dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#359 Fixed

Browse Source
This commit is contained in:
Nanne Baars
2017-06-12 20:02:21 +02:00
parent 52a48df70c
commit 99f75a835c
2 changed files with 37 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
webgoat-lessons/xxe/src/main/resources/html/XXE.html
View File

@ -53,10 +53,10 @@
</div> </div>
<div class="post-footer"> <div class="post-footer">
<div class="input-group"> <div class="input-group">
<input class="form-control" id="commentInputSimple" placeholder="Add a comment" <input class="form-control input-lg" id="commentInputSimple" placeholder="Add a comment"
type="text"/> type="text"/>
<span class="input-group-addon"> <span class="input-group-addon">
<button id="postCommentSimple" class="fa fa-edit" style="font-size: 20px"></button> <button id="postCommentSimple" class="btn btn-primary">Submit</button>
</span> </span>
</div> </div>
<ul class="comments-list"> <ul class="comments-list">
@ -80,8 +80,10 @@
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div> <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" <form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="form" method="POST" name="form"
action="/WebGoat/xxe/content-type" prepareData="contentTypeXXE"
enctype="application/json;charset=UTF-8"> callback="contentTypeXXECallback"
action="xxe/content-type"
contentType="application/json">
<div class="container-fluid"> <div class="container-fluid">
<div class="panel post"> <div class="panel post">
<div class="post-heading"> <div class="post-heading">
@ -107,10 +109,10 @@
</div> </div>
<div class="post-footer"> <div class="post-footer">
<div class="input-group"> <div class="input-group">
<input class="form-control" id="commentInputContentType" placeholder="Add a comment" <input class="form-control input-lg" id="commentInputContentType" placeholder="Add a comment"
type="text"/> type="text"/>
<span class="input-group-addon"> <span class="input-group-addon">
<i id="postCommentContentType" class="fa fa-edit" style="font-size: 20px"></i> <button id="postCommentContentType" class="btn btn-primary">Submit</button>
</span> </span>
</div> </div>
<ul class="comments-list"> <ul class="comments-list">
@ -143,8 +145,10 @@
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div> <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" <form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="form" method="POST" name="form"
prepareData="blindXXE"
callback="blindXXECallback"
action="/WebGoat/xxe/blind" action="/WebGoat/xxe/blind"
enctype="application/json;charset=UTF-8"> contentType="application/xml">
<div class="container-fluid"> <div class="container-fluid">
<div class="panel post"> <div class="panel post">
<div class="post-heading"> <div class="post-heading">
@ -170,9 +174,9 @@
</div> </div>
<div class="post-footer"> <div class="post-footer">
<div class="input-group"> <div class="input-group">
<input class="form-control" id="commentInputBlind" placeholder="Add a comment" type="text"/> <input class="form-control input-lg" id="commentInputBlind" placeholder="Add a comment" type="text"/>
<span class="input-group-addon"> <span class="input-group-addon">
<i id="postCommentBlind" class="fa fa-edit" style="font-size: 20px"></i> <button id="postCommentBlind" class="btn btn-primary">Submit</button>
</span> </span>
</div> </div>
<ul class="comments-list"> <ul class="comments-list">

61
webgoat-lessons/xxe/src/main/resources/js/xxe.js
View File

@ -8,6 +8,7 @@ webgoat.customjs.simpleXXE = function () {
} }
webgoat.customjs.simpleXXECallback = function() { webgoat.customjs.simpleXXECallback = function() {
$("#commentInputBlind").val('');
getComments('#commentsListSimple'); getComments('#commentsListSimple');
} }
@ -15,50 +16,36 @@ $(document).ready(function () {
getComments('#commentsListSimple'); getComments('#commentsListSimple');
}); });
webgoat.customjs.blindXXE = function() {
var commentInput = $("#commentInputBlind").val();
var xml = '<?xml version="1.0"?>' +
'<comment>' +
' <text>' + commentInput + '</text>' +
'</comment>';
return xml;
}
webgoat.customjs.blindXXECallback = function() {
$("#commentInputBlind").val('');
getComments('#commentsListBlind');
}
$(document).ready(function () { $(document).ready(function () {
$("#postCommentBlind").unbind();
$("#postCommentBlind").on("click", function () {
var commentInput = $("#commentInputBlind").val();
var xml = '<?xml version="1.0"?>' +
'<comment>' +
' <text>' + commentInput + '</text>' +
'</comment>';
$.ajax({
type: 'POST',
url: 'xxe/blind',
data: xml,
contentType: "application/xml",
dataType: 'xml',
complete: function (data) {
$("#commentInputBlind").val('');
getComments('#commentsListBlind')
}
})
});
getComments('#commentsListBlind'); getComments('#commentsListBlind');
}); });
$(document).ready(function () { webgoat.customjs.contentTypeXXE = function() {
$("#postCommentContentType").unbind(); var commentInput = $("#commentInputContentType").val();
$("#postCommentContentType").on("click", function () { return JSON.stringify({text: commentInput});
var commentInput = $("#commentInputContentType").val(); }
$.ajax({
type: 'POST', webgoat.customjs.contentTypeXXECallback = function() {
url: 'xxe/content-type', $("#commentInputContentType").val('');
data: JSON.stringify({text: commentInput}),
contentType: "application/json",
dataType: 'xml',
complete: function (data) {
$("#commentInputContentType").val('');
getComments('#commentsListContentType')
}
})
});
getComments('#commentsListContentType'); getComments('#commentsListContentType');
}); }
$(document).ready(function () { $(document).ready(function () {
getComments(); getComments('#commentsListContentType');
}); });
var html = '<li class="comment">' + var html = '<li class="comment">' +