Refactored files to Maven standard Layout
Added plugin to produce executable jar. Now it is easy to run webgoat on all platforms.
This commit is contained in:
Dave
85
src/main/webapp/WEB-INF/pages/login.jsp
Normal file
85
src/main/webapp/WEB-INF/pages/login.jsp
Normal file
@ -0,0 +1,85 @@
|
||||
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
|
||||
<html>
|
||||
<head>
|
||||
<title>Login Page</title>
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css">
|
||||
<style type="text/css">
|
||||
body {
|
||||
padding-top: 40px;
|
||||
padding-bottom: 40px;
|
||||
background-color: #f5f5f5;
|
||||
}
|
||||
|
||||
.form-signin {
|
||||
max-width: 300px;
|
||||
padding: 19px 29px 29px;
|
||||
margin: 0 auto 20px;
|
||||
background-color: #fff;
|
||||
border: 1px solid #e5e5e5;
|
||||
-webkit-border-radius: 5px;
|
||||
-moz-border-radius: 5px;
|
||||
border-radius: 5px;
|
||||
-webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
-moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
}
|
||||
.form-signin .form-signin-heading,
|
||||
.form-signin .checkbox {
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.form-signin input[type="text"],
|
||||
.form-signin input[type="password"] {
|
||||
font-size: 16px;
|
||||
height: auto;
|
||||
margin-bottom: 15px;
|
||||
padding: 7px 9px;
|
||||
}
|
||||
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
|
||||
<div class="container">
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
<form class="form-signin" name='loginForm'
|
||||
action="<c:url value='j_spring_security_check' />" method='POST'>
|
||||
<h2 class="form-signin-heading">Please sign in</h2>
|
||||
<input type="text" class="input-block-level" placeholder="Email address" name='username'>
|
||||
<input type="password" class="input-block-level" placeholder="Password" name='password'>
|
||||
|
||||
<input type="hidden" name="${_csrf.parameterName}"
|
||||
value="${_csrf.token}" />
|
||||
<button class="btn btn-large btn-primary" type="submit">Sign in</button>
|
||||
</form>
|
||||
<div class="panel panel-info" style="max-width: 300px; margin: 0 auto 20px;">
|
||||
<div class="panel-heading">
|
||||
Login with one of the following accounts
|
||||
</div>
|
||||
<div class="panel-body">
|
||||
<!-- Table -->
|
||||
<table class="table table-bordered">
|
||||
<thead>
|
||||
<tr><td>Account</td><td>User</td><td>Password</td></tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr><td>Webgoat User</td><td>guest</td><td>guest</td></tr>
|
||||
<tr><td>Webgoat Admin</td><td>webgoat</td><td>webgoat</td></tr>
|
||||
<tr><td>Server Admin</td><td>server</td><td>server</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div> <!-- /container -->
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
59
src/main/webapp/WEB-INF/pages/logout.jsp
Normal file
59
src/main/webapp/WEB-INF/pages/logout.jsp
Normal file
@ -0,0 +1,59 @@
|
||||
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
|
||||
<html>
|
||||
<head>
|
||||
<title>Login Page</title>
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css">
|
||||
<style type="text/css">
|
||||
body {
|
||||
padding-top: 40px;
|
||||
padding-bottom: 40px;
|
||||
background-color: #f5f5f5;
|
||||
}
|
||||
|
||||
.form-signin {
|
||||
max-width: 300px;
|
||||
padding: 19px 29px 29px;
|
||||
margin: 0 auto 20px;
|
||||
background-color: #fff;
|
||||
border: 1px solid #e5e5e5;
|
||||
-webkit-border-radius: 5px;
|
||||
-moz-border-radius: 5px;
|
||||
border-radius: 5px;
|
||||
-webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
-moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
}
|
||||
.form-signin .form-signin-heading,
|
||||
.form-signin .checkbox {
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.form-signin input[type="text"],
|
||||
.form-signin input[type="password"] {
|
||||
font-size: 16px;
|
||||
height: auto;
|
||||
margin-bottom: 15px;
|
||||
padding: 7px 9px;
|
||||
}
|
||||
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
|
||||
<div class="container">
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
You have logged out successfully
|
||||
<hr/>
|
||||
Click here to <a href="<c:url value="login.mvc" />" > Login</a>
|
||||
|
||||
</div> <!-- /container -->
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
193
src/main/webapp/WEB-INF/pages/main_new.jsp
