From b156d81535b3a1e771937307302debae00be8da1 Mon Sep 17 00:00:00 2001 From: Jason White Date: Wed, 11 Oct 2017 20:06:57 -0600 Subject: [PATCH] Initial cut on CSRF. More to come --- .../org/owasp/webgoat/lessons/Category.java | 1 + webgoat-lessons/csrf/src/.DS_Store | Bin 0 -> 6148 bytes webgoat-lessons/csrf/src/main/.DS_Store | Bin 0 -> 8196 bytes webgoat-lessons/csrf/src/main/java/.DS_Store | Bin 0 -> 6148 bytes .../csrf/src/main/java/org/.DS_Store | Bin 0 -> 6148 bytes .../csrf/src/main/java/org/owasp/.DS_Store | Bin 0 -> 6148 bytes .../src/main/java/org/owasp/webgoat/.DS_Store | Bin 0 -> 6148 bytes .../java/org/owasp/webgoat/plugin/CSRF.java | 36 ++++ .../webgoat/plugin/CSRFConfirmFlag1.java | 39 ++++ .../org/owasp/webgoat/plugin/CSRFGetFlag.java | 65 +++++++ .../csrf/src/main/resources/.DS_Store | Bin 0 -> 6148 bytes .../csrf/src/main/resources/html/CSRF.html | 57 ++++++ .../resources/i18n/WebGoatLabels.properties | 4 + .../src/main/resources/lessonPlans/.DS_Store | Bin 0 -> 6148 bytes .../lessonPlans/en/CSRF_Basic_Get-1.adoc | 3 + .../lessonPlans/en/CSRF_Basic_Get.adoc | 9 + .../CSRF => }/lessonPlans/en/CSRF_GET.adoc | 2 +- .../lessonPlans/en/CSRF_Get_Flag.adoc | 4 + .../CSRF => }/lessonPlans/en/CSRF_intro.adoc | 6 +- .../CSRF => }/lessonPlans/en/CSRF_plan.adoc | 0 .../main/resources/plugin/CSRF/html/CSRF.html | 181 ------------------ .../src/main/resources/plugin/CSRF/js/xxe.js | 15 -- .../src/main/resources/plugin/CSRF/secret.txt | 1 - .../csrf/webgoat-lesson-template/.DS_Store | Bin 0 -> 8196 bytes .../getting-started.txt | 55 ++++++ .../csrf/webgoat-lesson-template/pom.xml | 12 ++ .../webgoat-lesson-template/src/.DS_Store | Bin 0 -> 8196 bytes .../src/main/.DS_Store | Bin 0 -> 10244 bytes .../src/main/java/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/owasp/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/owasp/webgoat/.DS_Store | Bin 0 -> 8196 bytes .../owasp/webgoat/plugin/LessonTemplate.java | 65 +++++++ .../owasp/webgoat/plugin/SampleAttack.java | 62 ++++++ .../src/main/resources/.DS_Store | Bin 0 -> 6148 bytes .../src/main/resources/html/.DS_Store | Bin 0 -> 6148 bytes .../main/resources/html/LessonTemplate.html | 54 ++++++ .../resources/i18n/WebGoatLabels.properties | 7 + .../resources/images/firefox-proxy-config.png | Bin 0 -> 204442 bytes .../src/main/resources/js/idor.js | 18 ++ .../en/lesson-template-attack.adoc | 3 + .../lessonPlans/en/lesson-template-intro.adoc | 19 ++ .../lessonPlans/en/lesson-template-video.adoc | 7 + .../src/main/resources/video/sample-video.m4v | Bin 0 -> 21278272 bytes webgoat-lessons/pom.xml | 1 + webgoat-server/pom.xml | 5 + 46 files changed, 530 insertions(+), 201 deletions(-) create mode 100644 webgoat-lessons/csrf/src/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/java/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/java/org/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/java/org/owasp/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRF.java create mode 100644 webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFConfirmFlag1.java create mode 100644 webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFGetFlag.java create mode 100644 webgoat-lessons/csrf/src/main/resources/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/resources/html/CSRF.html create mode 100644 webgoat-lessons/csrf/src/main/resources/i18n/WebGoatLabels.properties create mode 100644 webgoat-lessons/csrf/src/main/resources/lessonPlans/.DS_Store create mode 100644 webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get-1.adoc create mode 100644 webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get.adoc rename webgoat-lessons/csrf/src/main/resources/{plugin/CSRF => }/lessonPlans/en/CSRF_GET.adoc (77%) create mode 100644 webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Get_Flag.adoc rename webgoat-lessons/csrf/src/main/resources/{plugin/CSRF => }/lessonPlans/en/CSRF_intro.adoc (78%) rename webgoat-lessons/csrf/src/main/resources/{plugin/CSRF => }/lessonPlans/en/CSRF_plan.adoc (100%) delete mode 100644 webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html delete mode 100644 webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js delete mode 100644 webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/getting-started.txt create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/pom.xml create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/org/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/org/owasp/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/org/owasp/webgoat/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/org/owasp/webgoat/plugin/LessonTemplate.java create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/java/org/owasp/webgoat/plugin/SampleAttack.java create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/html/.DS_Store create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/html/LessonTemplate.html create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/i18n/WebGoatLabels.properties create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/images/firefox-proxy-config.png create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/js/idor.js create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-attack.adoc create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-intro.adoc create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-video.adoc create mode 100644 webgoat-lessons/csrf/webgoat-lesson-template/src/main/resources/video/sample-video.m4v diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java index 6f42e26b7..2b25b698e 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java @@ -41,6 +41,7 @@ public enum Category { INJECTION("Injection Flaws", new Integer(200)), AUTHENTICATION("Authentication Flaws", new Integer(300)), XSS("Cross-Site Scripting (XSS)", new Integer(400)), + REQ_FORGERIES("Request Forgeries", new Integer(450)), ACCESS_CONTROL("Access Control Flaws", new Integer(500)), INSECURE_CONFIGURATION("Insecure Configuration", new Integer(600)), INSECURE_COMMUNICATION("Insecure Communication", new Integer(700)), diff --git a/webgoat-lessons/csrf/src/.DS_Store b/webgoat-lessons/csrf/src/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..24317c3182ed781e71343464b283e3c5f25d9fe0 GIT binary patch literal 6148 zcmeHKL2KJE6qb^7bJ~l?S_t%_Yaxe})(g9NX?H9HJQ7MXG8>yk;MpN|8b%2C+@Gufw3Uu+#4lvntTS|JboTW zNDL4I#K0OeV74@CYmMhXuTBgQ1Am7B+#dueqHD0wsJ0F$@b?khD~Kpy<6Qz#7<3I5 z8leS*>r_CU%FPvn>vZr76XzN%H0pH5)yU9~8JU|K3Rk0pU#M`#U5!){1H`~n2Fki> z#HiK8#E+yg@}Ms!Mtw5zNnh%@cV-D);K2t))47|u z=YE}g@BZ&^=I)&Z0PN1HEdVkA2y`(k?VxCb!0OqxE(E-iZDf)BAvI^urVJ}Z`9IdR z_6vLkdRjB}bK1AqZHtyNHYx$#tB7OuQ zTS~<|P+DRMvJub5J)3te)lfj!m8|QE-Vp;`cPfu~?c$!zyVi9F^bQ~Bjf~z21^MXI ze}p#&jJwv4eFc04)+@ly?xk=qD3AkX?fE@5Yv{Jq+`NK;lG3tm+l8RGgMFlscxPhT znoBr}leN2*%o(23RW0SE2Nh?!kRGxuV>PX$Ms#g1DedmDOh?g8EwjdTa#S}}Yp&bM znyNjSaQhq8RcAUWRSjme9JvlErZ%G6dP+BR=YAo`K1oSlScrARqLElEwit~pbaXUF zBW7HS>lzrJU3_9``PJ86KmW$ZpSl{L_Z)%BB26x?6(pC)n1*FeQ5kC= zgbZk4g9TYirCEB7WPkpDB G+S;R$mR2rV%b`}v#9CW6*6b6e3588H`;00#(8jQH zgYN5~fK|}uyEQn;y&>_oq*TF{_VlcyTc$mtWo)uZsoW;UPNXf5wCkF3DO4ef6U3b9==bPaW_XT)H?G)e%~W-BYBa~FGqfR7nbAUlnP8B6 