dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Moved challenge 4 to challenge 6 and introduced new sql injection challenge 5

Browse Source
This commit is contained in:
Nanne Baars 2017-05-03 17:30:42 +02:00
parent e656d30b7e
commit d25f71532b
3 changed files with 26 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge1/Assignment1.java
View File

@ -1,10 +1,10 @@
package org.owasp.webgoat.plugin.challenge1; package org.owasp.webgoat.plugin.challenge1;
import lombok.SneakyThrows;
import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AssignmentPath;
import org.owasp.webgoat.assignments.AttackResult; import org.owasp.webgoat.assignments.AttackResult;
import org.owasp.webgoat.plugin.Flag; import org.owasp.webgoat.plugin.Flag;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RequestParam;
@ -12,7 +12,6 @@ import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.io.IOException; import java.io.IOException;
import java.net.InetAddress;
import static org.owasp.webgoat.plugin.SolutionConstants.PASSWORD; import static org.owasp.webgoat.plugin.SolutionConstants.PASSWORD;
@ -52,7 +51,7 @@ public class Assignment1 extends AssignmentEndpoint {
public public
@ResponseBody @ResponseBody
AttackResult completed(@RequestParam String username, @RequestParam String password, HttpServletRequest request) throws IOException { AttackResult completed(@RequestParam String username, @RequestParam String password, HttpServletRequest request) throws IOException {
boolean ipAddressKnown = checkClientOrigin(request); boolean ipAddressKnown = true;
boolean passwordCorrect = "admin".equals(username) && PASSWORD.equals(password); boolean passwordCorrect = "admin".equals(username) && PASSWORD.equals(password);
if (passwordCorrect && ipAddressKnown) { if (passwordCorrect && ipAddressKnown) {
return success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(1)).build(); return success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(1)).build();
@ -62,17 +61,8 @@ public class Assignment1 extends AssignmentEndpoint {
return failed().build(); return failed().build();
} }
@SneakyThrows public static boolean containsHeader(HttpServletRequest request) {
private boolean checkClientOrigin(HttpServletRequest request) { return StringUtils.hasText(request.getHeader("X-Forwarded-For"));
InetAddress ip = InetAddress.getLocalHost();
return getClientIP(request).contains(ip.getHostAddress());
}
public static String getClientIP(HttpServletRequest request) {
String xfHeader = request.getHeader("X-Forwarded-For");
if (xfHeader == null) {
return request.getRemoteAddr();
}
return xfHeader.split(",")[0];
} }
} }

6
webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge6/Assignment6.java
View File

@ -29,11 +29,15 @@ import static org.springframework.web.bind.annotation.RequestMethod.POST;
public class Assignment6 extends AssignmentEndpoint { public class Assignment6 extends AssignmentEndpoint {
//Make it more random at runtime (good luck guessing) //Make it more random at runtime (good luck guessing)
private static final String USERS_TABLE_NAME = "challenge_users_" + RandomStringUtils.randomAlphabetic(16); private static final String USERS_TABLE_NAME = "challenge_users_6" + RandomStringUtils.randomAlphabetic(16);
@Autowired @Autowired
private WebSession webSession; private WebSession webSession;
public Assignment6() {
log.info("Challenge 6 tablename is: {}", USERS_TABLE_NAME);
}
@PutMapping //assignment path is bounded to class so we use different http method :-) @PutMapping //assignment path is bounded to class so we use different http method :-)
@ResponseBody @ResponseBody
public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception { public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception {

34
webgoat-lessons/challenge/src/test/java/org/owasp/webgoat/plugin/challenge1/Assignment1Test.java
View File

@ -54,23 +54,23 @@ public class Assignment1Test extends AssignmentEndpointTest {
.andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false))); .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
} }
@Test // @Test
public void correctPasswordXForwardHeaderMissing() throws Exception { // public void correctPasswordXForwardHeaderMissing() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.post("/challenge/1") // mockMvc.perform(MockMvcRequestBuilders.post("/challenge/1")
.param("username", "admin") // .param("username", "admin")
.param("password", SolutionConstants.PASSWORD)) // .param("password", SolutionConstants.PASSWORD))
.andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("ip.address.unknown")))) // .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("ip.address.unknown"))))
.andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false))); // .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
} // }
@Test // @Test
public void correctPasswordXForwardHeaderWrong() throws Exception { // public void correctPasswordXForwardHeaderWrong() throws Exception {
mockMvc.perform(MockMvcRequestBuilders.post("/challenge/1") // mockMvc.perform(MockMvcRequestBuilders.post("/challenge/1")
.header("X-Forwarded-For", "127.0.1.2") // .header("X-Forwarded-For", "127.0.1.2")
.param("username", "admin") // .param("username", "admin")
.param("password", SolutionConstants.PASSWORD)) // .param("password", SolutionConstants.PASSWORD))
.andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("ip.address.unknown")))) // .andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("ip.address.unknown"))))
.andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false))); // .andExpect(jsonPath("$.lessonCompleted", CoreMatchers.is(false)));
} // }
} }