diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AccessControlMatrix.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AccessControlMatrix.java index 968ffaf58..770399108 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AccessControlMatrix.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AccessControlMatrix.java @@ -5,6 +5,8 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; +import org.apache.ecs.html.A; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.P; import org.owasp.webgoat.session.ECSFactory; import org.owasp.webgoat.session.WebSession; @@ -44,7 +46,8 @@ import org.owasp.webgoat.session.WebSession; public class AccessControlMatrix extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + private final static String RESOURCE = "Resource"; private final static String USER = "User"; @@ -253,4 +256,9 @@ public class AccessControlMatrix extends LessonAdapter List resources = getResources(roles); return (resources.contains(resource)); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java index 786d3ea27..295245b73 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java @@ -10,6 +10,7 @@ import java.util.Map; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.html.IMG; +import org.apache.ecs.html.A; import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.Category; import org.owasp.webgoat.lessons.LessonAdapter; @@ -59,7 +60,7 @@ import org.owasp.webgoat.session.WebSession; */ public class CrossSiteScripting extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); public final static String DESCRIPTION = "description"; diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Encoding.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Encoding.java index 4dfc40c0c..bef70a8b8 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Encoding.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Encoding.java @@ -22,7 +22,9 @@ import javax.crypto.spec.PBEParameterSpec; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; @@ -68,7 +70,8 @@ import org.owasp.webgoat.util.HtmlEncoder; public class Encoding extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + private final static String INPUT = "input"; private final static String KEY = "key"; @@ -1033,4 +1036,9 @@ public class Encoding extends LessonAdapter i2e.put( entities[i][1], entities[i][0] ); } } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/FailOpenAuthentication.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/FailOpenAuthentication.java index 5175d5c14..2866bd42d 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/FailOpenAuthentication.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/FailOpenAuthentication.java @@ -4,6 +4,8 @@ import java.util.ArrayList; import java.util.List; import org.apache.ecs.Element; +import org.apache.ecs.html.A; +import org.apache.ecs.html.IMG; import org.owasp.webgoat.session.WebSession; /******************************************************************************* @@ -40,7 +42,8 @@ import org.owasp.webgoat.session.WebSession; */ public class FailOpenAuthentication extends WeakAuthenticationCookie { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + /** * Description of the Method * @@ -182,4 +185,9 @@ public class FailOpenAuthentication extends WeakAuthenticationCookie { return ("How to Bypass a Fail Open Authentication Scheme"); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForgotPassword.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForgotPassword.java index f5d0ff5f6..544b72bae 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForgotPassword.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForgotPassword.java @@ -7,6 +7,7 @@ import java.util.HashMap; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.BR; import org.apache.ecs.html.H1; @@ -55,7 +56,7 @@ import org.owasp.webgoat.session.WebSession; public class ForgotPassword extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); private final static String USERNAME = "Username"; diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java index 4b2b2c526..f6e607b30 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java @@ -5,10 +5,12 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.BR; import org.apache.ecs.html.Center; import org.apache.ecs.html.H1; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; @@ -52,7 +54,8 @@ import org.owasp.webgoat.session.WebSession; */ public class HiddenFieldTampering extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + private final static String PRICE = "Price"; private final static String PRICE_TV = "2999.99"; @@ -227,4 +230,9 @@ public class HiddenFieldTampering extends LessonAdapter { return ("How to Exploit Hidden Fields"); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HtmlClues.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HtmlClues.java index d7d657438..a83fa6887 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HtmlClues.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HtmlClues.java @@ -6,9 +6,11 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.Comment; import org.apache.ecs.html.H1; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; @@ -53,7 +55,8 @@ import org.owasp.webgoat.session.WebSession; */ public class HtmlClues extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + /** * Description of the Field */ @@ -249,4 +252,9 @@ public class HtmlClues extends LessonAdapter { return ("How to Discover Clues in the HTML"); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpOnly.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpOnly.java index 54ae5ffab..d08a1061f 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpOnly.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpOnly.java @@ -10,6 +10,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.Form; import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; @@ -50,7 +51,7 @@ import sun.misc.BASE64Encoder; */ public class HttpOnly extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); private final static Integer DEFAULT_RANKING = new Integer(125); diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/JavaScriptValidation.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/JavaScriptValidation.java index 946f15dce..f20c14683 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/JavaScriptValidation.