Merge branch 'next' of https://github.com/WebGoat/WebGoat into next
This commit is contained in:
diver-sity
@ -2,84 +2,85 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>Login Page</title>
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css">
|
||||
<style type="text/css">
|
||||
body {
|
||||
padding-top: 40px;
|
||||
padding-bottom: 40px;
|
||||
background-color: #f5f5f5;
|
||||
}
|
||||
<!--[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
|
||||
<!--[if IE 7]> <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
|
||||
<!--[if IE 8]> <html class="no-js lt-ie9"> <![endif]-->
|
||||
<!--[if gt IE 8]><!-->
|
||||
|
||||
.form-signin {
|
||||
max-width: 300px;
|
||||
padding: 19px 29px 29px;
|
||||
margin: 0 auto 20px;
|
||||
background-color: #fff;
|
||||
border: 1px solid #e5e5e5;
|
||||
-webkit-border-radius: 5px;
|
||||
-moz-border-radius: 5px;
|
||||
border-radius: 5px;
|
||||
-webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
-moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
}
|
||||
.form-signin .form-signin-heading,
|
||||
.form-signin .checkbox {
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.form-signin input[type="text"],
|
||||
.form-signin input[type="password"] {
|
||||
font-size: 16px;
|
||||
height: auto;
|
||||
margin-bottom: 15px;
|
||||
padding: 7px 9px;
|
||||
}
|
||||
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
|
||||
<div class="container">
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
<form class="form-signin" name='loginForm'
|
||||
action="<c:url value='j_spring_security_check' />" method='POST'>
|
||||
<h2 class="form-signin-heading">Please sign in</h2>
|
||||
<input type="text" class="input-block-level" placeholder="Email address" name='username'>
|
||||
<input type="password" class="input-block-level" placeholder="Password" name='password'>
|
||||
|
||||
<input type="hidden" name="${_csrf.parameterName}"
|
||||
value="${_csrf.token}" />
|
||||
<button class="btn btn-large btn-primary" type="submit">Sign in</button>
|
||||
</form>
|
||||
<div class="panel panel-info" style="max-width: 300px; margin: 0 auto 20px;">
|
||||
<div class="panel-heading">
|
||||
Login with one of the following accounts
|
||||
</div>
|
||||
<div class="panel-body">
|
||||
<!-- Table -->
|
||||
<table class="table table-bordered">
|
||||
<thead>
|
||||
<tr><td>Account</td><td>User</td><td>Password</td></tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr><td>Webgoat User</td><td>guest</td><td>guest</td></tr>
|
||||
<tr><td>Webgoat Admin</td><td>webgoat</td><td>webgoat</td></tr>
|
||||
<tr><td>Server Admin</td><td>server</td><td>server</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<!-- CSS -->
|
||||
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon"/>
|
||||
<!-- Bootstrap core CSS -->
|
||||
<link rel="stylesheet" href="plugins/bootstrap/css/bootstrap.min.css"/>
|
||||
<!-- Fonts from Font Awsome -->
|
||||
<link rel="stylesheet" href="css/font-awesome.min.css"/>
|
||||
<!-- CSS Animate -->
|
||||
<link rel="stylesheet" href="css/animate.css"/>
|
||||
<!-- Custom styles for this theme -->
|
||||
<link rel="stylesheet" href="css/main.css"/>
|
||||
<!-- end of CSS -->
|
||||
|
||||
|
||||
</div>
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
<section id="container" ng-controller="goatLesson">
|
||||
<header id="header">
|
||||
<!--logo start-->
|
||||
<div class="brand">
|
||||
<a href="${pageContext.request.contextPath}/start.mvc" class="logo"><span>Web</span>Goat</a>
|
||||
</div>
|
||||
</div> <!-- /container -->
|
||||
<!--logo end-->
|
||||
<div class="toggle-navigation toggle-left">
|
||||
|
||||
</div><!--toggle navigation end-->
|
||||
<div class="lessonTitle" >
|
||||
<h1 id="lessonTitle">Please login</h1>
|
||||
</div><!--lesson title end-->
|
||||
|
||||
</header>
|
||||
<section class="main-content-wrapper">
|
||||
|
||||
<section id="main-content" >
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
<br/><br/>
|
||||
<form role="form" name='loginForm' action="<c:url value='j_spring_security_check' />" method='POST' style="width: 400px;">
|
||||
<div class="form-group">
|
||||
<label for="exampleInputEmail1">Username</label>
|
||||
