diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml index 3067eca8b..a2d55e70b 100644 --- a/webgoat-container/pom.xml +++ b/webgoat-container/pom.xml @@ -95,7 +95,7 @@ org.asciidoctor asciidoctorj - 1.5.4 + 1.5.8.1 org.springframework.boot diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/OperatingSystemMacro.java b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/OperatingSystemMacro.java index b44fa447f..d965c2454 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/OperatingSystemMacro.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/OperatingSystemMacro.java @@ -12,7 +12,7 @@ public class OperatingSystemMacro extends InlineMacroProcessor { } @Override - protected String process(AbstractBlock parent, String target, Map attributes) { + public String process(AbstractBlock parent, String target, Map attributes) { return System.getProperty("os.name"); } } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatTmpDirMacro.java b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatTmpDirMacro.java index 00354c57a..845815d9f 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatTmpDirMacro.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatTmpDirMacro.java @@ -11,7 +11,7 @@ public class WebGoatTmpDirMacro extends InlineMacroProcessor { } @Override - protected String process(AbstractBlock parent, String target, Map attributes) { + public String process(AbstractBlock parent, String target, Map attributes) { return EnvironmentExposure.getEnv().getProperty("webgoat.server.directory"); } } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatVersionMacro.java b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatVersionMacro.java index ff8a1ef00..b736f4afe 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatVersionMacro.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebGoatVersionMacro.java @@ -11,7 +11,7 @@ public class WebGoatVersionMacro extends InlineMacroProcessor { } @Override - protected String process(AbstractBlock parent, String target, Map attributes) { + public String process(AbstractBlock parent, String target, Map attributes) { return EnvironmentExposure.getEnv().getProperty("webgoat.build.version"); } } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebWolfMacro.java b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebWolfMacro.java index 2d655ce58..82ea258f4 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebWolfMacro.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/asciidoc/WebWolfMacro.java @@ -23,7 +23,7 @@ public class WebWolfMacro extends InlineMacroProcessor { } @Override - protected String process(AbstractBlock parent, String target, Map attributes) { + public String process(AbstractBlock parent, String target, Map attributes) { Environment env = EnvironmentExposure.getEnv(); String hostname = determineHost(env.getProperty("webwolf.host"), env.getProperty("webwolf.port")); diff --git a/webgoat-lessons/challenge/src/main/resources/html/Challenge1.html b/webgoat-lessons/challenge/src/main/resources/html/Challenge1.html index 18c1d47d9..cb67c78a0 100644 --- a/webgoat-lessons/challenge/src/main/resources/html/Challenge1.html +++ b/webgoat-lessons/challenge/src/main/resources/html/Challenge1.html @@ -2,6 +2,9 @@ +
+
+
diff --git a/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc b/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc index d6037af18..990f386b4 100644 --- a/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc +++ b/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc @@ -4,7 +4,7 @@ The challenges contain more a CTF like lessons where we do not provide any explanations what you need to do, no hints will be provided. You can use these challenges in a CTF style where you can run WebGoat on one server and all -participants can join and hack the challenges. A scoreboard is available at http://localhost:8080/WebGoat/scoreboard +participants can join and hack the challenges. A scoreboard is available at link:/WebGoat/scoreboard["/WebGoat/scoreboard",window=_blank] :hardbreaks: In this CTF you will need to solve a couple of challenges, each challenge will give you a flag which you will diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_content5b.adoc b/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_content5b.adoc index e8b94828e..5f41ee65b 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_content5b.adoc +++ b/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_content5b.adoc @@ -5,6 +5,6 @@ You should have been able to execute script with the last example. At this point Why is that? That is because there is no link that would trigger that XSS. -You can try it yourself to see what happens ... go to (substitute localhost with your server's name or IP if you need to): +You can try it yourself to see what happens ... go to: -link: http://localhost:8080/WebGoat/CrossSiteScripting/attack5a?QTY1=1&QTY2=1&QTY3=1&QTY4=1&field1=4128+3214+0002+1999&field2=111 +link:/WebGoat/CrossSiteScripting/attack5a?QTY1=1&QTY2=1&QTY3=1&QTY4=1&field1=4128+3214+0002+1999&field2=111["/WebGoat/CrossSiteScripting/attack5a?QTY1=1&QTY2=1&QTY3=1&QTY4=1&field1=4128+3214+0002+1999&field2=111",window=_blank] diff --git a/webgoat-lessons/http-proxies/src/main/resources/lessonPlans/en/HttpBasics_ProxyIntro4.adoc b/webgoat-lessons/http-proxies/src/main/resources/lessonPlans/en/HttpBasics_ProxyIntro4.adoc index afb51ed06..27e03d7e2 100644 --- a/webgoat-lessons/http-proxies/src/main/resources/lessonPlans/en/HttpBasics_ProxyIntro4.adoc +++ b/webgoat-lessons/http-proxies/src/main/resources/lessonPlans/en/HttpBasics_ProxyIntro4.adoc @@ -12,8 +12,7 @@ image::images/zap_exclude.png[Select URL from history,style="lesson-image"] A new window will open and add the following entries: ``` -http://localhost:8080/WebGoat/service/.* -http://localhost:8080/WebGoat/.*.lesson.lesson +./WebGoat/service/..mvc ``` Click Ok to close the window, ZAP will now no longer proxy internal WebGoat requests.