet or JSP page by calling:
|
||||
|
||||
String value =
|
||||
getServletConfig().getInitParameter("name");
|
||||
|
||||
where "name" matches the <param-name> element of
|
||||
one of these initialization parameters.
|
||||
|
||||
You can define any number of servlets, including zero.
|
||||
-->
|
||||
|
||||
<servlet>
|
||||
<servlet-name>AxisServlet</servlet-name>
|
||||
<display-name>Apache-Axis Servlet</display-name>
|
||||
<servlet-class>
|
||||
org.apache.axis.transport.http.AxisServlet
|
||||
</servlet-class>
|
||||
</servlet>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>AdminServlet</servlet-name>
|
||||
<display-name>Axis Admin Servlet</display-name>
|
||||
<servlet-class>
|
||||
org.apache.axis.transport.http.AdminServlet
|
||||
</servlet-class>
|
||||
<load-on-startup>100</load-on-startup>
|
||||
</servlet>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>SOAPMonitorService</servlet-name>
|
||||
<display-name>SOAPMonitorService</display-name>
|
||||
<servlet-class>
|
||||
org.apache.axis.monitor.SOAPMonitorService
|
||||
</servlet-class>
|
||||
<init-param>
|
||||
<param-name>SOAPMonitorPort</param-name>
|
||||
<param-value>5001</param-value>
|
||||
</init-param>
|
||||
<load-on-startup>100</load-on-startup>
|
||||
</servlet>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>WebGoat</servlet-name>
|
||||
<description>
|
||||
This servlet plays the "controller" role in the MVC architecture
|
||||
used in this application.
|
||||
|
||||
The initialization parameter namess for this servlet are the
|
||||
"servlet path" that will be received by this servlet (after the
|
||||
filename extension is removed). The corresponding value is the
|
||||
name of the action class that will be used to process this request.
|
||||
</description>
|
||||
<servlet-class>org.owasp.webgoat.HammerHead</servlet-class>
|
||||
|
||||
<init-param>
|
||||
<param-name>email</param-name>
|
||||
<param-value>WebGoat@owasp.org</param-value>
|
||||
<description>
|
||||
The EMAIL address of the administrator to whom questions
|
||||
and comments about this application should be addressed.
|
||||
</description>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>debug</param-name>
|
||||
<param-value>false</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>CookieDebug</param-name>
|
||||
<param-value>true</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>DefuseOSCommands</param-name>
|
||||
<param-value>false</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>Enterprise</param-name>
|
||||
<param-value>true</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>CodingExercises</param-name>
|
||||
<param-value>true</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<!-- Specify an address where you would like comments to be sent. -->
|
||||
<!-- This can be any URL or HTML tags, and will appear on the report card and lesson incomplete pages -->
|
||||
<!-- Use iso8859-1 encoding to represent special characters that might confuse XML parser. For
|
||||
example, replace "<" with "<" and ">" with ">". -->
|
||||
<param-name>FeedbackAddress</param-name>
|
||||
<param-value>
|
||||
<A HREF=mailto:webgoat@owasp.org>webgoat@owasp.org</A>
|
||||
</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>DatabaseDriver</param-name>
|
||||
<param-value>
|
||||
org.hsqldb.jdbcDriver
|
||||
</param-value>
|
||||
</init-param>
|
||||
|
||||
<init-param>
|
||||
<param-name>DatabaseConnectionString</param-name>
|
||||
<!--
|
||||
The string "${USER}" in the connection string will be replaced by the active username
|
||||
when making a connection.
|
||||
-->
|
||||
<param-value>
|
||||
jdbc:hsqldb:mem:${USER}
|
||||
</param-value>
|
||||
</init-param>
|
||||
|
||||
<!-- Load this servlet at server startup time -->
|
||||
|
||||
<load-on-startup>5</load-on-startup>
|
||||
|
||||
</servlet>
|
||||
|
||||
|
||||
<servlet>
|
||||
<servlet-name>LessonSource</servlet-name>
|
||||
<description>
|
||||
This servlet returns the Java source of the current lesson.
|
||||
</description>
|
||||
<servlet-class>org.owasp.webgoat.LessonSource</servlet-class>
|
||||
</servlet>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>Catcher</servlet-name>
|
||||
<description>
|
||||
This servlet catches any posts and marks the appropriate lesson property.
