diff --git a/webgoat-lessons/csrf/pom.xml b/webgoat-lessons/csrf/pom.xml new file mode 100644 index 000000000..3845faaa4 --- /dev/null +++ b/webgoat-lessons/csrf/pom.xml @@ -0,0 +1,11 @@ + + 4.0.0 + csrf + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html new file mode 100644 index 000000000..e10652683 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html @@ -0,0 +1,178 @@ + + +
+ + +
+
+ +
+ + +
+
+ +
+ + +
+ +
+ + + +
+ +
+ Registration form + + + + + + + + + + + + + + + + + + +
Username
E-mail
Password
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+ +
+ + +
+
+ + + +
+ +
+ Registration form + + + + + + + + + + + + + + + + + + +
Username
E-mail
Password
+
+
+ +
+
+
+ +
+
+ + +
+ + +
+
+ +
+ + +
+
+ +
+ + +
+
+ + + +
+ +
+ Registration form + + + + + + + + + + + + + + + + + + +
Username
E-mail
Password
+
+
+ +
+
+
+ +
+
+ + +
+ + +
+
+ + + \ No newline at end of file diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js new file mode 100644 index 000000000..b38c2d9c2 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/js/xxe.js @@ -0,0 +1,15 @@ +webgoat.customjs.register = function () { + var xml = '' + + '' + + ' ' + 'test' + '' + + ' ' + 'test' + '' + + ''; + return xml; +} +webgoat.customjs.registerJson = function () { + var json = '{' + + ' "user":' + '"test"' + + ' "password":' + '"test"' + + '}'; + return json; +} diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc new file mode 100644 index 000000000..b0271a5f7 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc @@ -0,0 +1,10 @@ +== CSRF with a GET request + +This is the most easiest CSRF attack to perform. For example you receive an e-mail with the following content: + +`View my Pictures!` + +If the user is still logged in to the website of bank.com this simple GET request will transfer money from one account to another. +Of course in most cases the website might have multiple controls to approve the request. + + diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc new file mode 100644 index 000000000..3cfda81aa --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc @@ -0,0 +1,27 @@ +=== What is a Crosse-site request forgery? + +Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF +(sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted +from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF +exploits the trust that a site has in a user's browser. + +A cross-site request forgery is a confused deputy attack against a web browser. CSRF commonly has the following characteristics: + +* It involves sites that rely on a user's identity. +* It exploits the site's trust in that identity. +* It tricks the user's browser into sending HTTP requests to a target site. +* It involves HTTP requests that have side effects. + +At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize +the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site +that trusts the user and thereby causes an unwanted action. + +CSRF attacks target functionality that causes a state change on the server, such as changing the victim's email address or password, or purchasing +something. Forcing the victim to retrieve data doesn't benefit an attacker because the attacker doesn't receive the response, the victim does. +As such, CSRF attacks target state-changing requests. + +Let's continue with some exercises to address way to perform a CSRF request. + + + + diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc new file mode 100644 index 000000000..1cb953de9 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc @@ -0,0 +1,10 @@ += Cross-site request forgery (CSRF) + +== Concept + +This lesson teaches how to what a CSRF attack is and how it can be abused and protected against. + +== Goals + +* The user should have basic knowledge of JavaScript +* The user will learn to perform a CSRF attack and how to protected against it. diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt new file mode 100644 index 000000000..e4ec56814 --- /dev/null +++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/secret.txt @@ -0,0 +1 @@ +WebGoat 8 rocks... \ No newline at end of file