dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed posting flags towards the server

Browse Source
This commit is contained in:
Nanne Baars 2017-04-15 14:01:34 +02:00
parent 6f633a0f78
commit 7ff5503241
7 changed files with 83 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/Flag.java
View File

@ -1,11 +1,14 @@
package org.owasp.webgoat.plugin;
import com.google.common.collect.Maps;
import lombok.AllArgsConstructor;
import lombok.Getter;
import org.owasp.webgoat.assignments.Endpoint;
import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
@ -28,6 +31,12 @@ public class Flag extends Endpoint {
@Autowired
private WebSession webSession;
@AllArgsConstructor
private class FlagPosted {
@Getter
private boolean lessonCompleted;
}
@PostConstruct
public void initFlags() {
IntStream.range(1, 4).forEach(i -> FLAGS.put(i, UUID.randomUUID().toString()));
@ -38,12 +47,14 @@ public class Flag extends Endpoint {
return "challenge/flag";
}
@RequestMapping(method = RequestMethod.POST)
@RequestMapping(method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseStatus(HttpStatus.OK)
public void postFlag(@RequestParam String flag, @RequestParam int challengeNumber) {
public void postFlag(@RequestParam String flag) {
String currentChallenge = webSession.getCurrentLesson().getName();
int challengeNumber = Integer.valueOf(currentChallenge.substring(currentChallenge.length() - 1, currentChallenge.length()));
String expectedFlag = FLAGS.get(challengeNumber);
if (expectedFlag.equals(flag)) {
userTracker.assignmentSolved(webSession.getCurrentLesson(), "Challenge" + challengeNumber);
userTracker.assignmentSolved(webSession.getCurrentLesson(), "Assignment" + challengeNumber);
} else {
userTracker.assignmentFailed(webSession.getCurrentLesson());
}

33
webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/CommentsEndpoint.java
View File

@ -1,33 +0,0 @@
package org.owasp.webgoat.plugin.challenge3;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
/**
* @author nbaars
* @since 4/8/17.
*/
@RestController
@RequestMapping("challenge-comments")
public class CommentsEndpoint {
//
// private final WebSession webSession;
//
// public CommentsEndpoint(WebSession webSession) {
// this.webSession = webSession;
//
// }
//
//
//
//
//
// @PostMapping
// public Collection<Comment> addComment(String comment) {
// String s = StringUtils.abbreviate(comment, 100);
// comments.add(new Comment(webSession.getUserName(), DateTime.now().toString(), s));
// return comments;
// }
}

10
webgoat-lessons/challenge/src/main/resources/html/Challenge1.html
View File

@ -32,18 +32,22 @@
</div>
</div>
<form class="form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<form class="attack-form form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control" id="flagInput1"
<input type="text" class="form-control" id="flag" name="flag"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<div class="input-group" style="margin-top: 10px">
<button type="submit" class="btn btn-primary">Submit flag</button>
</div>
</div>
<button type="submit" class="btn btn-primary">Submit flag</button>
</form>
<br/>
<div class="attack-feedback"></div>
<div class="attack-output"></div>

25
webgoat-lessons/challenge/src/main/resources/html/Challenge2.html
View File

@ -85,19 +85,20 @@
</form>
<br/>
<div>
<form class="form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control" id="flagInpu2"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<form class="attack-form form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control" id="flag" name="flag"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<button type="submit" class="btn btn-primary">Submit flag</button>
</form>
</div>
<div class="input-group" style="margin-top: 10px">
<button type="submit" class="btn btn-primary">Submit flag</button>
</div>
</div>
</form>
<br/>
<div class="attack-feedback"></div>

17
webgoat-lessons/challenge/src/main/resources/html/Challenge3.html
View File

@ -35,7 +35,7 @@
<div class="input-group">
<input class="form-control" id="commentInput" placeholder="Add a comment" type="text"/>
<span class="input-group-addon">
<i id="postComment" class="fa fa-edit"></i>
<i id="postComment" class="fa fa-edit" style="font-size: 20px"></i>
</span>
</div>
<ul class="comments-list">
@ -45,6 +45,21 @@
</div>
</div>
<form class="attack-form form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control" id="flag" name="flag"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<div class="input-group" style="margin-top: 10px">
<button type="submit" class="btn btn-primary">Submit flag</button>
</div>
</div>
</form>
<br/>
<div class="attack-feedback"></div>

25
webgoat-lessons/challenge/src/main/resources/html/Challenge4.html
View File

@ -85,19 +85,20 @@
</form>
<br/>
<div>
<form class="form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<form class="attack-form form-inline" method="POST" name="form" action="/WebGoat/challenge/flag">
<div class="form-group">
<div class="input-group">
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
style="font-size:20px"></i></div>
<input type="text" class="form-control" id="flag" name="flag"
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
</div>
<button type="submit" class="btn btn-primary">Submit flag</button>
</form>
</div>
<div class="input-group" style="margin-top: 10px">
<button type="submit" class="btn btn-primary">Submit flag</button>
</div>
</div>
</form>
<br/>
<div class="attack-feedback"></div>

30
webgoat-lessons/challenge/src/main/resources/js/challenge3.js
View File

@ -4,10 +4,15 @@ $(document).ready(function () {
$.ajax({
type: 'POST',
url: 'challenge/3',
data: JSON.stringify ({comment: commentInput}),
data: JSON.stringify({comment: commentInput}),
contentType: "application/json",
dataType: 'json'
});
}).then(
function () {
getChallenges();
$("#commentInput").val('');
}
)
})
var html = '<li class="comment">' +
@ -23,13 +28,18 @@ $(document).ready(function () {
'</div>' +
'</li>';
$.get("challenge/3", function (result, status) {
for (var i = 0; i < result.length; i++) {
var comment = html.replace('USER', result[i].user);
comment = comment.replace('DATETIME', result[i].dateTime);
comment = comment.replace('COMMENT', result[i].comment);
$("#list").append(comment);
}
getChallenges();
});
function getChallenges() {
$("#list").empty();
$.get("challenge/3", function (result, status) {
for (var i = 0; i < result.length; i++) {
var comment = html.replace('USER', result[i].user);
comment = comment.replace('DATETIME', result[i].dateTime);
comment = comment.replace('COMMENT', result[i].comment);
$("#list").append(comment);
}
});
}
})