|
||||
</description>
|
||||
<servlet-class>org.owasp.webgoat.Catcher</servlet-class>
|
||||
</servlet>
|
||||
|
||||
<servlet>
|
||||
<servlet-name>conf</servlet-name>
|
||||
<jsp-file>/lessons/ConfManagement/config.jsp</jsp-file>
|
||||
</servlet>
|
||||
|
||||
|
||||
<!-- spring MVC -->
|
||||
<servlet>
|
||||
<servlet-name>mvc-dispatcher</servlet-name>
|
||||
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
|
||||
<load-on-startup>1</load-on-startup>
|
||||
</servlet>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>mvc-dispatcher</servlet-name>
|
||||
<url-pattern>*.do</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<listener>
|
||||
<listener-class>
|
||||
org.springframework.web.context.ContextLoaderListener
|
||||
</listener-class>
|
||||
</listener>
|
||||
<!-- end spring MVC -->
|
||||
|
||||
<!-- spring security -->
|
||||
<filter>
|
||||
<filter-name>springSecurityFilterChain</filter-name>
|
||||
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
|
||||
</filter>
|
||||
|
||||
<filter-mapping>
|
||||
<filter-name>springSecurityFilterChain</filter-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</filter-mapping>
|
||||
<!-- end spring security -->
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- Define mappings that are used by the servlet container to
|
||||
translate a particular request URI (context-relative) to a
|
||||
particular servlet. The examples below correspond to the
|
||||
servlet descriptions above. Thus, a request URI like:
|
||||
|
||||
http://localhost:8080/{contextpath}/graph
|
||||
|
||||
will be mapped to the "graph" servlet, while a request like:
|
||||
|
||||
http://localhost:8080/{contextpath}/saveCustomer.do
|
||||
|
||||
will be mapped to the "controller" servlet.
|
||||
|
||||
You may define any number of servlet mappings, including zero.
|
||||
It is also legal to define more than one mapping for the same
|
||||
servlet, if you wish to.
|
||||
-->
|
||||
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>AxisServlet</servlet-name>
|
||||
<url-pattern>/servlet/AxisServlet</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>AxisServlet</servlet-name>
|
||||
<url-pattern>*.jws</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>AxisServlet</servlet-name>
|
||||
<url-pattern>/services/*</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>SOAPMonitorService</servlet-name>
|
||||
<url-pattern>/SOAPMonitor</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<!-- uncomment this if you want the admin servlet -->
|
||||
<!--
|
||||
<servlet-mapping>
|
||||
<servlet-name>AdminServlet</servlet-name>
|
||||
<url-pattern>/servlet/AdminServlet</url-pattern>
|
||||
</servlet-mapping>
|
||||
-->
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>WebGoat</servlet-name>
|
||||
<url-pattern>/attack</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>LessonSource</servlet-name>
|
||||
<url-pattern>/source</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>Catcher</servlet-name>
|
||||
<url-pattern>/catcher</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>conf</servlet-name>
|
||||
<url-pattern>/conf</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
|
||||
|
||||
<!-- Define the default session timeout for your application,
|
||||
in minutes. From a servlet or JSP page, you can modify
|
||||
the timeout for a particular session dynamically by using
|
||||
HttpSession.getMaxInactiveInterval(). -->
|
||||
|
||||
<session-config>
|
||||
<!-- 2 days -->
|
||||
<session-timeout>2880</session-timeout>
|
||||
</session-config>
|
||||
|
||||
<mime-mapping>
|
||||
<extension>wmv</extension>
|
||||
<mime-type>video/x-ms-wmv</mime-type>
|
||||
</mime-mapping>
|
||||
|
||||
<!-- Define reference to the user database for looking up roles -->
|
||||
<resource-env-ref>
|
||||
<description>
|
||||
Link to the UserDatabase instance from which we request lists of
|
||||
defined role names. Typically, this will be connected to the global
|
||||
user database with a ResourceLink element in server.xml or the context
|
||||
configuration file for the Manager web application.
|
||||
</description>
|
||||
<resource-env-ref-name>users</resource-env-ref-name>
|
||||
<resource-env-ref-type>
|
||||
org.apache.catalina.UserDatabase
|
||||
</resource-env-ref-type>
|
||||
</resource-env-ref>
|
||||
|
||||
|
||||
<!-- Define a Security Constraint on this Application -->
|
||||
<security-constraint>
|
||||
<web-resource-collection>
|
||||
<web-resource-name>WebGoat Application</web-resource-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</web-resource-collection>
|
||||
<auth-constraint>
|
||||
<role-name>webgoat_user</role-name>
|
||||
<role-name>webgoat_admin</role-name>
|
||||
<role-name>webgoat_challenge</role-name>
|
||||
</auth-constraint>
|
||||
</security-constraint>
|
||||
|
||||
<security-constraint>
|
||||
<web-resource-collection>
|
||||
<web-resource-name>WebGoat Application Source</web-resource-name>
|
||||
<url-pattern>/JavaSource/*</url-pattern>
|
||||
</web-resource-collection>
|
||||
<auth-constraint>
|
||||
<role-name>server_admin</role-name>
|
||||
</auth-constraint>
|
||||
</security-constraint>
|
||||
|
||||
|
||||
<!-- Login configuration uses BASIC authentication -->
|
||||
<login-config>
|
||||
<auth-method>BASIC</auth-method>
|
||||
<realm-name>WebGoat Application</realm-name>
|
||||
</login-config>
|
||||
|
||||
<!-- Security roles referenced by this web application -->
|
||||
<security-role>
|
||||
<description>The role that is required to administrate WebGoat</description>
|
||||
<role-name>webgoat_admin</role-name>
|
||||
</security-role>
|
||||
|
||||
<security-role>
|
||||
<description>The role that is required to start the challenge log viewer</description>
|
||||
<role-name>webgoat_challenge</role-name>
|
||||
</security-role>
|
||||
|
||||
<security-role>
|
||||
<description>The role that is required to use WebGoat</description>
|
||||
<role-name>webgoat_user</role-name>
|
||||
</security-role>
|
||||
|
||||
<security-role>
|
||||
<description>This role is for admins only</description>
|
||||
<role-name>server_admin</role-name>
|
||||
</security-role>
|
||||
|
||||
</web-app>
|
||||
|
||||
60
webapp/WEB-INF/webgoat-class.properties
Normal file
60
webapp/WEB-INF/webgoat-class.properties
Normal file
@ -0,0 +1,60 @@
|
||||
category.General.ranking=11
|
||||
lesson.HttpBasics.ranking=10
|
||||
lesson.HttpSplitting.ranking=20
|
||||
lesson.ThreadSafetyProblem.ranking=30
|
||||
|
||||
category.Broken\ Authentication\ and\ Session\ Management.ranking=21
|
||||
lesson.BasicAuthentication.ranking=10
|
||||
lesson.WeakAuthenticationCookie.ranking=20
|
||||
|
||||
category.Broken\ Access\ Control.ranking=31
|
||||
lesson.AccessControlMatrix.ranking=10
|
||||
lesson.PathBasedAccessControl.ranking=20
|
||||
lesson.RoleBasedAccessControl.hidden=true
|
||||
|
||||
category.Cross-Site\ Scripting\ (XSS).ranking=41
|
||||
lesson.StoredXss.ranking=10
|
||||
lesson.ReflectedXSS.ranking=20
|
||||
lesson.CSRF.ranking=30
|
||||
lesson.CsrfPromptByPass.ranking=40
|
||||
