initial cut on auth-bypass lesson

webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AccountVerificationHelper.java

@@ -0,0 +1,69 @@
+package org.owasp.webgoat.plugin;
+
+import org.jcodings.util.Hash;
+import org.owasp.webgoat.session.UserSessionData;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Created by appsec on 7/18/17.
+ */
+public class AccountVerificationHelper {
+
+
+
+    //simulating database storage of verification credentials
+    private  static final Integer verifyUserId = new Integer(1223445);
+    private static final Map<String,String> userSecQuestions = new HashMap<>();
+    static {
+        userSecQuestions.put("secQuestion0","Mr. Hamurabi");
+        userSecQuestions.put("secQuestion1","Baker Street");
+    }
+
+    private static final Map<Integer,Map> secQuestionStore = new HashMap<>();
+    static {
+        secQuestionStore.put(verifyUserId,userSecQuestions);
+    }
+    // end 'data store set up'
+
+    // this is to aid feedback in the attack process and is not intended to be part of the 'vulnerable' code
+    public boolean didUserLikelylCheat(HashMap<String,String> submittedAnswers) {
+        boolean likely = false;
+
+        if (submittedAnswers.size() == secQuestionStore.get(verifyUserId).size()) {
+            likely = true;
+        }
+
+        if ((submittedAnswers.containsKey("secQuestion0") && submittedAnswers.get("secQuestion0").equals(secQuestionStore.get(verifyUserId).get("secQuestion0"))) &&
+                (submittedAnswers.containsKey("secQuestion1") && submittedAnswers.get("seQuestion1").equals(secQuestionStore.get(verifyUserId).get("secQuestion1"))) ) {
+            likely = true;
+        } else {
+            likely = false;
+        }
+
+        return likely;
+
+    }
+    //end of cheating check ... the method below is the one of real interest. Can you find the flaw?
+
+    public boolean verifyAccount(Integer userId, HashMap<String,String> submittedQuestions ) {
+        //short circuit if no questions are submitted
+        if (submittedQuestions.entrySet().size() != secQuestionStore.get(verifyUserId).size()) {
+            return false;
+        }
+
+        if (submittedQuestions.containsKey("secQuestion0") && !submittedQuestions.get("secQuestion0").equals(secQuestionStore.get(verifyUserId).get("secQuestion0"))) {
+            return false;
+        }
+
+        if (submittedQuestions.containsKey("secQuestion1") && !submittedQuestions.get("seQuestion1").equals(secQuestionStore.get(verifyUserId).get("secQuestion1"))) {
+            return false;
+        }
+
+        // else
+        return true;
+
+    }
+}

webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java

@@ -0,0 +1,65 @@
+package org.owasp.webgoat.plugin;
+
+import com.beust.jcommander.internal.Lists;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.NewLesson;
+
+import java.util.List;
+
+/**
+ * ************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * <p>
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ * <p>
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * <p>
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * <p>
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * <p>
+ * Getting Source ==============
+ * <p>
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * <p>
+ *
+ * @author misfir3
+ * @version $Id: $Id
+ * @since January 3, 2017
+ */
+public class AuthBypass extends NewLesson {
+
+    @Override
+    public Category getDefaultCategory() {
+        return Category.AUTHENTICATION;
+    }
+
+    @Override
+    public List<String> getHints() {
+        return Lists.newArrayList();
+    }
+
+    @Override
+    public Integer getDefaultRanking() {
+        return 30;
+    }
+
+    @Override
+    public String getTitle() {
+        return "auth-bypass.title";
+    }
+
+    @Override
+    public String getId() {
+        return "AuthBypass";
+    }
+
+}

webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java

@@ -0,0 +1,77 @@
+package org.owasp.webgoat.plugin;
+
+import com.google.common.collect.Lists;
+import org.jcodings.util.Hash;
+import org.owasp.webgoat.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.assignments.AssignmentPath;
+import org.owasp.webgoat.assignments.AttackResult;
+import org.owasp.webgoat.session.UserSessionData;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.*;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+
+import java.util.Map;
+
+/**
+ * Created by jason on 1/5/17.
+ */
+
+@AssignmentPath("/auth-bypass/verify-account")
+public class VerifyAccount extends AssignmentEndpoint {
+
+    String secretValue = "secr37Value";
+
+    //UserSessionData is bound to session and can be used to persist data across multiple assignments
+    @Autowired
+    UserSessionData userSessionData;
+
+
+    @PostMapping(produces = {"application/json"})
+    @ResponseBody
+    public AttackResult completed(@RequestParam String userId, @RequestParam String verifyMethod, HttpServletRequest req) throws ServletException, IOException {
+
+
+        AccountVerificationHelper verificationHelper = new AccountVerificationHelper();
+        Map<String,String> submittedAnswers = parseSecQuestions(req);
+        if (verificationHelper.didUserLikelylCheat((HashMap)submittedAnswers)) {
+            return trackProgress(failed()
+            .feedback("verify-account.cheated")
+            .output("Yes, you guessed correcctly,but see the feedback message")
+            .build());
+        }
+
+        // else
+        if (verificationHelper.verifyAccount(new Integer(userId),(HashMap)submittedAnswers)) {
+            return trackProgress(success()
+            .feedback("verify-account.success")
+            .build());
+        } else {
+            return trackProgress(failed()
+            .feedback("verify-account.failed")
+            .build());
+        }
+
+    }
+
+    private HashMap<String,String> parseSecQuestions (HttpServletRequest req) {
+
+        Map <String,String> userAnswers = new HashMap<>();
+        List<String> paramNames = Collections.list(req.getParameterNames());
+        for  (String paramName : paramNames) {
+            //String paramName = req.getParameterNames().nextElement();
+            if (paramName.contains("secQuestion")) {
+                userAnswers.put(paramName,req.getParameter(paramName));
+            }
+        }
+        return (HashMap)userAnswers;
+
+    }
+
+}