Concept / Topic To Teach:
-In role-based access control scheme, a role represents a set of access permissions and privileges. A user can be assigned one or more roles. A role-based access control normally consists of two parts: role permission management and role assignment. A broken role-based access control scheme might allow a user to perform accesses that are not allowed by his/her assigned roles, or somehow obtain unauthorized roles. +In a role-based access control scheme, a role represents a set of access permissions and privileges. A user can be assigned one or more roles. A role-based access control scheme normally consists of two parts: role permission management and role assignment. A broken role-based access control scheme might allow a user to perform accesses that are not allowed by his/her assigned roles, or somehow allow privilege escalation to an unauthorized role.General Goal(s):
Each user is a member of a role that is allowed to access only certain resources. Your goal is to explore the access control rules that govern this site. Only the [Admin] group should have access to the 'Account Manager' resource. diff --git a/ webgoat/main/project/WebContent/lesson_plans/BasicAuthentication.html b/ webgoat/main/project/WebContent/lesson_plans/BasicAuthentication.html index 3d1af4778..73a3c736d 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/BasicAuthentication.html +++ b/ webgoat/main/project/WebContent/lesson_plans/BasicAuthentication.html @@ -7,4 +7,3 @@ Basic Authentication is used to protect server side resources. The web server wGeneral Goal(s):
For this lesson, your goal is to understand Basic Authentication and answer the questions below. - diff --git a/ webgoat/main/project/WebContent/lesson_plans/SoapRequest.html b/ webgoat/main/project/WebContent/lesson_plans/SoapRequest.html index 4daca7fda..1b7b6b0e4 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/SoapRequest.html +++ b/ webgoat/main/project/WebContent/lesson_plans/SoapRequest.html @@ -3,7 +3,7 @@Concept / Topic To Teach:
-Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function listed in the web service definition language (WSDL). Lets learn something about WSDL files. Check out WebGoats web service description language (WSDL) file. +Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function defined in the web service definition language (WSDL). Let's learn something about WSDL files. Check out WebGoat's web service description language (WSDL) file.General Goal(s):
Try connecting to the WSDL with a browser or Web Service tool. The URL for the web service is: http://localhost/WebGoat/services/SoapRequest The WSDL can usually be viewed by adding a ?WSDL on the end of the web service request. \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/SqlNumericInjection.html b/ webgoat/main/project/WebContent/lesson_plans/SqlNumericInjection.html index 4b6c33184..17a789ba9 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/SqlNumericInjection.html +++ b/ webgoat/main/project/WebContent/lesson_plans/SqlNumericInjection.html @@ -4,11 +4,11 @@Concept / Topic To Teach:
-SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks an incredible number of systems on the internet are susceptible to this form of attack. +SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks, an incredible number of systems on the internet are susceptible to this form of attack. +General Goal(s):
The form below allows a user to view weather data. Try to inject an SQL string that results in all the weather data being displayed. - + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/SqlStringInjection.html b/ webgoat/main/project/WebContent/lesson_plans/SqlStringInjection.html index 542563590..32f6d4bac 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/SqlStringInjection.html +++ b/ webgoat/main/project/WebContent/lesson_plans/SqlStringInjection.html @@ -4,11 +4,11 @@Concept / Topic To Teach:
-SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks an incredible number of systems on the internet are susceptible to this form of attack. +SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks, an incredible number of systems on the internet are susceptible to this form of attack. +General Goal(s):
The form below allows a user to view their credit card numbers. Try to inject an SQL string that results in all the credit card numbers being displayed. Try the user name of 'Smith'. - + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/StoredXss.html b/ webgoat/main/project/WebContent/lesson_plans/StoredXss.html index f03b3f690..e2662164f 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/StoredXss.html +++ b/ webgoat/main/project/WebContent/lesson_plans/StoredXss.html @@ -3,7 +3,7 @@Concept / Topic To Teach:
-It is always a good practice to scrub all inputs, especially those inputs that will later be used as parameters to OS commands, scripts, and database queries. It is particularly important for content that will be permanently stored somewhere. Users should not be able to create message content that could cause another user to load an undesirable page or undesirable content when the user's message is retrieved. +It is always a good practice to scrub all input, especially those inputs that will later be used as parameters to OS commands, scripts, and database queries. It is particularly important for content that will be permanently stored somewhere in the application. Users should not be able to create message content that could cause another user to load an undesireable page or undesireable content when the user's message is retrieved.General Goal(s):
-The user should be able to add message content that cause another user to load an undesirable page or content. +The user should be able to add message content that cause another user to load an undesireable page or content. \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/TraceXSS.html b/ webgoat/main/project/WebContent/lesson_plans/TraceXSS.html index 6371eef38..d22b03b1a 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/TraceXSS.html +++ b/ webgoat/main/project/WebContent/lesson_plans/TraceXSS.html @@ -3,7 +3,7 @@Concept / Topic To Teach:
-It is always a good practice to scrub all inputs, especially those inputs that will later be used as parameters to OS commands, scripts, and database queries. It is particularly important for content that will be permanently stored somewhere. Users should not be able to create message content that could cause another user to load an undesirable page or undesirable content when the user's message is retrieved. +It is always a good practice to scrub all input, especially those inputs that will later be used as parameters to OS commands, scripts, and database queries. It is particularly important for content that will be permanently stored somewhere in the application. Users should not be able to create message content that could cause another user to load an undesireable page or undesireable content when the user's message is retrieved.General Goal(s):
Tomcat is configured to support the HTTP TRACE command. Your goal is to perform a Cross Site Trace (XST) attack. - + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/WSDLScanning.html b/ webgoat/main/project/WebContent/lesson_plans/WSDLScanning.html index df11d5a65..dd80ef598 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/WSDLScanning.html +++ b/ webgoat/main/project/WebContent/lesson_plans/WSDLScanning.html @@ -3,7 +3,7 @@Concept / Topic To Teach:
-Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function listed in the web service definition language (WSDL). +Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function defined in the web service definition language (WSDL) file.General Goal(s):
-This screen is the API for a web service. Check the WSDL for this web service and try to get some customer credit numbers. +This screen is the API for a web service. Check the WSDL file for this web service and try to get some customer credit numbers. \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_plans/WsSAXInjection.html b/ webgoat/main/project/WebContent/lesson_plans/WsSAXInjection.html index 2a8967289..23a2e8607 100644 --- a/ webgoat/main/project/WebContent/lesson_plans/WsSAXInjection.html +++ b/ webgoat/main/project/WebContent/lesson_plans/WsSAXInjection.html @@ -3,7 +3,10 @@Concept / Topic To Teach:
-Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function listed in the web service definition language (WSDL). +Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function defined in the web service definition language (WSDL) file.General Goal(s):
-Some web interfaces make use of Web Services in the background. If the front-end relies on the web service for all input validation, it may be possible to corrupt the XML that the web interface sends.Concept / Topic To Teach:
-Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function listed in the web service definition language (WSDL). +Web Services communicate through the use of SOAP requests. These requests are submitted to a web service in an attempt to execute a function defined in the web service definition language (WSDL) file.General Goal(s):
-Check the web service description language (WSDL) and try to obtain multiple customers credit card numbers. You will not see the results returned to this screen. When you believe you have succeeded, refresh the page and look for the 'green star' - +Check the web service description language (WSDL) file and try to obtain multiple customer credit card numbers. You will not see the results returned to this screen. When you believe you have suceeded, refresh the page and look for the 'green star'. + \ No newline at end of file