Removed space from " webgoat" directory name
git-svn-id: http://webgoat.googlecode.com/svn/trunk@272 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64
@ -0,0 +1,707 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/AccessControlMatrix_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/AccessControlMatrix_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>25</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:48:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:24:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>167</o:Words>
|
||||
<o:Characters>954</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>7</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1119</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/AccessControlMatrix_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="/WebGoat/lesson_solutions/AccessControlMatrix_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Cambria;
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1073741899 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Using an
|
||||
Access Control Matrix<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<!-- Start Instructions -->
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>In a
|
||||
role-based access control scheme, a role represents a set of access permissions
|
||||
and privileges. A user can be assigned one or more roles. A role-based access
|
||||
control scheme normally consists of two parts: role permission management and
|
||||
role assignment. A broken role-based access control scheme might allow a user
|
||||
to perform accesses that are not allowed by his/her assigned roles, or somehow
|
||||
allow privilege escalation to an unauthorized role. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Each user is
|
||||
a member of a role that is allowed to access only certain resources. Your goal
|
||||
is to explore the access control rules that govern this site. Only the [Admin]
|
||||
group should have access to the 'Account Manager' resource.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span class=Heading2Char><span style='font-size:13.0pt;
|
||||
color:windowtext'>Solution</span></span><span style='font-family:"Arial","sans-serif"'>:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This exercise
|
||||
is straightforward. You need to find a user where you can access a resource
|
||||
that you shouldn<64>t be able to access.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>After a few attempts
|
||||
you will learn that Larry can access resources of the role Account Manager.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_463" o:spid="_x0000_i1026" type="#_x0000_t75"
|
||||
style='width:480pt;height:276pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/AccessControlMatrix_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/AccessControlMatrix_files/image002.jpg" v:shapes="Picture_x0020_463"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 9<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_464"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/AccessControlMatrix_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/AccessControlMatrix_files/image004.jpg" v:shapes="Picture_x0020_464"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 9 Completed<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-font-family:
|
||||
"Times New Roman";mso-ansi-language:EN-US;mso-fareast-language:EN-US;
|
||||
mso-bidi-language:AR-SA'><br clear=all style='mso-special-character:line-break;
|
||||
page-break-before:always'>
|
||||
</span>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
Binary file not shown.
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,10 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../AccessControlMatrix.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image002.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image004.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 170 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 172 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
841
webgoat/main/project/WebContent/lesson_solutions/BackDoors.html
Normal file
841
webgoat/main/project/WebContent/lesson_solutions/BackDoors.html
Normal file
@ -0,0 +1,841 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/BackDoors_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/BackDoors_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>1202</o:TotalTime>
|
||||
<o:Created>2007-07-12T14:40:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:18:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>301</o:Words>
|
||||
<o:Characters>1718</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>14</o:Lines>
|
||||
<o:Paragraphs>4</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>2015</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/BackDoors_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="/WebGoat/lesson_solutions/BackDoors_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
h3
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 3 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:3;
|
||||
font-size:13.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.Heading3Char
|
||||
{mso-style-name:"Heading 3 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 3";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-ascii-font-family:"Times New Roman";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Times New Roman";
|
||||
mso-bidi-font-family:Arial;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Create Database Back Door Attacks.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>How to Create
|
||||
Database Back Door Attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Databases are
|
||||
used usually as a backend for web applications. Also it is used as a media of
|
||||
storage. It can also be used as a place to store a malicious activity such as a
|
||||
trigger. A trigger is called by the database management system upon the
|
||||
execution of another database operation like insert, select, update or delete.
|
||||
An attacker for example can create a trigger that would set his email address
|
||||
instead of every new user's email address. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->Your
|
||||
goal should be to learn how you can exploit a vulnerable query to create a
|
||||
trigger.<br>
|
||||
You will not be able to actually create one in this lesson because the
|
||||
underlying database engine used with WebGoat doesn't support triggers.<br>
|
||||
Your login ID is 101.</span><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600"
|
||||
o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f"
|
||||
stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_147" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image013.jpg" v:shapes="Picture_x0020_147"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Database backdoor</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'>Enter your user ID 101 to see how the application works.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_148"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image014.jpg" v:shapes="Picture_x0020_148"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> User ID is 101</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>As you
|
||||
probably noticed, the input is not validated so very easy to do SQL Injection.
