From b048988d2fbd166ff8b6530b60d0638f95db93bd Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Tue, 13 Jun 2017 03:22:19 +0200 Subject: [PATCH] Changed layout of the html tampering lesson and fixed some JavaScript issues. Added a small mitigation page. Moved the lessons concerning client side validation to client side category --- .../org/owasp/webgoat/lessons/Category.java | 2 +- .../webgoat/plugin/BypassRestrictions.java | 2 +- .../webgoat/plugin/ClientSideFiltering.java | 2 +- .../owasp/webgoat/plugin/HtmlTampering.java | 2 +- .../webgoat/plugin/HtmlTamperingTask.java | 3 +- .../main/resources/html/HtmlTampering.html | 220 +++++++++++------- .../resources/i18n/WebGoatLabels.properties | 4 + .../src/main/resources/images/samsung.jpg | Bin 0 -> 3547 bytes .../lessonPlans/en/HtmlTampering_Intro.adoc | 1 + .../en/HtmlTampering_Mitigation.adoc | 14 ++ .../lessonPlans/en/HtmlTampering_Task.adoc | 2 +- 11 files changed, 165 insertions(+), 87 deletions(-) create mode 100644 webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg create mode 100755 webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Mitigation.adoc diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java index 6c3a5833b..7d47892ab 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java @@ -52,7 +52,7 @@ public enum Category { INSECURE_CONFIGURATION("Insecure Configuration", new Integer(1400)), INSECURE_STORAGE("Insecure Storage", new Integer(1500)), MALICIOUS_EXECUTION("Malicious Execution", new Integer(1600)), - PARAMETER_TAMPERING("Parameter Tampering", new Integer(1700)), + CLIENT_SIDE("Client side", new Integer(1700)), SESSION_MANAGEMENT("Session Management Flaws", new Integer(1800)), WEB_SERVICES("Web Services", new Integer(1900)), VULNERABLE_COMPONENTS("Vulnerable Components - A9", new Integer(1950)), diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java index 5f74cea57..21e522a22 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java @@ -38,7 +38,7 @@ import java.util.List; public class BypassRestrictions extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java index feff55a0f..98a7c4172 100644 --- a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java +++ b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java @@ -39,7 +39,7 @@ public class ClientSideFiltering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.AJAX_SECURITY; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java index 86223963c..a03dddd1b 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java @@ -38,7 +38,7 @@ import java.util.List; public class HtmlTampering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java index a89ba294a..2f62612c0 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java @@ -1,6 +1,7 @@ package org.owasp.webgoat.plugin; import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; import org.springframework.web.bind.annotation.RequestMapping; @@ -8,7 +9,6 @@ import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; -import javax.servlet.http.HttpServletRequest; import java.io.IOException; /** @@ -45,6 +45,7 @@ import java.io.IOException; * @created October 28, 2003 */ @AssignmentPath("/HtmlTampering/task") +@AssignmentHints({ "hint1", "hint2", "hint3"}) public class HtmlTamperingTask extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) diff --git a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html index 552fc8e1b..b21ba255a 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html +++ b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html @@ -2,90 +2,148 @@ -
- - -
-
+
+
+
-
- -
-
-
-
- -
-

Shopping Cart

-
-
- - - - - - - - - - - - - - - -
Shopping Cart Items To Buy NowPriceQuantityTotal
56 inch HDTV (model KTV-551)2999.99 - -
-
- - - - - - - - - -
The total charged to your credit card:$2999,99 - - - -
- -
- - -
-

-
-
-
+ var total = price * document.task.QTY.value; + $('#total').text('$' + total.toFixed(2)); + $('#subtotal').text('$' + total.toFixed(2)); + $('#totalAmount').text('$' + total.toFixed(2)); + $('#Total').val(total.toFixed(2)); + } + +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProductQuantityPriceTotal 
+
+ + +
+

