dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename to bypassrestrictions

Browse Source
This commit is contained in:
Àngel Ollé Blázquez
2022-07-30 18:36:25 +02:00
parent c63345e4ee
commit 8a35316985
10 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/main/resources/lessons/bypassrestrictions/css/bypass-restrictions.css Normal file
View File

@ -0,0 +1,5 @@
.bypass-input-container {
position: relative;
padding: 7px;
margin-top: 7px;
}

6
src/main/resources/lessons/bypassrestrictions/documentation/BypassRestrictions_FieldRestrictions.adoc Executable file
View File

@ -0,0 +1,6 @@
== Field Restrictions
In most browsers, the client has complete or almost complete control over the HTML part
of the webpage. They can alter values or restrictions to fit their preference.
=== Task
Send a request that bypasses restrictions of all four of these fields.

9
src/main/resources/lessons/bypassrestrictions/documentation/BypassRestrictions_FrontendValidation.adoc Normal file
View File

@ -0,0 +1,9 @@
== Validation
There is often some mechanism in place to prevent users from sending altered
field values to the server, such as validation before sending. Most popular browsers
such as Chrome don't allow editing scripts during runtime. We will have to circumvent
the validation some other way.
=== Task
Send a request that does not fit the regular expression above the field in all fields.

10
src/main/resources/lessons/bypassrestrictions/documentation/BypassRestrictions_Intro.adoc Executable file
View File

@ -0,0 +1,10 @@
== Concept
Users have a great degree of control over the web application's front-end.
They can alter HTML code, sometimes also scripts. Applications that require a certain input format should also validate on the server-side.
== Goals
* The user should have a basic knowledge of HTML
* The user should be able to tamper with a request before sending (with proxy or other tools)
* The user will be able to tamper with field restrictions and bypass client-side validation

167
src/main/resources/lessons/bypassrestrictions/html/BypassRestrictions.html Executable file
View File

