From 6f0f71b1312080cc7f64140abe9f4df4e7d3d03e Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 4 May 2017 06:25:11 +0200 Subject: [PATCH 01/41] Changed XXE lessons to use photo comment example --- .../plugin/BlindSendFileAssignment.java | 17 +- .../webgoat/plugin/CommentsEndpoint.java | 30 ++++ .../webgoat/plugin/ContentTypeAssignment.java | 60 +++++-- .../java/org/owasp/webgoat/plugin/Ping.java | 2 +- .../org/owasp/webgoat/plugin/SimpleXXE.java | 37 ++-- .../xxe/src/main/resources/html/XXE.html | 165 +++++++++--------- .../xxe/src/main/resources/images/avatar1.png | Bin 0 -> 28394 bytes .../xxe/src/main/resources/js/xxe.js | 79 +++++++-- .../resources/lessonPlans/en/XXE_blind.adoc | 15 +- 9 files changed, 250 insertions(+), 155 deletions(-) create mode 100644 webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java create mode 100644 webgoat-lessons/xxe/src/main/resources/images/avatar1.png diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java index 1896cad1f..3214757c6 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java @@ -6,6 +6,8 @@ import org.apache.commons.lang.exception.ExceptionUtils; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; import org.springframework.core.io.ClassPathResource; import org.springframework.http.MediaType; @@ -51,11 +53,15 @@ import java.util.List; * @version $Id: $Id * @since November 18, 2016 */ -@AssignmentPath("XXE/blind") +@AssignmentPath("xxe/blind") public class BlindSendFileAssignment extends AssignmentEndpoint { @Value("${webgoat.user.directory}") private String webGoatHomeDirectory; + @Autowired + private WebSession webSession; + @Autowired + private Comments comments; @PostConstruct @SneakyThrows @@ -70,10 +76,11 @@ public class BlindSendFileAssignment extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @ResponseBody - public AttackResult createNewUser(@RequestBody String userInfo) throws Exception { + public AttackResult createNewUser(@RequestBody String commentStr) throws Exception { String error = "Parsing successful contents not send to server"; try { - //parseXml(userInfo); + Comment comment = comments.parseXml(commentStr); + comments.addComment(comment, false); } catch (Exception e) { error = ExceptionUtils.getFullStackTrace(e); } @@ -83,9 +90,9 @@ public class BlindSendFileAssignment extends AssignmentEndpoint { boolean solved = lines.stream().filter(l -> l.contains("WebGoat 8 rocks...")).findFirst().isPresent(); logFile.delete(); if (solved) { - return success().output("xxe.blind.output").outputArgs(Joiner.on('\n').join(lines)).build(); + return trackProgress(success().output("xxe.blind.output").outputArgs(Joiner.on('\n').join(lines)).build()); } else { - return failed().output(error).build(); + return trackProgress(failed().output(error).build()); } } diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java new file mode 100644 index 000000000..a46326f44 --- /dev/null +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/CommentsEndpoint.java @@ -0,0 +1,30 @@ +package org.owasp.webgoat.plugin; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.http.MediaType; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; +import org.springframework.web.bind.annotation.RestController; + +import java.util.Collection; + +import static org.springframework.web.bind.annotation.RequestMethod.GET; + +/** + * @author nbaars + * @since 5/4/17. + */ +@RestController +@RequestMapping("xxe/comments") +public class CommentsEndpoint { + + @Autowired + private Comments comments; + + @RequestMapping(method = GET, produces = MediaType.APPLICATION_JSON_VALUE) + @ResponseBody + public Collection retrieveComments() { + return comments.getComments(); + } + +} diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java index be850944e..96d470c87 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java @@ -1,14 +1,17 @@ package org.owasp.webgoat.plugin; -import com.fasterxml.jackson.databind.ObjectMapper; +import org.apache.commons.exec.OS; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.http.MediaType; import org.springframework.web.bind.annotation.*; -import java.io.IOException; +import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE; /** * ************************************************************************************************ @@ -39,37 +42,56 @@ import java.io.IOException; * @version $Id: $Id * @since November 17, 2016 */ -@AssignmentPath("XXE/content-type") +@AssignmentPath("xxe/content-type") @AssignmentHints({"xxe.hints.content.type.xxe.1", "xxe.hints.content.type.xxe.2"}) public class ContentTypeAssignment extends AssignmentEndpoint { + private final static String[] DEFAULT_LINUX_DIRECTORIES = {"usr", "opt", "var"}; + private final static String[] DEFAULT_WINDOWS_DIRECTORIES = {"Windows", "Program Files (x86)", "Program Files"}; + + + @Value("${webgoat.server.directory}") + private String webGoatHomeDirectory; + @Autowired + private WebSession webSession; + @Autowired + private Comments comments; + @RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @ResponseBody - public AttackResult createNewUser(@RequestBody String userInfo, @RequestHeader("Content-Type") String contentType) throws Exception { - User user = new User(); + public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { AttackResult attackResult = failed().build(); - if (MediaType.APPLICATION_JSON_VALUE.equals(contentType)) { - user = parseJson(userInfo); + Comment comment = null; + if (APPLICATION_JSON_VALUE.equals(contentType)) { + comment = comments.parseJson(commentStr); + comments.addComment(comment, true); attackResult = failed().feedback("xxe.content.type.feedback.json").build(); } + if (MediaType.APPLICATION_XML_VALUE.equals(contentType)) { - // user = parseXml(userInfo); - attackResult = failed().feedback("xxe.content.type.feedback.xml").build(); + String error = ""; + try { + comment = comments.parseXml(commentStr); + comments.addComment(comment, false); + } catch (Exception e) { + error = org.apache.commons.lang.exception.ExceptionUtils.getFullStackTrace(e); + } + attackResult = failed().feedback("xxe.content.type.feedback.xml").output(error).build(); } -// if (checkSolution(user)) { -// attackResult = success().output("xxe.content.output").outputArgs(user.getUsername()).build(); -// } - return attackResult; + if (checkSolution(comment)) { + attackResult = success().build(); + } + return trackProgress(attackResult); } - private User parseJson(String userInfo) { - ObjectMapper mapper = new ObjectMapper(); - try { - return mapper.readValue(userInfo, User.class); - } catch (IOException e) { - return new User(); + private boolean checkSolution(Comment comment) { + String[] directoriesToCheck = OS.isFamilyUnix() ? DEFAULT_LINUX_DIRECTORIES : DEFAULT_WINDOWS_DIRECTORIES; + boolean success = true; + for (String directory : directoriesToCheck) { + success &= comment.getText().contains(directory); } + return success; } } diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java index 6ef28f863..ec37961f7 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java @@ -58,7 +58,7 @@ public class Ping extends Endpoint { public String logRequest(@RequestHeader("User-Agent") String userAgent, @RequestParam(required = false) String text) { String logLine = String.format("%s %s %s", "GET", userAgent, text); log.debug(logLine); - File logFile = new File(webGoatHomeDirectory, "/XXE/log.txt"); + File logFile = new File(webGoatHomeDirectory, "/XXE/log.tdxt"); try { try (PrintWriter pw = new PrintWriter(logFile)) { pw.println(logLine); diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java index d5c6b6a82..f1f5bdfc3 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java @@ -1,24 +1,20 @@ package org.owasp.webgoat.plugin; import org.apache.commons.exec.OS; +import org.apache.commons.lang.exception.ExceptionUtils; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; -import org.owasp.webgoat.session.WebSession; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; -import org.springframework.http.MediaType; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestHeader; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.ResponseBody; -import java.util.Collection; - import static org.springframework.http.MediaType.ALL_VALUE; import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE; -import static org.springframework.web.bind.annotation.RequestMethod.GET; import static org.springframework.web.bind.annotation.RequestMethod.POST; /** @@ -65,35 +61,22 @@ public class SimpleXXE extends AssignmentEndpoint { @Value("${webgoat.server.directory}") private String webGoatHomeDirectory; @Autowired - private WebSession webSession; - @Autowired private Comments comments; - @RequestMapping(method = GET, produces = MediaType.APPLICATION_JSON_VALUE) - @ResponseBody - public Collection retrieveComments() { - return comments.getComments(); - } - @RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE) @ResponseBody public AttackResult createNewComment(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { - Comment comment = null; - if (APPLICATION_JSON_VALUE.equals(contentType)) { - comment = comments.parseJson(commentStr); - comments.addComment(comment, true); - } - if (MediaType.APPLICATION_XML_VALUE.equals(contentType)) { - //Do not show these comments to all users - comment = comments.parseXml(commentStr); + String error = ""; + try { + Comment comment = comments.parseXml(commentStr); comments.addComment(comment, false); + if (checkSolution(comment)) { + return trackProgress(success().build()); + } + } catch (Exception e) { + error = ExceptionUtils.getFullStackTrace(e); } - if (checkSolution(comment)) { - return trackProgress(success() - .output("xxe.simple.output") - .outputArgs(webSession.getUserName()).build()); - } - return trackProgress(failed().build()); + return trackProgress(failed().output(error).build()); } private boolean checkSolution(Comment comment) { diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html index 7d79b58d3..2ad34cf5d 100644 --- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html +++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html @@ -48,13 +48,13 @@
- + - +
    -
    +
@@ -68,111 +68,112 @@
- -
- - - -
-
- Registration form - - - - - - - - - - - - - - - - - - -
Username
E-mail
Password
-
-
- -
-
+
+
+
+
+ user profile image +
+
+
+ John Doe + uploaded a photo. +
+
24 days ago
+
+
+ +
+ image post +
+ +
+ +
+
+
+ + + + +
+
    +
    +
    +
+
- +
+ +
+
+
- -
- -
- -
- - - -
-
- Registration form - - - - - - - - - - - - - - - - - - -
Username
E-mail
Password
-
-
- -
-
+
+
+
+
+ user profile image +
+
+
+ John Doe + uploaded a photo. +
+
24 days ago
+
+
+ +
+ image post +
+ +
+ +
+
+
+ + + + +
+
    +
    +
    +
+
- +
+ +
+
+
- -
diff --git a/webgoat-lessons/xxe/src/main/resources/images/avatar1.png b/webgoat-lessons/xxe/src/main/resources/images/avatar1.png new file mode 100644 index 0000000000000000000000000000000000000000..4ea864f90009013d7d30ea3fb8c70b1f49c7e4b8 GIT binary patch literal 28394 zcmeI(f5ENDT zB&p@Sc=YAQ>&<*i$#bO7-o&Gu?VKUsO?QUKLA9X!NhjL%0D`5Zr6Vlefig3uH=W86 zhROl^mnF#*Bta<2ln^4%AkT!rV3{}~WI%U4xcSuiSpi2>l(>_w!WLOg1b*QYouQtRy&27 z?PsI9pYI)1XIh*L?;kHF2X5{HPP!jzZmEw^e*Smn_jtG!U>a~&d}o~T@$Mgy;r->b zYRX!@Ml=a$ndiaWOpUR~q`T64^DI50&c<13d(DcAJZkHrbNC6c29<=1WLo5;lM#k& za}oUxFnY7C|w=Q zm*R;(syPaz_ryu`v4qrH;7SX3k_3VT?PvdaGUqWQDE-0D3EG)0*BnYtRGD;K>lXWR zHLHuLMf>&9HQmZO9so6wzxu-Jdr;k4CK-Z?=y(<&hya@c80mj8;mbhN=u^em3WJqB z`paXKPV&}$yoHCv#{x9)deD;YgakUVmPv1hI@A?BA36V=RFxobF!yTn*0+>nvLs3B z$#_s8F`;Dx7b^7ko$)+r3>jAYbwpdw)`Ckbz}%ubp>c7pfal{EWw znn^6mj=cjgkhYn=!6O{af(ntqLn+(mfc&~vKh}ejfd`mhG57Q&A55|$$jKS0|(9fVF zz%EUC)91g*S-c>G?BWUl<~niKYG6f=_o|C)$wNS6K|1mu`)lZ$0dKAHHrw`UaND;G z2HjU512mPz#^q7)^5-?;yeSr;;)6li1}a(AhOITF@5|(i5SW-Gj#6RKlkmoG@;cWI z1Ox8a(61Hc5e6ZZpF`%G&+sc85g?>PKX%Xu)tUdwN@pc!a(uU7=!_^&?8@ha#+!zd zelynhBIO?nVn87~l&Xx4_=UW1QFi6VmSYus`Ey6x(;O<8lK`w>+i{0HKVAWh0-$T2 z72@+pDMzuMs7WYY{#c;zU0_4~SKfJsk;MeG|0-hm6G-6RK*D#&fezRp+y_j7?1Oc`dHL*M1_JxEvmn$lJym?% zLfic?7`4qU5^%GenL-Lox_l8i)E)|&M^23a8r?2zU0yV;HB;=2r-Xw&4FZd|q^m*A zJ19kPQd58W8+zhK8-NlJjkbrD&T(JecRQ9 zNSbzb&{>v+I`B@hb7{U-H;v`;;L}j5a?xm)5CKsjYW(^tl+}-DQ;76$Ks-3!*^Sf; zxlTxBo7tK4ugN<=jl3JiX1RS}x%SYjpvDtdKwL9Ww(iKYBVZ#Ms~+s}u_r?mo8&bq9`e`9i;R zs|k8>l1a0dJ}DKVU8`4QnN(JvJ<|&1pfVWC_vr@O~!Mp+m_xC zJ1Ajs8Wk58ZvCK6B0^%DSZVQ5{-O8F(4`~j`@Aa8-pJr*epEdO@(6aFqyZAR z`Uii*uMIe3`oF?t56nyViF}o#zq}fMR)5w+C5ZsumbzEwO~Bo+)_gK+YRO0uYoe&# z9Ymp75@@VAGnOA5^LPz=S!~0136uVvh5@fk76ZqkyHM)jd@9P8RvW8WeD_}12y>e_ zntKB|VF>XB@oo^a>0aDTUoPY2bA!NW5z&Q#Rwz$#vt$erLS*D@SzD0_cfpW}uE|tv=)9lOjf-S+$uLVWU5R*4t=zt9(V|@|hzmD-X@n+w4 zZFdLi^Q9U8U}s-o+&Qw}Rhi!HPTLjDB`HrMsr4&3eWK!Ch{HYo2IS%5gcaL=3TdKp zHY^b?<}oNI{=mB-hh8Ba#k}+i9P0KA zt)`V{@Zj~m<_}XUI88Q9j1j*vUrNg&s8b_pqO!`>H+#4EiE^UfY(3+-Md&}@CE=}U zDpuPrH6XIgODHEJO`h3Dg*-4wcgu!g37MIE7qqqwH;TfQSnsf_`kaY+d^h!1X+xuWJ%->?;a5>H7p<1vuIQ%#M%L1GmmSH?|trK5XNiDXPP2Hj*w~d!S z@+2%2j76ao|NKuHhtvbi6+xU=Gp4|dyFc_ehUeE*!ouRCR~D?x6Pq%%z%p*|;LI-T zonSO`FKjX)e$jAj;KAK*svWnBH>mJLH_R@GU(~=Vrf69CCXW>uL5oV>Mv97Ph=tze zce$<{02mVgu*Gan`ZRU~8yIxx9X1In<&K3}+qz3?|Kl5gE9-m~D=`18?4m~G^s|Po zI}Bb(4Grc^nsFWK2*R?br~QJw6RsG%r?HXS0B^`)v_`9f;pCdY6T61}C(`*RxdFP^ z@CF*E%{QX57n6ZOnyhmJuE35*_14CsUUmeiNf1`JJrn$A9BLoQnx$>H@oYV~kFvu8 z1}i5zkO~hsQX>Bh&~LRgN;>BB0NI*@%>|PhHxS-;$i7E_+Ot6Q-1gj5bf-dwolBQD z!(89>`0pZyfMzpa+Px1N0|7Gp1`ga})TUqqoU_Xn@d$6BCe;LfD(>|lKTO33%@8)o z1lBvD-XA~piE*HMoHO*b+101gfTF+6=4H zkKoaTvk%c&tCE1I!V}2TirVEh37Fq}b@jJl=D(LU6;bH3o`VUOQJ034h zx`64O%N2uuqK^55{q;|PI^b*~!yA4V`)Hd;2g+!NIeN8YAdVtHr#j50CboYrH~}cX z%1%VeWt#zjXtTdT=QW1=nt+-aQXO2NCTFu8U#ga zOFKv`?DPEF-+Va>3mE4qg9!A_L;|;!g`eL3-J9X4hhho=bbW)PEsfn&Ufu@}d(;YM zs2+bmNIM9t0+F))r4OV=6?$og&iTMn1$!)DDes$)$&zvID0`}V7(i_<-9R9g26eD4(*$RH>pcjrV&KaME@joRTE_hT?%2miu z43AbbD|F+r=LDe2kqzipUy``qG zSb--xx;A#i+B)AYjRXNZ^ps;6Yw~Nu=O3H0KjAQ2yqnLv2QN)LLoB)36THT83;J-e|U(jBj?V)t5q`u*V~uboAg!CCkm|i+Lgh=s6}WxJgWXh%vd1GduGxG#^U^9 zhk~J~oqc~lWx$R3H9X%`n;AZs^lxG$#6rkv+tp&U^WQ%Wsz zOR_jOI)ZKK%nw|r*OaR+29I%S(%cKSOSN5b{)5cvDRES2$UHn-3iGv78|Tc9#oIIP z_Wp3C4_!0Po}VnbAnGQ_O~bf}FE1JsAy{BOJMZspi9$A;^GUW1pb^l$Gd7weC%f*J zxE1>t?bY47NvZg55SPwlSEHIzrA88pGKEQ5u7o}&Q7LK8nJbKGqW5Td1Tab>KNB7CM%)fG(tyLWe%BaS{PBvd6s_B*e@a8jmau)Rv3 zf*Y%<1sbY?kC`^QK-JmAp#v3~O~SbE$N>mb9SPV~F-cQ*<-uV6c(hSCd7onYGvX@*d^zrQ6`#h7Vrb zD~mTd{}Zn9a`aLxN$a%V^-z9H)! zuw0P>_#i(c#HB0se9+@Np2?@nA42r*k7t=AS_hN=*(kQK zgXDBVD#8B48N=s4MuM!aF@;eQ$c=tdE|f;4A%eRKMD&~OOd|{w@pRV0_mzAm=3s00 zO;6+eJ*QR^zjZY>zISscnqD57(HsBmPPTb^6q|j%=!xQyijpZn&{x;_TVGuv(Lf4zWy{)&JyaXeM1W%dbY?`;-0Ezm zUK4DN^;r*-uAqnSLdg2^;&OG5^1_QE(e}{;nc)0gHmhH-}V=wvXCOf^C1h-n@ z%szu=Rq%d$BajA0PEJxxMYE|o;vkVsH%dEH<{CCc(a`EqUimxMWGdr9wq==q`5?sy z6_2tv1xJHo4q*eVnU{9Y^>AvwoHaD#`hy7WPb=HQ$!L$*p)Lva>z~2eA$I zf$C%&srK|YxaH`v?6^wmP!wBvNp_u%1r3a!RR}&I;O1hj%<%Emd_%CF^dhDeiP%VaM)u zH%|A&!D=t3`N^sNU0nQ)(Zkw*41@X~*8PTxj5A(hS}hrf)@Z<*O}0@AhGPsGivUEI zSv#;Xjo}zJ$D;MSsti$>!1h26L*-E2m7HhF;MG8g$nHSOCZYrc8Gre$iK?p0vtrLm zmqLV>V@Y=9MVZy68ymmfSOZm(&X$d4?}j6r(GTekLE_&n%^|#D{2q;6qi&VV!SQOSW&a*{#Ckkpa6h z+;@++E;gP-KYaNVi0zK)lSVogV@q4SllJ`&?4xnYfx7V6N5MBdO03}e8T;8Pb@|n| zXcN7LFH^;>Cx?vBJSs6WmxVVeEBW~4y3D6@FYkwlBfa@QU6V>1yT=&nr-52lWOz;v zkN^NRY#FlZj9LpQ)V{;|{19&4s1$`uu7H_w@Gtt~nb(TM zF(7$Y2w5=x{BlAo;Mi$8);H){?-5OCgoOsVLmOp!4&IEkYzm$4`S$b|EaVk^VMvODAr#)0HwL~QdrIhUolSaVDRsBPk9OIDFWCej z*V(8c$BXR=Rr6iv8VKC-3HWBlFF~I@>_9W5$ibB^k*~hQu!*B)6tWpfK;FiBSDlcv z-nwht7>W8>DzQb}z>?I??Z%#EyOSNNm!bd`UBvhwHQj@rtNA+D?~m8+s_+H@lr7JQ z5wk7g33}z0l@t$f3gjBK=3#03x138@S^=0(o(s-P{<}`@UsyytGXKb^$GCSUb_)Ku z$KEo=S;u)pUrS8ukeTS=vtN`z!agDl_K#({S0K3GXUn_n=|8EEwn#&Id=4Tl*@Y`- zXR1ROKn+LX?Ib~<4gx60@@#JQva>)+zF`(b+A&@qcqh(id4FF@jf9-~b`LWANbB7$w(A!vKxx`Q&ULZK3d!?rU2=Fb|T6u+n$c zLt=rDDwYvaM^U=fjyi;%UtXc}0ksMx1{EBC#6{VO^OV{WfozLZQY7Gts2V=n2 zoA3XzH2t4Ee8f-z!!Tg#a4RUHOF0_My-MF9C>{Y(M~&&w#I8M zF>G;80z-v}^P}r4qCp^QTQ8T>9}UT2y(p`gGg2TiBHn=`-c|ywmPM1_UDfbKfisc& ze9t8O_^`mSyoZj|sgOpwkt4R@4CRHSuLT3s5x)z{Lq6-R9l!tAQA7XU#>~Zl*MV&7 z7n!2_AYRcJ>BQ3N$v`8kN5@-nZ0z`tqB^W*BmIDoes{M%aZ#^j*Eol?alxGrw#%@( zyPy)B6S=X5@Mxh4&kV-N3!4Oly24B;SXe9)q%dhFvDdn}HLoiWucfJC8;jiRFtPT` zo<0Nwv8%hm|Br_9cg#fW5#6r*nyf`@18U03@|p5M7Y!Tju8!~5zMDggd>0X~ zxYUpNXfZ76pn+eK2tcb%J!-v8ktgNT@Xj*>Y6^ZDBezka9x7nS&`G@4AlJjxWlq!S z#p$&J)j^#hlRP(p2*n&%))|ndAPvtY%6M+C-R%rpHxO;>$)iGY zT-bcjnA`1cav8Gm3h!`N;O_L~kTr{VWG5I@`*0^S?;{2nXCGe)q< zW(1)8oct@g9rq9vHCOAFq6Z+(8HuCt2|$nU7=V6=jKLjin33W|*f5p=K* zd>QCbTx)c>khsuBvgm-?a&zx{9IaG0y}b7t?1zP+E9;x!8_aK~`j&>X7)k(<-MuhN zE!Y2AI5(-ppx>i(xbiqr^qa1TkKP)|qd}bVSijSDfY_0}i6`ao)3sS9jelT+#g>Gl zS-f11KlbQep08@_p5_Ys#zUNj@iG_#Ry#b4H>qe%KS-*o92M@AzC6^C$73b5LC@Y#ujf7VOPRoLk`QyhEA|F!&IkKZysgIRC!je z@+`gz!Mu=EA~{_p)Gx%M?bP|0dQH{qrm94aIjqE~n4yJLf2*1Oq?H6Tx+Tkvaw-D& zE@*HXS;gXh!>-nFfz>?B*~IQ+`+fZi1*yX8ec$n@W8Y7&2<N>TBGg-$4Tahlw|cH8L4%I<}ub0f2@lhG)FY zLPx6*WJ3(gkWJ=94I&7p1m|MPRnog`F$FHPawox7yA%Bu8 zM(NP5=gXAw2#*?8iIs<4)qxB466Gl3fH6b*r)q}lS&?sy;$JojyHX0n zMh7H__0K8BT~@N{XEPVsx!(RnQ-N==SveH691@^HtM1C&4n(OjS(?i~Z7bna+M{RR zUnk~Dn|7bIrJm^MzV$`a?=+| zjPK@5i3iW4_4GWo^08lgFe=LVdvFD``b$F(CrIFgDzwrvosB-J8D6^)U&yiQKB$v! zCPa&O`C?jwaqQNNE_we=8fDIl7d@-$U?fqmP2m~|mXvEt#~BZE(W>BhW48%s^jeed zR3sX0hT2Ewb_85YdVcOS&t>wBK&$hX8`5JCOJJ_*IDVwv-Cypmy??J#+AvV46v%8D zpoX&Wa91k+j3?Y_rZ?=J|12DY()z%h+npaKVZ{cB`^oT}YX`ubadizVg7Z<0H3wP{Uo}jh=Ya~8()R}MYjudDo)RZ^wYoG#zXXUUfZy6iiM1+Jzz zxF-kTurZPm1|pGl22SA0Lx-AHtC92cG=#GI2|1x~&SXCQLyIq>f<dpCB-8PNtKC z2*~u!thtvneE(0kww|tu(AKv*=7oWT#SoCnKbf3#YH0j3L&(_PTY7zd5HwO@ND}<+zk9DLgFJba?R5mW(iKXpC1(zlHX1 z5kjz}J^iIcSF2G@5s1Bc=EGynSMPBUvG*q-%+i4m*|CmCumc%>1>}p~=SX6shJT1+ zMj||SnGra3AB@MapdTdZI#$r=_gv0PLV1ZAGaSD@-RgnBBRpKVZz^CY9S&9h1i35T46(Kg~&S!}2jaKOxK!$1BR zo|Y8C(k$?J^u>^t^|}#+yZl!K0Z(9-Hm+=_9J~5>gzX&)M~Xdq9uFhd1B)bGNV^kj zwbcHk=rYzdAKNeb=DKbO=cqpO4D-r6YgjScf4bSdVLgTF->%RpST&BS%w%77Wzim! z?VzL(1MW~-`@F=@v94nk`NW-_-@seEgG5*17J=I1Lr}b9Qiao{Xg+DJI9o`5TrR(W zUs;)!-vX#i(~+GS=ILqSEulYv{{cQ>aIux9h&uQ!wP1uOCJbNC7Cf-O`kmCr)du|S zzXB3%?cKLLn1R89+w?C$ER}^$`PHL$Nx5yaP z)$bmyX3LX)^Zx5jZ7&ijo*7A;`(&c+k$cdg*gg|2uMH9eo2xX~+bIhv3iynS*M;l< z+x|2cgLjMzDU0ZS%+!E4XmVyjghUjZ7D-$-lyF$YE$jl8!c6AFD`T`5(JL?8FIklI zUl#AlS+;g72<8rw_6vJEEs(TmTlR$(g{|l1$X-w80}+HOKa|2ykV&afTS`XRp?y74Pz0(hcF(u-ummFc| z(^j{PmXCdeZ6Ja?fMomof15iE&$)I899-3v)%Bo^x;Z`fyPVEv+lZHX-r*=t@FY_n zZKAlNqMcajWyyz(jL^*{C^!mctadjvU!IQxD?}SgFdcz6M0={WMf3q5`KyX)u2YBL zJduW4md29U40n0BZPv}W#yJ{w*>gq+% zOJYC}R!4d>c~MsX9={<{B0~l|*qF)hw&3b|-S{QKM-Ld)CxfB|q$ysLII?S_arX-$ zjSvql0`+$Wol6WpP4Hh-P#9EN5#iK;rv1{*eopfCLe2>*gEf(X4*o-!bJAVnO7Hv* z`q@3#7I|a+V3niy2_r;-?1K$oD~mJ;D#OjM#3=?l@J;Z=$Z_zEGS_miA!S4s{hR;o zu=-nKahDmmaS{;$2H?VvD{}8FT_l&_-o>NQ6$Z8|qxYJaM)D5pX?82WX7-1gBD=!B z#d(P>epJmm@i*VIW82fo1u7kL1cLcbY}=C`_^2}%zK@n%mmpbo7b8g*`7WDwMX-XNP4wcecRDFG|98}A5&p&T1xj2a-_HJMUnE2o=*e% z;dG%UZ>HGZdhGc3{x&;I8e>6c`$bMH%d9Vsq49*{!EMWAJWNf3$ngOPn6QkNRnwn9 zUpiS-*I(7+$+@UxnQp$~L*CuUNF|O|EE86qzNEXZB@P_p>HrVzT_nA1GwB@n#k7@()Jm;4_zoT|D}u?