From ceb0286109e7ffccfd6fff15d255e1bfaac9962e Mon Sep 17 00:00:00 2001
From: "wirth.marcel"
Date: Sun, 13 Apr 2008 11:54:42 +0000
Subject: [PATCH] solution for MultiLevelLogin1 altered
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@321 4033779f-a91e-0410-96ef-6bf7bf53c507
---
.../MultiLevelLogin1.html | 33 ++++++++++++++----
.../MultiLevelLogin1_files/login.png | Bin 0 -> 36792 bytes
.../MultiLevelLogin1_files/success.png | Bin 0 -> 42469 bytes
.../MultiLevelLogin1_files/tan.png | Bin 0 -> 43778 bytes
.../MultiLevelLogin1_files/webscarab.png | Bin 0 -> 20732 bytes
5 files changed, 27 insertions(+), 6 deletions(-)
rename main/project/WebContent/lesson_solutions/{MultiLevelLogin1 => }/MultiLevelLogin1.html (63%)
create mode 100644 main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/login.png
create mode 100644 main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/success.png
create mode 100644 main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/tan.png
create mode 100644 main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/webscarab.png
diff --git a/main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html b/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html
similarity index 63%
rename from main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html
rename to main/project/WebContent/lesson_solutions/MultiLevelLogin1.html
index 9a5056086..adc96712f 100644
--- a/main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html
+++ b/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html
@@ -32,18 +32,39 @@ works. In the second you have to breake the strong authentication.
Stage 1
This stage should be rather straight forward. Give in as name Jane
-and as password tarzan. Afther clicking on the submit button
-you will be asked for the TAN. Choose the correct TAN from the
+and as password tarzan.
+
+
+Image 1: Login Screen
+
+Afthr clicking on the submit button
+you will be asked for the TAN.
+
+
+Image 2: TAN Screen
+
+
+Choose the correct TAN from the
list provided, click on the submit button and you are done.
-
+
Stage 2
The first step in this stage is equal to Stage 1. Log in as Jane with tarzan.
-Now you will be asked for a TAN. Unfortunately the TAN you have only a already
+Now you will be asked for a TAN. Unfortunately you have only a already
used TAN from the victim. Fill in the TAN you have and make sure that WebScarab
will intercept the next request. Hit the submit button and change the hidden_tan
-value to 1. Congratulations you are logged in as Jane.
-
+value to 1.
+
+
+Image 3: Manipulation Of The Hidden Field With WebScarab
+
+Congratulations you are logged in as Jane.
+
+
+
+Image 3: Manipulation Of The Hidden Field With WebScarab
+
+