lesson.CsrfTokenByPass.ranking=50
|
||||
lesson.CrossSiteScripting.hidden=true
|
||||
|
||||
category.Unvalidated\ Parameters.ranking=51
|
||||
lesson.HiddenFieldTampering.ranking=10
|
||||
lesson.JavaScriptValidation.ranking=20
|
||||
lesson.UncheckedEmail.ranking=30
|
||||
|
||||
category.Insecure\ Storage.ranking=61
|
||||
lesson.Encoding.ranking=10
|
||||
|
||||
category.Injection\ Flaws.ranking=71
|
||||
lesson.SqlNumericInjection.ranking=10
|
||||
lesson.SqlStringInjection.ranking=20
|
||||
lesson.CommandInjection.ranking=30
|
||||
lesson.LogSpoofing.ranking=40
|
||||
lesson.SQLInjection.hidden=true
|
||||
|
||||
category.Improper\ Error\ Handling.ranking=81
|
||||
lesson.FailOpenAuthentication.ranking=10
|
||||
|
||||
category.Code\ Quality.ranking=91
|
||||
lesson.HtmlClues.ranking=10
|
||||
|
||||
category.Web\ Services.category.ranking=101
|
||||
lesson.SoapRequest.ranking=10
|
||||
lesson.WSDLScanning.ranking=20
|
||||
lesson.WsSqlInjection.ranking=30
|
||||
|
||||
category.New\ Lesson.category.ranking=111
|
||||
lesson.HowToAddNewLesson.ranking=10
|
||||
|
||||
lesson.WeakSessionID.hidden=true
|
||||
lesson.BufferOverflow.hidden=true
|
||||
lesson.BlindSqlInjection.hidden=true
|
||||
lesson.DOS_Login.hidden=true
|
||||
lesson.ForcedBrowsing.hidden=true
|
||||
lesson.ForgotPassword.hidden=true
|
||||
lesson.ParameterInjection.hidden=true
|
||||
lesson.RemoteAdminFlaw.hidden=true
|
||||
lesson.ChallengeScreen.hidden=true
|
||||
57
webapp/WEB-INF/webgoat-lab.properties
Normal file
57
webapp/WEB-INF/webgoat-lab.properties
Normal file
@ -0,0 +1,57 @@
|
||||
category.General.ranking=11
|
||||
lesson.HttpBasics.ranking=10
|
||||
lesson.HttpSplitting.ranking=20
|
||||
lesson.ThreadSafetyProblem.ranking=30
|
||||
|
||||
category.Broken\ Authentication\ and\ Session\ Management.ranking=21
|
||||
lesson.BasicAuthentication.ranking=10
|
||||
lesson.WeakAuthenticationCookie.ranking=20
|
||||
|
||||
category.Broken\ Access\ Control.ranking=31
|
||||
lesson.AccessControlMatrix.ranking=10
|
||||
lesson.PathBasedAccessControl.ranking=20
|
||||
|
||||
category.Cross-Site\ Scripting\ (XSS).ranking=41
|
||||
lesson.StoredXss.ranking=10
|
||||
lesson.ReflectedXSS.ranking=20
|
||||
lesson.CSRF.ranking=30
|
||||
lesson.CsrfPromptByPass.ranking=40
|
||||
lesson.CsrfTokenByPass.ranking=50
|
||||
|
||||
category.Unvalidated\ Parameters.ranking=51
|
||||
lesson.HiddenFieldTampering.ranking=10
|
||||
lesson.JavaScriptValidation.ranking=20
|
||||
lesson.UncheckedEmail.ranking=30
|
||||
|
||||
category.Insecure\ Storage.ranking=61
|
||||
lesson.Encoding.ranking=10
|
||||
|
||||
category.Injection\ Flaws.ranking=71
|
||||
lesson.SqlNumericInjection.ranking=10
|
||||
lesson.SqlStringInjection.ranking=20
|
||||
lesson.CommandInjection.ranking=30
|
||||
lesson.LogSpoofing.ranking=40
|
||||
|
||||
category.Improper\ Error\ Handling.ranking=81
|
||||
lesson.FailOpenAuthentication.ranking=10
|
||||
|
||||
category.Code\ Quality.ranking=91