<input type="text" class="form-control" id="exampleInputEmail1" placeholder="Username" name='username'>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<label for="exampleInputPassword1">Password</label>
|
||||
<input type="password" class="form-control" id="exampleInputPassword1" placeholder="Password" name='password'>
|
||||
</div>
|
||||
|
||||
|
||||
<input type="hidden" name="${_csrf.parameterName}"
|
||||
value="${_csrf.token}" />
|
||||
<button class="btn btn-large btn-primary" type="submit">Sign in</button>
|
||||
</form>
|
||||
<br/><br/>
|
||||
<h4>The following accounts are built into Webgoat</h4>
|
||||
<table class="table table-bordered" style="width:400px;">
|
||||
<thead>
|
||||
<tr class="warning"><th>Account</th><th>User</th><th>Password</th></tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr><td>Webgoat User</td><td>guest</td><td>guest</td></tr>
|
||||
<tr><td>Webgoat Admin</td><td>webgoat</td><td>webgoat</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<br/><br/>
|
||||
|
||||
</body>
|
||||
|
||||
</section>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@ -1,59 +1,68 @@
|
||||
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
|
||||
<html>
|
||||
<head>
|
||||
<title>Login Page</title>
|
||||
<!-- Latest compiled and minified CSS -->
|
||||
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css">
|
||||
<style type="text/css">
|
||||
body {
|
||||
padding-top: 40px;
|
||||
padding-bottom: 40px;
|
||||
background-color: #f5f5f5;
|
||||
}
|
||||
<title>Logout Page</title>
|
||||
<!--[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
|
||||
<!--[if IE 7]> <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
|
||||
<!--[if IE 8]> <html class="no-js lt-ie9"> <![endif]-->
|
||||
<!--[if gt IE 8]><!-->
|
||||
|
||||
.form-signin {
|
||||
max-width: 300px;
|
||||
padding: 19px 29px 29px;
|
||||
margin: 0 auto 20px;
|
||||
background-color: #fff;
|
||||
border: 1px solid #e5e5e5;
|
||||
-webkit-border-radius: 5px;
|
||||
-moz-border-radius: 5px;
|
||||
border-radius: 5px;
|
||||
-webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
-moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
box-shadow: 0 1px 2px rgba(0,0,0,.05);
|
||||
}
|
||||
.form-signin .form-signin-heading,
|
||||
.form-signin .checkbox {
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.form-signin input[type="text"],
|
||||
.form-signin input[type="password"] {
|
||||
font-size: 16px;
|
||||
height: auto;
|
||||
margin-bottom: 15px;
|
||||
padding: 7px 9px;
|
||||
}
|
||||
<!-- CSS -->
|
||||
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon"/>
|
||||
<!-- Bootstrap core CSS -->
|
||||
<link rel="stylesheet" href="plugins/bootstrap/css/bootstrap.min.css"/>
|
||||
<!-- Fonts from Font Awsome -->
|
||||
<link rel="stylesheet" href="css/font-awesome.min.css"/>
|
||||
<!-- CSS Animate -->
|
||||
<link rel="stylesheet" href="css/animate.css"/>
|
||||
<!-- Custom styles for this theme -->
|
||||
<link rel="stylesheet" href="css/main.css"/>
|
||||
<!-- end of CSS -->
|
||||
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
|
||||
<div class="container">
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
You have logged out successfully
|
||||
<hr/>
|
||||
Click here to <a href="<c:url value="login.mvc" />" > Login</a>
|
||||
</style>
|
||||
</head>
|
||||
<body onload='document.loginForm.username.focus();'>
|
||||
<section id="container" ng-controller="goatLesson">
|
||||
<header id="header">
|
||||
<!--logo start-->
|
||||
<div class="brand">
|
||||
<a href="${pageContext.request.contextPath}/start.mvc" class="logo"><span>Web</span>Goat</a>
|
||||
</div>
|
||||
<!--logo end-->
|
||||
<div class="toggle-navigation toggle-left">
|
||||
|
||||
</div> <!-- /container -->
|
||||
</div><!--toggle navigation end-->
|
||||
<div class="lessonTitle" >
|
||||
<h1 id="lessonTitle">Logout</h1>
|
||||
</div><!--lesson title end-->
|
||||
|
||||
</header>
|
||||
<section class="main-content-wrapper">
|
||||
|
||||
<section id="main-content" >
|
||||
<c:if test="${not empty error}">
|
||||
<div class="error">${error}</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty msg}">
|
||||
<div class="msg">${msg}</div>
|
||||
</c:if>
|
||||
<br/><br/>
|
||||
<div class="alert alert-success" role="alert" style="width: 400px;">
|
||||