55'' M5510 White Full HD Smart TV +

+
by Samsung
+ Status: In Stock +
+
+ 		+ + 2999.99$2999.99 + +
     
Subtotal
$2999.99
+
     
Shipping costs
$0.00
+
     

Total

$2999.99

+
      + + +
+ +
+
+
+
+
+ +

+
+
+ +
+
+
diff --git a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties index 8084fcf71..24ae7a2ed 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties @@ -3,3 +3,7 @@ html-tampering.title=HTML tampering html-tampering.tamper.success=Well done, you just bought a TV at a discount html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost! + +hint1=Try to change the number of items and see what is happening +hint2=Is the price part of the HTML request? +hint3=Intercept the request and manipulate the price before submitting it. diff --git a/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg b/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg new file mode 100644 index 0000000000000000000000000000000000000000..dd15a64cf98c3b29fcc31b5ddc06af62f914286f GIT binary patch literal 3547 zcmbtWXIPWT7XDHofRrR4RUy=bDnvR9gbd?|aUBjwg<10l0y#zAgX)fdD<)2OLiW z+9$JrWhaOHs{>A)kJ|wR13&;mARq()Mt~p)&~Ycg4*(!27y<%*8ibC45efr=>6vKj zoF}e7*G~RG;NvNPndSn9L*TS21ppw06F>H_1iNua*ED)s@u$FSlD+3l`^3w?ECq>(pk=~GwvdM2S!Vp7Jjc1G0|$?xQusTtgZ z;5%!O$tMYcSe?WR5D`5b6#=18Dky~sice|bU}zVngFya2Vh|WY2c?HGAlTtZ4ir{i zP)Jse79ayHY!Dsz%gmqOlg66kOFXidDAIWZ4BuORGS0J}WP6U16m8f2K~kL>_OQD=W5&Mb z3K4yyOVjyYD-teYlv69;BRh>O}d7FSX6Vji#d)R)3vMpQ_Jdk7Jflssu{1oaL zYMIXYOIop=7+cu5@a9|cG+#9FP}IwL#%m-Qd5T=%x2Ag5FiomtCecfc#UxLKL03{* zl=AR0Yi#Ys)~X>_bp{4!hx=4t>*Q2Z-U~?BDTkFQel=~XTgV#NvBIcMIazs#Utd(1 z_EfwymVhDu551NdfPf3)emo8Y1kwcIt)H;V*ej;ec1s~>EQi7velm&1GPqU*7%3=g zPHIER;T(yT!*f{j=GG5?@QME{SxGA+U#q0!oX7YzmybMb+wb1Mv&c`f41&5pSp+~g zbmx~DS8iyach7>xR&G3J@aN6$dCZ$9#r%2w_4Q%)%~DIJCRmzFPNK03(sQNiKuLml zWAi=jIyg9urVuDS^b{TA-ywiO5GWl2phpU_bD-p~=5Q@XB1{Nx;pBfUAc9nVS~xPL zQdCy{4mrDKc;p}a={3QV9hRk%21_OZi-(ggVrjKDvCx%m*Jg17en132U9%HGDY(Z) zD%a@`(pF4JryP#HRBf-1G$wnPW{<>W$1d+CI&{Vx3-0$jj=ajus#D8)(57JEPX#?! zy&W@mR8=K1{@Ea3d{Ii?d3&ees!f8x!*jRoBE(X779jE6r6N)ng+C=X%hYdOZD3&e zpaUzYhp5(@o_Bcdk|TDF{wz=WMOKPaC0R@NV~!Kw5ZXQi6$=1iUQ3s(Wk2( z?C)$2a$MFYiYAx)fucJ8E?^Rg$(O zzE<ys1^ekA6$l&(n&{D2~>G zhn;n2CN;Sa#FRBy^m>JMjmNp>jxmc6F5iiQb6egyTP=uhudy;(ZY(ux81~MSc+sof zK4;=0$EN6P@*>eLX!z0i20p`#HV(Xw#hg0mWZCs>u-fzVGEXC+8 z6S=0<`8amxSbw9>BZLd@dS~#@ii^df(%M_=>@Ru{eHu9D(Q%nsZW5G2LVFPPbnx$N zbV{nJ(eJP52P*wh(%2eZ^hG+-tRDGw#^)}p(fVh1RVEFyE|X`Kf&~`wnfu-tW$-K~ zK`aJeI2E6Ap4XiJ$Jow9tG8C$-cguj$;oHLSoc-1hCsKrj{E~F3{ND+ma*|s<3f&)}@ zWjyoN7Ur>t+QccD8zDTAA3x2ey%ENXfK9TH)PO>bk;DlO=_0P6M_c)EyYbzjl;H1N zKCYM<+eyAs5wnu?Pj!+K-B#XV*U@O1mAZ1~a1N6Glc~e&t>@Y&d*(XLQO+B%Ded7K zvwVxu#{l+P_}DI6PDE=(1^n?%c1fK!M6+$<*v|B|ig&HYfQ{*^GfdcaLsRifes(Uz zRKJR}t|dO+?il4P9)GxUs!DjRc&JS>2a1ny!?Fm3!AWzGN!2!bY1`KlX7BwBkAk9pu-NMj7w*vkN_|Fyvhrigz5X3Dr(sC%eZe&=+$D;QGC1Aa&AKGMsqW z5L|-+i-kF}iU{!VPv8?6W@BVpE->%24P4e>+Yx~6uqo{@9RmWHnwptxnweZl16XE) zZf$Tzl+b>-JjWgK)IG!myKn_ zboT4t{CzreH{lrIHytds(iq6#u~QQmad{heuBPKFO7iw_Ojp3IdiIgurMaHo-(%KZ zn*Vbm3L%#v+gC6n5sDOFP%{!9ah)3s+=?XY@D_>3V=R)-psz2I+}aM$4?$T3L z1#k;os6I2mzV=enFlV;EvHRS?#s${CQ>q$cE~Xz(*o~m+J_rV-3EV$@4+tR#2x^%V zNn|+6aWkT_4JSMIKMjL_#}r=>*qL0$2pUc%xL@8F5e^#Z_54cMakq-ftt`>dQcC^Q zYNMgAqNg;{W5@n{A*ClnL`D7E5$gqN!hv)LnluBRb6U-dFAS8awicHP_OILzOH7<^ zP8#%E+mlrAYkm-HI(NP|ph0rI1(q{kR(k18bJNV&+kjiX)c1plU&~vxLuHhja5I-aIvy>P=+iK3F# zQhL1HD@3kz-0{;V^wV{rrhRt4#mbP^xg7@bEDW?QY(*wURNCkr(gebu5Z{|C{`Ix3 zT*Oq>Dc?0WGGr;IaGV%@5G^XBs*sLt{QWB{C!1A4oTT$CeJK7}RFUsWf=!4Iyq$C3 zAnGv!i;ZH9;NMDiYUdq~WQhk%n9hfDpcan-`?sMg4BDF&>PV#Q?pv2klz^Kgv|`vY z&Wy5&1C`@gJGXEP=nYcNzDU-suJ`oQu@Qz~ z`0--OnB8AFUj