Normal file
193
src/main/webapp/WEB-INF/pages/main_new.jsp
Normal file
@ -0,0 +1,193 @@
|
||||
<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
|
||||
errorPage=""%>
|
||||
<%@page import="org.owasp.webgoat.session.WebSession"%>
|
||||
<%
|
||||
WebSession webSession = ((WebSession) session.getAttribute(WebSession.SESSION));
|
||||
%>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<!--[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
|
||||
<!--[if IE 7]> <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
|
||||
<!--[if IE 8]> <html class="no-js lt-ie9"> <![endif]-->
|
||||
<!--[if gt IE 8]><!-->
|
||||
|
||||
<!-- CSS -->
|
||||
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon">
|
||||
<!-- Bootstrap core CSS -->
|
||||
<link rel="stylesheet" href="plugins/bootstrap/css/bootstrap.min.css">
|
||||
<!-- Fonts from Font Awsome -->
|
||||
<link rel="stylesheet" href="css/font-awesome.min.css">
|
||||
<!-- CSS Animate -->
|
||||
<link rel="stylesheet" href="css/animate.css">
|
||||
<!-- Custom styles for this theme -->
|
||||
<link rel="stylesheet" href="css/main.css">
|
||||
|
||||
<!-- JS -->
|
||||
<script src="js/angular/angular.min.js"></script>
|
||||
<script src="js/angular/angular-animate.min.js"></script>
|
||||
<!-- Feature detection -->
|
||||
<script src="js/modernizr-2.6.2.min.js"></script>
|
||||
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
|
||||
<!--[if lt IE 9]>
|
||||
<script src="js/html5shiv.js"></script>
|
||||
<script src="js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<script src="js/application.js"></script>
|
||||
<script type="text/javascript">
|
||||
var goat=angular.module("goatApp", ['ngAnimate']);
|
||||
</script>
|
||||
<script type="text/javascript" src="js/goat.js"></script>
|
||||
<script type="text/javascript" src="js/goatConstants.js"></script>
|
||||
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
|
||||
<title>WebGoat V6.0</title>
|
||||
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css"/>
|
||||
|
||||
</head>
|
||||
|
||||
<body class="animated fadeIn" ng-app="goatApp">
|
||||
<section id="container">
|
||||
<header id="header">
|
||||
<!--logo start-->
|
||||
<div class="brand">
|
||||
<a href="index.html" class="logo"><span>Web</span>Goat</a>
|
||||
</div>
|
||||
<!--logo end-->
|
||||
<div class="toggle-navigation toggle-left">
|
||||
<button type="button" class="btn btn-default" id="toggle-left" data-toggle="tooltip" data-placement="right" title="Toggle Navigation">
|
||||
<i class="fa fa-bars"></i>
|
||||
</button>
|
||||
</div><!--toggle navigation end-->
|
||||
</header>
|
||||
|
||||
<!--sidebar left start-->
|
||||
<aside class="sidebar">
|
||||
<div id="leftside-navigation" class="nano" ng-controller="goatMenu">
|
||||
<ul class="nano-content">
|
||||
<li class="sub-menu" ng-repeat="item in menuTopics">
|
||||
<!-- TODO: implement conditional rendering -->
|
||||
<a ng-click="expanded = !expanded" href=""><i class="fa {{item.class}}"></i><span>{{item.name}}</span></a>
|
||||
<ul class="slideDown" ng-show="expanded">
|
||||
<li ng-repeat="lesson in item.children">
|
||||
<a ng-click="renderLesson(lesson.link)" title="link to {{lesson.name}}" href="">{{lesson.name}}</a>
|
||||
<span ng-repeat="stage in lesson.children">
|
||||
<a ng-click="renderLesson(stage.link)" title="link to {{stage.name}}" href=""> {{stage.name}}</a>
|
||||
</span>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
|
||||
</aside>
|
||||
<!--sidebar left end-->
|
||||
<!--main content start-->
|
||||
<section class="main-content-wrapper">
|
||||
<section id="main-content">
|
||||
<div class="row">
|
||||
<div class="col-md-12">
|
||||
<div class="panel" >
|
||||
<div class="panel-body" id="lesson_content">
|
||||
<b>This should default to the "How to Work with Webgoat" lesson</b>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
</section>
|
||||
<!--main content end-->
|
||||
|
||||
</section>
|
||||
|
||||
|
||||
<!--Global JS-->
|
||||
<script src="js/jquery/jquery-1.10.2.min.js"></script>
|
||||
<script src="plugins/bootstrap/js/bootstrap.min.js"></script>
|
||||
<!-- <script src="plugins/waypoints/waypoints.min.js"></script> -->
|
||||
<!-- <script src="js/application.js"></script> -->
|
||||
|
||||
<!-- Bootstrap core JavaScript
|
||||
================================================== -->
