diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java index 6c3a5833b..7d47892ab 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java @@ -52,7 +52,7 @@ public enum Category { INSECURE_CONFIGURATION("Insecure Configuration", new Integer(1400)), INSECURE_STORAGE("Insecure Storage", new Integer(1500)), MALICIOUS_EXECUTION("Malicious Execution", new Integer(1600)), - PARAMETER_TAMPERING("Parameter Tampering", new Integer(1700)), + CLIENT_SIDE("Client side", new Integer(1700)), SESSION_MANAGEMENT("Session Management Flaws", new Integer(1800)), WEB_SERVICES("Web Services", new Integer(1900)), VULNERABLE_COMPONENTS("Vulnerable Components - A9", new Integer(1950)), diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java index 5f74cea57..21e522a22 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java @@ -38,7 +38,7 @@ import java.util.List; public class BypassRestrictions extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java index feff55a0f..98a7c4172 100644 --- a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java +++ b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java @@ -39,7 +39,7 @@ public class ClientSideFiltering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.AJAX_SECURITY; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java index 86223963c..a03dddd1b 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java @@ -38,7 +38,7 @@ import java.util.List; public class HtmlTampering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java index a89ba294a..2f62612c0 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java @@ -1,6 +1,7 @@ package org.owasp.webgoat.plugin; import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; import org.springframework.web.bind.annotation.RequestMapping; @@ -8,7 +9,6 @@ import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; -import javax.servlet.http.HttpServletRequest; import java.io.IOException; /** @@ -45,6 +45,7 @@ import java.io.IOException; * @created October 28, 2003 */ @AssignmentPath("/HtmlTampering/task") +@AssignmentHints({ "hint1", "hint2", "hint3"}) public class HtmlTamperingTask extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) diff --git a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html index 552fc8e1b..b21ba255a 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html +++ b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html @@ -2,90 +2,148 @@ -
- - -
-
+
+
+
-
- -
-
-
-
- -
-

Shopping Cart

-
-
- - - - - - - - - - - - - - - -
Shopping Cart Items To Buy NowPriceQuantityTotal
56 inch HDTV (model KTV-551)2999.99 - -
-
- - - - - - - - - -
The total charged to your credit card:$2999,99 - - - -
- -
- - -
-

-
-
-
+ var total = price * document.task.QTY.value; + $('#total').text('$' + total.toFixed(2)); + $('#subtotal').text('$' + total.toFixed(2)); + $('#totalAmount').text('$' + total.toFixed(2)); + $('#Total').val(total.toFixed(2)); + } + +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProductQuantityPriceTotal 
+
+ + +
+

55'' M5510 White Full HD Smart TV +

+
by Samsung
+ Status: In Stock +
+
+ 		+ + 2999.99$2999.99 + +
     
Subtotal
$2999.99
+
     
Shipping costs
$0.00
+
     

Total

$2999.99

+
      + + +
+ +
+
+
+
+
+ +

+
+
+ +
+
+
diff --git a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties index 8084fcf71..24ae7a2ed 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties @@ -3,3 +3,7 @@ html-tampering.title=HTML tampering html-tampering.tamper.success=Well done, you just bought a TV at a discount html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost! + +hint1=Try to change the number of items and see what is happening +hint2=Is the price part of the HTML request? +hint3=Intercept the request and manipulate the price before submitting it. diff --git a/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg b/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg new file mode 100644 index 000000000..dd15a64cf Binary files /dev/null and b/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg differ diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc index d2dd4b243..998433314 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc @@ -2,6 +2,7 @@ == Concept Browsers generally offer many options of editing the displayed content. Developers therefore must be aware that the values sent by the user may have been tampered with. + == Goals * The user should have a basic understanding of HTML * The user will be able to exploit editing front end of website diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Mitigation.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Mitigation.adoc new file mode 100755 index 000000000..22eb72fa2 --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Mitigation.adoc @@ -0,0 +1,14 @@ +=== Mitigation + +In this simple example you noticed that the price is calculated server side and send to the server. The server +accepted the input as a given and did not calculate the price again. One of the mitigations in this case is to look up +the price of the television in your database and calculate the total price again. + + +In a real application you should never rely on client side validation it is important to verify all the input +send by the client. Always remember: **NEVER TRUST INPUT SEND BY A CLIENT.** + +'''' +==== References + +https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc index 60b07989d..ae07f6891 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc @@ -1,2 +1,2 @@ === Try it yourself -This is an internet store. Try to buy TV-s for a lower price. +In an online store you ordered a new TV, try to buy one or more TVs for a lower price.