zU0W@SlPdK+V5!VcmEINHn%ZhvKErByG8)CIAaI9$5m_9v*%TD7VSR%r4&6uSOSac( z;{j0~Hk6cRNNUh^Yr094M{}+;(n+tdwM~@A($>rjP1+7&)GO{hEX#MXkxwbMb9z=Y zX;z=p@JEl`x=XH>y9-~X_$vy+IP>aKRhn&Gd_P}t2-d}$-4yN5HPA%A1CGNafjufyxH4(qW2 zo3IVru>(7?3s2xlJcR=|f=Nta8daRZ2k{|%81wizK7%jdE4YNq_%>d^_wappPJzNr z-0#iNGx!lDHU`prKN%R^2*_|>rP#kUK(6d`F|6EO<#E}yy0}Hlxt1#qlS>Pys6Yt^ z^$IjE5v(3hh^&tQe1>RTVfv_l*aFAIo zF&dW2II=8Dbc#|bhni(O4^!3kW>2()UfAOexZO^`4H0f*IF1tpoQ6|4 zjXGw~!5q%vJU)VF@lia7j}d;);&b>szJxCqfp@$Jyz?7_SG12@>9l3J5_e>oo&Wnb zfB(N_^YaJx74Q}K=M})x-b8OVjZ@f8i-%-q?Fe0W)5QX7mv=39p@<*H$@1ek+0{P` kDIKAv%qQ;Iylbh1!oU6^fd4<~@Bf?p!u9w6t7QNG3-)ECH~;_u literal 0 HcmV?d00001 diff --git a/webgoat-lessons/csrf/src/main/java/.DS_Store b/webgoat-lessons/csrf/src/main/java/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..aed36ee174e4cbeb73eb5a17d50e427a8c957a2b GIT binary patch literal 6148 zcmeHK&2G~`5Z+Bf>$Ddms8or|UXgN01twP$!VxKwODjZCuxl$>$@NCI(+EY8eC9Fu zY5N`s-hcxK-hvA^W_CAGs*qz5pc!lSo1NVm+uvHd9>y5&PT~W`T*jCKidbtx^Bci& z)HSJD&lVuZ9K|?FRRq1C(Rgh(IsQflaP8_$v78N~>FWBWvMAf_Z@gA-+}hf9nmfCA zxwm&-1tT>L%CMXi-7tTtdooTUYxl!)w6G7AN|$yR9m!-maPK}*SsBVK$yY*8j%60B zX;)3MxHt(+zGE4eqk+5E&y#Zq?T1-%BnuhIRF-d?CSC(~e>U?vUQ2kMH*bkqr_*kU zhYudj=k9mMxp&`t{OrYe{`TGb4<9csuReV?Yrx@i)pEz;0=|G@=}3nM!Kpf1{gCa* zndZa@B`Tult{eL}(dc*)R@Lw^& z8@-^{g;%m?>)OlVSt~$agQDQP%HT2t41E;CTs(^RLA8KipaJMxtPFw&gnk4x4b%_= Hf0Th=uWWg` literal 0 HcmV?d00001 diff --git a/webgoat-lessons/csrf/src/main/java/org/.DS_Store b/webgoat-lessons/csrf/src/main/java/org/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..89210ac2d4eb476775a1de06ae5099b0b5af69c3 GIT binary patch literal 6148 zcmeHK&1%~~5T13MR8B4`Z6VOhUJE`rw5qSF>mCaRm4wg~SBgZuAZvvsM-*ewxsTER z_bBZf^w2}!qLtqu-<5H+uK zLt56egUED^JgSO3N@cVWOOF4O0kwA9AfbW~3TUq1uP9GNQTBS@S!=7ky>r9q?Cz<{ zy}A1$n8+$9!*X5>!r60uC*mZs_9!eTEBl$0>4hCeha#!Q?(N4iD?^bbvqtL4k;r0M z4dgtFi<7|AI}&j@8M}8zv*a98M`4y6ib6yp73C|Zqpq>LzgT#Eugg8pTXy-P-|uz# zgZmGcOZSK4+`Z>LdU~8MU%z?#?)`_4pFV#vE5Yz5tL2u(6?{dbK}mXc5S+?szM5X2 zoyy@bo|mTp-+ubXI;N33mGLFB`Q)<7=fNyXWp;)&S8v*Q1u}^NVt^R93IldqarUlK zgmQ@iV&Gabp!Nrjs?fJs8`N6|4!Q+EY@=HX+NzgOIozUeu{MY^D9ofHnp9?63}({N z&uyG$Ddms8p$!y&~n13QVphgdqdI);CgHsoz^& za~kU#@^SC4zX^uC3`8g#d*kF7Q+r{S?6HDHEM?-I(~wW!-I`9lw%4Sd=gpdQ z+HSX+^vUC=vzhzdakd|M&tAUDXD9DZ&pv$o^!dwIy%z+3wn`otoWnU9*Jw!xJHZhj z<@1o`h!O90)7DjbNf(YBTW%fM9zR&>{u_y3FE*Z)_O zY|k=a8Th9dAoXt0?cgVwyLIW~DnGVn77aA#AN*N#~y z1Ia)#@WBAjhk`<^fz8p54pf!`0QrnIfzDilF(t4DHb+<>>Y+dn)krba!_i;DuLd?p z4;PK(Lu2OmB8At~H83VfLw%rDs zio5m8_ITG8lsgm({TdYr^vNRt4W1)6W^{X@4!;`M961X6EgYB+0V5= getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 1; + } + + @Override + public String getTitle() { return "csrf.title"; } + + @Override + public String getId() { + return "CSRF"; + } + +} diff --git a/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFConfirmFlag1.java b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFConfirmFlag1.java new file mode 100644 index 000000000..6ec24f9f2 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFConfirmFlag1.java @@ -0,0 +1,39 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.UserSessionData; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; + +/** + * Created by jason on 9/29/17. + */ + +@AssignmentPath("/csrf/confirm-flag-1") +@AssignmentHints({""}) +public class CSRFConfirmFlag1 extends AssignmentEndpoint { + + @Autowired + UserSessionData userSessionData; + + @PostMapping(produces = {"application/json"}) + public @ResponseBody AttackResult completed(String confirmFlagVal) { +// String host = (req.getHeader("host") == null) ? "NULL" : req.getHeader("host"); +// String origin = (req.getHeader("origin") == null) ? "NULL" : req.getHeader("origin"); +// Integer serverPort = (req.getServerPort() < 1) ? 