|
||||
To have two SQL queries executed, you need to separate them using a sem-colon.
|
||||
For example select * from employees; drop table employees will first select all
|
||||
the users from employees and then drop the table employees. Not all databases
|
||||
support multiple SQL statements.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Here you need
|
||||
to update the salary of the employees. This requires an update query like
|
||||
update employees set salary=10000.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Inject this
|
||||
for the user ID: 101; update employee set salary=10000<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_149"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image015.jpg" v:shapes="Picture_x0020_149"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Update query<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_150"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image016.jpg" v:shapes="Picture_x0020_150"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Stage 1 completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To create a
|
||||
database trigger, you need to inject the following SQL: CREATE TRIGGER
|
||||
myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET
|
||||
email='john@hackme.com'WHERE userid = NEW.userid<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_151"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image017.jpg" v:shapes="Picture_x0020_151"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Insert trigger</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_152" o:spid="_x0000_i1025"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BackDoors_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/BackDoors_files/image018.jpg" v:shapes="Picture_x0020_152"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,18 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../BackDoors.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image013.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image014.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image015.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image016.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image017.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image018.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 179 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 178 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 186 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 187 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 175 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
@ -0,0 +1,932 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/BasicAuthentication_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/BasicAuthentication_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>26</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:55:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:24:00Z</o:LastSaved>
|
||||
<o:Pages>4</o:Pages>
|
||||
<o:Words>609</o:Words>
|
||||
<o:Characters>3474</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>28</o:Lines>
|
||||
<o:Paragraphs>8</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>4075</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/BasicAuthentication_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="/WebGoat/lesson_solutions/BasicAuthentication_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Basic
|
||||
Authentication <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Basic
|
||||
Authentication is used to protect server side resources. The web server will send
|
||||
a 401 authentication request with the response for the requested resource. The
|
||||
client side browser will then prompt the user for a user name and password
|
||||
using a browser supplied dialog box. The browser will base64 encode the user
|
||||
name and password and send those credentials back to the web server. The web
|
||||
server will then validate the credentials and return the requested resource if
|
||||
the credentials are correct. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>These
|
||||
credentials are automatically resent for each page protected with this
|
||||
mechanism without requiring the user to enter their credentials again. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For this
|
||||
lesson, your goal is to understand Basic Authentication and answer the
|
||||
questions below.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_1015" o:spid="_x0000_i1036" type="#_x0000_t75"
|
||||
style='width:480pt;height:276pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image025.jpg" v:shapes="Picture_x0020_1015"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 13<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To learn the
|
||||
name of the authentication header you must click <20>Submit<69> and intercept the
|
||||
request with WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1016"
|
||||
o:spid="_x0000_i1035" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image026.jpg" v:shapes="Picture_x0020_1016"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercepted request</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The HTTP
|
||||
header that contains the Basic Authentication information is called
|
||||
<EFBFBD>Authorization<EFBFBD>. This value Z3Vlc3Q6Z3Vlc3Q= is Base64 encoded. You can decode
|
||||
this by using WebScarab <20> Tools <20> Transcoder.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1017"
|
||||
o:spid="_x0000_i1034" type="#_x0000_t75" style='width:365.25pt;height:243.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=487 height=325
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image027.jpg" v:shapes="Picture_x0020_1017"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> WebScarabs Transcoder<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Click Base64
|
||||
decode. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1018"
|
||||
o:spid="_x0000_i1033" type="#_x0000_t75" style='width:449.25pt;height:300pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=599 height=400
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image028.jpg" v:shapes="Picture_x0020_1018"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Decode value<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>These values must
|
||||
be used to complete the questions.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1019"
|
||||
o:spid="_x0000_i1032" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image029.jpg" v:shapes="Picture_x0020_1019"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Answers<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1020"
