-Welcome to a short introduction of WebGoat.
+Welcome to a short introduction to WebGoat.
Here you will learn how to use WebGoat and additional tools for the lessons.
Always read first the lessons plan. Then try to solve the lesson and if necessary, use the hints. If you cannot solve the lesson using the hints, you may watch the -solution. Here every step is explained.
+solution. Every step is explained there.
-To read and edit Parameters you need a proxy to intercept the HTTP request.
+To read and edit Parameters you need a local proxy to intercept the HTTP request.
Here we use WebScarab. More informations to WebScarab you will get in the
Chapter "Useful Tools".
-After installing WebScarab and making a proxy on localhost we can start.
+After installing WebScarab and using it as proxy on localhost we can start.
-We have to select "intercept request" in the tab "Intercept". If we send a new HTTP request now, we get a new WebScarab window.
+We have to select "Intercept Request" in the tab "Intercept". If we send a HTTP request we get a new WebScarab window.
Here we can read and edit the sent parameter. After "Accept changes" the request will be sent to the server.
Often it is not only necessary to change the value of parameters but to change the value of cookies. We use again WebScarab and intercept the request as explained in the last topic.
-We again get the new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit the values of them.
+We get a new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit the values of them.
WebGoat comes with a sane default setup for Tomcat. This page will explain the setup -and which further possibilites you have to setup Tomcat. This is just +
WebGoat comes with sane default configurations for Tomcat. This page will explain the configurations +and which further possibilities you have to configure Tomcat. This is just a short description which should be enough in most cases. For more advanced tasks please refer to the Tomcat documentation. Please note that all solutions -are written for the standard setup on port 80. If you use another configuration you have -to ajust the solution to your configuration.
+are written for the standard configurations on port 80. If you use another configurations you have +to adjust the solution to your configurations. -There are two standard Tomcat setups. In this setups WebGoat is only reachable from within +
There are two standard Tomcat configurations. In this configurations WebGoat is only reachable from within the localhost. Both are identically with the only difference - that one is running on port 80 and 443 (SSL) and the other on 8080 and 8443. In Linux you have + that in one tomcat is running on port 80 and 443 (SSL) and in the other tomcat is running on port 8080 and 8443. In Linux you have to start WebGoat as root or with sudo if you want to run it on port 80 and 443. As running software as root is dangerous we strongly advice to use the port 8080 and 8443. In Windows you can run WebGoat.bat to run it on port 80 and WebGoat_8080.bat to run it on port 8080. In Linux you can use webgoat.sh and run it with webgoat.sh start80 or wegoat.sh start8080. The user in these -setups is guest with password guest +configurations is guest with password guest
-If you are a single user of WebGoat the standard setups should be +If you are a single user of WebGoat the standard configurations should be enough but if you want to use WebGoat in laboratory or in class there -might be the need to change the configuration. Before changing +might be the need to change the configurations. Before changing the configurations we recommend doing a backup of the files you change.
@@ -54,13 +54,13 @@ In this example to port 8442:THIS MAKES IT POSSIBLE TO REALLY ATTACK YOUR SERVER! DO NOT DO THIS UNTIL YOU KNOW WHAT YOU ARE DOING. THIS CONFIGURATION SHOULD BE ONLY USED IN SAVE NETWORKS!
-By its default configuration WebGoat is only +
By its default configurations WebGoat is only reachable within the localhost. In a laboratory or a class there is maybe the need of having a server and a few clients. In this case it is possible to make WebGoat reachable.
The reason why WebGoat is only reachable within the localhost is -the parameter address in the connectors in server_80.xml. It is set +the parameter address in the connectors for the non-SSL and SSL connection in server_80.xml. It is set to 127.0.0.1. The applications only listens on the port of this address for incoming connections if it is set. If you remove this parameter the server listens on all IPs on the specific port.
@@ -79,10 +79,10 @@ only discussed the whitebox approach. You have to add following lines to the HosIn this case only localhost, ip1 and ip2 are permitted to connect.
-Usually using WebGoat you just use the user guest with the password guest. -But maybe in laboratory you have made a configuration with one server and a lot of +But maybe in laboratory you have made a setup with one server and a lot of clients. In this case you might want to have a user for every client and you have to alter tomcat-users.xml in tomcat/conf as the users are stored there. We recommend not to use real passwords diff --git a/main/project/WebContent/lesson_plans/UsefulTools.html b/main/project/WebContent/lesson_plans/UsefulTools.html index 67586e959..0de90cfaa 100644 --- a/main/project/WebContent/lesson_plans/UsefulTools.html +++ b/main/project/WebContent/lesson_plans/UsefulTools.html @@ -6,8 +6,8 @@ Here we want to present you some useful tools. You will need WebScarab to solve most of the lessons.
-As WebGoat, WebScarab is a part of OWASP.
-WebScarab is a framework for analysing applications that
+Like WebGoat, WebScarab is a part of OWASP.
+WebScarab is a framework for analyzing applications that
communicate using the HTTP and HTTPS protocols. Because WebScarab
operates as an intercepting proxy, we can review and modify requests
and responses.
@@ -20,11 +20,21 @@ Firebug is an add-on for the Firefox browser. We can use it to inspect, edit and
Webpage:http://www.getfirebug.com
-IEWatch:
+
IEWatch is a tool to analyse HTTP and HTML for users of the Internet Explorer.
Webpage:http://www.iewatch.com
+Wireshark is a network protocol analyzer. You can sniff network traffic and gather useful
+informations this way.
+
+Webpage:http://www.wireshark.org
+
+
There exist a lot of vulnerability scanner for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Here the links to two open source scanner.