0 : req.getServerPort(); +// String serverName = (req.getServerName() == null) ? "NULL" : req.getServerName(); +// String referer = (req.getHeader("referer") == null) ? "NULL" : req.getHeader("referer"); + + if (confirmFlagVal.equals(userSessionData.getValue("csrf-get-success"))) { + return success().feedback("csrf-get-success").output("Correct, the flag was " + userSessionData.getValue("csrf-get-success")).build(); + } + return failed().feedback("").build(); + } +} diff --git a/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFGetFlag.java b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFGetFlag.java new file mode 100644 index 000000000..9aa681378 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/plugin/CSRFGetFlag.java @@ -0,0 +1,65 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.Endpoint; +import org.owasp.webgoat.i18n.PluginMessages; +import org.owasp.webgoat.session.UserSessionData; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.util.HashMap; +import java.util.Map; + +/** + * Created by jason on 9/30/17. + */ + +public class CSRFGetFlag extends Endpoint { + + @Autowired + UserSessionData userSessionData; + @Autowired + private PluginMessages pluginMessages; + + @RequestMapping(produces = {"application/json"}, method = RequestMethod.GET) + @ResponseBody + public Map invoke(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + + Map response = new HashMap<>(); + + String host = (req.getHeader("host") == null) ? "NULL" : req.getHeader("host"); + String origin = (req.getHeader("origin") == null) ? "NULL" : req.getHeader("origin"); + Integer serverPort = (req.getServerPort() < 1) ? 0 : req.getServerPort(); + String serverName = (req.getServerName() == null) ? "NULL" : req.getServerName(); + String referer = (req.getHeader("referer") == null) ? "NULL" : req.getHeader("referer"); + String[] refererArr = referer.split("/"); + + if (referer.equals("NULL") && req.getParameter("csrf").equals("true")) { + userSessionData.setValue("csrf-get-success", Math.floor(Math.random()*100000)); + response.put("success",true); + response.put("message",pluginMessages.getMessage("csrf-get-null-referer.success")); + response.put("flag",userSessionData.getValue("csrf-get-success")); + } else if (refererArr[2].equals(host)) { + response.put("success", false); + response.put("message", "Appears the request came from the original host"); + response.put("flag", null); + } else { + response.put("success", false); + response.put("message", "TBD"); + response.put("flag", null); + } + + return response; + + } + + @Override + public String getPath() { + return "/csrf/basic-get-flag"; + } +} diff --git a/webgoat-lessons/csrf/src/main/resources/.DS_Store b/webgoat-lessons/csrf/src/main/resources/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..4fb1e9b269cff0d83d78b2190de71546ac938ea2 GIT binary patch literal 6148 zcmeHKOOMkq5FU2}WZO%4Nh@*56{&}I7j`*@Za5-U3fdK7QAsw@#wd-WCfy2Em2&21 z@ctW!$3Nh}fq%h;3u64(lG1b~E(lc~%l^h=kH`Mp*fju<-Z<<6SO8#R=4dprs1e@I z^O7`_{m$El%yq+YaSZU~`~G{e zluBE;vMr03&IAJ}bm0!9!6eUugatU-k048EUUWKNNn^vfaPgA4*=+G-U2Z=1Vm9## zzZmB|fAmPyXcz@b@B2l3raxdTnd^RVK%>dPy0*{K!l!98s<<8<(llg~9vi1&e&osV z4ry4#1M7N!6rG}L-%q0hn$v(Lw0LH2@-(ovrqkW+ownWWY|q;EbZ@WIwr}n1&Sus( z)4Xx>_TBprv)S_(FJHZW^Y-0`Pjc4@9*{z=Dm;VFsLTne-2g?_!UlX4?sLB(t8Bm@ zZRc&ksW(a!mY(2fe0~jh3VF>Ognc3YPZ3|)E3qr~nz$`UAc7ndgB1E$^AYPJuIO2v zgDV+b+4J|T&hJ?>PqDc5FVs)cY_0!N^$Ilunt{J$fS(UGW{!@+QldCIunz9mlstcOZ^L zU1|n21B(o7$g0Kf|9h+7|BFt#rWw!-tQ7;qa6Pw&OHz01(&G4CYh!+bnG5e%N)#?w ksOwlL{3_nUECkzZt{^%JONnSf(SHO44Z6?_{8I*g0T!>y-~a#s literal 0 HcmV?d00001 diff --git a/webgoat-lessons/csrf/src/main/resources/html/CSRF.html b/webgoat-lessons/csrf/src/main/resources/html/CSRF.html new file mode 100644 index 000000000..2a9ef3041 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/html/CSRF.html @@ -0,0 +1,57 @@ + + + + +