@ -0,0 +1,167 @@
<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org" xmlns="http://www.w3.org/1999/html">
<div class="lesson-page-wrapper">
<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
<!-- include content here. Content will be presented via asciidocs files,
which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
<div class="adoc-content" th:replace="doc:lessons/bypassrestrictions/documentation/BypassRestrictions_Intro.adoc"></div>
</div>
<div class="lesson-page-wrapper">
<!-- stripped down without extra comments -->
<div class="adoc-content" th:replace="doc:lessons/bypassrestrictions/documentation/BypassRestrictions_FieldRestrictions.adoc"></div>
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/bypass-restrictions.css}"/>
<div class="attack-container">
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<div class="container-fluid">
<form class="attack-form" accept-charset="UNKNOWN" name="fieldRestrictions"
method="POST"
action="/WebGoat/BypassRestrictions/FieldRestrictions">
<div class="bypass-input-container"><b>Select field with two possible value</b>
<div class="input-group">
<select name="select">
<option value="option1">Option 1</option>
<option value="option2">Option 2</option>
</select>
</div>
</div>
<div class="bypass-input-container"><b>Radio button with two possible values</b>
<div class="input-group">
<input type="radio" name="radio" value="option1" checked="checked"/> Option 1<br/>
<input type="radio" name="radio" value="option2"/> Option 2<br/>
</div>
</div>
<div class="bypass-input-container"><b>Checkbox: value either on or off</b>
<div class="input-group">
<input type="checkbox" name="checkbox" checked="checked"> Checkbox</input>
</div>
</div>
<div class="bypass-input-container"><b>Input restricted to max 5 characters</b>
<div class="input-group"><input type="text" value="12345" name="shortInput" maxlength="5"/>
</div>
</div>
<div class="bypass-input-container"><b>Readonly input field</b>
<div class="input-group">
<input type="text" value="change" readonly="readonly" name="readOnlyInput"/>
</div>
</div>
<br>
<input type="submit" class="btn btn-primary" value="Submit"/>
</form>
</div>
<br/>
<div class="attack-feedback"></div>
<div class="attack-output"></div>
</div>
</div>
<div class="lesson-page-wrapper">
<div class="adoc-content" th:replace="doc:lessons/bypassrestrictions/documentation/BypassRestrictions_FrontendValidation.adoc"></div>
<div class="attack-container">
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" name="frontendValidation"
id="frontendValidation"
method="POST"
action="/WebGoat/BypassRestrictions/frontendValidation/"
onsubmit="return validate()">
<div>
<strong>Field 1:</strong> exactly three lowercase characters(^[a-z]{3}$)
</div>
<div>
<textarea cols="25" name="field1" rows="1">abc</textarea>
</div>
<p></p>
<div><strong>Field 2:</strong> exactly three digits(^[0-9]{3}$)</div>
<div>
<textarea cols="25" name="field2" rows="1">123</textarea>
</div>
<p></p>
<div><strong>Field 3:</strong> letters, numbers, and space only(^[a-zA-Z0-9 ]*$)</div>
<div>
<textarea cols="25" name="field3" rows="1">abc 123 ABC</textarea>
</div>
<p></p>
<div><strong>Field 4:</strong> enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
</div>
<div>
<textarea cols="25" name="field4" rows="1">seven</textarea>
</div>
<p></p>
<div><strong>Field 5:</strong> simple zip code (^\d{5}$)</div>
<div>
<textarea cols="25" name="field5" rows="1">01101</textarea>
</div>
<p></p>
<div><strong>Field 6:</strong> zip with optional dash four (^\d{5}(-\d{4})?$)</div>
<div>
<textarea cols="25" name="field6" rows="1">90210-1111</textarea>
</div>
<p></p>
<div><strong>Field 7:</strong> US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)</div>
<div>
<textarea cols="25" name="field7" rows="1">301-604-4882</textarea>
</div>
<input type="hidden" value="" name="error"/>
<p>
<button type="submit" class="btn btn-primary">Submit</button>
</p>
</form>
<script>
var regex1 = /^[a-z]{3}$/;
var regex2 = /^[0-9]{3}$/;
var regex3 = /^[a-zA-Z0-9 ]*$/;
var regex4 = /^(one|two|three|four|five|six|seven|eight|nine)$/;
var regex5 = /^\d{5}$/;
var regex6 = /^\d{5}(-\d{4})?$/;
var regex7 = /^[2-9]\d{2}-?\d{3}-?\d{4}$/;
var validate = function () {
var msg = 'JavaScript found form errors';
var err = 0;
if (!regex1.test(document.frontendValidation.field1.value)) {
err += 1;
msg += '\n Value entered for field 1 is not correct';
}
if (!regex2.test(document.frontendValidation.field2.value)) {
err += 1;
msg += '\n Value entered for field 2 is not correct';
}
if (!regex3.test(document.frontendValidation.field3.value)) {
err += 1;
msg += '\n Value entered for field 3 is not correct';
}
if (!regex4.test(document.frontendValidation.field4.value)) {
err += 1;
msg += '\n Value entered for field 4 is not correct';
}
if (!regex5.test(document.frontendValidation.field5.value)) {
err += 1;
msg += '\n Value entered for field 5 is not correct';
}
if (!regex6.test(document.frontendValidation.field6.value)) {
err += 1;
msg += '\n Value entered for field 6 is not correct';
}
if (!regex7.test(document.frontendValidation.field7.value)) {
err += 1;
msg += '\n Value entered for field 7 is not correct';
}
document.frontendValidation.error.value = err
if (err > 0) {
alert(msg)
return false;
}
return true;
}
</script>
<br/>
<br/>
<div class="attack-feedback"></div>
<div class="attack-output"></div>
</div>
</div>
</html>

4
src/main/resources/lessons/bypassrestrictions/i18n/WebGoatLabels.properties Executable file
View File

@ -0,0 +1,4 @@
bypass-restrictions.title=Bypass front-end restrictions
bypass-restrictions.intercept.success=Well done, you intercepted the request as expected
bypass-restrictions.intercept.failure=Please try again. Make sure to make all the changes. And case sensitivity may matter ... or not, you never know!