|
||||
o:spid="_x0000_i1031" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image030.jpg" v:shapes="Picture_x0020_1020"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Part 1 completed<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For this
|
||||
lesson it is very important that you understand how the JSESSIONID cookie is
|
||||
used for session management and how the basic authorization header is used for
|
||||
authentication.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1021" o:spid="_x0000_i1030"
|
||||
type="#_x0000_t75" style='width:435.75pt;height:343.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image013.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=581 height=458
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image031.jpg" v:shapes="Picture_x0020_1021"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>When WebGoat
|
||||
is able to retrieve a valid session you are automatically redirected to the
|
||||
lesson you are working on. When there is no valid session, WebGoat will create
|
||||
a new JSESSIONID and you will see the first lesson, HTTP Basics.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>When there is
|
||||
no session cookie, WebGoat will first verify if you already authenticated. If
|
||||
not, you will get a pop-up window from the browser that requests your user name
|
||||
and password (guest/guest). After the user credentials are validated, you will
|
||||
access the Start-page of WebGoat and WebGoat will create a new JSESSIONID for
|
||||
this session.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To access
|
||||
WebGoat as the user basic, you need to corrupt the existing JSESSIONID and the
|
||||
Authorization header. You can do this in WebScarab. Intercept the request and
|
||||
delete a character from the JSESSIONID value and the Authorization header.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>WebGoat will
|
||||
require you to authenticate, so you now enter for the user name basic and for
|
||||
the password basic. This logs you on as the user basic. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Remember our
|
||||
JSESSIONID? This JSESSIONID is a non-persistent cookie which is set during our
|
||||
first visit. Every request from the browser to WebGoat will have this cookie
|
||||
value. Corrupting this value in the previous request will not change the cookie
|
||||
value stored in browser memory and that is the reason why the old JSESSIONID
|
||||
cookie is sent in every request.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1022"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:244.5pt;height:265.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image015.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=326 height=354
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image032.jpg" v:shapes="Picture_x0020_1022"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>7</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Basic Authentication<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>You clearly
|
||||
see that the JSESSIONID is the same like in the previous request, but the
|
||||
Authorization header now contains the Base 64 encoded value of basic:basic (you
|
||||
can decode this value in WebScarab <20> Tools <20> Transcoder).<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1023"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image017.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image033.jpg" v:shapes="Picture_x0020_1023"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>8</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Logged on as user basic<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Because of the
|
||||
valid JSESSIONID, WebGoat retrieves the authenticated user via the server-side
|
||||
session object using getSession().getUser(). To make WebGoat believe that you
|
||||
are authenticated as basic, you need to corrupt the JSESSIONID, as shown in the
|
||||
screenshot below.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1024"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:448.5pt;height:353.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image019.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=598 height=471
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image034.jpg" v:shapes="Picture_x0020_1024"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>9</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Corrupt JSESSIONID<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1025"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image021.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image035.jpg" v:shapes="Picture_x0020_1025"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>10</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Start page for user basic<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Now you are
|
||||
redirected to the WebGoat start page. The JSESSIONID is changed and you lost all
|
||||
your green stars because the basic user hasn<73>t completed any lesson. Go to the
|
||||
lesson <20>Basic Authentication<6F> to complete this lesson.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1026"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BasicAuthentication_files/image023.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="/WebGoat/lesson_solutions/BasicAuthentication_files/image036.jpg" v:shapes="Picture_x0020_1026"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>11</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson 13 Completed<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,30 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../BasicAuthentication.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image025.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image026.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image027.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image028.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image029.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image030.jpg"/>
|
||||
<o:File HRef="image013.png"/>
|
||||
<o:File HRef="image031.jpg"/>
|
||||
<o:File HRef="image015.png"/>
|
||||
<o:File HRef="image032.jpg"/>
|
||||
<o:File HRef="image017.png"/>
|
||||
<o:File HRef="image033.jpg"/>
|
||||
<o:File HRef="image019.png"/>
|
||||
<o:File HRef="image034.jpg"/>
|
||||
<o:File HRef="image021.png"/>
|
||||
<o:File HRef="image035.jpg"/>
|
||||
<o:File HRef="image023.png"/>
|
||||
<o:File HRef="image036.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 180 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 181 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 182 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 156 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 174 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 54 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
@ -0,0 +1,904 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/BlindSqlInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/BlindSqlInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>35</o:TotalTime>
|
||||
<o:Created>2007-07-11T11:06:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:25:00Z</o:LastSaved>
|
||||
<o:Pages>3</o:Pages>
|
||||
<o:Words>622</o:Words>
|
||||
<o:Characters>3547</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>29</o:Lines>
|
||||
<o:Paragraphs>8</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>4161</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/BlindSqlInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="/WebGoat/lesson_solutions/BlindSqlInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:Wingdings;
|
||||
panose-1:5 0 0 0 0 0 0 0 0 0;
|
||||
mso-font-charset:2;
|
||||
mso-generic-font-family:auto;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:0 268435456 0 0 -2147483648 0;}
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> How to Perform Blind SQL Injection <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Concept / Topic To Teach: <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>SQL injection
|
||||
attacks represent a serious threat to any database-driven site. The methods behind
|
||||
an attack are easy to learn and the damage caused can range from considerable
|
||||
to complete system compromise. Despite these risks an incredible number of
|
||||
systems on the internet are susceptible to this form of attack. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Not only is
|
||||
it a threat easily instigated, it is also a threat that, with a little
|
||||
common-sense and forethought, can be almost totally prevented. This lesson will
|
||||
show the student several examples of SQL injection.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>It is always
|
||||
good practice to sanitize all input data, especially data that will used in OS
|
||||
command, scripts, and database queries.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to view all records in the specified table.<span
|
||||
style='mso-spacerun:yes'><EFBFBD> </span>The user could add new records or modify
|
||||
existing records.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>From the hints </span></b><b
|
||||
style='mso-bidi-font-weight:normal'><span style='font-family:Wingdings;
|
||||
mso-ascii-font-family:Arial;mso-hansi-font-family:Arial;mso-bidi-font-family:
|
||||
Arial;mso-char-type:symbol;mso-symbol-font-family:Wingdings'><span
|
||||
style='mso-char-type:symbol;mso-symbol-font-family:Wingdings'>J</span></span></b><b
|
||||
style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Compound SQL
|
||||
statements can be made by joining multiple tests with keywords like AND and OR.
|
||||
Create a SQL statement that you can use as a true/false test and then select
|
||||
the first character of the target element and do a start narrowing down the
|
||||
character using > and <<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The backend
|
||||
database is Microsoft Access. Keep that in mind if you research SQL functions
|
||||
on the Internet since different databases use some different functions and
|
||||
syntax.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This is the
|
||||
code for the query being built and issued by WebGoat:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>"SELECT
|
||||
* FROM user_data WHERE userid = " + accountNumber<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The
|
||||
application is taking your input and inserting it at the end of a pre-formed
|
||||
SQL command. You will need to make use of the following SQL functions: <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>SELECT -
|
||||
query for your target data and get a string <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>mid(string,
|
||||
start, length) - returns a substring of string starting at the start character
|
||||
and going for length characters <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>asc(string)
|
||||
will return the ascii value of the first character in string <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>> and <
|
||||
- once you have a character's value, compare it to a choosen one<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Example: is
|
||||
the first character of the first_name of userid 15613 less than 'M' (ascii 77)?
|
||||
<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>101 AND (asc(
|
||||
mid((SELECT first_name FROM user_data WHERE userid=15613) , 1 , 1) ) < 77 );
|
||||
<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>If you get
|
||||
back that account number is valid, then yes. If get back that the number
|
||||
isinvalid then answer is no.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Another
|
||||
example: is the second character of the first_name of userid 15613 greater than
|
||||
'm' (ascii 109)? <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>101 AND (asc(
|
||||
mid((SELECT first_name FROM user_data WHERE userid=15613) , 2 , 1) ) > 109
|
||||
); <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>If you get back
|
||||
that account number is valid, then yes. If get back that the number is invalid
|
||||
then answer is no.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_1419" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image013.jpg" v:shapes="Picture_x0020_1419"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 16<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the
|
||||
query: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE userid=15613)
|
||||
, 1 , 1) ) < 77 ); you will get a <20>Account number is valid<69>. If the
|
||||
character is bigger then the value you get an invalid account error message.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1420"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image014.jpg" v:shapes="Picture_x0020_1420"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Invalid account number<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>You can
|
||||
change the < to = to make sure that you have the correct value.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This results
|
||||
