Restructured the baseline to remove extra src/main directory structure. Added eclipes project file
git-svn-id: http://webgoat.googlecode.com/svn/branches/webgoat-6.0@485 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64@gmail.com
70
webapp/WEB-INF/pages/layouts/genericLesson.jsp
Normal file
70
webapp/WEB-INF/pages/layouts/genericLesson.jsp
Normal file
@ -0,0 +1,70 @@
|
||||
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
|
||||
<%@ taglib uri="http://tiles.apache.org/tags-tiles" prefix="tiles"%>
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
|
||||
<title><tiles:insertAttribute name="title-content" /></title>
|
||||
<link rel="stylesheet" href="css/webgoat.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/lesson.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/menu.css" type="text/css" />
|
||||
<link rel="stylesheet" href="css/layers.css" type="text/css" />
|
||||
<script language="JavaScript1.2" src="javascript/javascript.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/menu_system.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/lessonNav.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/makeWindow.js" type="text/javascript"></script>
|
||||
<script language="JavaScript1.2" src="javascript/toggle.js" type="text/javascript"></script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
|
||||
// pcs 8/29/2012 - HACK
|
||||
//
|
||||
// Legacy lessons result in a call to WebSession.update(). Among other things, that call
|
||||
// sets the previous and current screens. The latter determines the title that is displayed
|
||||
// in the webgoat banner.
|
||||
//
|
||||
// The new Spring-MVC jsps, among which is this genericLesson.jsp, are loaded via our dispatcher servlet
|
||||
// and does not pass through the code path that results in that update() call.
|
||||
//
|
||||
// As a result, we must call update() explicitly here. If we refactor away that legacy code as part
|
||||
// of webgoat 6 development, we will need to get rid of the call below.
|
||||
//
|
||||
webSession.update(request, response, "genericLesson");
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
%>
|
||||
|
||||
<div id="header-style"><tiles:insertAttribute name="header-content" /></div>
|
||||
<div><tiles:insertAttribute name="menu-content" /></div>
|
||||
<div id="lessonTitle" align="right"><%= currentLesson.getTitle() %></div>
|
||||
<div id="primary-style"">
|
||||
<div id="lessonArea">
|
||||
<tiles:insertAttribute name="hints-params-cookies" />
|
||||
<div id="twoCol">
|
||||
<div id="menuSpacer"></div>
|
||||
<div id="lessonAreaTop">
|
||||
<div id="training_wrap">
|
||||
<div id="training" class="info"><a href="http://yehg.net/lab/pr0js/training/webgoat.php" target="_blank"><%=WebGoatI18N.get("SolutionVideos")%></a></div>
|
||||
<div id="reset" class="info"><a href="<%=webSession.getRestartLink()%>"><%=WebGoatI18N.get("RestartLesson")%></a></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="lessonContent">
|
||||
<tiles:insertAttribute name="primary-content" />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="footer-style"><tiles:insertAttribute name="footer-content" /></div>
|
||||
</body>
|
||||
</html>
|
||||
77
webapp/WEB-INF/pages/lessons/httpBasics.jsp
Normal file
77
webapp/WEB-INF/pages/lessons/httpBasics.jsp
Normal file
@ -0,0 +1,77 @@
|
||||
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
|
||||
<%@ taglib uri="http://tiles.apache.org/tags-tiles" prefix="tiles"%>
|
||||
<%@taglib uri="http://www.springframework.org/tags/form" prefix="form"%>
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<div id="lessonPlans" style="visibility:hidden; height:1px; position:absolute; left:260px; top:130px; width:425px; z-index:105;">
|
||||
<div align="Center">
|
||||
<p><b>Lesson Plan Title:</b> Http Basics </p>
|
||||
</div>
|
||||
<p><b>Concept / Topic To Teach:</b> </p>
|
||||
This lesson presents the basics for understanding the transfer of data between the browser and the web application.<br>
|
||||
|
||||
<div align="Left">
|
||||
<p>
|
||||
<b>How HTTP works:</b>
|
||||
</p>
|
||||
All HTTP transactions follow the same general format. Each client request and server response has three parts: the request or response line, a header section, and the entity body. The client initiates a transaction as follows: <br>
|
||||
<br>
|
||||
The client contacts the server and sends a document request <br>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
<ul>GET /index.html?param=value HTTP/1.0</ul>
|
||||
Next, the client sends optional header information to inform the server of its configuration and the document formats it will accept.<br>
|
||||
<br>
|
||||
<ul>User-Agent: Mozilla/4.06 Accept: image/gif,image/jpeg, */*</ul>
|
||||
After sending the request and headers, the client may send additional data. This data is mostly used by CGI programs using the POST method.<br>
|
||||
<p><b>General Goal(s):</b> </p>
|
||||
<%-- Start Instructions --%>
|
||||
Enter your name in the input field below and press "go" to submit. The server will accept the request, reverse the input, and display it back to the user, illustrating the basics of handling an HTTP request.
