submittedQuestions ) {
+ //short circuit if no questions are submitted
+ if (submittedQuestions.entrySet().size() != secQuestionStore.get(verifyUserId).size()) {
+ return false;
+ }
+
+ if (submittedQuestions.containsKey("secQuestion0") && !submittedQuestions.get("secQuestion0").equals(secQuestionStore.get(verifyUserId).get("secQuestion0"))) {
+ return false;
+ }
+
+ if (submittedQuestions.containsKey("secQuestion1") && !submittedQuestions.get("seQuestion1").equals(secQuestionStore.get(verifyUserId).get("secQuestion1"))) {
+ return false;
+ }
+
+ // else
+ return true;
+
+ }
+}
diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java
new file mode 100644
index 000000000..3588303c4
--- /dev/null
+++ b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java
@@ -0,0 +1,65 @@
+package org.owasp.webgoat.plugin;
+
+import com.beust.jcommander.internal.Lists;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.NewLesson;
+
+import java.util.List;
+
+/**
+ * ************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *
+ *
+ * @author misfir3
+ * @version $Id: $Id
+ * @since January 3, 2017
+ */
+public class AuthBypass extends NewLesson {
+
+ @Override
+ public Category getDefaultCategory() {
+ return Category.AUTHENTICATION;
+ }
+
+ @Override
+ public List getHints() {
+ return Lists.newArrayList();
+ }
+
+ @Override
+ public Integer getDefaultRanking() {
+ return 30;
+ }
+
+ @Override
+ public String getTitle() {
+ return "auth-bypass.title";
+ }
+
+ @Override
+ public String getId() {
+ return "AuthBypass";
+ }
+
+}
diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java
new file mode 100644
index 000000000..a5e671712
--- /dev/null
+++ b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java
@@ -0,0 +1,77 @@
+package org.owasp.webgoat.plugin;
+
+import com.google.common.collect.Lists;
+import org.jcodings.util.Hash;
+import org.owasp.webgoat.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.assignments.AssignmentPath;
+import org.owasp.webgoat.assignments.AttackResult;
+import org.owasp.webgoat.session.UserSessionData;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.*;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+
+import java.util.Map;
+
+/**
+ * Created by jason on 1/5/17.
+ */
+
+@AssignmentPath("/auth-bypass/verify-account")
+public class VerifyAccount extends AssignmentEndpoint {
+
+ String secretValue = "secr37Value";
+
+ //UserSessionData is bound to session and can be used to persist data across multiple assignments
+ @Autowired
+ UserSessionData userSessionData;
+
+
+ @PostMapping(produces = {"application/json"})
+ @ResponseBody
+ public AttackResult completed(@RequestParam String userId, @RequestParam String verifyMethod, HttpServletRequest req) throws ServletException, IOException {
+
+
+ AccountVerificationHelper verificationHelper = new AccountVerificationHelper();
+ Map submittedAnswers = parseSecQuestions(req);
+ if (verificationHelper.didUserLikelylCheat((HashMap)submittedAnswers)) {
+ return trackProgress(failed()
+ .feedback("verify-account.cheated")
+ .output("Yes, you guessed correcctly,but see the feedback message")
+ .build());
+ }
+
+ // else
+ if (verificationHelper.verifyAccount(new Integer(userId),(HashMap)submittedAnswers)) {
+ return trackProgress(success()
+ .feedback("verify-account.success")
+ .build());
+ } else {
+ return trackProgress(failed()
+ .feedback("verify-account.failed")
+ .build());
+ }
+
+ }
+
+ private HashMap parseSecQuestions (HttpServletRequest req) {
+
+ Map userAnswers = new HashMap<>();
+ List paramNames = Collections.list(req.getParameterNames());
+ for (String paramName : paramNames) {
+ //String paramName = req.getParameterNames().nextElement();
+ if (paramName.contains("secQuestion")) {
+ userAnswers.put(paramName,req.getParameter(paramName));
+ }
+ }
+ return (HashMap)userAnswers;
+
+ }
+
+}
diff --git a/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store b/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store
new file mode 100644
index 000000000..6efa04a20
Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store differ
diff --git a/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store b/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store
new file mode 100644
index 000000000..5008ddfcf
Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store differ
diff --git a/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html b/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html
new file mode 100644
index 000000000..e5d8f7f93
--- /dev/null
+++ b/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html
@@ -0,0 +1,67 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+