|
||||
<!-- Placed at the end of the document so the pages load faster -->
|
||||
<!-- <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script> -->
|
||||
<script src="http://malsup.github.com/jquery.form.js"></script>
|
||||
<script>
|
||||
//Load global functions
|
||||
|
||||
// set this to true if you want to see form submissions
|
||||
// set to false once we get all the kinks worked out
|
||||
var DEBUG_FORM_SUBMISSION = false;
|
||||
|
||||
$(document).ready(function() {
|
||||
// bind to click events on menu links
|
||||
$('.menu-link').bind('click', function(event) {
|
||||
event.preventDefault();
|
||||
$.get(this.href, {}, function(reply) {
|
||||
$("#lesson_content").html(reply);
|
||||
}, "html");
|
||||
});
|
||||
app.init();
|
||||
});
|
||||
// make all forms ajax forms
|
||||
var options = {
|
||||
target: '#lesson_content', // target element(s) to be updated with server response
|
||||
beforeSubmit: showRequest, // pre-submit callback, comment out after debugging
|
||||
success: showResponse // post-submit callback, comment out after debugging
|
||||
|
||||
// other available options:
|
||||
//url: url // override for form's 'action' attribute
|
||||
//type: type // 'get' or 'post', override for form's 'method' attribute
|
||||
//dataType: null // 'xml', 'script', or 'json' (expected server response type)
|
||||
//clearForm: true // clear all form fields after successful submit
|
||||
//resetForm: true // reset the form after successful submit
|
||||
|
||||
// $.ajax options can be used here too, for example:
|
||||
//timeout: 3000
|
||||
};
|
||||
// pre-submit callback
|
||||
function showRequest(formData, jqForm, options) {
|
||||
if (DEBUG_FORM_SUBMISSION) {
|
||||
// formData is an array; here we use $.param to convert it to a string to display it
|
||||
// but the form plugin does this for you automatically when it submits the data
|
||||
var queryString = $.param(formData);
|
||||
|
||||
// jqForm is a jQuery object encapsulating the form element. To access the
|
||||
// DOM element for the form do this:
|
||||
// var formElement = jqForm[0];
|
||||
|
||||
alert('About to submit: \n\n' + queryString);
|
||||
}
|
||||
|
||||
// here we could return false to prevent the form from being submitted;
|
||||
// returning anything other than false will allow the form submit to continue
|
||||
return true;
|
||||
}
|
||||
|
||||
// post-submit callback
|
||||
function showResponse(responseText, statusText, xhr, $form) {
|
||||
// for normal html responses, the first argument to the success callback
|
||||
// is the XMLHttpRequest object's responseText property
|
||||
|
||||
// if the ajaxForm method was passed an Options Object with the dataType
|
||||
// property set to 'xml' then the first argument to the success callback
|
||||
// is the XMLHttpRequest object's responseXML property
|
||||
|
||||
// if the ajaxForm method was passed an Options Object with the dataType
|
||||
// property set to 'json' then the first argument to the success callback
|
||||
// is the json data object returned by the server
|
||||
if (DEBUG_FORM_SUBMISSION) {
|
||||
alert('status: ' + statusText + '\n\nresponseText: \n' + responseText +
|
||||
'\n\nThe output div should have already been updated with the responseText.');
|
||||
}
|
||||
makeFormsAjax();
|
||||
}
|
||||
function makeFormsAjax() {
|
||||
//console.log("Hooking any lesson forms to make them ajax");
|
||||
$("form").ajaxForm(options);
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
138
src/main/webapp/WEB-INF/pages/welcome.jsp
Normal file
138
src/main/webapp/WEB-INF/pages/welcome.jsp
Normal file
@ -0,0 +1,138 @@
|
||||
<%@ page contentType="text/html; charset=ISO-8859-1" language="java"
|
||||
errorPage=""%>
|
||||
<%@page import="org.owasp.webgoat.session.WebSession"%>
|
||||
<%
|
||||
//WebSession webSession = ((WebSession) session.getAttribute("websession"));
|
||||
%>
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
|
||||
<title>WebGoat V5.4</title>
|
||||
<link rel="stylesheet" href="css/webgoat.css" type="text/css" />
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div id="wrap">
|
||||
<div id="top"></div>
|
||||
<div id="start">
|
||||
<p>Thank you for using WebGoat! This program is a demonstration of common web application flaws.