|
||||
<br/><br/>
|
||||
The user should become familiar with the features of WebGoat by manipulating the above
|
||||
buttons to view hints, show the HTTP request parameters, the HTTP request cookies, and the Java source code. You may also try using WebScarab for the first time.
|
||||
<%-- Stop Instructions --%>
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
<a href="javascript:toggle('lessonPlans')" target="_top" onclick="MM_nbGroup('down','group1','plans','',1)">Close this Window</a>
|
||||
</div>
|
||||
|
||||
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
%>
|
||||
|
||||
<%--
|
||||
This form posts to httpBasics.do. However, we must append the "menu" request parameter in order
|
||||
for the current submenu to display properly, hence the getLink() call to build the form's
|
||||
action attribute below.
|
||||
--%>
|
||||
<form:form method="POST" action="<%= webSession.getCurrentLesson().getLink() %>">
|
||||
<p>
|
||||
Enter your name in the input field below and press "go" to submit.
|
||||
The server will accept the request, reverse the input, and display it back to the user,
|
||||
illustrating the basics of handling an HTTP request.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
The user should become familiar with the features of WebGoat by manipulating
|
||||
the above buttons to view hints, show the HTTP request parameters,
|
||||
the HTTP request cookies, and the Java source code.
|
||||
You may also try using WebScarab for the first time.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Enter your name:
|
||||
<form:input path="personName" />
|
||||
<input name="SUBMIT" type="SUBMIT" value="Go!"/>
|
||||
</p>
|
||||
</form:form>
|
||||
7
webapp/WEB-INF/pages/sections/footer.jsp
Normal file
7
webapp/WEB-INF/pages/sections/footer.jsp
Normal file
@ -0,0 +1,7 @@
|
||||
<div id="bottom">
|
||||
<div align="center">
|
||||
<a href="http://www.owasp.org">OWASP Foundation</a> |
|
||||
<a href="http://www.owasp.org/index.php/OWASP_WebGoat_Project">Project WebGoat</a> |
|
||||
<a href="reportBug.jsp">Report Bug</a>
|
||||
</div>
|
||||
</div>
|
||||
2
webapp/WEB-INF/pages/sections/header.jsp
Normal file
2
webapp/WEB-INF/pages/sections/header.jsp
Normal file
@ -0,0 +1,2 @@
|
||||
<div id="top"/>
|
||||
<div id="topLeft">
|
||||
45
webapp/WEB-INF/pages/sections/hintsParamsAndCookies.jsp
Normal file
45
webapp/WEB-INF/pages/sections/hintsParamsAndCookies.jsp
Normal file
@ -0,0 +1,45 @@
|
||||
<%@ page
|
||||
language="java"
|
||||
contentType="text/html; charset=UTF-8"
|
||||
pageEncoding="UTF-8"
|
||||
import="java.util.Iterator, org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*"
|
||||
errorPage=""
|
||||
isELIgnored="false" %>
|
||||
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
|
||||
if (webSession.getHint() != null)
|
||||
{
|
||||
%>
|
||||
<div id="hint" class="info"> <%= webSession.getHint() %> </div><br>
|
||||
<%
|
||||
}
|
||||
|
||||
if (webSession.getParams() != null)
|
||||
{
|
||||
Iterator i = webSession.getParams().iterator();
|
||||
while (i.hasNext())
|
||||
{
|
||||
Parameter p = (Parameter) i.next();
|
||||
%>
|
||||
<div id="parameter" class="info"> <%= p.getName()%> = <%= p.getValue() %></div><br>