%pQ4dbs}5YHxE*jjs!M<0ku~ zESg_y;6E+4{E2HF#XyiVNd+R=rMr-{0ZVOL_#dV=-gG*YM;kZxzNKNj09>`QGJI21d1mhY=2T?)K6*JF7a{tZ;L4(<`}@o4ft8XcsvOq zgl$?Y-BNvxC}v&5`$r0>Pmq|ss-ozi0^8zHS*~sUwHi##$T^~nr?uB@>bEq@#IG=8qPs-&<;wP~ZVLrqzb6*zE@xPo z?M+4^Z8erw5DY~AIaxPS)sbGM=o{l<>mMZDeUdU#)zKSkFX&g!SD~aZzsNu%~ba6F@hVhgUTYr#!kcrNF$#gF)nb zS@zLZb5X9PVLQYH6Smch5lj}9W@VCMZ`bNBZ5$;Ux^^({l9Wx$nDP2qZl|-wR!y3D;(B&H@YHD(RRHO6qcP2$?&E{psDrQXZL`g)tz%zRODzmyo zwgWMZ4Jm2Ba*Y-%30U9w+@v!!Dp9BFa+P>A5T%dVtm;?xPw zG9>W8+pbP;+=cpe(_sVOv^J!8n7Qj3JqmMGm;;0HDlV_!XT) z%B9<4vwApTE29^-8RHFZJ+Sg1J7h4zmmeRZ)XBG*Es*YKXzK?IpJ^L1dl^UnQMFr- zr|o=Kh|&z9M($BMG@6A}D|05r`L7L&Dolg&Z8<^{DN66w3=XO*HHAxsP~cHh{9irR z!KM{%mO|Ta>}RhI5rV5Ks@5XXqCW(1d=yONpXF0^h-xPZMYSfL=^T zlQhSFVaz#GW99t%oy8=b`6`rSs|z7}_ff7v!Y})u!dLk4#iW!yz4M&Nn&u5;zi)(p z#%F+(G@&@9-h;5nu^S}tEZs(@bVtYqkdvA--EM6;za@r5L9WQdwb!z*9*NXovEHkW zr6L3Y%5*|ci&uG0BXxv86r@NJrv#nHuOJVG>Ue#q2-&nhIcma_HY;5BDrjh&YU7dx z)R5gX7#!7hII#SPY4V!DpDZQ~Kp3mudmETGT!rn({rE9%oKj;`@ud#~c3<^Hu6X%^ z4znoFz>Xi9-IGR6Xd(g4#&9wfY!R^J`Mie+J0J~Y>g#Zgnl6u;p6$EadU?KBG<|aI z4Efgnu!D!?g9pAYQ&h0mAbDx~t*~sbvsqxa9@(fCWK~++iK}%y(pzkPVlHu3vc&XU zF6;yMRNI0Q07x4$)_|5E7S6ligZFe!C2U8ocBcCAYUX8&=#G@~92f^gOz z-2#az0ZW1oYUoF~*$QZ++6o*QD*XWNWLLeD9oe3$976s&XQv;9L7V!5VZ}q+ zpF-+{@=Yq(ov<&bf&~Vq#pA9 zM4`CxD`tMkMMP9!Z4?alU5xj6rMl7SWK(wNe8|TaSHjbBQ%Tr7aP8OxEe5AgSZz6*IGxAbDZ+g+qe0m=1pIrpI9~&(a4{mty4wku1$EiKM z{pa@q9mqAKSPr`b39blSFN68-ec#LTv)a&uyG=AivkK9^70Zrk4a=JeLCA?`*T>=~ z&4)kvZ6V6S4QAD+ozxPprmfyTrQzg(oLPszSrTh#9NsWv<0E@RxZB@=@lNI~cFInW z&zb1iNw>n6-I;=Q63;sj{n6IJ)-NOkRTQ|d%%F;cmv+_y=})D3OzcdnXMEvg{`eN# zmi*#h4j799d11F=)9Of}r(`)sA0_>Me)tZgBH?}h_4HA2r=`Y^k;nA$d5*38-1~x~ z0_rJqw`!7%`|_6(SUIW#ZqG3VlEzqFhv^BV#*sr579R7Pyo~VJxQpg_Exk;a?xfi= z9iy;NKP^;|RbH3gI=@7YL6dC)^*-$}Kz1yl;9OTMTZ&vws)BH5`v#iai353w925 zJ^R3e7UL&VDQtmD>HD6fr*CayI}X2Ckhji6N7Vg`Ex)m^HFAp%(5H(ncbPPXx$@f$ z7AwYf2&ax{Cu8;d^hTK3#O%@jR5y=t|A}O2YD{q>JL_j@GQ96Nn!5Kgu8^iof|LwP`mhDDa9AsWrkZnhe-%q)-TuwKad@4^{Jb^?~nQP6Z-x} zZMZVT&R@{r#?#oqiJJ#qoYc0ZU>Y^aRF7ZZ%B4T^G>hnh@AJvzQF)ywwL1qTP9Qbe zymri1Lp{COxH)V08*33^pb_&I9EhV8GMl;M{KdhJ6csgFdzU>THT9Y{Hy@vX9jGt{Fbj44-Kv;;pkOh#n;iwYy_ zWnrqgYSD`AalC2T=%4(8hy#}C*=6&lR#QHMwQC$UNA;y5PGid7-T6+tx8ngG0V8(m zhQ#l(vjihYOD;<`f=r_xMs7^!OK^$tZWC2(p6Ga$X{xfV#C7^>3+igM=KrwcmAP&! z8N7d@6zy^6OXcMet;3d6@}3?U+zXmmQ~DoIl)G`$v=}9d3Qxj|jL; zZfX7+GS^&Y9Y~kl0(lB-xpDrdcx#lu@jxjuLo6Y}U)_3okFe})8KsSrTwHNz$_PaJ5)2TZ~mP15rTpROL4OBg3ET$1v$Lo@>59(9^YMywrIH9)jOg zib5HDSkoj7$SdqSYqD7bJikopVO3!Ww0plSC1Ragtc2xx37tgDr_K=HkYIKETl?De z+cQDC>Ed7WEz;qgOPmIWvq#HcT~)L6rIq-{{}%mR`%kD0kc*bYAtp3}d#N16yo~As zZ~7skCR9txCPhhvmJP_|L7_`eqySY$)VXUd2yO)3dau- z%SF$#?x)nMhmK|g!d7sFyST8}{xro7y-gs^!gNK_rqY(U8(r|3y75#~5bV)buv3e- zdxr)*#C3hi7$haQG!^+(8r@36Oky@kgP8_(futb(^{xm!_x$&h^K4?H3kZQ^noe=h zwCKxF0>QrE5#3Lk1h+Uy~SmhmvBd~PRUOS6v)*ZsG!_TcB z*q|Y5X<9?q;W{TWocGL3rsY3N4&~T`VKRoez{Kn38Bi#_bq&EXm6-d8Z!_u`8PDEl zqyaLrr;+k_pL4L)*7uXOi)iZ{5Ba_0yAW|!U!rzl5_N}!UVNgS$jK@9oU0&VBl;RY z;k?zpGO=2kF z7D7|U9Mvr|e~>l3AXfqHwQl&@ejZ@562mMl9*y%qPHl8Z7|GN@3Jz+y=jOzh1RV2X zk4x-9khW5&Z~D62Tv$0S#l{>3ev@L2mJxQD8g3p(W$oyGgNB9klfCE(MLGKxPl=bgeqR>cHZ26j<-}zh(IkP^BZzKUUvc)0Zv5P`#w!whb*> zl30h2j5>JvtRkZf5Y5?Ri~aY0a#GodCHCG|$WKnUiMxC%qKMcKvvzOP6&Q0SpGvQF zXeJ>dupi*Kaw5P)`jeiTd6v}f&vE0oix%=sq95r}zE8C()0R;SZ3rAIq9M-k!~;Ne zOS-l%GqRCeE|#HOIGUJX3dR?~QQ+D|k;z?e)pTo4iK!~}H$Sz1L56@miR3l{;{OuLpy`sBUboYwxUeVnv zx_d=;ujuX--Myl_S9JG^?q1Q|E4q6{cdzK~72Um}yH|Agitb*~-7C6#MR%|0?iJm= zqPtgg_loXb(cLS$dqsDz=' + + ' ' + commentInput + '' + + ''; $.ajax({ type: 'POST', url: 'xxe/simple', - data: JSON.stringify({text: commentInput}), - contentType: "application/json", - dataType: 'json' + data: xml, + contentType: "application/xml", + dataType: 'xml', + complete: function (data) { + $("#commentInputSimple").val(''); + getComments('#commentsListSimple') + } + }) + }); + getComments('#commentsListSimple'); +}); + +$(document).ready(function () { + $("#postCommentBlind").unbind(); + $("#postCommentBlind").on("click", function () { + var commentInput = $("#commentInput").val(); + var xml = '' + + '' + + ' ' + commentInput + '' + + ''; + $.ajax({ + type: 'POST', + url: 'xxe/blind', + data: xml, + contentType: "application/xml", + dataType: 'xml' }).then( function () { - getComments(); + getComments('#commentsListBlind'); $("#commentInput").val(''); } ) - }) + }); + getComments('#commentsListBlind'); +}); + +$(document).ready(function () { + $("#postCommentContentType").unbind(); + $("#postCommentContentType").on("click", function () { + var commentInput = $("#commentInputContentType").val(); + $.ajax({ + type: 'POST', + url: 'xxe/content-type', + data: JSON.stringify({text: commentInput}), + contentType: "application/json", + dataType: 'xml' + }).then( + function () { + getComments('#commentsListContentType'); + $("#commentInputContentType").val(''); + } + ) + }); + getComments('#commentsListContentType'); +}); + +$(document).ready(function () { getComments(); -}) +}); var html = '
  • ' + '
    ' + @@ -31,15 +82,15 @@ var html = '
  • ' + '
    • ' + ''; -function getComments() { - $.get("xxe/simple", function (result, status) { - $("#comments_list").empty(); +function getComments(field) { + $.get("xxe/comments", function (result, status) { + $(field).empty(); for (var i = 0; i < result.length; i++) { var comment = html.replace('USER', result[i].user); comment = comment.replace('DATETIME', result[i].dateTime); comment = comment.replace('COMMENT', result[i].text); - $("#comments_list").append(comment); + $(field).append(comment); } }); -} \ No newline at end of file +} diff --git a/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_blind.adoc b/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_blind.adoc index cd615ee26..0d7e110e4 100644 --- a/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_blind.adoc +++ b/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_blind.adoc @@ -8,11 +8,11 @@ Our WebGoat server by default has an /xxe/ping endpoint which we can use. *This [source] ---- -curl -i http://localhost:8080/WebGoat/XXE/ping +curl -i http://localhost:8080/WebGoat/XXE/ping?text=HelloWorld will result in: -GET curl/7.45.0 +GET curl/7.45.0 HelloWorld ---- at the server side. @@ -33,12 +33,12 @@ Now submit the form and change the xml to: ---- + %remote; ]> - - test&ping; - + + test&ping; + ---- Now if we check our server log we will see: @@ -48,7 +48,8 @@ Now if we check our server log we will see: GET Java/1.8.0_101 HelloWorld ---- -So with the XXE we are able to ping our own server which means XXE injection is possible. +So with the XXE we are able to ping our own server which means XXE injection is possible. So with the XXE injection +we are basically able to reach the same effect as we did in the beginning with the curl command. [NOTE] In this case we use http://localhost:8080/WebGoat/plugin_lessons/XXE/test.dtd to fetch the dtd but in reality this will From cb9503d4a34c3dad5c6aeb3ed80055d3ee624894 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sun, 21 May 2017 11:04:13 +0200 Subject: [PATCH 02/41] Upgraded to Spring Boot 1.5.3 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index af60fd088..79c12a753 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ org.springframework.boot spring-boot-starter-parent - 1.4.2.RELEASE + 1.5.3.RELEASE From 877de6ebd48c1a2d64dc743aa3bd7e2b037f019f Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sun, 21 May 2017 12:24:42 +0200 Subject: [PATCH 03/41] Updated XXE lessons with challenge screens --- webgoat-container/pom.xml | 6 + .../owasp/webgoat/controller/StartLesson.java | 5 +- .../owasp/webgoat/lessons/AbstractLesson.java | 10 +- .../src/main/resources/application.properties | 1 + .../org/owasp/webgoat/plugins/LessonTest.java | 42 ++++ .../org/owasp/webgoat/plugins/TestConfig.java | 23 +++ webgoat-lessons/pom.xml | 32 +++- .../plugin/BlindSendFileAssignment.java | 19 +- .../java/org/owasp/webgoat/plugin/Ping.java | 12 +- .../xxe/src/main/resources/html/XXE.html | 180 ++++++++++-------- .../xxe/src/main/resources/js/xxe.js | 22 +-- .../plugin/BlindSendFileAssignmentTest.java | 90 +++++++++ 12 files changed, 323 insertions(+), 119 deletions(-) create mode 100644 webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java create mode 100644 webgoat-container/src/test/java/org/owasp/webgoat/plugins/TestConfig.java create mode 100644 webgoat-lessons/xxe/src/test/java/org/owasp/webgoat/plugin/BlindSendFileAssignmentTest.java diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml index f9e4f76ae..d2f86a151 100644 --- a/webgoat-container/pom.xml +++ b/webgoat-container/pom.xml @@ -242,6 +242,12 @@ ${junit.version} jar + + com.github.fakemongo + fongo + 2.1.0 + test + diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java b/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java index 6af1770f3..28d0524fb 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java @@ -33,7 +33,6 @@ package org.owasp.webgoat.controller; import org.owasp.webgoat.lessons.AbstractLesson; import org.owasp.webgoat.session.Course; import org.owasp.webgoat.session.WebSession; -import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Controller; @@ -77,8 +76,8 @@ public class StartLesson { // I will set here the thymeleaf fragment location based on the resource requested. ModelAndView model = new ModelAndView(); SecurityContext context = SecurityContextHolder.getContext(); //TODO this should work with the security roles of Spring - GrantedAuthority authority = context.getAuthentication().getAuthorities().iterator().next(); - String path = request.getServletPath(); // we now got /a/b/c/AccessControlMatrix.lesson + //GrantedAuthority authority = context.getAuthentication().getAuthorities().iterator().next(); + String path = request.getRequestURL().toString(); // we now got /a/b/c/AccessControlMatrix.lesson String lessonName = path.substring(path.lastIndexOf('/') + 1, path.indexOf(".lesson")); List lessons = course.getLessons(); Optional lesson = lessons.stream() diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java index eb200b354..1336fa326 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java @@ -1,6 +1,6 @@ package org.owasp.webgoat.lessons; -import lombok.Getter; +import com.google.common.collect.Lists; import lombok.Setter; import org.owasp.webgoat.session.Screen; @@ -44,10 +44,16 @@ public abstract class AbstractLesson extends Screen implements Comparable assignments; + public List getAssignments() { + if (assignments == null) { + return Lists.newArrayList(); + } + return assignments; + } + /** * Constructor for the Lesson object */ diff --git a/webgoat-container/src/main/resources/application.properties b/webgoat-container/src/main/resources/application.properties index 4119f9887..5ac2c63c3 100644 --- a/webgoat-container/src/main/resources/application.properties +++ b/webgoat-container/src/main/resources/application.properties @@ -29,6 +29,7 @@ webgoat.database.driver=org.hsqldb.jdbcDriver webgoat.database.connection.string=jdbc:hsqldb:mem:{USER} webgoat.default.language=en + spring.data.mongodb.database=webgoat spring.mongodb.embedded.storage.databaseDir=${webgoat.user.directory}/mongodb/ diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java new file mode 100644 index 000000000..049d38697 --- /dev/null +++ b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java @@ -0,0 +1,42 @@ +package org.owasp.webgoat.plugins; + +import org.junit.Before; +import org.owasp.webgoat.i18n.Language; +import org.owasp.webgoat.i18n.Messages; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.context.embedded.LocalServerPort; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.boot.test.mock.mockito.MockBean; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.web.context.WebApplicationContext; + +import java.util.Locale; + +import static org.mockito.Mockito.when; + +/** + * @author nbaars + * @since 5/20/17. + */ +@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) +public abstract class LessonTest { + + @LocalServerPort + protected int localPort; + protected MockMvc mockMvc; + @Autowired + protected WebApplicationContext wac; + @Autowired + protected Messages messages; + @MockBean + protected WebSession webSession; + @MockBean + private Language language; + + @Before + public void init() { + when(language.getLocale()).thenReturn(Locale.US); + } + +} diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/TestConfig.java b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/TestConfig.java new file mode 100644 index 000000000..5946104b4 --- /dev/null +++ b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/TestConfig.java @@ -0,0 +1,23 @@ +package org.owasp.webgoat.plugins; + +import com.github.fakemongo.Fongo; +import com.mongodb.MongoClient; +import org.springframework.context.annotation.Configuration; +import org.springframework.data.mongodb.config.AbstractMongoConfiguration; + +/** + * Using Fongo for embedded in memory MongoDB testing + */ +@Configuration +public class TestConfig extends AbstractMongoConfiguration { + + @Override + protected String getDatabaseName() { + return "test"; + } + + @Override + public MongoClient mongo() throws Exception { + return new Fongo(getDatabaseName()).getMongo(); + } +} \ No newline at end of file diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index 51babeab6..f19b0ba3c 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -33,11 +33,19 @@ ${project.version} provided jar + + + + de.flapdoodle.embed + de.flapdoodle.embed.mongo + + - - - + + + org.owasp.webgoat @@ -45,6 +53,14 @@ ${project.version} tests test + + + + de.flapdoodle.embed + de.flapdoodle.embed.mongo + + junit @@ -70,6 +86,12 @@ 4.1.3.RELEASE test + + com.github.fakemongo + fongo + 2.1.0 + test + org.owasp.encoder encoder @@ -119,6 +141,6 @@ - - + + diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java index 3214757c6..3a3ddb74f 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java @@ -1,8 +1,9 @@ package org.owasp.webgoat.plugin; +import com.beust.jcommander.internal.Lists; import com.google.common.base.Joiner; import lombok.SneakyThrows; -import org.apache.commons.lang.exception.ExceptionUtils; +import org.apache.commons.lang3.StringEscapeUtils; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; @@ -59,9 +60,9 @@ public class BlindSendFileAssignment extends AssignmentEndpoint { @Value("${webgoat.user.directory}") private String webGoatHomeDirectory; @Autowired - private WebSession webSession; - @Autowired private Comments comments; + @Autowired + private WebSession webSession; @PostConstruct @SneakyThrows @@ -76,20 +77,20 @@ public class BlindSendFileAssignment extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST, consumes = MediaType.ALL_VALUE, produces = MediaType.APPLICATION_JSON_VALUE) @ResponseBody - public AttackResult createNewUser(@RequestBody String commentStr) throws Exception { - String error = "Parsing successful contents not send to server"; + public AttackResult addComment(@RequestBody String commentStr) throws Exception { + String error = "Parsing successful contents not send to attacker"; try { Comment comment = comments.parseXml(commentStr); comments.addComment(comment, false); } catch (Exception e) { - error = ExceptionUtils.getFullStackTrace(e); + error = StringEscapeUtils.escapeJson(e.toString()); } - File logFile = new File(webGoatHomeDirectory, "/XXE/log.txt"); - List lines = Files.readAllLines(Paths.get(logFile.toURI())); + File logFile = new File(webGoatHomeDirectory, "/XXE/log" + webSession.getUserName() + ".txt"); + List lines = logFile.exists() ? Files.readAllLines(Paths.get(logFile.toURI())) : Lists.newArrayList(); boolean solved = lines.stream().filter(l -> l.contains("WebGoat 8 rocks...")).findFirst().isPresent(); - logFile.delete(); if (solved) { + logFile.delete(); return trackProgress(success().output("xxe.blind.output").outputArgs(Joiner.on('\n').join(lines)).build()); } else { return trackProgress(failed().output(error).build()); diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java index ec37961f7..c09fa0377 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/Ping.java @@ -2,12 +2,10 @@ package org.owasp.webgoat.plugin; import lombok.extern.slf4j.Slf4j; import org.owasp.webgoat.assignments.Endpoint; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; -import org.springframework.web.bind.annotation.RequestHeader; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.ResponseBody; +import org.springframework.web.bind.annotation.*; import java.io.File; import java.io.FileNotFoundException; @@ -47,6 +45,8 @@ public class Ping extends Endpoint { @Value("${webgoat.user.directory}") private String webGoatHomeDirectory; + @Autowired + private WebSession webSession; @Override public String getPath() { @@ -58,7 +58,7 @@ public class Ping extends Endpoint { public String logRequest(@RequestHeader("User-Agent") String userAgent, @RequestParam(required = false) String text) { String logLine = String.format("%s %s %s", "GET", userAgent, text); log.debug(logLine); - File logFile = new File(webGoatHomeDirectory, "/XXE/log.tdxt"); + File logFile = new File(webGoatHomeDirectory, "/XXE/log" + webSession.getUserName() + ".txt"); try { try (PrintWriter pw = new PrintWriter(logFile)) { pw.println(logLine); diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html index 2ad34cf5d..21b4aa916 100644 --- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html +++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html @@ -2,7 +2,6 @@ -
    -
    - -
    +
    - -
    +
    - -
    +
    - -
    +
    - -
    +
    - -
    - - - - -
    -
    -
    +
    - -
    - - - -
    - -
    -
    +
    - -
    +
    - -
    - - - -
    - -
    -
    - - - -
    - -
    -
    - -
    +
    - -
    +
    - -
    +
    - -
    +
    - -
    +
    - -
    +
    - -
    diff --git a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties index 407f5367a..e63a9fb5c 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties @@ -1,12 +1,13 @@ #StringSqlInjection.java StringSqlInjectionSecondStage=Now that you have successfully performed an SQL injection, try the same type of attack on a parameterized query. Restart the lesson if you wish to return to the injectable query. EnterLastName=Enter your last name: -NoResultsMatched=No results matched. Try Again. +NoResultsMatched=No results matched. Try Again. SqlStringInjectionHint1=The application is taking your input and inserting it at the end of a pre-formed SQL command. SqlStringInjectionHint2=This is the code for the query being built and issued by WebGoat:

    "SELECT * FROM user_data WHERE last_name = "accountName" SqlStringInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ]. - +SqlStringInjectionHint5=Try adding a union to the query, the number of columns should match. +SqlStringInjectionHint6=Try entering [ Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- ]. sql-injection.5a.success=You have succeed: {0} sql-injection.5a.no.results=No results matched. Try Again. diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java new file mode 100644 index 000000000..54c99b481 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java @@ -0,0 +1,81 @@ +package org.owasp.webgoat.plugin; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.owasp.webgoat.plugins.LessonTest; +import org.owasp.webgoat.session.WebgoatContext; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.hamcrest.CoreMatchers.containsString; +import static org.hamcrest.CoreMatchers.is; +import static org.mockito.Mockito.when; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * @author nbaars + * @since 5/21/17. + */ +@RunWith(SpringJUnit4ClassRunner.class) +public class SqlInjectionLesson5aTest extends LessonTest { + + @Autowired + private WebgoatContext context; + + @Before + public void setup() throws Exception { + SqlInjection sql = new SqlInjection(); + when(webSession.getCurrentLesson()).thenReturn(sql); + when(webSession.getWebgoatContext()).thenReturn(context); + this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build(); + } + + @Test + public void knownAccountShouldDisplayData() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") + .param("account", "Smith")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(jsonPath("lessonCompleted", is(false))) + .andExpect(jsonPath("$.feedback", is(messages.getMessage("assignment.not.solved")))) + .andExpect(jsonPath("$.output", containsString("

