From 8f8998922385f85a57abb9f1e7ad7db3024bb43e Mon Sep 17 00:00:00 2001
From: "wirth.marcel" Lesson Plan Title: How to Work with WebGoat Concept / Topic To Teach:
Welcome to a short introduction of WebGoat.
+WebGoat uses Apache Tomcat as server. It is setup to run on localhost. This
+configuration is for single user. If you want to use WebGoat in a laboratory or in
+class you might need to change the setup. Please refer to the Tomcat Configuration
+in the Introduction section.
+Always read first the lessons plan. Then try to solve the lesson and if necessary,
+use the hints. If you cannot solve the lesson using the hints, you may watch the
+solution. Here every step is explained.
+To read and edit Parameters you need a proxy to intercept the HTTP request.
+Here we use WebScarab. More informations to WebScarab you will get in the
+Chapter "Useful Tools".
After installing WebScarab and making a proxy on localhost we can start.
Often it is not only necessary to change the value of parameters but to change the value of cookies. We use again WebScarab and intercept the request as explained in the last topic. Lesson Plan Title: How to Add a New WebGoat Lesson Concept / Topic To Teach:
Adding lessons to WebGoat is very easy. If you have an idea that would be suitable General Goal(s): WebGoat comes with a sane default setup for Tomcat. This page will explain the setup
and which further possibilites you have to setup Tomcat. This is just
@@ -8,7 +8,7 @@ refer to the Tomcat documentation. Please note that all solutions
are written for the standard setup on port 80. If you use another configuration you have
to ajust the solution to your configuration. There are two standard Tomcat setups. In this setups WebGoat is only reachable from within
the localhost.
Both are identically with the only difference
@@ -47,12 +47,13 @@ In this example to port 8442:
THIS MAKES IT POSSIBLE TO REALLY ATTACK YOUR SERVER! DO NOT DO THIS
+ THIS MAKES IT POSSIBLE TO REALLY ATTACK YOUR SERVER! DO NOT DO THIS
UNTIL YOU KNOW WHAT YOU ARE DOING. THIS CONFIGURATION SHOULD BE ONLY USED IN
-SAVE NETWORKS!How To Work With WebGoat
+
Here you will learn how to use WebGoat and additional tools for the lessons.
-The interface of WebGoat
+Environment Information
+The Interface Of WebGoat
+
1. Here you see all Categories of Lessons in WebGoat. Click on the Categories to see all Lessons in it.
2. This link will give you the technical background to solve the lesson.
3. Do you need some help to find the solution? Here you will find useful hints.
4. Here you will find a complete solution of the selected lesson.
-5. If you want to restart a lesson you can use this link.
-Solve the Lesson
-Always read first the lessons plan. Then try to solve the lesson and if necessary, use the hints. If you cannot solve the lesson using the hints, you may watch the solution. Here every step is explained.
-Read and edit Parameters
-To read and edit Parameters you need a proxy to intercept the HTTP request. Here we use WebScarab. More informations to WebScarab you will get in the Chapter "Useful Tools".
+5. If you want to restart a lesson you can use this link.Solve The Lesson
+Read And Edit Parameters
+
We have to select "intercept request" in the tab "Intercept". If we send a new HTTP request now, we get a new WebScarab window.
Here we can read and edit the sent parameter. After "Accept changes" the request will be sent to the server.
-
-Read and edit Cookies
+Read And Edit Cookies
+
We again get the new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit the values of them.
-
+Create A WebGoat Lesson
+
for a new lesson, follow these few simple instructions to implement it:
* Download the source code from here.
* Setup framework: follow the simple instructions in "HOW TO create the WebGoat workspace.txt" that comes with the project.
* You need to add two files for each new lesson:
- YourLesson.java to org.owasp.webgoat.lessons
- - YourLesson.html to WebContent/lesson_plans
+ - YourLesson.html to WebContent/lesson_plans
-
-How To Setup Tomcat
+How To Configure Tomcat
Introduction
The standard Setup
+The Standard Configuration
<!-- Define a SSL HTTP/1.1 Connector on port 8442 -->
<Connector address="127.0.0.1" port="8442"...
-
+
+
Make WebGoat Reachable From Another Client
-
By its default configuration WebGoat is only reachable within the localhost. In a laboratory or a class there is maybe the need of having a server and a few clients. diff --git a/main/project/WebContent/lesson_plans/UsefulTools.html b/main/project/WebContent/lesson_plans/UsefulTools.html index 5a772b0b2..67586e959 100644 --- a/main/project/WebContent/lesson_plans/UsefulTools.html +++ b/main/project/WebContent/lesson_plans/UsefulTools.html @@ -1,16 +1,21 @@ -
Lesson Plan Title: Useful Toolst
-Concept / Topic To Teach:
+ -Here we want to present you some useful tools. You will need WebScarab to solve most of the lessons.+Here we want to present you some useful tools. You will need WebScarab +to solve most of the lessons.
+
+As WebGoat, WebScarab is a part of OWASP.
+WebScarab is a framework for analysing applications that
+communicate using the HTTP and HTTPS protocols. Because WebScarab
+operates as an intercepting proxy, we can review and modify requests
+and responses.
Webpage:http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
-
-Firebug:
+
Firebug is an add-on for the Firefox browser. We can use it to inspect, edit and monitor CSS, HTML and JavaScript.
Webpage:http://www.getfirebug.com
@@ -19,10 +24,12 @@ Webpage:http://www.getfirebu
IEWatch is a tool to analyse HTTP and HTML for users of the Internet Explorer.
Webpage:http://www.iewatch.com
-
-Scanner:
+
There exist a lot of vulnerability scanner for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Here the links to two open source scanner.