in the query 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 1 , 1) ) = 74 );<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1421"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image015.jpg" v:shapes="Picture_x0020_1421"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> First character<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>So you know
|
||||
that ascii(74) is capital J. Now do the same for the second and all other
|
||||
characters.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The query for
|
||||
the second character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 2 , 1) ) = 111 );<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Ascii(111) =
|
||||
o, so you have now Jo.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1422" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image016.jpg" v:shapes="Picture_x0020_1422"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the third
|
||||
character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 3 , 1) ) = 101 ); Ascii(101) = e<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the
|
||||
fourth character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 4 , 1) ) = 115 ); Ascii(115) = s<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the fifth
|
||||
character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 5 , 1) ) = 112); Ascii(112) = p<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the sixth
|
||||
character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE
|
||||
userid=15613) , 6 , 1) ) = 104); Ascii(104) = h<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>So the name
|
||||
that you found is Joesph. Enter this in the text field to complete this lesson.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1423"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image017.jpg" v:shapes="Picture_x0020_1423"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Enter the name Joesph<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1424"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image018.jpg" v:shapes="Picture_x0020_1424"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 16 Completed<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,18 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../BlindSqlInjection.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image013.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image014.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image015.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image016.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image017.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image018.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 169 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 177 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 181 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
868
webgoat/main/project/WebContent/lesson_solutions/CSRF.html
Normal file
868
webgoat/main/project/WebContent/lesson_solutions/CSRF.html
Normal file
@ -0,0 +1,868 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/CSRF_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/CSRF_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>1193</o:TotalTime>
|
||||
<o:Created>2007-07-12T11:07:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:19:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>471</o:Words>
|
||||
<o:Characters>2690</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>22</o:Lines>
|
||||
<o:Paragraphs>6</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>3155</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/CSRF_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="/WebGoat/lesson_solutions/CSRF_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
h3
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 3 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:3;
|
||||
font-size:13.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.Heading3Char
|
||||
{mso-style-name:"Heading 3 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 3";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-ascii-font-family:"Times New Roman";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Times New Roman";
|
||||
mso-bidi-font-family:Arial;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform Cross Site Request Forgery. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Concept
|
||||
/ Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>This
|
||||
lesson teaches how to perform Cross Site Request Forgery (CSRF) attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>How
|
||||
the attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Cross-Site
|
||||
Request Forgery (CSRF/XSRF) is an attack that tricks the victim into loading a
|
||||
page that contains img links like the one below: <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span lang=NL-BE
|
||||
style='font-family:"Arial","sans-serif";mso-ansi-language:NL-BE'><img
|
||||
src="</span><span style='font-family:"Arial","sans-serif"'><a
|
||||
href="http://www.mybank.com/transferFunds.do?acctId=123456"
|
||||
title="http://www.mybank.com/transferFunds.do?acctId=123456"><span lang=NL-BE
|
||||
style='mso-ansi-language:NL-BE'>http://www.mybank.com/sendFunds.do?acctId=123456</span></a></span><span
|
||||
lang=NL-BE style='font-family:"Arial","sans-serif";mso-ansi-language:NL-BE'>"/></span><span
|
||||
lang=NL-BE style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-ansi-language:
|
||||
NL-BE'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>When
|
||||
the victim's browser attempts to render this page, it will issue a request to
|
||||
www.mybank.com to the transferFunds.do page with the specified parameters. The
|
||||
browser will think the link is to get an image, even though it actually is a
|
||||
funds transfer function. The request will include any cookies associated with
|
||||
the site. Therefore, if the user has authenticated to the site, and has either
|
||||
a permanent cookie or even a current session cookie, the site will have no way
|
||||
to distinguish this from a legitimate user request. In this way, the attacker
|
||||
can make the victim perform actions that they didn't intend to, such as logout,
|
||||
purchase item, or any other function provided by the vulnerable website <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->Your
|
||||
goal is to send an email to a newsgroup that contains an image whose URL is
|
||||
pointing to a malicious request. Try to include a 1x1 pixel image that includes
|
||||
a URL. The URL should point to the CSRF lesson with an extra parameter
|
||||
"transferFunds=4000". You can copy the shortcut from the left hand
|
||||
menu by right clicking on the left hand menu and choosing copy shortcut.
