- Add reference to the WebWolf icon in the top right corner.

- Format all text of the lesson
This commit is contained in:
Nanne Baars
2023-01-03 08:19:51 +01:00
committed by Nanne Baars
parent d2a1546dff
commit 9666597164
4 changed files with 23 additions and 23 deletions

View File

@ -1,7 +1,7 @@
== Introducing WebWolf == Introducing WebWolf
You only need WebWolf if a lesson specifies you can use it. For a lot of lessons you use WebGoat without You only need WebWolf if a lesson specifies that you can use it. For many lessons, you use WebGoat without
using WebWolf. Lessons where you can use WebWolf are marked with the following icon (top right in assignment): using WebWolf. Lessons where you can use WebWolf, are marked with the following icon (top right in the assignment):
{nbsp} {nbsp}
@ -9,16 +9,17 @@ image::images/wolf-enabled.png[width=115,height=128]
{nbsp} {nbsp}
Even if the icon is present, you are not obliged to use WebWolf, you can also use any intercepting tool you like. Even if the icon is present, you are not obliged to use WebWolf. You can also use any intercepting tool you like.
(`netcat` etc.) (`netcat` etc.)
WebWolf opens in a new browser tab and is a separate web application which simulates an attacker's machine. It makes it possible for us to You can always open WebWolf by clicking the icon in the top right corner.
make a clear distinction between what takes place on the attacked website and the actions you need to do as
an "attacker". WebWolf was introduced after a couple of workshops where we received feedback that there WebWolf opens in a new browser tab and is a separate web application that simulates an attacker's machine. It makes it possible for us to
distinguish between what takes place on the attacked website and what actions you need to take as
an "attacker." The idea for WebWolf came about after a couple of workshops where we received feedback that there
was no clear distinction between what was part of the "attackers" role and what was part of the "users" role on the was no clear distinction between what was part of the "attackers" role and what was part of the "users" role on the
website. The following items are supported in WebWolf: website. WebWolf supports the following functionality:
* Hosting a file * Hosting a file
* Receiving email * Receiving email
* Landing page for incoming requests * Landing page for incoming requests

View File

@ -1,8 +1,8 @@
== Landing page == Landing page
This page will show all the requests made to '/landing/**'. This means This page will show all the requests made to '/landing/**'. This means
you can use WebWolf as your landing page for harvesting cookies etc which you can use WebWolf as your landing page for harvesting cookies etc. which
is helpful when you perform a XSS lesson. is helpful when you perform an XSS lesson.
image::images/requests.png[caption="Figure: ", style="lesson-image"] image::images/requests.png[caption="Figure: ", style="lesson-image"]
@ -10,16 +10,15 @@ image::images/requests.png[caption="Figure: ", style="lesson-image"]
{nbsp} {nbsp}
{nbsp} {nbsp}
*For this exercise you need to login to WebWolf first.* *For this exercise, you need to log in to WebWolf first.*
{nbsp} {nbsp}
{nbsp} {nbsp}
Suppose we tricked a user to click on a link he/she received in an email, this link will open up our crafted Suppose we tricked a user into clicking on a link he/she received in an email. This link will open up our crafted
password reset link page. The user does not notice any differences compared to the normal password reset page of the company. password reset link page. The user does not notice any differences compared to the normal password reset page of the company.
The user enters a new password and hits enter. The new password will be sent to your host. In this case the new The user enters a new password and hits enter. The new password will be sent to your host. In this case, the new
password will be sent to WebWolf. Try to locate the unique code. password will be sent to WebWolf. Try to locate the unique code.
Please be aware that after resetting the password the user will receive an error page. In a real attack scenario the Please be aware that the user will receive an error page after resetting the password. In a real attack scenario the user would probably see a normal success page (this is due to a limit on what we can control with WebWolf)
user would probably see a normal success page (this is due to a limit what we can control with WebWolf)

View File

@ -1,7 +1,7 @@
== Your own mailbox == Your mailbox
WebWolf offers a mail client which will contain the e-mail sent during a lesson. WebWolf offers a mail client containing the e-mail sent during a lesson.
This mailbox is user specific so each user has a separate mailbox. All e-mail This mailbox is user-specific, so each user has a separate mailbox. All e-mail
sent to {user}@.... will end up in this inbox. sent to {user}@.... will end up in this inbox.
{nbsp} {nbsp}
@ -14,5 +14,5 @@ image::images/mailbox.png[caption="Figure: ", style="lesson-image"]
{nbsp} {nbsp}
{nbsp} {nbsp}
Try it, type in your e-mail address below and check your inbox in Try it; type in your e-mail address below and check your inbox in
WebWolf. Then type in the unique code from the e-mail in the field below. WebWolf. Then type in the unique code from the e-mail in the field below.

View File

@ -1,12 +1,12 @@
== Uploading files == Uploading files
In this section you can upload files. These files will be available from outside In this section, you can upload files. These files will be available from outside
the application. For example if you want to reference a DTD which you the application. For example, if you want to reference a DTD that you
reference from an xml in an XXE attack, you can use WebWolf to serve this DTD. reference from an XML in an XXE attack, you can use WebWolf to serve this DTD.
image::images/files.png[caption="Figure: ", style="lesson-image"] image::images/files.png[caption="Figure: ", style="lesson-image"]
{nbsp} {nbsp}
After uploading a file you can use the 'Link' to get the full URL to the uploaded After uploading a file, you can use the 'Link' to get the full URL to the uploaded
file. file.