dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented assignment 4, some other changes

Browse Source
This commit is contained in:
philippesteinbach
2018-11-10 21:03:28 +01:00
committed by Nanne Baars
parent 7733ea0c85
commit 6b669df025
5 changed files with 98 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
webgoat-lessons/sql-injection/src/main/resources/html/SqlInjection.html
View File

@ -65,13 +65,13 @@
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="form"
action="/WebGoat/SqlInjection/attack"
action="/WebGoat/SqlInjection/attack4"
enctype="application/json;charset=UTF-8"
autocomplete="off">
<table>
<tr>
<td><label>SQL query</label></td>
<td><input name="name" value="" type="TEXT" placeholder="SQL query"/></td>
<td><input name="query" value="" type="TEXT" placeholder="SQL query"/></td>
</tr>
<tr>
<td><button type="SUBMIT">Submit</button></td>
@ -90,13 +90,13 @@
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="form"
action="/WebGoat/SqlInjection/attack"
action="/WebGoat/SqlInjection/attack5"
enctype="application/json;charset=UTF-8"
autocomplete="off">
<table>
<tr>
<td><label>SQL query</label></td>
<td><input name="name" value="" type="TEXT" placeholder="SQL query"/></td>
<td><input name="query" value="" type="TEXT" placeholder="SQL query"/></td>
</tr>
<tr>
<td><button type="SUBMIT">Submit</button></td>

15
webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_introduction_content3.adoc
View File

@ -11,15 +11,14 @@ If an attacker uses a SQL injection of the DDL type to manipulate your database,
* DROP - delete objects from the database
* Example:
** CREATE TABLE Employees( +
&nbsp;&nbsp;&nbsp;&nbsp;IdNum INT NOT NULL, +
&nbsp;&nbsp;&nbsp;&nbsp;LName VARCHAR (20) NOT NULL, +
&nbsp;&nbsp;&nbsp;&nbsp;FName VARCHAR (20) NOT NULL, +
&nbsp;&nbsp;&nbsp;&nbsp;JobCode VARCHAR (3) NOT NULL, +
&nbsp;&nbsp;&nbsp;&nbsp;Salary DECIMAL (18, 2), +
&nbsp;&nbsp;&nbsp;&nbsp;Phone VARCHAR (20), +
&nbsp;&nbsp;&nbsp;&nbsp;PRIMARY KEY (IdNum) +
&nbsp;&nbsp;&nbsp;&nbsp;userid varchar(6) not null primary key, +
&nbsp;&nbsp;&nbsp;&nbsp;first_name varchar(20), +
&nbsp;&nbsp;&nbsp;&nbsp;last_name varchar(20), +
&nbsp;&nbsp;&nbsp;&nbsp;department varchar(20), +
&nbsp;&nbsp;&nbsp;&nbsp;salary varchar(10), +
&nbsp;&nbsp;&nbsp;&nbsp;auth_tan varchar(6) +
);
** This statement creates the employees example table given on page 2.
Now try to modify the schneme by removing the column "Phone" from the table "Employees":
Now try to modify the scheme by adding the column "phone" to the table "employees":