    USERID, FIRST_NAME"))); + } + + @Test + public void unknownAccount() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") + .param("account", "Smithh")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(jsonPath("lessonCompleted", is(false))) + .andExpect(jsonPath("$.feedback", is(messages.getMessage("NoResultsMatched")))) + .andExpect(jsonPath("$.output").doesNotExist()); + } + + @Test + public void sqlInjection() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") + .param("account", "smith' OR '1' = '1")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(jsonPath("lessonCompleted", is(true))) + .andExpect(jsonPath("$.feedback", containsString("You have succeed"))) + .andExpect(jsonPath("$.output").doesNotExist()); + } + + @Test + public void sqlInjectionWrongShouldDisplayError() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack5a") + .param("account", "smith' OR '1' = '1'")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(jsonPath("lessonCompleted", is(false))) + .andExpect(jsonPath("$.feedback", containsString(messages.getMessage("assignment.not.solved")))) + .andExpect(jsonPath("$.output", is("malformed string: '1''"))); + } +} \ No newline at end of file diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java index 3a3ddb74f..f8792b06c 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java @@ -3,7 +3,6 @@ package org.owasp.webgoat.plugin; import com.beust.jcommander.internal.Lists; import com.google.common.base.Joiner; import lombok.SneakyThrows; -import org.apache.commons.lang3.StringEscapeUtils; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; @@ -83,7 +82,7 @@ public class BlindSendFileAssignment extends AssignmentEndpoint { Comment comment = comments.parseXml(commentStr); comments.addComment(comment, false); } catch (Exception e) { - error = StringEscapeUtils.escapeJson(e.toString()); + error = e.toString(); } File logFile = new File(webGoatHomeDirectory, "/XXE/log" + webSession.getUserName() + ".txt"); From 19a4859e4f7093c584e6b62df7e8e875e430aef0 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Mon, 12 Jun 2017 13:03:14 +0200 Subject: [PATCH 22/41] Fix hint not being display correctly due to missing escaping --- .../xxe/src/main/resources/i18n/WebGoatLabels.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties index 864ae5afb..877a3774c 100644 --- a/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/xxe/src/main/resources/i18n/WebGoatLabels.properties @@ -31,7 +31,7 @@ xxe.blind.output=Contents of the file is: {0} xxe.hints.simple.xxe.1=Try submitting the form and see what happens xxe.hints.simple.xxe.2=XXE stands for XML External Entity attack xxe.hints.simple.xxe.3=Try to include your own DTD -xxe.hints.simple.xxe.4=Try to include a doctype ( Date: Mon, 12 Jun 2017 15:08:55 +0200 Subject: [PATCH 23/41] XXE successfully completed message was no longer shown, fixed it by using form POST together with customjs functions. Introduced callback functionality which you can specify after the posting in order to be able to load the comments list again. --- .../js/goatApp/view/LessonContentView.js | 8 +++-- webgoat-lessons/sol.txt | 2 +- .../org/owasp/webgoat/plugin/SimpleXXE.java | 3 +- .../xxe/src/main/resources/html/XXE.html | 8 +++-- .../xxe/src/main/resources/js/xxe.js | 32 ++++++++----------- 5 files changed, 26 insertions(+), 27 deletions(-) diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js index beb0f6fa6..dd96905cb 100644 --- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js +++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js @@ -80,7 +80,9 @@ define(['jquery', var self = this; // TODO custom Data prep for submission var prepareDataFunctionName = $(curForm).attr('prepareData'); + var callbackFunctionName = $(curForm).attr('callback'); var submitData = (typeof webgoat.customjs[prepareDataFunctionName] === 'function') ? webgoat.customjs[prepareDataFunctionName]() : $(curForm).serialize(); + var callbackFunction = (typeof webgoat.customjs[callbackFunctionName] === 'function') ? webgoat.customjs[callbackFunctionName] : function() {}; // var submitData = this.$form.serialize(); this.curForm = curForm; this.$curFeedback = $(curForm).closest('.attack-container').find('.attack-feedback'); @@ -93,14 +95,16 @@ define(['jquery', url:formUrl, method:formMethod, contentType:contentType, - data: submitData + data: submitData, + complete: function (data) { + callbackFunction(); + } }).then(self.onSuccessResponse.bind(self), self.onErrorResponse.bind(self)); return false; }, onSuccessResponse: function(data) { this.renderFeedback(data.feedback); - this.renderOutput(data.output || ""); //TODO: refactor back assignmentCompleted in Java if (data.lessonCompleted || data.assignmentCompleted) { diff --git a/webgoat-lessons/sol.txt b/webgoat-lessons/sol.txt index c686e4396..d54494a64 100644 --- a/webgoat-lessons/sol.txt +++ b/webgoat-lessons/sol.txt @@ -11,7 +11,7 @@ Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from ## XXE ## -Simple - ]> &root;test +Simple - ]>&root; Modern Rest Framework - change content type to: Content-Type: application/xml && ]> &root;test diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java index f1f5bdfc3..4a3de9d8f 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java @@ -9,7 +9,6 @@ import org.owasp.webgoat.assignments.AttackResult; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; import org.springframework.web.bind.annotation.RequestBody; -import org.springframework.web.bind.annotation.RequestHeader; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.ResponseBody; @@ -65,7 +64,7 @@ public class SimpleXXE extends AssignmentEndpoint { @RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE) @ResponseBody - public AttackResult createNewComment(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { + public AttackResult createNewComment(@RequestBody String commentStr) throws Exception { String error = ""; try { Comment comment = comments.parseXml(commentStr); diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html index 21b4aa916..bbdc2e39a 100644 --- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html +++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html @@ -24,8 +24,10 @@