|
||||
lesson.HtmlClues.ranking=10
|
||||
|
||||
category.Web\ Services.category.ranking=101
|
||||
lesson.SoapRequest.ranking=10
|
||||
lesson.WSDLScanning.ranking=20
|
||||
lesson.WsSqlInjection.ranking=30
|
||||
|
||||
category.New\ Lesson.category.ranking=111
|
||||
lesson.HowToAddNewLesson.ranking=10
|
||||
|
||||
lesson.WeakSessionID.hidden=true
|
||||
lesson.BufferOverflow.hidden=true
|
||||
lesson.BlindSqlInjection.hidden=true
|
||||
lesson.DOS_Login.hidden=true
|
||||
lesson.ForcedBrowsing.hidden=true
|
||||
lesson.ForgotPassword.hidden=true
|
||||
lesson.ParameterInjection.hidden=true
|
||||
lesson.RemoteAdminFlaw.hidden=true
|
||||
lesson.ChallengeScreen.hidden=true
|
||||
2
webapp/WEB-INF/webgoat-owasp.properties
Normal file
2
webapp/WEB-INF/webgoat-owasp.properties
Normal file
@ -0,0 +1,2 @@
|
||||
#lesson.BufferOverflow.hidden=true
|
||||
lesson.BlindScript.hidden=true
|
||||
2
webapp/WEB-INF/webgoat.properties
Normal file
2
webapp/WEB-INF/webgoat.properties
Normal file
@ -0,0 +1,2 @@
|
||||
#lesson.BufferOverflow.hidden=true
|
||||
lesson.BlindScript.hidden=true
|
||||
132
webapp/WEB-INF/webgoat_oracle.sql
Normal file
132
webapp/WEB-INF/webgoat_oracle.sql
Normal file
@ -0,0 +1,132 @@
|
||||
DROP USER webgoat_guest CASCADE;
|
||||
CREATE USER webgoat_guest IDENTIFIED BY webgoat DEFAULT TABLESPACE users;
|
||||
GRANT CONNECT, RESOURCE TO webgoat_guest;
|
||||
GRANT CREATE PROCEDURE TO webgoat_guest;
|
||||
|
||||
CREATE TABLE WEBGOAT_guest.EMPLOYEE (
|
||||
userid INT NOT NULL PRIMARY KEY,
|
||||
first_name VARCHAR(20),
|
||||
last_name VARCHAR(20),
|
||||
ssn VARCHAR(12),
|
||||
password VARCHAR(10),
|
||||
title VARCHAR(20),
|
||||
phone VARCHAR(13),
|
||||
address1 VARCHAR(80),
|
||||
address2 VARCHAR(80),
|
||||
manager INT,
|
||||
start_date CHAR(8),
|
||||
salary INT,
|
||||
ccn VARCHAR(30),
|
||||
ccn_limit INT,
|
||||
disciplined_date CHAR(8),
|
||||
disciplined_notes VARCHAR(60),
|
||||
personal_description VARCHAR(60)
|
||||
);
|
||||
|
||||
|
||||
CREATE OR REPLACE FUNCTION WEBGOAT_guest.EMPLOYEE_LOGIN(v_id NUMBER, v_password VARCHAR) RETURN NUMBER AS
|
||||
stmt VARCHAR(32767);cnt NUMBER;
|
||||
BEGIN
|
||||
stmt := 'SELECT COUNT (*) FROM EMPLOYEE WHERE USERID = ' || v_id || ' AND PASSWORD = ''' || v_password || '''';
|
||||
EXECUTE IMMEDIATE stmt INTO cnt;
|
||||
RETURN cnt;
|
||||
END;
|
||||
/
|
||||
|
||||
CREATE OR REPLACE FUNCTION WEBGOAT_guest.EMPLOYEE_LOGIN_BACKUP(v_id NUMBER, v_password VARCHAR) RETURN NUMBER AS
|
||||
stmt VARCHAR(32767);cnt NUMBER;
|
||||
BEGIN
|
||||
stmt := 'SELECT COUNT (*) FROM EMPLOYEE WHERE USERID = ' || v_id || ' AND PASSWORD = ''' || v_password || '''';
|
||||
EXECUTE IMMEDIATE stmt INTO cnt;
|
||||
RETURN cnt;
|
||||
END;
|
||||
/
|
||||
|
||||
CREATE OR REPLACE PROCEDURE WEBGOAT_guest.UPDATE_EMPLOYEE(
|
||||
v_userid IN employee.userid%type,
|
||||
v_first_name IN employee.first_name%type,
|
||||
v_last_name IN employee.last_name%type,
