From ac6e8b59b7f480de66bdf55d481c2f0067010cb5 Mon Sep 17 00:00:00 2001 From: Jason White Date: Fri, 17 Feb 2017 15:59:38 -0500 Subject: [PATCH] XSS updates --- .../webgoat/plugin/DOMCrossSiteScripting.java | 2 +- .../plugin/DOMCrossSiteScriptingFollowUp.java | 35 +++ .../html/CrossSiteScripting.html | 261 ++++++++++-------- .../en/CrossSiteScripting_content6a.adoc | 2 +- .../en/CrossSiteScripting_content6b.adoc | 9 + .../plugin/i18n/WebGoatLabels.properties | 2 + 6 files changed, 193 insertions(+), 118 deletions(-) create mode 100644 webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScriptingFollowUp.java create mode 100644 webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content6b.adoc diff --git a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScripting.java b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScripting.java index c4ceea5b4..7bd3456ff 100644 --- a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScripting.java +++ b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScripting.java @@ -21,7 +21,7 @@ public class DOMCrossSiteScripting extends AssignmentEndpoint { AttackResult completed(@RequestParam Integer param1, @RequestParam Integer param2, HttpServletRequest request) throws IOException { if (param1 == 42 && param2 == 24 && request.getHeader("webgoat-requested-by").equals("dom-xss-vuln")) { - System.out.println("DOM-XSS successful"); + System.out.println("DOM-XSS successful, param1 is 42"); return trackProgress(success().build()); } else { return trackProgress(failed().build()); diff --git a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScriptingFollowUp.java b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScriptingFollowUp.java new file mode 100644 index 000000000..846c1eaa4 --- /dev/null +++ b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/DOMCrossSiteScriptingFollowUp.java @@ -0,0 +1,35 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * Created by jason on 11/23/16. + */ +@AssignmentPath("/CrossSiteScripting/dom-follow-up") +public class DOMCrossSiteScriptingFollowUp extends AssignmentEndpoint { + @RequestMapping(method = RequestMethod.POST) + public @ResponseBody + AttackResult completed(@RequestParam String successMessage) throws IOException { + if (successMessage.equals("DOM-XSS successful, param1 is 42")) { + return trackProgress(success().feedback("xss-dom-message-success").build()); + } else { + return trackProgress(failed().feedback("xss-dom-message-success").build()); + } + } +} +// something like ... http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E +// or http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere