Minor fixes

git-svn-id: http://webgoat.googlecode.com/svn/trunk@337 4033779f-a91e-0410-96ef-6bf7bf53c507

webgoat/main/project/WebContent/lesson_solutions/ClientSideFiltering.html

@@ -22,11 +22,14 @@ to which you should not have access.
 </p>
 
 <b>Solution:</b><br/>
+<p>
 This Lab consists of two Stages. In the first Stage you have to 
 get sensitive information . In the second one you have to fix the problem.<br/>
-<h3>Stage 1</h3>
+</p>
+<b>Stage 1</b>
+<p>
 Use Firebug to solve this stage. If you are using IE you can try it with 
-IEWatch.<br/><br/>
+IEWatch.</p>
 
 First use any person from the list and see what you get. After doing this you 
 can search for a specific person in Firebug. Make sure you find the hidden table with
@@ -36,16 +39,17 @@ Neville.
 <img src="/WebGoat/lesson_solutions/ClientSideFiltering_files/clientside_firebug.jpg" alt="Clientside Filtering" />
 <font size="2"><b>Inspect HTML on Firebug</b></font>
 </center>
-<br/><br/>
+<p>
 Now write the salary into the text edit box and submit your answer!
-
-<h3>Stage 2</h3>
+</p>
+<b>Stage 2</b>
+<p>
 In this stage you have to modify the clientSideFiltering.jsp which you will find under 
 the WebContent in the lessons/Ajax folder. The Problem is that
 the server sends all information to the client. As you could see
 even if it is hidden it is easy to find the sensitive date. In this
 stage you will add a filter to the XPath queries. In this file you will find 
-following construct:<br><br>
+following construct:<br><br></p>
 <code>
 	StringBuffer sb = new StringBuffer();<br>
 	
@@ -56,10 +60,11 @@ following construct:<br><br>
 	sb.append("/Employees/Employee/Salary ");<br>
 	
 	String expression = sb.toString();<br>
-</code><br>
+</code>
+<p>
 This string will be used for the XPath query. You have to guarantee that a manger only 
 can see employees which are working for him. To archive this you can use
-filters in XPath. Following code will exactly do this:<br><br>
+filters in XPath. Following code will exactly do this:</p>
 <code>
 	StringBuffer sb = new StringBuffer();<br>
 	
@@ -71,9 +76,9 @@ filters in XPath. Following code will exactly do this:<br><br>
 	
 	String expression = sb.toString();<br>
 </code>
-<br><br>
+<p>
 Now only information is sent to your client you are authorized for. You can click on the button.
-<br><br>
+</p>
 
 </body>
 </html>

webgoat/main/project/WebContent/lesson_solutions/ClientSideValidation.html

@@ -28,7 +28,7 @@ Javascript. For IE you can use IEWatch. This solution is written for Firebug
 which is a plugin for Firefox.
 </p>
 
-<h2>Stage 1</h2>
+<b>Stage 1</b>
 <p>
 First we want to try to get a coupon code to get something cheaper. Open 
 Firebug and click on the Script Tab. Make sure you choose clientSideValidation.js
@@ -47,7 +47,7 @@ Now that you know the coupon name enter it in the coupon field, purchase somethi
 and you are done.
 </p>
 
-<h2>Stage 2</h2>
+<b>Stage 2</b>
 <p>
 You can not edit the Prices in the Shopping Cart. The reason is that the readonly 
 attribute is set for this field. 

webgoat/main/project/WebContent/lesson_solutions/HttpSplitting.html

@@ -747,7 +747,7 @@ line-feed you want. <o:p></o:p></span></p>
 <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p>&nbsp;</o:p></span></p>
 
 <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter a
-language to examine what<EFBFBD>s going on. You do have WebScarab intercepting HTTP
+language to examine what's going on. You do have WebScarab intercepting HTTP
 requests and responses?<o:p></o:p></span></p>
 
 <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p>&nbsp;</o:p></span></p>
@@ -948,7 +948,7 @@ style='mso-element:field-end'></span><![endif]--> Hacked!</p>
 
 <p class=MsoNormal><o:p>&nbsp;</o:p></p>
 
-<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Hit the <EFBFBD>Back<EFBFBD>
+<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Hit the "Back"
 button of your browser.<o:p></o:p></span></p>
 
 <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p>&nbsp;</o:p></span></p>

webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html

@@ -28,7 +28,7 @@ accept the TAN even it is already used.
 
 <b>Solution:</b><br/>
 This Lesson has two stages. The first stage is only to show how a multi level login
-works. In the second you have to breake the strong authentication.
+works. In the second you have to break the strong authentication.
 <p>
 <b>Stage 1</b><br>
 This stage should be rather straight forward. Give in as name Jane
@@ -49,7 +49,7 @@ list provided, click on the submit button and you are done.
 
 <p>
 <b>Stage 2</b><br>
-The first step in this stage is equal to Stage 1. Log in as Jane with tarzan.
+The first step in this stage is equal to Stage 1. Log in as Jane with tarzan as password.
 Now you will be asked for a TAN. Unfortunately you have only a already
 used TAN from the victim. Fill in the TAN you have and make sure that WebScarab
 will intercept the next request. Hit the submit button and change the hidden_tan