|
||||
<%
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (webSession.getCookies() != null)
|
||||
{
|
||||
Iterator i = webSession.getCookies().iterator();
|
||||
while (i.hasNext())
|
||||
{
|
||||
Cookie c = (Cookie) i.next();
|
||||
%>
|
||||
<div id="cookie" class="info"> <%= c.getName() %> <img src="images/icons/rightArrow.jpg" alt="\"><%= c.getValue() %></div><br>
|
||||
<%
|
||||
}
|
||||
}
|
||||
%>
|
||||
202
webapp/WEB-INF/pages/sections/menu.jsp
Normal file
202
webapp/WEB-INF/pages/sections/menu.jsp
Normal file
@ -0,0 +1,202 @@
|
||||
<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
|
||||
import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.Category, org.owasp.webgoat.lessons.AbstractLesson, org.owasp.webgoat.util.*, java.util.*"
|
||||
errorPage="" %>
|
||||
<%
|
||||
Course course = ((Course)session.getAttribute("course"));
|
||||
WebSession webSession = ((WebSession)session.getAttribute("websession"));
|
||||
AbstractLesson currentLesson = webSession.getCurrentLesson();
|
||||
%>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<%@page import="org.owasp.webgoat.lessons.RandomLessonAdapter"%>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
|
||||
|
||||
<%
|
||||
final String menuPrefix = WebSession.MENU;
|
||||
final String submenuPrefix = "submenu";
|
||||
final String mbutPrefix = "mbut";
|
||||
String printHint = "";
|
||||
String printParameters = "";
|
||||
String printCookies = "";
|
||||
String lessonComplete = "<img src=\"images/buttons/lessonComplete.jpg\">";
|
||||
|
||||
List categories = course.getCategories();
|
||||
|
||||
StringBuffer buildList = new StringBuffer();
|
||||
|
||||
Iterator iter1 = categories.iterator();
|
||||
while(iter1.hasNext())
|
||||
{
|
||||
Category category = (Category)iter1.next();
|
||||
|
||||
buildList.append("'");
|
||||
buildList.append(menuPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("','");
|
||||
buildList.append(submenuPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("','");
|
||||
buildList.append(mbutPrefix);
|
||||
buildList.append(category.getRanking());
|
||||
buildList.append("'");
|
||||
|
||||
if (iter1.hasNext())
|
||||
buildList.append(",");
|
||||
}%>
|
||||
<body class="page" onload="setMenuMagic1(10,40,10,'menubottom',<%=buildList%>);trigMM1url('<%= menuPrefix %>',1);MM_preloadImages('images/buttons/hintLeftOver.jpg','images/buttons/hintOver.jpg','images/buttons/hintRightOver.jpg','images/buttons/paramsOver.jpg','images/buttons/htmlOver.jpg','images/buttons/cookiesOver.jpg','images/buttons/javaOver.jpg','images/buttons/plansOver.jpg','images/buttons/logout.jpg','images/buttons/helpOver.jpg'); initIframe();">
|
||||
|
||||
<div id="wrap">
|
||||
<%
|
||||
int topCord = 140;
|
||||
int zIndex = 105;
|
||||
|
||||
Iterator iter2 = categories.iterator();
|
||||
while(iter2.hasNext())
|
||||
{
|
||||
Category category = (Category)iter2.next();
|
||||
%>
|
||||
<div id="<%=menuPrefix + category.getRanking()%>" style="position:absolute; left:30px; top:<%=topCord%>px; width:160px; z-index:<%=zIndex%>"><a href="javascript:;" onclick="trigMenuMagic1('<%=menuPrefix + category.getRanking()%>',1);return false" onfocus="if(this.blur)this.blur()"><img src="images/menu_images/1x1.gif" width="1" height=1"20" name="mbut<%=category.getRanking()%>" border="0" alt=""/><%=category.getName()%></a></div>
