diff --git a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html similarity index 63% rename from webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html rename to webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html index 9a5056086..adc96712f 100644 --- a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1/MultiLevelLogin1.html +++ b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1.html @@ -32,18 +32,39 @@ works. In the second you have to breake the strong authentication.

Stage 1
This stage should be rather straight forward. Give in as name Jane -and as password tarzan. Afther clicking on the submit button -you will be asked for the TAN. Choose the correct TAN from the +and as password tarzan.

+
+
+Image 1: Login Screen +

+Afthr clicking on the submit button +you will be asked for the TAN.

+
+
+Image 2: TAN Screen +
+
+Choose the correct TAN from the list provided, click on the submit button and you are done. -

+

Stage 2
The first step in this stage is equal to Stage 1. Log in as Jane with tarzan. -Now you will be asked for a TAN. Unfortunately the TAN you have only a already +Now you will be asked for a TAN. Unfortunately you have only a already used TAN from the victim. Fill in the TAN you have and make sure that WebScarab will intercept the next request. Hit the submit button and change the hidden_tan -value to 1. Congratulations you are logged in as Jane. -

+value to 1.

+
+
+Image 3: Manipulation Of The Hidden Field With WebScarab +


+Congratulations you are logged in as Jane.

+ +
+
+Image 3: Manipulation Of The Hidden Field With WebScarab +
+ diff --git a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/login.png b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/login.png new file mode 100644 index 000000000..2cf17feb8 Binary files /dev/null and b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/login.png differ diff --git a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/success.png b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/success.png new file mode 100644 index 000000000..3179d178e Binary files /dev/null and b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/success.png differ diff --git a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/tan.png b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/tan.png new file mode 100644 index 000000000..896334751 Binary files /dev/null and b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/tan.png differ diff --git a/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/webscarab.png b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/webscarab.png new file mode 100644 index 000000000..75acaa951 Binary files /dev/null and b/webgoat/main/project/WebContent/lesson_solutions/MultiLevelLogin1_files/webscarab.png differ