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/JavaScriptValidation.java @@ -7,7 +7,9 @@ import java.util.regex.Pattern; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.Div; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TextArea; @@ -49,7 +51,8 @@ import org.owasp.webgoat.session.WebSession; public class JavaScriptValidation extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + /** * Description of the Method * @@ -322,4 +325,9 @@ public class JavaScriptValidation extends LessonAdapter { return ("How to Bypass Client Side JavaScript Validation"); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java index de9857a24..4b8cd0bea 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java @@ -9,6 +9,7 @@ import java.util.Map; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; +import org.apache.ecs.html.A; import org.apache.ecs.html.IMG; import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.Category; @@ -52,7 +53,7 @@ import org.owasp.webgoat.session.WebSession; */ public class RoleBasedAccessControl extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); public final static String DESCRIPTION = "description"; diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java index 5b45d6c8e..99f2e9e68 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java @@ -9,6 +9,7 @@ import java.util.Map; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; +import org.apache.ecs.html.A; import org.apache.ecs.html.IMG; import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.lessons.Category; @@ -58,7 +59,7 @@ import org.owasp.webgoat.session.WebSession; */ public class SQLInjection extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); public final static String DESCRIPTION = "description"; diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java index 2bdadcb53..45b05ecd7 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java @@ -9,8 +9,10 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; +import org.apache.ecs.html.A; import org.owasp.webgoat.session.*; @@ -48,7 +50,8 @@ import org.owasp.webgoat.session.*; */ public class ThreadSafetyProblem extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + private final static String USER_NAME = "username"; private Connection connection = null; @@ -214,4 +217,9 @@ public class ThreadSafetyProblem extends LessonAdapter e.printStackTrace(System.out); } } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakAuthenticationCookie.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakAuthenticationCookie.java index 0cb0229a8..6546e6673 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakAuthenticationCookie.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakAuthenticationCookie.java @@ -6,8 +6,10 @@ import javax.servlet.http.Cookie; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.H1; +import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; @@ -50,7 +52,8 @@ import org.owasp.webgoat.session.*; */ public class WeakAuthenticationCookie extends LessonAdapter { - + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + /** * Description of the Field */ @@ -381,4 +384,9 @@ public class WeakAuthenticationCookie extends LessonAdapter return (ec); } + + public Element getCredits() + { + return super.getCustomCredits("", ASPECT_LOGO); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakSessionID.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakSessionID.java index 59a515096..dd334e1f2 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakSessionID.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/WeakSessionID.java @@ -8,6 +8,7 @@ import javax.servlet.http.Cookie; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; +import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.H1; import org.apache.ecs.html.IMG; @@ -55,7 +56,7 @@ import org.owasp.webgoat.session.WebSession; */ public class WeakSessionID extends LessonAdapter { - public final static IMG ASPECT_LOGO = new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0); + public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); /** * Description of the Field */ diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java index 503507480..5fcb2dbee 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java @@ -474,7 +474,7 @@ public class CreateDB String insertData1 = "INSERT INTO employee VALUES (101, 'Larry', 'Stooge', '386-09-5451', 'larry'," + "'Technician','443-689-0192','9175 Guilford Rd','New York, NY', 102, 01012000,55000,'2578546969853547'," - + "5000,010106,'Constantly harrassing coworkers','Does not work well with others')"; + + "5000,010106,'Constantly harassing coworkers','Does not work well with others')"; String insertData2 = "INSERT INTO employee VALUES (102, 'Moe', 'Stooge', '936-18-4524','moe'," + "'CSO','443-938-5301', '3013 AMD Ave', 'New York, NY', 112, 03082003, 140000, 'NA', 0, 0101013, " diff --git a/ webgoat/main/project/WebContent/css/webgoat.css b/ webgoat/main/project/WebContent/css/webgoat.css index 6db239c1c..16f0f30ba 100644 --- a/ webgoat/main/project/WebContent/css/webgoat.css +++ b/ webgoat/main/project/WebContent/css/webgoat.css @@ -242,7 +242,7 @@ html>body #navBar li {} } #start { - height: 360px; + height: 380px; width: 700px; padding: 10px 50px 10px 50px; font-size: 12px; diff --git a/ webgoat/main/project/WebContent/images/logos/aspect.jpg b/ webgoat/main/project/WebContent/images/logos/aspect.jpg index 8c6c8d98a..b88015ed5 100644 Binary files a/ webgoat/main/project/WebContent/images/logos/aspect.jpg and b/ webgoat/main/project/WebContent/images/logos/aspect.jpg differ diff --git a/ webgoat/main/project/WebContent/images/logos/owasp.jpg b/ webgoat/main/project/WebContent/images/logos/owasp.jpg index d4a0f5888..3934b7a49 100644 Binary files a/ webgoat/main/project/WebContent/images/logos/owasp.jpg and b/ webgoat/main/project/WebContent/images/logos/owasp.jpg differ diff --git a/ webgoat/main/project/WebContent/webgoat.jsp b/ webgoat/main/project/WebContent/webgoat.jsp index 6e21d99c6..51143caf6 100644 --- a/ webgoat/main/project/WebContent/webgoat.jsp +++ b/ webgoat/main/project/WebContent/webgoat.jsp @@ -19,7 +19,11 @@ The exercises are intended to provide hands on experience with application penetration testing techniques.

- +
+ + + + @@ -86,10 +90,6 @@ Use of these techniques without permission could lead to job termination, financial liability, and/or criminal penalties. -
-
OWASP Foundation
-Project WebGoat
-
OWASP Foundation
Aspect Security
WebGoat Design Team
Lesson Contributers