Nessus:http://www.nessus.org
Paros:http://www.parosproxy.org
+
Add a Proxy on localhost in the settings of your browser. Then you can start WebScarab .We have to select "intercept request" in the tab "Intercept".
MwV;4zepfhJS@+N`#W&%m19~8DoCLA+Z(!TN$poX>_`tHW!c5J61Dw
zbvmNb`S1QnZ5`vaKO6cLkLZZ%gkFrSOn?Ky>uwJB39EHrrM)h9$%O9tbKcYRyUmCJ
za)igYUECOpem-eX88!|z+sa&L_aPnH$6||N4#e@s=7}yuSOKbXq|ay>+=J3Ee;1hf
zI)Oia3cQD%?Cx-@ok)4LW3*dZy3!#p@<&0>!7ZF 68Tu$iop>@Y{
z4pfpHR;Yhc15?8i_h+v2j6U#HAQ$!K?8U}9;Y=-o5$Tdj3OyB773~87<}@ccNP;FE
zXc-!SWW|Q25v{&r{;X2JO9D-VmRn1Tpp=lqSjXaLY7{gtH4h^>scjP+5W<~xJU$#)
zVqPM%Z)cV;JpfZ!S%xGDE;6@suV5yfsJd(&%_IO`4T4F2mGlltA!jqUTP$$JoKj YLV{V~BoNV!n#j0El;s$ogn1Tc}wNV?Hxc=RPqcW{W>w)O!*eWn#U5e-B2z~HM
zjkYT&Uc9kfzp%1`THF-1-ax~WxiBPwBkN%<*qnPQxJ7g$jnlYyN}@*AHIKo?NCJJg
zf`rF>Ocxe&E&Osgo;alFZ`#ZQ5!FSoouPI3Zb)ws1>!>PnTwb5g=oE6u9l)QGgkTF
zLan^MQhV(LG|uR6rbNgmG+`q%!ZKh}D}dA|%8jG&MwGPt@F)nXWSP>H^kxiTg&Z+{
zNwzDbzGPbb*je$zYpw1{Z@{ZqWs;7a^vU(LYoh^9Fm@+(buE9=lf2=F?|tquTz&mq
zzUMMJZ6p!tstDy%hDOs>Z&Hg+fy)~G+!X)_cuG8mi$L5Rjwg*)AH;gU-R;cAs~ZU%Ei=qK4%wiGD`#O~8O
zq%oAuoGCI`#%6P@5*j&+H%1a#JVJpnTl F-h9M;VF3e+Gl+#x9-Ys~0
zvk=c6583hF%
zg??D!Q1$t7Y=y`t7o@!iltCnOutnAI-0j3A>1r$GmOqV=o%ML@9E1~BWrON8_+GOE
z6e+@#AOJa_0qnXG%h;&FXO#OOG3^JgHTfvCRQQ#5E!EkZp<@{+IMvgGC&Zts`+Z5p
zm*q`Ngy(e#w7q(z>bE@rGr5?~GGiSjMIDj#BM^6^VK-7R;{b{xRbkv_l%x~RwPG#vuQZO%
zdl8`L;_Z*ZB^)AKj+J`G9JwODth+VcXr;TSkN}ZmPR>p6Is;@iJ6aULko!Y#&O$L*
zfbx5Q_1?
{Gw<9^=vkEU1AiO?;5$S(fR506A&Q&
z+#o)Qh+NM}%j+n83oqBp{0wVVoEMbE{O~DdShx?e8d}+XMX4
$_s@{}FhN2_|8NTBN!wjpXhln8X#A*z`y6s3AN?9)zo
zk`@#Jl?_v703ll{9jU;6W8{E#+LOwUG+ZQY@Pa-;={NLQSo>2*18gFIk1yLafD3C`
z?DKQDaAx4n?p{O
%?lsu_n(`LzQyzYwZ(QcA-C=F{5yvMbtVt|6W94QCm~B?
zvHgaV{=DSl6TGv^Ogy-LNy(hcbm}v%_swZ~$e7TjD}U}=zBSt0{Q!vcbo#I7^ApG2
zA+TFhg&T7vb^pYr%YX4d`*T111AppnA@`F%{nP*T-}`&0d;IW6KJr)p@E`o+?|Ap+
za`f&>;fg=2_6J}7+~@q=<3a0W6-LNx2-*2ow+lst6MqC#8IdkPF3Nq_B!zew=RS4)
z?w#fkWN2?Z+t&q54}Euq(#P;Hh6<>cG_=GHqNLNlRp^JQyXP_E?Vpfx#YO(J)Yl^5P35^Es5gg(h5*-pK
zV0ckq#QmjKmM_9ri8x+}-Zz
z)BF3c9uD^V1JuQ)1MEg1U0}SZ%Da$@4tl+V<5sb`|a)O^0Y
zwgPvVOGFPlb8{vWCCStoLsL47y>yU?&(aFWDt&4WwNtf>EpBE3T;c0nYNIJ^`wbzz
zVowO7$c98_@+X8W%2YVx;Lxm4W(2>qiCg1A+H-5P%wnQ`lEotXMnT|wG`rVty&rUY
zAdF`b>CIyM*_;2GwwvC~y^Z+~hrfjw+t-t^&E1cG{9^}=&fo8}-%+jnM6vvjJDp!q
z=t_pv6K;ApO`h=Gcfd|dX20&ZeJ91xv!bNR-<8lBd6kSNFKOyAM2`c0+r&w)qnv{U
z0(3VNdL8%MrP1nrCdHOCSa;^{f{W&QKb_3~6+#%9HfWkW?zz7^N!p-FzJDo6Uv-_|
zNd2A=C5fJ1_M8h$5xT*elf1)8{*{})+lBh(HE~3BoUZ3R>!crWoPX$ezvMXI