    + prepareData="simpleXXE" + callback="simpleXXECallback" + contentType="application/xml" + action="/WebGoat/xxe/simple">
    @@ -54,7 +56,7 @@ - +
      diff --git a/webgoat-lessons/xxe/src/main/resources/js/xxe.js b/webgoat-lessons/xxe/src/main/resources/js/xxe.js index dc5b0ddcf..f0219af89 100644 --- a/webgoat-lessons/xxe/src/main/resources/js/xxe.js +++ b/webgoat-lessons/xxe/src/main/resources/js/xxe.js @@ -1,23 +1,17 @@ +webgoat.customjs.simpleXXE = function () { + var commentInput = $("#commentInputSimple").val(); + var xml = '' + + '' + + ' ' + commentInput + '' + + ''; + return xml; +} + +webgoat.customjs.simpleXXECallback = function() { + getComments('#commentsListSimple'); +} + $(document).ready(function () { - $("#postCommentSimple").unbind(); - $("#postCommentSimple").on("click", function () { - var commentInput = $("#commentInputSimple").val(); - var xml = '' + - '' + - ' ' + commentInput + '' + - ''; - $.ajax({ - type: 'POST', - url: 'xxe/simple', - data: xml, - contentType: "application/xml", - dataType: 'xml', - complete: function (data) { - $("#commentInputSimple").val(''); - getComments('#commentsListSimple') - } - }) - }); getComments('#commentsListSimple'); }); From 99f75a835c442661db73d7eb89a39666b130f40c Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Mon, 12 Jun 2017 20:02:21 +0200 Subject: [PATCH 24/41] #359 Fixed --- .../xxe/src/main/resources/html/XXE.html | 22 ++++--- .../xxe/src/main/resources/js/xxe.js | 61 ++++++++----------- 2 files changed, 37 insertions(+), 46 deletions(-) diff --git a/webgoat-lessons/xxe/src/main/resources/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/html/XXE.html index bbdc2e39a..7b0d74867 100644 --- a/webgoat-lessons/xxe/src/main/resources/html/XXE.html +++ b/webgoat-lessons/xxe/src/main/resources/html/XXE.html @@ -53,10 +53,10 @@
    - - +
      @@ -80,8 +80,10 @@
      + prepareData="contentTypeXXE" + callback="contentTypeXXECallback" + action="xxe/content-type" + contentType="application/json">
      @@ -107,10 +109,10 @@
      - - +
        @@ -143,8 +145,10 @@
        + contentType="application/xml">
        @@ -170,9 +174,9 @@
        - + - +
          diff --git a/webgoat-lessons/xxe/src/main/resources/js/xxe.js b/webgoat-lessons/xxe/src/main/resources/js/xxe.js index f0219af89..391101e89 100644 --- a/webgoat-lessons/xxe/src/main/resources/js/xxe.js +++ b/webgoat-lessons/xxe/src/main/resources/js/xxe.js @@ -8,6 +8,7 @@ webgoat.customjs.simpleXXE = function () { } webgoat.customjs.simpleXXECallback = function() { + $("#commentInputBlind").val(''); getComments('#commentsListSimple'); } @@ -15,50 +16,36 @@ $(document).ready(function () { getComments('#commentsListSimple'); }); +webgoat.customjs.blindXXE = function() { + var commentInput = $("#commentInputBlind").val(); + var xml = '' + + '' + + ' ' + commentInput + '' + + ''; + return xml; +} + +webgoat.customjs.blindXXECallback = function() { + $("#commentInputBlind").val(''); + getComments('#commentsListBlind'); +} + $(document).ready(function () { - $("#postCommentBlind").unbind(); - $("#postCommentBlind").on("click", function () { - var commentInput = $("#commentInputBlind").val(); - var xml = '' + - '' + - ' ' + commentInput + '' + - ''; - $.ajax({ - type: 'POST', - url: 'xxe/blind', - data: xml, - contentType: "application/xml", - dataType: 'xml', - complete: function (data) { - $("#commentInputBlind").val(''); - getComments('#commentsListBlind') - } - }) - }); getComments('#commentsListBlind'); }); -$(document).ready(function () { - $("#postCommentContentType").unbind(); - $("#postCommentContentType").on("click", function () { - var commentInput = $("#commentInputContentType").val(); - $.ajax({ - type: 'POST', - url: 'xxe/content-type', - data: JSON.stringify({text: commentInput}), - contentType: "application/json", - dataType: 'xml', - complete: function (data) { - $("#commentInputContentType").val(''); - getComments('#commentsListContentType') - } - }) - }); +webgoat.customjs.contentTypeXXE = function() { + var commentInput = $("#commentInputContentType").val(); + return JSON.stringify({text: commentInput}); +} + +webgoat.customjs.contentTypeXXECallback = function() { + $("#commentInputContentType").val(''); getComments('#commentsListContentType'); -}); +} $(document).ready(function () { - getComments(); + getComments('#commentsListContentType'); }); var html = '
        • ' + From 007cdaa0d87336cee7ab9872e0a2d514185d0976 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20Smol=C3=ADk?= Date: Fri, 2 Jun 2017 16:30:19 +0200 Subject: [PATCH 25/41] insecure login lesson --- webgoat-lessons/insecure-login/pom.xml | 34 ++++++++++ .../owasp/webgoat/plugin/InsecureLogin.java | 63 +++++++++++++++++++ .../webgoat/plugin/InsecureLoginTask.java | 59 +++++++++++++++++ .../main/resources/html/InsecureLogin.html | 45 +++++++++++++ .../resources/i18n/WebGoatLabels.properties | 4 ++ .../src/main/resources/js/credentials.js | 6 ++ .../lessonPlans/en/InsecureLogin_Intro.adoc | 7 +++ .../lessonPlans/en/InsecureLogin_Task.adoc | 4 ++ webgoat-lessons/pom.xml | 1 + webgoat-server/pom.xml | 5 ++ 10 files changed, 228 insertions(+) create mode 100755 webgoat-lessons/insecure-login/pom.xml create mode 100755 webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLogin.java create mode 100755 webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java create mode 100755 webgoat-lessons/insecure-login/src/main/resources/html/InsecureLogin.html create mode 100755 webgoat-lessons/insecure-login/src/main/resources/i18n/WebGoatLabels.properties create mode 100755 webgoat-lessons/insecure-login/src/main/resources/js/credentials.js create mode 100755 webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Intro.adoc create mode 100755 webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Task.adoc diff --git a/webgoat-lessons/insecure-login/pom.xml b/webgoat-lessons/insecure-login/pom.xml new file mode 100755 index 000000000..aac10ceef --- /dev/null +++ b/webgoat-lessons/insecure-login/pom.xml @@ -0,0 +1,34 @@ + + 4.0.0 + insecure-login + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + + + junit + junit + ${junit.version} + jar + test + + + + + diff --git a/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLogin.java b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLogin.java new file mode 100755 index 000000000..6d8108e63 --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLogin.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import com.beust.jcommander.internal.Lists; +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