You have logged out successfully
|
||||
</div>
|
||||
|
||||
<hr/>
|
||||
<h4>Click here if you would like to log back in: <a href="<c:url value="login.mvc" />" > Login</a></h4>
|
||||
|
||||
|
||||
</section>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@ -82,8 +82,8 @@
|
||||
<i class="fa fa-user"></i> <span class="caret"></span>
|
||||
</button>
|
||||
<ul class="dropdown-menu dropdown-menu-left" role="menu" aria-labelledby="dropdownMenu1">
|
||||
<li role="presentation" class="disabled"><a role="menuitem" tabindex="-1" href="#">User: TODO</a></li>
|
||||
<li role="presentation" class="disabled"><a role="menuitem" tabindex="-1" href="#">Role: TODO</a></li>
|
||||
<li role="presentation" class="disabled"><a role="menuitem" tabindex="-1" href="#">User: ${user}</a></li>
|
||||
<li role="presentation" class="disabled"><a role="menuitem" tabindex="-1" href="#">Role: ${role}</a></li>
|
||||
<li role="presentation" class="divider"></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1" href="<c:url value="j_spring_security_logout" />">Logout</a></li>
|
||||
</ul>
|
||||
@ -91,7 +91,7 @@
|
||||
<button type="button" class="btn btn-default right_nav_button" ng-click="showAbout()" data-toggle="tooltip" title="About WebGoat">
|
||||
<i class="fa fa-info"></i>
|
||||
</button>
|
||||
<a href="mailto:someone@example.com?Subject=Hello%20again" target="_top">
|
||||
<a href="mailto:${contactEmail}?Subject=Webgoat%20feedback" target="_top">
|
||||
<button type="button" class="btn btn-default right_nav_button"data-toggle="tooltip" title="Contact Us">
|
||||
<i class="fa fa-envelope"></i>
|
||||
</button>
|
||||
@ -137,8 +137,19 @@
|
||||
<button type="button" id="showHintsBtn" class="btn btn-primary btn-xs" ng-click="viewHints()">Hints</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="lessonHelp" id="lesson_hint_row">
|
||||
<h4>Hints</h4>
|
||||
<div class="panel" >
|
||||
<div class="panel-body" id="lesson_hint">
|
||||
<span class="glyphicon-class glyphicon glyphicon-circle-arrow-left" id="showPrevHintBtn" ng-click="viewPrevHint()"></span>
|
||||
<span class="glyphicon-class glyphicon glyphicon-circle-arrow-right" id="showNextHintBtn" ng-click="viewNextHint()"></span>
|
||||
<br/>
|
||||
{{curHint}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="col-md-12">
|
||||
<div class="panel" >
|
||||
<div class="panel-body" id="lesson_content">
|
||||
@ -195,7 +206,7 @@
|
||||
</div><!--col-md-4 end-->
|
||||
</div>
|
||||
<div id="lessonHelpsWrapper">
|
||||
<div class="row lessonHelp" id="lesson_hint_row">
|
||||
<!--div class="row lessonHelp" id="lesson_hint_row">
|
||||
<div class="col-md-12">
|
||||
<h4>Hints</h4>
|
||||
<div class="panel" >
|
||||
@ -207,7 +218,7 @@
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div-->
|
||||
<div class="row lessonHelp" id="lesson_cookies_row">
|
||||
<div class="col-md-12">
|
||||
<h4>Lesson Parameters and Cookies</h4>
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 17 KiB |
BIN
src/main/webapp/images/introduction/UsefulTools-ZAP.png
Normal file
BIN
src/main/webapp/images/introduction/UsefulTools-ZAP.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 119 KiB |
BIN
src/main/webapp/images/introduction/UsefulTools-ZAP_1.png
Normal file
BIN
src/main/webapp/images/introduction/UsefulTools-ZAP_1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 265 KiB |
@ -8,11 +8,12 @@ var app = function() {
|
||||
// menu is handled by angular
|
||||
//menu();
|
||||
togglePanel();
|
||||
closePanel();
|
||||
closePanel();
|
||||
};
|
||||
|
||||
var tooltips = function() {
|
||||
$('#toggle-left').tooltip();
|
||||
$('.right_nav_button').tooltip({'placement': 'bottom'});
|
||||
};
|
||||
|
||||
var togglePanel = function() {
|
||||
|
||||
@ -2,38 +2,25 @@
|
||||
<!-- Start Instructions -->
|
||||
<h1>Useful Tools</h1>
|
||||
<p>
|
||||
Below is a list of tools we've found useful in solving the WebGoat lessons. You will need WebScarab or Paros to solve most of the lessons. </p>
|
||||
<h2>WebScarab:</h2>
|
||||
Below is a list of tools we've found useful in solving the WebGoat lessons. You will need a proxy like OWASP ZAP or Paros to solve most of the lessons. </p>
|
||||
<h2>OWASP ZAP:</h2>
|
||||
<p>
|
||||
Like WebGoat, WebScarab is a part of OWASP.
