diff --git a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin1.java b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin1.java
index 7d7d28870..688904a96 100644
--- a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin1.java
+++ b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin1.java
@@ -821,7 +821,7 @@ public class MultiLevelLogin1 extends SequentialLessonAdapter
if (getLessonTracker(s).getStage() == 1)
{
instructions = "STAGE 1:\t This stage is just to show how a classic multi login works. "
- + "Your goal is to do a regular login as Jane with password tarzan. "
+ + "Your goal is to do a regular login as Jane with password tarzan. "
+ "You have following TAN:
" + "Tan #1 = 15648
" + "Tan #2 = 92156
"
+ "Tan #3 = 4879
" + "Tan #4 = 9458
" + "Tan #5 = 4879
";
diff --git a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin2.java b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin2.java
index ac11b0cf7..138a65ffb 100644
--- a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin2.java
+++ b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/MultiLevelLogin2.java
@@ -798,7 +798,7 @@ public class MultiLevelLogin2 extends LessonAdapter
String instructions = "";
instructions = "You are an attacker called Joe. You have a valid account by webgoat financial. Your goal is to log in as "
- + "Jane. Your username is Joe and your password is banana. This are your TANS:
"
+ + "Jane. Your username is Joe and your password is banana. This are your TANS:
"
+ "Tan #1 = 15161
"
+ "Tan #2 = 4894
"
+ "Tan #3 = 18794
"
diff --git a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java
index 75ab86aff..3e8ec5929 100644
--- a/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java
+++ b/webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java
@@ -148,7 +148,7 @@ public class SessionFixation extends SequentialLessonAdapter
{
s.add(MAILCONTENTNAME, mailContent);
}
- if (mailContent.contains(getLink()+"&SID=") && getLessonTracker(s).getStage() == 1)
+ if ((mailContent.contains("&SID=") || mailContent.contains("?SID=")) && getLessonTracker(s).getStage() == 1)
{
getLessonTracker(s).setStage(2);
s.setMessage("You completed stage 1!");
@@ -234,7 +234,7 @@ public class SessionFixation extends SequentialLessonAdapter
ElementContainer ec = new ElementContainer();
ec.addElement("