+
+
+ +
+
+
+ +
+
+ +
+ + + +
+
+ +
+ +
+ + + +
+
+ +
+
+ + Confirm Flag Value: + + + + +
+ +
+
+
+
+ + + \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/csrf/src/main/resources/i18n/WebGoatLabels.properties new file mode 100644 index 000000000..4a802622a --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/i18n/WebGoatLabels.properties @@ -0,0 +1,4 @@ +csrf.title=Cross-Site Request Forgeries +csrf-get-null-referer.success=Congratulations! Appears you made the request from your local machine. +csrf-get-other-referer.successfeedback=Congratulations! Appears you made the request from\ + diff --git a/webgoat-lessons/csrf/src/main/resources/lessonPlans/.DS_Store b/webgoat-lessons/csrf/src/main/resources/lessonPlans/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..1151fe231819a1c35d96116fb7babc7806c1ec2d GIT binary patch literal 6148 zcmeHKJ5B>Z47HOKk!Vt;oGau8qi8rmE`XFpP!N)W^xJWqoQ9il0G>Y}!azz2c$Vz9 zPGn#XxVxSXe7weyS^Wjs2Q9209&irvv#TV7kz#z;7t<2Ki7SsQ>@~ literal 0 HcmV?d00001 diff --git a/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get-1.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get-1.adoc new file mode 100644 index 000000000..c81193a70 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get-1.adoc @@ -0,0 +1,3 @@ +== Confirm Flag + +Confirm the flag you should have gotten on the previous page below. \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get.adoc new file mode 100644 index 000000000..d5f420ee4 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Basic_Get.adoc @@ -0,0 +1,9 @@ +== The Base Form + +The form below has hidden elements and submits to an action of TBD. You can try it out and watch what it does, but it won't get you the flag. Once you can + +Every attack in this lesson will need to be done through another page or site. To see your progress, you will need to reload the +pages or re-navigate back through the lesson to see your progress. + +Just to get your feet wet, issue a request to _SERVER_/WebGoat/csrf/basic-get-flag with a parameter named 'csrf' equal to 'true'. Your request needs to +come from a local file or be hosted on a different website. \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_GET.adoc similarity index 77% rename from webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc rename to webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_GET.adoc index b0271a5f7..12d69f08e 100644 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_GET.adoc @@ -1,6 +1,6 @@ == CSRF with a GET request -This is the most easiest CSRF attack to perform. For example you receive an e-mail with the following content: +This is the most simple CSRF attack to perform. For example you receive an e-mail with the following content: `View my Pictures!` diff --git a/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Get_Flag.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Get_Flag.adoc new file mode 100644 index 000000000..2279cf9d3 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Get_Flag.adoc @@ -0,0 +1,4 @@ +== Basic Get CSRF Exercise + +place holder ... + diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_intro.adoc similarity index 78% rename from webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc rename to webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_intro.adoc index 3cfda81aa..fb6a15641 100644 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_intro.adoc @@ -1,11 +1,11 @@ -=== What is a Crosse-site request forgery? +=== What is a Cross-site request forgery? Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser. -A cross-site request forgery is a confused deputy attack against a web browser. CSRF commonly has the following characteristics: +A cross-site request forgery is a 'confused deputy' attack against a web browser. CSRF commonly has the following characteristics: * It involves sites that rely on a user's identity. * It exploits the site's trust in that identity. @@ -16,7 +16,7 @@ At risk are web applications that perform actions based on input from trusted an the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action. -CSRF attacks target functionality that causes a state change on the server, such as changing the victim's email address or password, or purchasing +A CSRF attack targets/abuses basic web functionality. If the site allows that causes a state change on the server, such as changing the victim's email address or password, or purchasing something. Forcing the victim to retrieve data doesn't benefit an attacker because the attacker doesn't receive the response, the victim does. As such, CSRF attacks target state-changing requests. diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_plan.adoc similarity index 100% rename from webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc rename to webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_plan.adoc diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html deleted file mode 100644 index c2bb6e238..000000000 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - -
-
- -
- - -
-
- -
- - -
- -
-
- - - -
- -
- Registration form - - - - - - - - - - - - - - - - - - -
Username
E-mail
Password
-
-
- -
-
-
- -
-
- -
-
- -
- -
- - -
-
-
- - - -
- -
- Registration form - - - - - - - - - - - - - - - - - - -
Username
E-mail
Password
-
-
- -
-
-
- -
-
- - -
- - -
-
- -
- - -
-
- -
- - -
-
-
- - - -
- -
- Registration form - - - - - - - - - - - - - - - - - - -
Username
E-mail
Password
-
-
- -
-
-
- -
-
- - -
- - -
-
- - - \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js deleted file mode 100644 index b38c2d9c2..000000000 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js +++ /dev/null @@ -1,15 +0,0 @@ -webgoat.customjs.register = function () { - var xml = '' + - '' + - ' ' + 'test' + '' + - ' ' + 'test' + '' + - ''; - return xml; -} -webgoat.customjs.registerJson = function () { - var json = '{' + - ' "user":' + '"test"' + - ' "password":' + '"test"' + - '}'; - return json; -} diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt deleted file mode 100644 index e4ec56814..000000000 --- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt +++ /dev/null @@ -1 +0,0 @@ -WebGoat 8 rocks... \ No newline at end of file diff --git a/webgoat-lessons/csrf/webgoat-lesson-template/.DS_Store b/webgoat-lessons/csrf/webgoat-lesson-template/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..0d597e3dbf596974fdd877729e0dab83badc8e41 GIT binary patch literal 8196 zcmeHLT}&KB9RL3hN_Y6M1BG%uY`qkbiidKAf@o6@xMCaH6g}X8qPTavz{X|wa=Uk+ zgos9?ZPcjI2VYFAAJx9-ix29HFE*{l_+U*+)ED1;GEpCV@WKD=EFb0Ltp~q-?YAOKVUD2m}b+k_d?PAxc@ugfEw*^p*}Pydwa~Qc`<~ z>RePvMtzy^<&uh=DSk^ikh0;mai{WjLUJ_(1>7=$}x~dpq?X_1pmy zQU+y!K!Ctz1jOE70uJOMo0(gGem4!rZEIV`P)X^IvYiSmuMiKfE`KaFW6z~r)h#%^ zYW|GZGBiEo*9TR1W~Dx4+vaLr&5RiO+$68@l5iDg@x95M`w2|8gIXUF&15jx3?dPMY|4n zEH3h26s6(r!