|
||||
Whoever receives this email and happens to be authenticated at that time will
|
||||
have his funds transferred. When you think the attack is successful, refresh
|
||||
the page and you will find the green check on the left hand side menu.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype
|
||||
id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"
|
||||
path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_105" o:spid="_x0000_i1029" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CSRF_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/CSRF_files/image011.jpg" v:shapes="Picture_x0020_105"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>1</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> How to perform CSRF</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<h3 style='text-align:justify'>Solution:</h3>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>To
|
||||
complete this lesson you need to embed HTML code in the message box. This HTML
|
||||
code should contain a image tag linking to an URL that is not a real image<span
|
||||
style='mso-spacerun:yes'><EFBFBD> </span>will but start a transaction on the web
|
||||
server instead.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>The
|
||||
format of an image in html is <img src="[URL]" width="1"
|
||||
height="1" /><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>The transaction can be triggered by an URL to the
|
||||
current lesson and an extra parameter <20>transferFunds<64> and the amount. The
|
||||
width=1 and height=1 will not show the image.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>This payload will work:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><img
|
||||
src=<3D>http://localhost/WebGoat/attack?Screen=81&menu=210&transferFunds=5000<30>
|
||||
width="1" height="1" /><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>So create a new message with title <20>Test<73> and a
|
||||
message with the payload.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_106" o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;
|
||||
height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CSRF_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/CSRF_files/image012.jpg" v:shapes="Picture_x0020_106"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>2</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Insert payload</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='mso-fareast-language:
|
||||
JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>The page will refresh and you will see a new message
|
||||
in the message list.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='mso-fareast-language:
|
||||
JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_107"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CSRF_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/CSRF_files/image013.jpg" v:shapes="Picture_x0020_107"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>3</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> New message test<span
|
||||
style='mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Click
|
||||
on the message test. This will download the message and display the contents as
|
||||
HTML, executing the payload. Examine the HTTP Request in WebScarab that is
|
||||
generated when the browers tries to render the image tag.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_108" o:spid="_x0000_i1026" type="#_x0000_t75" style='width:481.5pt;
|
||||
height:344.25pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CSRF_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=642 height=459
|
||||
src="/WebGoat/lesson_solutions/CSRF_files/image014.jpg" v:shapes="Picture_x0020_108"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>4</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> CSRF attack</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Now
|
||||
you need to refresh the page to get the green star next to the lesson.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_109"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CSRF_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/CSRF_files/image015.jpg" v:shapes="Picture_x0020_109"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>5</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,16 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../CSRF.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image011.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image012.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image013.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image014.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image015.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 181 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 185 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 95 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 157 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
@ -0,0 +1,738 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/CommandInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/CommandInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>34</o:TotalTime>
|
||||
<o:Created>2007-07-11T11:04:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:25:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>198</o:Words>
|
||||
<o:Characters>1130</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>9</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1326</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/CommandInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="/WebGoat/lesson_solutions/CommandInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> How to Perform Command Injection <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Concept / Topic To Teach: </span></b><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Command
|
||||
injection attacks represent a serious threat to any parameter-driven site. The methods
|
||||
behind an attack are easy to learn and the damage caused can range from
|
||||
considerable to complete system compromise. Despite these risks an incredible
|
||||
number of systems on the internet are susceptible to this form of attack. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Not only is
|
||||
it a threat easily instigated, it is also a threat that, with a little
|
||||
common-sense and forethought, can be almost totally prevented. This lesson will
|
||||
show the student several examples of parameter injection.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>It is always
|
||||
good practice to sanitize all input data, especially data that will used in OS
|
||||
command, scripts, and database queries.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to execute any command on the hosting OS.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_1375" o:spid="_x0000_i1028" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CommandInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/CommandInjection_files/image007.jpg" v:shapes="Picture_x0020_1375"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 16<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Select a
|
||||
lesson from the drop-down box and click on <20>View<65>.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1376" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CommandInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/CommandInjection_files/image007.jpg" v:shapes="Picture_x0020_1376"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Intercept the
|
||||
request with WebScarab when you click on <20>View<65>. Append <20> & netstat <20>an
|
||||