|
||||
<%
|
||||
topCord=topCord + 30;
|
||||
zIndex=zIndex + 1;
|
||||
}
|
||||
|
||||
int topSubMenu = 72;
|
||||
|
||||
Iterator iter3 = categories.iterator();
|
||||
while(iter3.hasNext())
|
||||
{
|
||||
Category category = (Category)iter3.next();
|
||||
List lessons = webSession.getLessons(category);
|
||||
Iterator iter4 = lessons.iterator();
|
||||
%>
|
||||
<div id="submenu<%=category.getRanking()%>" class="pviimenudiv" style="position:absolute; left:200px; top:<%=topSubMenu%>px; width:150px; visibility: hidden; z-index:<%=zIndex%>">
|
||||
<table width="150" border="0" cellspacing="6" cellpadding="0"><%
|
||||
|
||||
topSubMenu=topSubMenu+30;
|
||||
zIndex=zIndex + 1;
|
||||
|
||||
while(iter4.hasNext())
|
||||
{
|
||||
AbstractLesson lesson = (AbstractLesson)iter4.next();
|
||||
|
||||
%><tr>
|
||||
<td><%=(lesson.isCompleted(webSession) ? lessonComplete : "")%><a href="<%=lesson.getLink()%>"><%=lesson.getTitle()%></a></td>
|
||||
</tr>
|
||||
<% if (lesson instanceof RandomLessonAdapter) {
|
||||
RandomLessonAdapter rla = (RandomLessonAdapter) lesson;
|
||||
String[] stages = rla.getStages();
|
||||
if (stages != null)
|
||||
for (int i=0; i<stages.length; i++) {
|
||||
%>
|
||||
<tr><td class="pviimenudivstage"><%=(rla.isStageComplete(webSession, stages[i]) ? lessonComplete : "")%><a href="<%=lesson.getLink() + "&stage=" + (i+1) %>">Stage <%=i+1%>: <%=stages[i] %></a>
|
||||
</td></tr>
|
||||
<%
|
||||
}
|
||||
}
|
||||
%>
|
||||
<%
|
||||
}
|
||||
%>
|
||||
</table>
|
||||
</div><%
|
||||
}%>
|
||||
<div id="top"></div>
|
||||
<div id="topLeft">
|
||||
<div align="left">
|
||||
<% if (currentLesson.getAvailableLanguages().size() != 0 )
|
||||
{
|
||||
%>
|
||||
<form method="get" action="attack" style="display: inline;">
|
||||
Choose another language: <select name="language" size="1"
|
||||
onChange="changeLanguage();">
|
||||
<%
|
||||
for(String lang: currentLesson.getAvailableLanguages()){
|
||||
%>
|
||||
<option value="<%=lang%>"
|
||||
<% if(webSession.getCurrrentLanguage().equals(lang)) out.println("selected" );%>><%=lang%>
|
||||
</option>
|
||||
<%
|
||||
|
||||
}
|
||||
%>
|
||||
</select></form>
|
||||
<%
|
||||
} else {
|
||||
%>
|
||||
Internationalization is not available for this lesson
|
||||
<%
|
||||
}
|
||||
%>
|
||||
</div></div>
|
||||
<div align="right" id="topRight">
|
||||
<a href="attack?action=Logout" onmouseout="MM_swapImgRestore()"
|
||||
onmouseover="MM_swapImage('logout','','images/buttons/logoutOver.jpg',1)"><img
|
||||
src="images/buttons/logout.jpg" alt="LogOut" name="logout" width="45"
|
||||
height="22" border="0" id="logout" /></a> <a href="#getFAQ()"
|
||||
onmouseout="MM_swapImgRestore()"
|
||||
onmouseover="MM_swapImage('help','','images/buttons/helpOver.jpg',1)"><img
|
||||
src="images/buttons/help.jpg" alt="Help" name="help" width="22"
|
||||
height="22" border="0" id="help" /></a>
|
||||
</div>
|
||||
<div id="hMenuBar">
|
||||
<%
|
||||
if (webSession.isAuthorizedInLesson(webSession.getRole(), WebSession.SHOWHINTS))