|
||||
The exercises are intended to provide hands on experience with
|
||||
application penetration testing techniques. </p>
|
||||
<p>The WebGoat project is led
|
||||
by Bruce Mayhew. Please send all comments to Bruce at [TODO, session was blowing up here for some reason].</p>
|
||||
|
||||
<div id="team">
|
||||
<table border="0" align="center" class="lessonText">
|
||||
<tr>
|
||||
<td width="50%">
|
||||
<div align="center"><a href="http://www.owasp.org"><img
|
||||
border="0" src="images/logos/owasp.jpg" alt="OWASP Foundation"
|
||||
longdesc="http://www.owasp.org" /></a></div>
|
||||
</td>
|
||||
<td width="50%">
|
||||
<div align="center"><a href="http://www.aspectsecurity.com"><img
|
||||
border="0" src="images/logos/aspect.jpg" alt="Aspect Security"
|
||||
longdesc="http://www.aspectsecurity.com" /></a></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="2">
|
||||
<div align="center"><span class="style1">
|
||||
WebGoat Authors </span></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="2">
|
||||
<div align="center"><span class="style2">
|
||||
Bruce Mayhew </span></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="2">
|
||||
<div align="center"><span class="style2">
|
||||
Jeff Williams </span></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="50%">
|
||||
<div align="center"><span class="style1"><br />
|
||||
WebGoat Design Team </span></div>
|
||||
</td>
|
||||
<td width="50%">
|
||||
<div align="center"><span class="style1"><br />
|
||||
V5.4 Lesson Contributers </span></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">
|
||||
<div align="center" class="style2">David Anderson</div>
|
||||
<div align="center" class="style2">Laurence Casey (Graphics)</div>
|
||||
<div align="center" class="style2">Rogan Dawes</div>
|
||||
<div align="center" class="style2">Bruce Mayhew</div>
|
||||
</td>
|
||||
<td valign="top">
|
||||
<div align="center" class="style2">Sherif Koussa</div>
|
||||
<div align="center" class="style2">Yiannis Pavlosoglou</div>
|
||||
<div align="center" class="style2"></div>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td height="25" valign="bottom">
|
||||
<div align="center"><span class="style1">Special Thanks
|
||||
for V5.4</span></div>
|
||||
</td>
|
||||
<td height="25" valign="bottom">
|
||||
<div align="center"><span class="style1">Documentation
|
||||
Contributers</span></div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<div align="center" class="style2">Brian Ciomei (Multitude of bug fixes)</div>
|
||||
<div align="center" class="style2">To all who have sent comments</div>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
<div align="center" class="style2">
|
||||
<a href="http://www.zionsecurity.com/" target="_blank">Erwin Geirnaert</a></div>
|
||||
<div align="center" class="style2">
|
||||
<a href="http://yehg.org/" target="_blank">Aung Khant</a></div>
|
||||
<div align="center" class="style2">
|
||||
<a href="http://www.softwaresecured.com" target="blank">Sherif Koussa</a>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="2">
|
||||
<div align="center" class="style2">
|
||||
<form id="form" name="form" method="get" action="start.mvc"><input
|
||||
type="submit" name="start" value="Start WebGoat" /></form>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<div align="center" class="style2"> </div>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<div align="center" class="style2"> </div>
|
||||
<div align="center" class="style2"> </div>
|
||||
<div align="center" class="style2"> </div>
|
||||
<div id="warning">WARNING<br />
|
||||
While running this program, your machine is extremely vulnerable to
|
||||
attack if you are not running on localhost. If you are NOT running on localhost (default configuration), You should disconnect from the network while using this program.
|
||||
<br />
|
||||
<br />
|
||||
This program is for educational purposes only. Use of these techniques
|
||||
without permission could lead to job termination, financial liability,
|
||||
and/or criminal penalties.</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user