& ipconfig to the HelpFile parameter. Do not forget the double quote!<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1377"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CommandInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="/WebGoat/lesson_solutions/CommandInjection_files/image008.jpg" v:shapes="Picture_x0020_1377"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Injecting command netstat & ipconfig</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The result
|
||||
contains the output of the command netstat and ipconfig.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1378"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/CommandInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="/WebGoat/lesson_solutions/CommandInjection_files/image009.jpg" v:shapes="Picture_x0020_1378"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Command Injection results<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,12 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../CommandInjection.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image007.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image008.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image009.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 85 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 68 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
@ -0,0 +1,865 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="/WebGoat/lesson_solutions/DOMInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/DOMInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>45</o:TotalTime>
|
||||
<o:Created>2007-07-11T14:49:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:20:00Z</o:LastSaved>
|
||||
<o:Pages>3</o:Pages>
|
||||
<o:Words>345</o:Words>
|
||||
<o:Characters>1972</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>16</o:Lines>
|
||||
<o:Paragraphs>4</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>2313</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="/WebGoat/lesson_solutions/DOMInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="/WebGoat/lesson_solutions/DOMInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform DOM Injection Attack. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>How to
|
||||
perform DOM injection attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Some applications
|
||||
specially the ones that uses AJAX manipulates and updates the DOM directly
|
||||
using JavaScript, DHTML and eval() method.<br>
|
||||
An attacker may take advantage of that by intercepting the reply and try to
|
||||
inject some javascript commands to exploit his attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->*
|
||||
Your victim is a system that takes an activation key to allow you to use it.<br>
|
||||
* Your goal should be to try to get to enable the activate button.<br>
|
||||
* Take some time to see the HTML source in order to understand how the key
|
||||
validation process works.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_49" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image002.jpg" v:shapes="Picture_x0020_49"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> AJAX Security - DOM Injection</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>AJAX requires
|
||||
XML communication between the browser and the web application. When you view
|
||||
the source of the HTML page, you will notice the usage of XMLHttpRequest:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><script><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>function
|
||||
validate() {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>var keyField
|
||||
= document.getElementById('key');<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>var url =
|
||||
'/WebGoat/attack?Screen=80&menu=1150&from=ajax&key=' +
|
||||
encodeURIComponent(keyField.value);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>if (typeof
|
||||
XMLHttpRequest != 'undefined') {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-indent:36.0pt'><span style='font-family:"Arial","sans-serif"'>req
|
||||
= new XMLHttpRequest();<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>} else if
|
||||
(window.ActiveXObject) {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-indent:36.0pt'><span style='font-family:"Arial","sans-serif"'>req
|
||||
= new ActiveXObject('Microsoft.XMLHTTP');<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.open('GET', url, true);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.onreadystatechange = callback;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.send(null);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>function
|
||||
callback() {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD> </span>if (req.readyState == 4) { <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>if (req.status == 200) { <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>var message = req.responseText;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-tab-count:3'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span><span
|
||||
style='mso-spacerun:yes'><EFBFBD></span>eval(message);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>}}}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'></script><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The XML
|
||||
response contains JavaScript that will activate the button so that you are able
|
||||
to click on it. This requires you to inject JavaScript to manipulate the
|
||||
Document Object Model of the HTML page in the browser. This requires
|
||||
intercepting the HTTP response in WebScarab!<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter a
|
||||
license key (for example <20>a<EFBFBD>) and intercept the HTTP Request and HTTP Response
|
||||
in WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_50"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:481.5pt;height:345pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image004.jpg" v:shapes="Picture_x0020_50"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTP Request</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_51" o:spid="_x0000_i1028"
|
||||
type="#_x0000_t75" style='width:481.5pt;height:345pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image006.jpg" v:shapes="Picture_x0020_51"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTP Response</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Intercept the
|
||||
reply and replace the body with document.forms[0].SUBMIT.disabled = false;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_52"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:481.5pt;height:345pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image008.jpg" v:shapes="Picture_x0020_52"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Updated HTTP Response</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal>The button <20>Activate!<21> is now enabled!</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_53" o:spid="_x0000_i1026"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image010.jpg" v:shapes="Picture_x0020_53"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Activate! Button is enabled</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_54" o:spid="_x0000_i1025"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="/WebGoat/lesson_solutions/DOMInjection_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="/WebGoat/lesson_solutions/DOMInjection_files/image012.jpg" v:shapes="Picture_x0020_54"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,18 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../DOMInjection.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image002.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image004.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image006.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image008.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image010.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image012.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 167 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user