          + * Copyright (c) 2002 - 20014 Bruce Mayhew + *

          + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

          + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

          + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

          + * Getting Source ============== + *

          + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

          + * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class InsecureLogin extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.INSECURE_COMMUNICATION; + } + + @Override + public List getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 1; + } + + @Override + public String getTitle() { + return "insecure-login.title"; + } + + @Override + public String getId() { + return "InsecureLogin"; + } +} diff --git a/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java new file mode 100755 index 000000000..e5895f39c --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/java/org/owasp/webgoat/plugin/InsecureLoginTask.java @@ -0,0 +1,59 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * ************************************************************************************************* + * + * + * This file is part of WebGoat, an Open Web Application Security Project + * utility. For details, please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 20014 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at your option) any later + * version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository + * for free software projects. + * + * For details, please see http://webgoat.github.io + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 + */ +@AssignmentPath("/InsecureLogin/task") +public class InsecureLoginTask extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String username, @RequestParam String password) throws IOException { + if (username.toString().equals("CaptainJack") && password.toString().equals("BlackPearl")) { + return trackProgress(success().build()); + } + return trackProgress(failed().build()); + } +} diff --git a/webgoat-lessons/insecure-login/src/main/resources/html/InsecureLogin.html b/webgoat-lessons/insecure-login/src/main/resources/html/InsecureLogin.html new file mode 100755 index 000000000..04798c65f --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/resources/html/InsecureLogin.html @@ -0,0 +1,45 @@ + + + + +

          + + +
          +
          + +
          + +
          +
          +
          + + + + + + +

          +
          + + + + + +
          +
          +
          +
          +
          + diff --git a/webgoat-lessons/insecure-login/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/insecure-login/src/main/resources/i18n/WebGoatLabels.properties new file mode 100755 index 000000000..dc4f1874f --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/resources/i18n/WebGoatLabels.properties @@ -0,0 +1,4 @@ +insecure-login.title=Insecure Login + +insecure-login.intercept.success=Welcome, CaptainJack! +insecure-login.intercept.failure=Wrong username or password diff --git a/webgoat-lessons/insecure-login/src/main/resources/js/credentials.js b/webgoat-lessons/insecure-login/src/main/resources/js/credentials.js new file mode 100755 index 000000000..b7387c623 --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/resources/js/credentials.js @@ -0,0 +1,6 @@ +function submit_secret_credentials() { + var xhttp = new XMLHttpRequest(); + xhttp['open']('POST', '#attack/307/100', true); + //sending the request is obfuscated, to descourage js reading + var _0xb7f9=["\x43\x61\x70\x74\x61\x69\x6E\x4A\x61\x63\x6B","\x42\x6C\x61\x63\x6B\x50\x65\x61\x72\x6C","\x73\x74\x72\x69\x6E\x67\x69\x66\x79","\x73\x65\x6E\x64"];xhttp[_0xb7f9[3]](JSON[_0xb7f9[2]]({username:_0xb7f9[0],password:_0xb7f9[1]})) +} \ No newline at end of file diff --git a/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Intro.adoc b/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Intro.adoc new file mode 100755 index 000000000..f4fac8471 --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Intro.adoc @@ -0,0 +1,7 @@ + +== Concept +Encryption is a very inportant tool for secure communication. In this lesson, we will find out, why it should always be employed when sending sensitive data. + +== Goals +* The user should have a basic understanding of packet sniffer usage +* The user will be able to intercept and read an unencrypted requests \ No newline at end of file diff --git a/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Task.adoc b/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Task.adoc new file mode 100755 index 000000000..e6e7fea56 --- /dev/null +++ b/webgoat-lessons/insecure-login/src/main/resources/lessonPlans/en/InsecureLogin_Task.adoc @@ -0,0 +1,4 @@ +=== Let's try +Click the "log in" button to send a request containing login credentials of another user. +Then, write these credentials into the appropriate fields and submit to confirm. +Try using a packet sniffer to intercept the request. diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index f19b0ba3c..c0bd2241a 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -19,6 +19,7 @@ cross-site-scripting http-basics http-proxies + insecure-login jwt sql-injection xxe diff --git a/webgoat-server/pom.xml b/webgoat-server/pom.xml index 8dff0cda9..2708a0055 100644 --- a/webgoat-server/pom.xml +++ b/webgoat-server/pom.xml @@ -116,6 +116,11 @@ idor ${project.version} + + org.owasp.webgoat.lesson + insecure-login + ${project.version} + org.owasp.webgoat.lesson jwt From 01421ca822663fa885caac9e2f52efaa9eea0ea2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20Smol=C3=ADk?= Date: Fri, 2 Jun 2017 16:32:10 +0200 Subject: [PATCH 26/41] html restrictions lesson --- webgoat-lessons/html-tampering/pom.xml | 34 +++++++ .../owasp/webgoat/plugin/HtmlTampering.java | 63 +++++++++++++ .../webgoat/plugin/HtmlTamperingTask.java | 59 ++++++++++++ .../main/resources/html/HtmlTampering.html | 91 +++++++++++++++++++ .../resources/i18n/WebGoatLabels.properties | 5 + .../lessonPlans/en/HtmlTampering_Intro.adoc | 7 ++ .../lessonPlans/en/HtmlTampering_Task.adoc | 2 + webgoat-lessons/pom.xml | 1 + webgoat-server/pom.xml | 5 + 9 files changed, 267 insertions(+) create mode 100755 webgoat-lessons/html-tampering/pom.xml create mode 100755 webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java create mode 100755 webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java create mode 100755 webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html create mode 100755 webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties create mode 100755 webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc create mode 100755 webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc diff --git a/webgoat-lessons/html-tampering/pom.xml b/webgoat-lessons/html-tampering/pom.xml new file mode 100755 index 000000000..44d24a8ce --- /dev/null +++ b/webgoat-lessons/html-tampering/pom.xml @@ -0,0 +1,34 @@ + + 4.0.0 + html-tampering + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + + + junit + junit + ${junit.version} + jar + test + + + + + diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java new file mode 100755 index 000000000..86223963c --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import com.beust.jcommander.internal.Lists; +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

          + * Copyright (c) 2002 - 20014 Bruce Mayhew + *

          + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

          + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

          + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

          + * Getting Source ============== + *

          + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

          + * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class HtmlTampering extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.PARAMETER_TAMPERING; + } + + @Override + public List getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 3; + } + + @Override + public String getTitle() { + return "html-tampering.title"; + } + + @Override + public String getId() { + return "HtmlTampering"; + } +} diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java new file mode 100755 index 000000000..a89ba294a --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java @@ -0,0 +1,59 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * ************************************************************************************************* + * + * + * This file is part of WebGoat, an Open Web Application Security Project + * utility. For details, please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 20014 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at your option) any later + * version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository + * for free software projects. + * + * For details, please see http://webgoat.github.io + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 + */ +@AssignmentPath("/HtmlTampering/task") +public class HtmlTamperingTask extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String QTY, @RequestParam String Total) throws IOException { + if (Float.parseFloat(QTY) * 2999.99 > Float.parseFloat(Total) + 1) { + return trackProgress(success().feedback("html-tampering.tamper.success").build()); + } + return trackProgress(failed().feedback("html-tampering.tamper.failure").build()); + } +} diff --git a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html new file mode 100755 index 000000000..552fc8e1b --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html @@ -0,0 +1,91 @@ + + + + +

          + + +
          +
          + +
          + +
          +
          +
          +
          + +
          +

          Shopping Cart

          +
          +
          + + + + + + + + + + + + + + + +
          Shopping Cart Items To Buy NowPriceQuantityTotal
          56 inch HDTV (model KTV-551)2999.99 + +
          +
          + + + + + + + + + +
          The total charged to your credit card:$2999,99 + + + +
          + +
          + + +
          +