|
||||
v_ssn IN employee.ssn%type,
|
||||
v_title IN employee.title%type,
|
||||
v_phone IN employee.phone%type,
|
||||
v_address1 IN employee.address1%type,
|
||||
v_address2 IN employee.address2%type,
|
||||
v_manager IN employee.manager%type,
|
||||
v_start_date IN employee.start_date%type,
|
||||
v_salary IN employee.salary%type,
|
||||
v_ccn IN employee.ccn%type,
|
||||
v_ccn_limit IN employee.ccn_limit%type,
|
||||
v_disciplined_date IN employee.disciplined_date%type,
|
||||
v_disciplined_notes IN employee.disciplined_notes%type,
|
||||
v_personal_description IN employee.personal_description%type
|
||||
)
|
||||
AS
|
||||
BEGIN
|
||||
UPDATE EMPLOYEE
|
||||
SET
|
||||
first_name = v_first_name,
|
||||
last_name = v_last_name,
|
||||
ssn = v_ssn,
|
||||
title = v_title,
|
||||
phone = v_phone,
|
||||
address1 = v_address1,
|
||||
address2 = v_address2,
|
||||
manager = v_manager,
|
||||
start_date = v_Start_date,
|
||||
salary = v_salary,
|
||||
ccn = v_ccn,
|
||||
ccn_limit = v_ccn_limit,
|
||||
disciplined_date = v_disciplined_date,
|
||||
disciplined_notes = v_disciplined_notes,
|
||||
personal_description = v_personal_description
|
||||
WHERE
|
||||
userid = v_userid;
|
||||
END;
|
||||
/
|
||||
|
||||
CREATE OR REPLACE PROCEDURE WEBGOAT_guest.UPDATE_EMPLOYEE_BACKUP(
|
||||
v_userid IN employee.userid%type,
|
||||
v_first_name IN employee.first_name%type,
|
||||
v_last_name IN employee.last_name%type,
|
||||
v_ssn IN employee.ssn%type,
|
||||
v_title IN employee.title%type,
|
||||
v_phone IN employee.phone%type,
|
||||
v_address1 IN employee.address1%type,
|
||||
v_address2 IN employee.address2%type,
|
||||
v_manager IN employee.manager%type,
|
||||
v_start_date IN employee.start_date%type,
|
||||
v_salary IN employee.salary%type,
|
||||
v_ccn IN employee.ccn%type,
|
||||
v_ccn_limit IN employee.ccn_limit%type,
|
||||
v_disciplined_date IN employee.disciplined_date%type,
|
||||
v_disciplined_notes IN employee.disciplined_notes%type,
|
||||
v_personal_description IN employee.personal_description%type
|
||||
)
|
||||
AS
|
||||
BEGIN
|
||||
UPDATE EMPLOYEE
|
||||
SET
|
||||
first_name = v_first_name,
|
||||
last_name = v_last_name,
|
||||
ssn = v_ssn,
|
||||
title = v_title,
|
||||
phone = v_phone,
|
||||
address1 = v_address1,
|
||||
address2 = v_address2,
|
||||
manager = v_manager,
|
||||
start_date = v_Start_date,
|
||||
salary = v_salary,
|
||||
ccn = v_ccn,
|
||||
ccn_limit = v_ccn_limit,
|
||||
disciplined_date = v_disciplined_date,
|
||||
disciplined_notes = v_disciplined_notes,
|
||||
personal_description = v_personal_description
|
||||
WHERE
|
||||
userid = v_userid;
|
||||
END;
|
||||
/
|
||||
|
||||
|
||||
exit;
|
||||
|
||||
|
||||
226
webapp/WEB-INF/webgoat_sqlserver.sql
Normal file
226
webapp/WEB-INF/webgoat_sqlserver.sql
Normal file
@ -0,0 +1,226 @@
|
||||
EXEC sp_configure 'clr enabled', 1
|
||||
GO
|
||||
|
||||
RECONFIGURE
|
||||
GO
|
||||
|
||||
USE master;
|
||||
|
||||
go
|
||||