|
||||
{
|
||||
%>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=PreviousHint" target="_top" onclick="MM_nbGroup('down','group1','hintLeft','',1)"
|
||||
onmouseover="MM_nbGroup('over','hintLeft','images/buttons/hintLeftOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hintLeft.jpg" alt="Previous Hint" name="hintLeft" width="20" height="20" border="0" id="hintLeft"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=NextHint" target="_top" onclick="MM_nbGroup('down','group1','hint','',1)"
|
||||
onmouseover="MM_nbGroup('over','hint','images/buttons/hintOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hint.jpg" alt="Hints" name="hint" width="35" height="20" border="0" id="hint"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=NextHint" target="_top" onclick="MM_nbGroup('down','group1','hintRight','',1)"
|
||||
onmouseover="MM_nbGroup('over','hintRight','images/buttons/hintRightOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/hintRight.jpg" alt="Next Hint" name="hintRight" width="20" height="20" border="0" id="hintRight"/>
|
||||
</a>
|
||||
<%}%>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=Params" target="_top" onclick="MM_nbGroup('down','group1','params','',1)"
|
||||
onmouseover="MM_nbGroup('over','params','images/buttons/paramsOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/params.jpg" alt="Show Params" name="<%= webSession.getCurrentLesson().getLink() %>&show=Params" width="87" height="20" border="0" id="params"/>
|
||||
</a>
|
||||
<a href="<%= webSession.getCurrentLesson().getLink() %>&show=Cookies" target="_top" onclick="MM_nbGroup('down','group1','cookies','',1)"
|
||||
onmouseover="MM_nbGroup('over','cookies','images/buttons/cookiesOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/cookies.jpg" alt="Show Cookies" name="cookies" width="99" height="20" border="0" id="cookies"/>
|
||||
</a>
|
||||
<a href="javascript:toggle('lessonPlans')" target="_top" onclick="MM_nbGroup('down','group1','plans','',1)"
|
||||
onmouseover="MM_nbGroup('over','plans','images/buttons/plansOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/plans.jpg" alt="Lesson Plans" width="89" height="20" border="0" id="plans"/>
|
||||
</a>
|
||||
<%
|
||||
if (webSession.isAuthorizedInLesson(webSession.getRole(), WebSession.SHOWSOURCE))
|
||||
{
|
||||
%>
|
||||
<a href="source" onclick="makeWindow(this.href+ '?source=true', 'Java Source');return false;" target="javaWin"
|
||||
onmouseover="MM_nbGroup('over','java','images/buttons/javaOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/java.jpg" alt="Show Java" name="java" width="75" height="20" border="0" id="java"/>
|
||||
</a>
|
||||
<a href="source" onclick="makeWindow(this.href + '?solution=true', 'Java Solution');return false;" target="javaWin"
|
||||
onmouseover="MM_nbGroup('over','solutions','images/buttons/solutionsOver.jpg','',1)"
|
||||
onmouseout="MM_nbGroup('out')">
|
||||
<img src="images/buttons/solutions.jpg" alt="Show Solution" name="solutions" width="73" height="20" border="0" id="solutions"/>
|
||||
</a>
|
||||
<%}%>
|
||||
|
||||
</div>
|
||||
<div id="twoCol">
|
||||
<div id="menuSpacer"></div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user