          +
          +
          +
          +
          + diff --git a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties new file mode 100755 index 000000000..8084fcf71 --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties @@ -0,0 +1,5 @@ +html-tampering.title=HTML tampering + + +html-tampering.tamper.success=Well done, you just bought a TV at a discount +html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost! diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc new file mode 100755 index 000000000..d2dd4b243 --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc @@ -0,0 +1,7 @@ + +== Concept +Browsers generally offer many options of editing the displayed content. Developers +therefore must be aware that the values sent by the user may have been tampered with. +== Goals +* The user should have a basic understanding of HTML +* The user will be able to exploit editing front end of website diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc new file mode 100755 index 000000000..60b07989d --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc @@ -0,0 +1,2 @@ +=== Try it yourself +This is an internet store. Try to buy TV-s for a lower price. diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index c0bd2241a..79d287f30 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -17,6 +17,7 @@ challenge client-side-filtering cross-site-scripting + html-tampering http-basics http-proxies insecure-login diff --git a/webgoat-server/pom.xml b/webgoat-server/pom.xml index 2708a0055..bce375377 100644 --- a/webgoat-server/pom.xml +++ b/webgoat-server/pom.xml @@ -101,6 +101,11 @@ cross-site-scripting ${project.version}           + + org.owasp.webgoat.lesson + html-tampering + ${project.version} + org.owasp.webgoat.lesson http-basics From 870fa000aa6ccea7a753a2095acc220ac3c4b5ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20Smol=C3=ADk?= Date: Fri, 2 Jun 2017 16:34:20 +0200 Subject: [PATCH 27/41] bypass front-end restrictions (javascript validation) --- webgoat-lessons/bypass-restrictions/pom.xml | 34 +++++ .../webgoat/plugin/BypassRestrictions.java | 63 +++++++++ .../BypassRestrictionsFieldRestrictions.java | 74 +++++++++++ .../BypassRestrictionsFrontendValidation.java | 87 ++++++++++++ .../resources/html/BypassRestrictions.html | 124 ++++++++++++++++++ .../resources/i18n/WebGoatLabels.properties | 4 + .../BypassRestrictions_FieldRestrictions.adoc | 6 + ...BypassRestrictions_FrontendValidation.adoc | 8 ++ .../en/BypassRestrictions_Intro.adoc | 10 ++ webgoat-lessons/pom.xml | 1 + webgoat-server/pom.xml | 5 + 11 files changed, 416 insertions(+) create mode 100755 webgoat-lessons/bypass-restrictions/pom.xml create mode 100755 webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java create mode 100755 webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFieldRestrictions.java create mode 100644 webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidation.java create mode 100755 webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html create mode 100755 webgoat-lessons/bypass-restrictions/src/main/resources/i18n/WebGoatLabels.properties create mode 100755 webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FieldRestrictions.adoc create mode 100644 webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc create mode 100755 webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc diff --git a/webgoat-lessons/bypass-restrictions/pom.xml b/webgoat-lessons/bypass-restrictions/pom.xml new file mode 100755 index 000000000..0f5b02576 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/pom.xml @@ -0,0 +1,34 @@ + + 4.0.0 + bypass-restrictions + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + + + junit + junit + ${junit.version} + jar + test + + + + + diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java new file mode 100755 index 000000000..5f74cea57 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import com.beust.jcommander.internal.Lists; +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

          + * Copyright (c) 2002 - 20014 Bruce Mayhew + *

          + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

          + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

          + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

          + * Getting Source ============== + *

          + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

          + * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class BypassRestrictions extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.PARAMETER_TAMPERING; + } + + @Override + public List getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 2; + } + + @Override + public String getTitle() { + return "bypass-restrictions.title"; + } + + @Override + public String getId() { + return "BypassRestrictions"; + } +} diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFieldRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFieldRestrictions.java new file mode 100755 index 000000000..b916019f8 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFieldRestrictions.java @@ -0,0 +1,74 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * ************************************************************************************************* + * + * + * This file is part of WebGoat, an Open Web Application Security Project + * utility. For details, please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 20014 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at your option) any later + * version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository + * for free software projects. + * + * For details, please see http://webgoat.github.io + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 + */ +@AssignmentPath("/BypassRestrictions/FieldRestrictions") +public class BypassRestrictionsFieldRestrictions extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String select, @RequestParam String radio, @RequestParam String checkbox, @RequestParam String shortInput) throws IOException { + if (select.toString().equals("option1") || select.toString().equals("option2")) { + return trackProgress(failed().build()); + } + if (radio.toString().equals("option1") || radio.toString().equals("option2")) { + return trackProgress(failed().build()); + } + if (checkbox.toString().equals("on") || checkbox.toString().equals("off")) { + return trackProgress(failed().build()); + } + if (shortInput.toString().length() <= 5) { + return trackProgress(failed().build()); + } + /*if (disabled == null) { + return trackProgress(failed().build()); + } + if (submit.toString().equals("submit")) { + return trackProgress(failed().build()); + }*/ + return trackProgress(success().build()); + } +} diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidation.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidation.java new file mode 100644 index 000000000..7eaefb129 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidation.java @@ -0,0 +1,87 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * ************************************************************************************************* + * + * + * This file is part of WebGoat, an Open Web Application Security Project + * utility. For details, please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 20014 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at your option) any later + * version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository + * for free software projects. + * + * For details, please see http://webgoat.github.io + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 + */ +@AssignmentPath("/BypassRestrictions/frontendValidation") +public class BypassRestrictionsFrontendValidation extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String field1, @RequestParam String field2, @RequestParam String field3, @RequestParam String field4, @RequestParam String field5, @RequestParam String field6, @RequestParam String field7, @RequestParam Integer error) throws IOException { + String regex1="^[a-z]{3}$"; + String regex2="^[0-9]{3}$"; + String regex3="^[a-zA-Z0-9 ]*$"; + String regex4="^(one|two|three|four|five|six|seven|eight|nine)$"; + String regex5="^\\d{5}$"; + String regex6="^\\d{5}(-\\d{4})?$"; + String regex7="^[2-9]\\d{2}-?\\d{3}-?\\d{4}$"; + if (error>0) { + return trackProgress(failed().build()); + } + if (field1.matches(regex1)) { + return trackProgress(failed().build()); + } + if (field2.matches(regex2)) { + return trackProgress(failed().build()); + } + if (field3.matches(regex3)) { + return trackProgress(failed().build()); + } + if (field4.matches(regex4)) { + return trackProgress(failed().build()); + } + if (field5.matches(regex5)) { + return trackProgress(failed().build()); + } + if (field6.matches(regex6)) { + return trackProgress(failed().build()); + } + if (field7.matches(regex7)) { + return trackProgress(failed().build()); + } + return trackProgress(success().build()); + } +} diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html new file mode 100755 index 000000000..f8153ca3e --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html @@ -0,0 +1,124 @@ + + + + +

          + + +
          +
          + +
          + +
          +
          +
          +
          + +
          Select field with two possible values
          + +
          Radio button with two possible values
          + Option 1
          + Option 2
          +
          Checkbox: value either on or off
          + Checkbox +
          Input restricted to max 5 characters
          + +
          Disabled input field
          + + +
          +
          +
          +
          +
          + +
          +
          +
          +
          + +
          +
          + Field1: exactly three lowercase characters(^[a-z]{3}$) +
          +
          + +
          +

          +
          Field2: exactly three digits(^[0-9]{3}$)
          +
          + +
          +

          +
          Field3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
          +
          + +
          +

          +
          Field4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
          +
          + +
          +

          +
          Field5: simple zip code (^\d{5}$)
          +
          + +
          +

          +
          Field6: zip with optional dash four (^\d{5}(-\d{4})?$)
          +
          + +
          +

          +
          Field7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
          +
          + +
          + +

          +
          + + +
          +
          +
          +
          + diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/bypass-restrictions/src/main/resources/i18n/WebGoatLabels.properties new file mode 100755 index 000000000..bff117c72 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/i18n/WebGoatLabels.properties @@ -0,0 +1,4 @@ +bypass-restrictions.title=Bypass front-end restrictions + +bypass-restrictions.intercept.success=Well done, you intercepted the request as expected +bypass-restrictions.intercept.failure=Please try again. Make sure to make all the changes. And case sensitivity may matter ... or not, you never know! diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FieldRestrictions.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FieldRestrictions.adoc new file mode 100755 index 000000000..4d103d6b3 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FieldRestrictions.adoc @@ -0,0 +1,6 @@ +== Field Restrictions +In most browsers, client has complete or almost complete control over HTML part +of the webpage. They can alter values or restrictions to fit their preference. + +=== Task +Send a request that bypasses restrictions of all four of these fields diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc new file mode 100644 index 000000000..2f02262d0 --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc @@ -0,0 +1,8 @@ +== Validation +Often, there is some mechanism in place to prevent users from sending altered +field values to server, such as validation before sending. Most of popular browsers +such as Chrome don't allow editing scripts during runtime. We will have to circumvent +the validation some other way. + +=== Task +Send a request that does not fit the regular expression above the field in all fields. diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc new file mode 100755 index 000000000..5743d6f9a --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc @@ -0,0 +1,10 @@ + +== Concept +Users have a great degree of control over the front-end of the web application. +They can alter HTML code, sometimes also scripts. This is why +apps that require certain format of input should also validate on server-side. + +== Goals +* The user should have a basic knowledge of HTML +* The user should be able to tamper a request before sending (with proxy or other tool) +* The user will be able to tamper with field restrictions and bypass client-side validation diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index 79d287f30..5267c0099 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -14,6 +14,7 @@ + bypass-restrictions challenge client-side-filtering cross-site-scripting diff --git a/webgoat-server/pom.xml b/webgoat-server/pom.xml index bce375377..03297cc02 100644 --- a/webgoat-server/pom.xml +++ b/webgoat-server/pom.xml @@ -91,6 +91,11 @@ + + org.owasp.webgoat.lesson + bypass-restrictions + ${project.version} + org.owasp.webgoat.lesson client-side-filtering From b048988d2fbd166ff8b6530b60d0638f95db93bd Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Tue, 13 Jun 2017 03:22:19 +0200 Subject: [PATCH 28/41] Changed layout of the html tampering lesson and fixed some JavaScript issues. Added a small mitigation page. Moved the lessons concerning client side validation to client side category --- .../org/owasp/webgoat/lessons/Category.java | 2 +- .../webgoat/plugin/BypassRestrictions.java | 2 +- .../webgoat/plugin/ClientSideFiltering.java | 2 +- .../owasp/webgoat/plugin/HtmlTampering.java | 2 +- .../webgoat/plugin/HtmlTamperingTask.java | 3 +- .../main/resources/html/HtmlTampering.html | 220 +++++++++++------- .../resources/i18n/WebGoatLabels.properties | 4 + .../src/main/resources/images/samsung.jpg | Bin 0 -> 3547 bytes .../lessonPlans/en/HtmlTampering_Intro.adoc | 1 + .../en/HtmlTampering_Mitigation.adoc | 14 ++ .../lessonPlans/en/HtmlTampering_Task.adoc | 2 +- 11 files changed, 165 insertions(+), 87 deletions(-) create mode 100644 webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg create mode 100755 webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Mitigation.adoc diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java index 6c3a5833b..7d47892ab 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Category.java @@ -52,7 +52,7 @@ public enum Category { INSECURE_CONFIGURATION("Insecure Configuration", new Integer(1400)), INSECURE_STORAGE("Insecure Storage", new Integer(1500)), MALICIOUS_EXECUTION("Malicious Execution", new Integer(1600)), - PARAMETER_TAMPERING("Parameter Tampering", new Integer(1700)), + CLIENT_SIDE("Client side", new Integer(1700)), SESSION_MANAGEMENT("Session Management Flaws", new Integer(1800)), WEB_SERVICES("Web Services", new Integer(1900)), VULNERABLE_COMPONENTS("Vulnerable Components - A9", new Integer(1950)), diff --git a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java index 5f74cea57..21e522a22 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java +++ b/webgoat-lessons/bypass-restrictions/src/main/java/org/owasp/webgoat/plugin/BypassRestrictions.java @@ -38,7 +38,7 @@ import java.util.List; public class BypassRestrictions extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java index feff55a0f..98a7c4172 100644 --- a/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java +++ b/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/plugin/ClientSideFiltering.java @@ -39,7 +39,7 @@ public class ClientSideFiltering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.AJAX_SECURITY; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java index 86223963c..a03dddd1b 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java @@ -38,7 +38,7 @@ import java.util.List; public class HtmlTampering extends NewLesson { @Override public Category getDefaultCategory() { - return Category.PARAMETER_TAMPERING; + return Category.CLIENT_SIDE; } @Override diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java index a89ba294a..2f62612c0 100755 --- a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java @@ -1,6 +1,7 @@ package org.owasp.webgoat.plugin; import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; import org.owasp.webgoat.assignments.AssignmentPath; import org.owasp.webgoat.assignments.AttackResult; import org.springframework.web.bind.annotation.RequestMapping; @@ -8,7 +9,6 @@ import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; -import javax.servlet.http.HttpServletRequest; import java.io.IOException; /** @@ -45,6 +45,7 @@ import java.io.IOException; * @created October 28, 2003 */ @AssignmentPath("/HtmlTampering/task") +@AssignmentHints({ "hint1", "hint2", "hint3"}) public class HtmlTamperingTask extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) diff --git a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html index 552fc8e1b..b21ba255a 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html +++ b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html @@ -2,90 +2,148 @@ -
          - - -
          -
          +
          +
          +
          -
          - -
          -
          -
          -
          - -
          -