|
||||
DROP LOGIN webgoat_guest;
|
||||
|
||||
go
|
||||
|
||||
DROP database webgoat;
|
||||
|
||||
go
|
||||
|
||||
|
||||
CREATE database webgoat;
|
||||
|
||||
go
|
||||
|
||||
USE webgoat;
|
||||
|
||||
go
|
||||
|
||||
CREATE SCHEMA webgoat_guest;
|
||||
|
||||
go
|
||||
|
||||
CREATE LOGIN webgoat_guest with password = '_webgoat';
|
||||
|
||||
go
|
||||
|
||||
CREATE USER webgoat_guest with default_schema = webgoat_guest;
|
||||
|
||||
go
|
||||
|
||||
GRANT CONTROL TO webgoat_guest;
|
||||
|
||||
go
|
||||
|
||||
|
||||
CREATE TABLE WEBGOAT_guest.EMPLOYEE (
|
||||
userid INT NOT NULL PRIMARY KEY,
|
||||
first_name VARCHAR(20),
|
||||
last_name VARCHAR(20),
|
||||
ssn VARCHAR(12),
|
||||
password VARCHAR(10),
|
||||
title VARCHAR(20),
|
||||
phone VARCHAR(13),
|
||||
address1 VARCHAR(80),
|
||||
address2 VARCHAR(80),
|
||||
manager INT,
|
||||
start_date CHAR(8),
|
||||
salary INT,
|
||||
ccn VARCHAR(30),
|
||||
ccn_limit INT,
|
||||
disciplined_date CHAR(8),
|
||||
disciplined_notes VARCHAR(60),
|
||||
personal_description VARCHAR(60)
|
||||
);
|
||||
|
||||
go
|
||||
|
||||
IF EXISTS
|
||||
(
|
||||
SELECT 1
|
||||
FROM INFORMATION_SCHEMA.ROUTINES
|
||||
WHERE ROUTINE_NAME = 'UPDATE_EMPLOYEE'
|
||||
AND ROUTINE_SCHEMA = 'webgoat_guest'
|
||||
AND ROUTINE_TYPE = 'PROCEDURE'
|
||||
)
|
||||
BEGIN
|
||||
DROP PROCEDURE webgoat_guest.UPDATE_EMPLOYEE
|
||||
DROP PROCEDURE webgoat_guest.UPDATE_EMPLOYEE_BACKUP
|
||||
END
|
||||
GO
|
||||
|
||||
CREATE PROCEDURE webgoat_guest.UPDATE_EMPLOYEE
|
||||
@v_userid INT,
|
||||
@v_first_name VARCHAR(20),
|
||||
@v_last_name VARCHAR(20),
|
||||
@v_ssn VARCHAR(12),
|
||||
@v_title VARCHAR(20),
|
||||
@v_phone VARCHAR(13),
|
||||
@v_address1 VARCHAR(80),
|
||||
@v_address2 VARCHAR(80),
|
||||
@v_manager INT,
|
||||
@v_start_date CHAR(8),
|
||||
@v_salary INT,
|
||||
@v_ccn VARCHAR(30),
|
||||
@v_ccn_limit INT,
|
||||
@v_disciplined_date CHAR(8),
|
||||
@v_disciplined_notes VARCHAR(60),
|
||||
@v_personal_description VARCHAR(60)
|
||||
AS
|
||||
UPDATE EMPLOYEE
|
||||
SET
|
||||
first_name = @v_first_name,
|
||||
last_name = @v_last_name,
|
||||
ssn = @v_ssn,
|
||||
title = @v_title,
|
||||
phone = @v_phone,
|
||||
address1 = @v_address1,
|
||||
address2 = @v_address2,
|
||||
manager = @v_manager,
|
||||
start_date = @v_Start_date,
|
||||
salary = @v_salary,
|
||||
ccn = @v_ccn,
|
||||
ccn_limit = @v_ccn_limit,
|
||||
disciplined_date = @v_disciplined_date,
|
||||
disciplined_notes = @v_disciplined_notes,
|
||||
personal_description = @v_personal_description
|
||||
WHERE
|
||||
userid = @v_userid;
|
||||
|
||||
go
|
||||
|
||||
CREATE PROCEDURE webgoat_guest.UPDATE_EMPLOYEE_BACKUP
|
||||
@v_userid INT,
|
||||
@v_first_name VARCHAR(20),
|
||||
@v_last_name VARCHAR(20),
|
||||
@v_ssn VARCHAR(12),
|
||||
@v_title VARCHAR(20),
|
||||
@v_phone VARCHAR(13),
|
||||
@v_address1 VARCHAR(80),
|
||||
@v_address2 VARCHAR(80),
|
||||
@v_manager INT,
|
||||
@v_start_date CHAR(8),
