From 99435a107320df6e3cdca06afac813f48b4b86ca Mon Sep 17 00:00:00 2001 From: Rene Zubcevic Date: Fri, 19 Jul 2019 12:16:06 +0200 Subject: [PATCH 1/7] increased sql form fields and fixed chrome progress --- .../owasp/webgoat/plugin/NetworkDummy.java | 14 ++++++- .../owasp/webgoat/plugin/NetworkLesson.java | 10 ++++- .../main/resources/html/ChromeDevTools.html | 41 ++++--------------- .../src/main/resources/html/SqlInjection.html | 8 ++-- 4 files changed, 33 insertions(+), 40 deletions(-) diff --git a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java index 9a462f77a..e5efd285d 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java +++ b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java @@ -3,6 +3,7 @@ package org.owasp.webgoat.plugin; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.UserSessionData; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; @@ -21,7 +22,16 @@ public class NetworkDummy extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) public @ResponseBody - AttackResult completed(@RequestParam String networkNum) throws IOException { - return trackProgress(failed().feedback("network.request").build()); + AttackResult completed(@RequestParam String successMessage) throws IOException { + + UserSessionData userSessionData = getUserSessionData(); + String answer = (String) userSessionData.getValue("randValue"); + + if (successMessage!=null && successMessage.equals(answer)) { + return trackProgress(success().feedback("xss-dom-message-success").build()); + } else { + return trackProgress(failed().feedback("xss-dom-message-failure").build()); + } + } } \ No newline at end of file diff --git a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java index 41071eaff..1969e53e9 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java +++ b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java @@ -4,6 +4,7 @@ import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; @@ -21,7 +22,7 @@ import java.io.IOException; @AssignmentHints({"networkHint1", "networkHint2"}) public class NetworkLesson extends AssignmentEndpoint { - @RequestMapping(method = RequestMethod.POST) + @RequestMapping(method = RequestMethod.POST, params= {"network_num","number"}) public @ResponseBody AttackResult completed(@RequestParam String network_num, @RequestParam String number) throws IOException { @@ -31,4 +32,11 @@ public class NetworkLesson extends AssignmentEndpoint { return trackProgress(failed().feedback("network.failed").build()); } } + + @RequestMapping(method = RequestMethod.POST, params="networkNum") + public + @ResponseBody + ResponseEntity ok(@RequestParam String networkNum) throws IOException { + return ResponseEntity.ok().build(); + } } diff --git a/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html b/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html index d8d576bb6..807cc5a4b 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html +++ b/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html @@ -2,25 +2,29 @@ +
+
+
+
@@ -30,17 +34,19 @@
+
+
@@ -78,7 +78,7 @@
diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java index cee8e8c13..974d48b7f 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java @@ -38,7 +38,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void knownAccountShouldDisplayData() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "id")) .andExpect(status().isOk()); @@ -46,7 +46,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void addressCorrectShouldOrderByHostname() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '104.%' THEN hostname ELSE id END")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); @@ -54,17 +54,17 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void addressCorrectShouldOrderByHostnameUsingSubstr() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,1,1) = '1') IS NOT NULL then hostname else id end")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,2,1) = '0') IS NOT NULL then hostname else id end")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,3,1) = '4') IS NOT NULL then hostname else id end")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); @@ -72,7 +72,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void addressIncorrectShouldOrderByIdUsingSubstr() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "case when (select ip from servers where hostname='webgoat-prd' and substr(ip,1,1) = '9') IS NOT NULL then hostname else id end")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-dev"))); @@ -80,7 +80,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void trueShouldSortByHostname() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "(case when (true) then hostname else id end)")) .andExpect(status().isOk()) @@ -89,7 +89,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void falseShouldSortById() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "(case when (true) then hostname else id end)")) .andExpect(status().isOk()) @@ -98,7 +98,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void addressIncorrectShouldOrderByHostname() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjectionMitigations/servers") .param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '192.%' THEN hostname ELSE id END")) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-dev"))); @@ -106,7 +106,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void postingCorrectAnswerShouldPassTheLesson() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a") + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjectionMitigations/attack12a") .param("ip", "104.130.219.202")) .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))); @@ -114,7 +114,7 @@ public class SqlInjectionLesson12aTest extends LessonTest { @Test public void postingWrongAnswerShouldNotPassTheLesson() throws Exception { - mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a") + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjectionMitigations/attack12a") .param("ip", "192.168.219.202")) .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); From 7ad3996f2fe1905107d7b24d7f3c369e794e7d76 Mon Sep 17 00:00:00 2001 From: Rene Zubcevic Date: Mon, 22 Jul 2019 15:36:31 +0200 Subject: [PATCH 7/7] fix 6a6b page --- .../owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java | 2 +- .../src/main/resources/html/SqlInjectionAdvanced.html | 2 +- .../webgoat/plugin/introduction/SqlInjectionLesson6aTest.java | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java index 9bf990d3c..f2affbeee 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionLesson6a.java @@ -83,7 +83,7 @@ public class SqlInjectionLesson6a extends AssignmentEndpoint { if (output.toString().contains("dave") && output.toString().contains("passW0rD")) { output.append(appendingWhenSucceded); - return trackProgress(informationMessage().feedback("sql-injection.advanced.6a.success").feedbackArgs(output.toString()).output(" Your query was: " + query).build()); + return trackProgress(success().feedback("sql-injection.advanced.6a.success").feedbackArgs(output.toString()).output(" Your query was: " + query).build()); } else { return trackProgress(failed().output(output.toString() + "
Your query was: " + query).build()); } diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html index de3c4dee2..bca28bd63 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html @@ -18,7 +18,7 @@
- diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java index be88f4b75..dc65e7eb3 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java @@ -62,7 +62,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjectionAdvanced/attack6a") .param("userid_6a", "Smith'; SELECT * from user_system_data; --")) .andExpect(status().isOk()) - .andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.lessonCompleted", is(true))) .andExpect(jsonPath("$.feedback", containsString("passW0rD"))); } @@ -82,6 +82,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "S'; Select * from user_system_data; --")) .andExpect(status().isOk()) + .andExpect(jsonPath("$.lessonCompleted", is(true))) .andExpect(jsonPath("$.feedback", containsString("UNION"))); } } \ No newline at end of file