diff --git a/ webgoat/main/project/WebContent/lesson_plans/DBCrossSiteScripting.html b/ webgoat/main/project/WebContent/lesson_plans/DBCrossSiteScripting.html new file mode 100755 index 000000000..a54fd9ab9 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_plans/DBCrossSiteScripting.html @@ -0,0 +1,24 @@ +
+

Lesson Plan Title: How to Perform Cross Site Scripting +(XSS)

+
+

Concept / Topic To Teach:

+ +It is always a good practice to scrub all inputs, especially those +inputs that will later be used as parameters to OS commands, scripts, +and database queries. It is particularly important for content that will +be permanently stored somewhere. Users should not be able to create +message content that could cause another user to load an undesirable +page or undesirable content when the user's message is retrieved. +
+XSS can also occur when unvalidated user input is used in an HTTP +response. In a reflected XSS attack, an attacker can craft a URL with +the attack script and post it to another website, email it, or otherwise +get a victim to click on it. + +

General Goal(s):

+For this exercise, you will perform a stored XSS attack. +You will also implement code changes in the database to defeat +these attacks. +
+ diff --git a/ webgoat/main/project/WebContent/lesson_plans/DBSQLInjection.html b/ webgoat/main/project/WebContent/lesson_plans/DBSQLInjection.html new file mode 100755 index 000000000..879a1b92e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_plans/DBSQLInjection.html @@ -0,0 +1,16 @@ +
+

Lesson Plan Title: How to Perform SQL Injection

+
+

Concept / Topic To Teach:

+ +It is always a good practice to scrub all inputs, especially those +inputs that will later be used as parameters to OS commands, scripts, +and database queries. Users should not be able to alter the intent of +commands that are executed on the server, in many cases as a privileged user. + +

General Goal(s):

+For this exercise, you will perform a SQL Injection attack. +You will also implement code changes in the database to defeat +these attacks. +
+