|
||||
@v_salary INT,
|
||||
@v_ccn VARCHAR(30),
|
||||
@v_ccn_limit INT,
|
||||
@v_disciplined_date CHAR(8),
|
||||
@v_disciplined_notes VARCHAR(60),
|
||||
@v_personal_description VARCHAR(60)
|
||||
AS
|
||||
UPDATE EMPLOYEE
|
||||
SET
|
||||
first_name = @v_first_name,
|
||||
last_name = @v_last_name,
|
||||
ssn = @v_ssn,
|
||||
title = @v_title,
|
||||
phone = @v_phone,
|
||||
address1 = @v_address1,
|
||||
address2 = @v_address2,
|
||||
manager = @v_manager,
|
||||
start_date = @v_Start_date,
|
||||
salary = @v_salary,
|
||||
ccn = @v_ccn,
|
||||
ccn_limit = @v_ccn_limit,
|
||||
disciplined_date = @v_disciplined_date,
|
||||
disciplined_notes = @v_disciplined_notes,
|
||||
personal_description = @v_personal_description
|
||||
WHERE
|
||||
userid = @v_userid;
|
||||
|
||||
go
|
||||
|
||||
IF EXISTS
|
||||
(
|
||||
SELECT 1
|
||||
FROM INFORMATION_SCHEMA.ROUTINES
|
||||
WHERE ROUTINE_NAME = 'EMPLOYEE_LOGIN'
|
||||
AND ROUTINE_SCHEMA = 'webgoat_guest'
|
||||
AND ROUTINE_TYPE = 'FUNCTION'
|
||||
)
|
||||
BEGIN
|
||||
DROP FUNCTION webgoat_guest.EMPLOYEE_LOGIN
|
||||
DROP FUNCTION webgoat_guest.EMPLOYEE_LOGIN_BACKUP
|
||||
END
|
||||
GO
|
||||
|
||||
CREATE FUNCTION webgoat_guest.EMPLOYEE_LOGIN (
|
||||
@v_id INT,
|
||||
@v_password VARCHAR(100)
|
||||
) RETURNS INTEGER
|
||||
AS
|
||||
BEGIN
|
||||
DECLARE @sql nvarchar(4000), @count int
|
||||
SELECT @sql = N'SELECT @cnt = COUNT(*) FROM EMPLOYEE WHERE USERID = ' + convert(varchar(10),@v_id) + N' AND PASSWORD = ''' + @v_password + N'''';
|
||||
EXEC sp_executesql @sql, N'@cnt int OUTPUT', @cnt = @count OUTPUT
|
||||
return @count
|
||||
END
|
||||
GO
|
||||
|
||||
CREATE FUNCTION webgoat_guest.EMPLOYEE_LOGIN_BACKUP (
|
||||
@v_id INT,
|
||||
@v_password VARCHAR(100)
|
||||
) RETURNS INTEGER
|
||||
AS
|
||||
BEGIN
|
||||
DECLARE @sql nvarchar(4000), @count int
|
||||
SELECT @sql = N'SELECT @cnt = COUNT(*) FROM EMPLOYEE WHERE USERID = ' + convert(varchar(10),@v_id) + N' AND PASSWORD = ''' + @v_password + N'''';
|
||||
EXEC sp_executesql @sql, N'@cnt int OUTPUT', @cnt = @count OUTPUT
|
||||
return @count
|
||||
END
|
||||
GO
|
||||
|
||||
IF EXISTS
|
||||
(
|
||||
SELECT 1
|
||||
FROM INFORMATION_SCHEMA.ROUTINES
|
||||
WHERE ROUTINE_NAME = 'RegexMatch'
|
||||
AND ROUTINE_SCHEMA = 'webgoat_guest'
|
||||
AND ROUTINE_TYPE = 'FUNCTION'
|
||||
)
|
||||
BEGIN
|
||||
DROP FUNCTION webgoat_guest.RegexMatch
|
||||
END
|
||||
GO
|
||||
|
||||
IF EXISTS (SELECT name FROM sys.assemblies WHERE name = N'RegexMatch')
|
||||
DROP ASSEMBLY RegexMatch;
|
||||
GO
|
||||
|
||||
CREATE ASSEMBLY RegexMatch FROM 'C:\AspectClass\Database\Labs\tomcat\webapps\WebGoat\WEB-INF\RegexMatch.dll' WITH PERMISSION_SET = SAFE;
|
||||
GO
|
||||
|
||||
CREATE FUNCTION webgoat_guest.RegexMatch (
|
||||
@input NVARCHAR(MAX),
|
||||
@pattern NVARCHAR(MAX)
|
||||
) RETURNS BIT
|
||||
AS EXTERNAL NAME RegexMatch.[UserDefinedFunctions].RegexMatch;
|
||||
GO
|
||||
Reference in New Issue
Block a user