|
||||
WebScarab is a proxy for analyzing applications that
|
||||
communicate using the HTTP and HTTPS protocols. Because WebScarab
|
||||
operates as an intercepting proxy, we can review and modify requests
|
||||
and responses.<br><br>
|
||||
<img src="images/introduction/webscarab.jpg"><br><br>
|
||||
Webpage:<a href="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project">http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project</a>
|
||||
<br>The .jar install file can be found at the <a href="http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=61823">OWASP Sourceforge Page</a></p>
|
||||
<p>After installing WebScarab and configuring your browser to use it as proxy on localhost we can start. If you are using localhost for your Tomcat server, remember to <a href="https://www.owasp.org/index.php/WebScarab_Getting_Started">put a "." after the hostname when browsing to WebGoat</a>.<br><br>
|
||||
<img src="images/introduction/HowToUse_1.jpg"><br><br>
|
||||
We have to select "Intercept Request" in the tab "Intercept". If we send a HTTP request we get a new WebScarab window.<br><br>
|
||||
<img src="images/introduction/HowToUse_2.jpg"><br><br>
|
||||
Here we can read and edit the intercepted parameter. After "Accept changes" the request will be sent to the server.<br><br>
|
||||
WebScarab is also used to intercept the request and change cookies values just like parameter data:<br><br>
|
||||
<img src="images/introduction/HowToUse_3.jpg"><br><br>
|
||||
We get a new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit their values.
|
||||
Like WebGoat, Zed Attack Proxy (ZAP) is a part of OWASP and is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
|
||||
It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
|
||||
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually..<br><br>
|
||||
<img src="images/introduction/UsefulTools-ZAP.png"><br><br>
|
||||
Webpage: <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project">https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project</a>
|
||||
<br>The .jar install file can be found at the <a href="http://code.google.com/p/zaproxy/wiki/Downloads?tm=2">OWASP ZAP Google Code Project</a></p>
|
||||
<p>After installing ZAP and configuring your browser to use it as a proxy on localhost we can start. To intercept a request,
|
||||
click the green arrow icon turning it red. If we browse a WebGoat page, ZAP will intercept the HTTP request.
|
||||
Here we can read and edit the intercepted parameters and headers. After editing is complete press the play icon to submit the request to the server.<br>
|
||||
<img src="images/introduction/UsefulTools-ZAP_1.png"><br><br>
|
||||
</p>
|
||||
<h2>Firebug:</h2>
|
||||
<h2>Modern Browsers:</h2>
|
||||
<p>
|
||||
Firebug is an add-on for the Firefox browser. We can use it to inspect, edit and monitor CSS, HTML and JavaScript.<br><br>
|
||||
<img src="images/introduction/firebug.jpg"><br><br>
|
||||
Webpage:<a href="http://www.getfirebug.com" target="_blank">http://www.getfirebug.com</a>
|
||||
Most modern browser have developer tools that will allow you to inspect and modify request data.
|
||||
<br><br>
|
||||
<h2>IEWatch:</h2>
|
||||
<p>
|
||||
IEWatch is a tool to analyze HTTP and HTML for users of the Internet Explorer.<br><br>
|
||||
<img src="images/introduction/iewatch.jpg"><br><br>
|
||||
Webpage:<a href="http://www.iewatch.com" target="_blank">http://www.iewatch.com</a>
|
||||
</p>
|
||||
|
||||
<h2>Wireshark</h2>
|
||||
<p>
|
||||
Wireshark is a network protocol analyzer. You can sniff network traffic and gather useful
|
||||
@ -43,11 +30,12 @@ Webpage:<a href="http://www.wireshark.org" target="_blank">http://www.wireshark.
|
||||
|
||||
</p>
|
||||
|
||||
<h2>Scanner:</h2>
|
||||
<h2>Scanners (Attacking Proxies):</h2>
|
||||
<p>
|
||||
There are many vulnerability scanners for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Below are links to two open source scanner. <br><br>
|
||||
There are many vulnerability scanners for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Below are links to three open source scanners. <br><br>
|
||||
Nessus:<a href="http://www.nessus.org" target="_blank">http://www.nessus.org</a><br>
|
||||
Paros:<a href="http://www.parosproxy.org" target="_blank">http://www.parosproxy.org</a><br>
|
||||
OWASP ZAP:<a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project" target="_blank">https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project</a><br>
|
||||
</p>
|
||||
<!-- Stop Instructions -->
|
||||
<br>
|
||||
|
||||
Reference in New Issue
Block a user