#$_Qa*OBAzxVzJA71$A(q#z(`U?r{-T=y#HAFNgYi8&hgsTtI6zMjo z%;|V4YtOE~@$j8Zr#L8YL_&{bauU&NtBA6Sa8GS--z4V+M}Jf|Ro5u$N!8VzNxsV= zkWXZ7%m4Ot);0^X7FnvZs+ld2v)*HxDdTC~8Flq}SJcKGJMZ>+j-v*}3f&~H5!jv1 zxrS{yBYNH;$=Jopy2$>r)uHd$kfqM*GO9kjm+{Y(35|wx%GQLB=2^n^;eCp7M(F$UI+aq*qTvIKtICi= zLz7)Jv1Y~{HuNMBK!&!kn8GzSY^oXEl&bq!T;T&OU6kXO$`014RAY>d68N(;LPx5* z!w)L_vhuii_es@pPv>-NZB!2_%9yb9Xqv7mjfsPD_8Svzvckniv=?G<6#8KtvS7g+ zybQ0vtME3Qhl}tjd;wp>CAb3L!1r(smf~Q#JBJrydcLDTA^uDwpU90 zm}+Y@^Do{)>8)rM>92Y?`M=O?xl)j;x@LE6ozJ$O)!FiBw4NazDdensY*?A?4KsN? z+4c|xBMofdcH|u=cY)KDIB+;*|sEmmnilLd#lD3f;8*w^ z{w7+LA;&#fj}fBPKD-N?u?6oTVs#R!y72)#g2%8QkK+j(z#$@68b>{HX*h+`XkZ>4 zEMO7m@mYKhpT`&QMSKlk$2TP1HjwT33eBYS$mo-8)=nn1f|~{Sv1{gY&%SEWwz1@9 zwp$^Ksk~*{)-?4ah+YORsI(VNgAVTc)mM%qC~qhNC9=1$_y;(){r&$9eP_^FfIxu2 z&4mD#CR52?8q>U}^vv!p76O=^~eoIn%Ayiy<5kPJKIPUpI$yLN8e7Pj07fO0B Ul;nSO5fJSE!Tv7@c#Efh0lIMvPyhe` literal 0 HcmV?d00001 diff --git a/webgoat-lessons/csrf/webgoat-lesson-template/getting-started.txt b/webgoat-lessons/csrf/webgoat-lesson-template/getting-started.txt new file mode 100644 index 000000000..c0677c6b7 --- /dev/null +++ b/webgoat-lessons/csrf/webgoat-lesson-template/getting-started.txt @@ -0,0 +1,55 @@ +##### To include lesson template in build ##### +1. edit theh webgoat-server/pom.xml file and uncomment the section under ... + + +2. Also uncomment in webgoat-lessons/pom.xml where it says ... + + +##### To add a lesson to WebGoat ##### + +There are a number of moving parts and this sample lesson will help you navigate those parts. Most of your work will be done in two directories. To start though, you can copy this directory with the name of your-lesson in the webgoat-lessons directory. + +0. The POM file + a. change the ... + webgoat-lesson-template + ... line to give your lesson its own artifactId.That should be all you need to do there + +1. The Base Class ... + In webgoat-lessons/{your-lesson}/src/main/java, refactor the LessonTemplate.java class, changing ... + a. the category in which you want your lesson to be in. You can create a new category if you want, or put in an issue to have one added + b. The 'defaultRanking' will move your lesson up or down in the categories list + c. implement a new key name pair "lesson-template.title" (the key) and update the same key/value pair (your.key=your value) in src/main/resources/i18n/WebGoatLabels.properties + d. Implement a new value for the getId method, which leads us to ... + +2. The HTML content framing ... + a. Rename the provided file in src/main/resources/html using your value from the getId method in your lesson's base class (e.g. public String getId() { return "your-lesson"; } >> "your-lesson.html") + b. Modify that file following the commented instructions in there + c. In conjunction with this file you + +3. Assignment Endpoints + a. In the above html file, you will see an example of an 'attack form'. You can create endpoints to handle these attacks and provide the user feedback and simulated output. See the example file here as well as other existing lessons for ways to extend these. You will extend the AssignmentEndpoint as the example will show + b. You can also create supporting (non-assignment) endpoints, that are not evaluated/graded. + c. See other lesson examples for creating unit/integration tests for your project as well + + +4. Getting your lesson to show up + a. modify the webgoat-lessons/pom.xml to include your project in the section + + + webgoat-lesson-template + + + + b. modify the webgoat-server/pom.xml to add your project as a dependency in the section ... + + + +
+ + +
+ + +
+ +
+ + +
+
+ + + + + +