          Shopping Cart

          -
          -
          - - - - - - - - - - - - - - - -
          Shopping Cart Items To Buy NowPriceQuantityTotal
          56 inch HDTV (model KTV-551)2999.99 - -
          -
          - - - - - - - - - -
          The total charged to your credit card:$2999,99 - - - -
          - -
          - - -
          -

          -
          -
          -
          + var total = price * document.task.QTY.value; + $('#total').text('$' + total.toFixed(2)); + $('#subtotal').text('$' + total.toFixed(2)); + $('#totalAmount').text('$' + total.toFixed(2)); + $('#Total').val(total.toFixed(2)); + } + +
          +
          +
          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          ProductQuantityPriceTotal 
          +
          + + +
          +

          55'' M5510 White Full HD Smart TV +

          +
          by Samsung
          + Status: In Stock +
          +
          +           		+ + 2999.99$2999.99 + +
               
          Subtotal
          $2999.99
          +
               
          Shipping costs
          $0.00
          +
               

          Total

          $2999.99

          +
                + + +
          + +
          +
          +
          +
          +
          + +

          +
          +
          +
        +
        +
        +
        diff --git a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties index 8084fcf71..24ae7a2ed 100755 --- a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties @@ -3,3 +3,7 @@ html-tampering.title=HTML tampering html-tampering.tamper.success=Well done, you just bought a TV at a discount html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost! + +hint1=Try to change the number of items and see what is happening +hint2=Is the price part of the HTML request? +hint3=Intercept the request and manipulate the price before submitting it. diff --git a/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg b/webgoat-lessons/html-tampering/src/main/resources/images/samsung.jpg new file mode 100644 index 0000000000000000000000000000000000000000..dd15a64cf98c3b29fcc31b5ddc06af62f914286f GIT binary patch literal 3547 zcmbtWXIPWT7XDHofRrR4RUy=bDnvR9gbd?|aUBjwg<10l0y#zAgX)fdD<)2OLiW z+9$JrWhaOHs{>A)kJ|wR13&;mARq()Mt~p)&~Ycg4*(!27y<%*8ibC45efr=>6vKj zoF}e7*G~RG;NvNPndSn9L*TS21ppw06F>H_1iNua*ED)s@u$FSlD+3l`^3w?ECq>(pk=~GwvdM2S!Vp7Jjc1G0|$?xQusTtgZ z;5%!O$tMYcSe?WR5D`5b6#=18Dky~sice|bU}zVngFya2Vh|WY2c?HGAlTtZ4ir{i zP)Jse79ayHY!Dsz%gmqOlg66kOFXidDAIWZ4BuORGS0J}WP6U16m8f2K~kL>_OQD=W5&Mb z3K4yyOVjyYD-teYlv69;BRh>O}d7FSX6Vji#d)R)3vMpQ_Jdk7Jflssu{1oaL zYMIXYOIop=7+cu5@a9|cG+#9FP}IwL#%m-Qd5T=%x2Ag5FiomtCecfc#UxLKL03{* zl=AR0Yi#Ys)~X>_bp{4!hx=4t>*Q2Z-U~?BDTkFQel=~XTgV#NvBIcMIazs#Utd(1 z_EfwymVhDu551NdfPf3)emo8Y1kwcIt)H;V*ej;ec1s~>EQi7velm&1GPqU*7%3=g zPHIER;T(yT!*f{j=GG5?@QME{SxGA+U#q0!oX7YzmybMb+wb1Mv&c`f41&5pSp+~g zbmx~DS8iyach7>xR&G3J@aN6$dCZ$9#r%2w_4Q%)%~DIJCRmzFPNK03(sQNiKuLml zWAi=jIyg9urVuDS^b{TA-ywiO5GWl2phpU_bD-p~=5Q@XB1{Nx;pBfUAc9nVS~xPL zQdCy{4mrDKc;p}a={3QV9hRk%21_OZi-(ggVrjKDvCx%m*Jg17en132U9%HGDY(Z) zD%a@`(pF4JryP#HRBf-1G$wnPW{<>W$1d+CI&{Vx3-0$jj=ajus#D8)(57JEPX#?! zy&W@mR8=K1{@Ea3d{Ii?d3&ees!f8x!*jRoBE(X779jE6r6N)ng+C=X%hYdOZD3&e zpaUzYhp5(@o_Bcdk|TDF{wz=WMOKPaC0R@NV~!Kw5ZXQi6$=1iUQ3s(Wk2( z?C)$2a$MFYiYAx)fucJ8E?^Rg$(O zzE<ys1^ekA6$l&(n&{D2~>G zhn;n2CN;Sa#FRBy^m>JMjmNp>jxmc6F5iiQb6egyTP=uhudy;(ZY(ux81~MSc+sof zK4;=0$EN6P@*>eLX!z0i20p`#HV(Xw#hg0mWZCs>u-fzVGEXC+8 z6S=0<`8amxSbw9>BZLd@dS~#@ii^df(%M_=>@Ru{eHu9D(Q%nsZW5G2LVFPPbnx$N zbV{nJ(eJP52P*wh(%2eZ^hG+-tRDGw#^)}p(fVh1RVEFyE|X`Kf&~`wnfu-tW$-K~ zK`aJeI2E6Ap4XiJ$Jow9tG8C$-cguj$;oHLSoc-1hCsKrj{E~F3{ND+ma*|s<3f&)}@ zWjyoN7Ur>t+QccD8zDTAA3x2ey%ENXfK9TH)PO>bk;DlO=_0P6M_c)EyYbzjl;H1N zKCYM<+eyAs5wnu?Pj!+K-B#XV*U@O1mAZ1~a1N6Glc~e&t>@Y&d*(XLQO+B%Ded7K zvwVxu#{l+P_}DI6PDE=(1^n?%c1fK!M6+$<*v|B|ig&HYfQ{*^GfdcaLsRifes(Uz zRKJR}t|dO+?il4P9)GxUs!DjRc&JS>2a1ny!?Fm3!AWzGN!2!bY1`KlX7BwBkAk9pu-NMj7w*vkN_|Fyvhrigz5X3Dr(sC%eZe&=+$D;QGC1Aa&AKGMsqW z5L|-+i-kF}iU{!VPv8?6W@BVpE->%24P4e>+Yx~6uqo{@9RmWHnwptxnweZl16XE) zZf$Tzl+b>-JjWgK)IG!myKn_ zboT4t{CzreH{lrIHytds(iq6#u~QQmad{heuBPKFO7iw_Ojp3IdiIgurMaHo-(%KZ zn*Vbm3L%#v+gC6n5sDOFP%{!9ah)3s+=?XY@D_>3V=R)-psz2I+}aM$4?$T3L z1#k;os6I2mzV=enFlV;EvHRS?#s${CQ>q$cE~Xz(*o~m+J_rV-3EV$@4+tR#2x^%V zNn|+6aWkT_4JSMIKMjL_#}r=>*qL0$2pUc%xL@8F5e^#Z_54cMakq-ftt`>dQcC^Q zYNMgAqNg;{W5@n{A*ClnL`D7E5$gqN!hv)LnluBRb6U-dFAS8awicHP_OILzOH7<^ zP8#%E+mlrAYkm-HI(NP|ph0rI1(q{kR(k18bJNV&+kjiX)c1plU&~vxLuHhja5I-aIvy>P=+iK3F# zQhL1HD@3kz-0{;V^wV{rrhRt4#mbP^xg7@bEDW?QY(*wURNCkr(gebu5Z{|C{`Ix3 zT*Oq>Dc?0WGGr;IaGV%@5G^XBs*sLt{QWB{C!1A4oTT$CeJK7}RFUsWf=!4Iyq$C3 zAnGv!i;ZH9;NMDiYUdq~WQhk%n9hfDpcan-`?sMg4BDF&>PV#Q?pv2klz^Kgv|`vY z&Wy5&1C`@gJGXEP=nYcNzDU-suJ`oQu@Qz~ z`0--OnB8AFUj Date: Sun, 11 Jun 2017 22:12:53 +0200 Subject: [PATCH 29/41] Split large SQL lesson --- .../webgoat/plugin/SqlInjectionAdvanced.java | 63 ++++++++++++++ .../webgoat/plugin/SqlInjectionLesson6a.java | 2 +- .../plugin/SqlInjectionMitigations.java | 63 ++++++++++++++ .../src/main/resources/html/SqlInjection.html | 74 ---------------- .../resources/html/SqlInjectionAdvanced.html | 85 +++++++++++++++++++ .../html/SqlInjectionMitigation.html | 85 +++++++++++++++++++ .../resources/i18n/WebGoatLabels.properties | 5 +- .../en/SqlInjectionAdvanced_plan.adoc | 8 ++ .../en/SqlInjection_content10.adoc | 55 ++++++------ .../lessonPlans/en/SqlInjection_plan.adoc | 1 - 10 files changed, 332 insertions(+), 109 deletions(-) create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java create mode 100644 webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html create mode 100644 webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjectionAdvanced_plan.adoc diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java new file mode 100644 index 000000000..5a8a28c25 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.ArrayList; +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

        + * Copyright (c) 2002 - 20014 Bruce Mayhew + *

        + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

        + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

        + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

        + * Getting Source ============== + *

        + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

        + * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class SqlInjectionAdvanced extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.INJECTION; + } + + @Override + public List getHints() { + return new ArrayList<>(); + } + + @Override + public Integer getDefaultRanking() { + return 1; + } + + @Override + public String getTitle() { + return "SQL Injection (advanced)"; + } + + @Override + public String getId() { + return "SqlInjectionAdvanced"; + } +} diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java index 90774c0e3..701e9a0e4 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java @@ -48,7 +48,7 @@ import static org.owasp.webgoat.plugin.SqlInjectionLesson5a.writeTable; * @created October 28, 2003 */ @AssignmentPath("/SqlInjection/attack6a") -@AssignmentHints(value = {"SqlStringInjectionHint5", "SqlStringInjectionHint6"}) +@AssignmentHints(value = {"SqlStringInjectionHint5", "SqlStringInjectionHint6", "SqlStringInjectionHint7"}) public class SqlInjectionLesson6a extends AssignmentEndpoint { @RequestMapping(method = RequestMethod.POST) diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java new file mode 100644 index 000000000..291d9c98f --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.ArrayList; +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

        + * Copyright (c) 2002 - 20014 Bruce Mayhew + *

        + * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

        + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

        + * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

        + * Getting Source ============== + *

        + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

        + * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class SqlInjectionMitigations extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.INJECTION; + } + + @Override + public List getHints() { + return new ArrayList<>(); + } + + @Override + public Integer getDefaultRanking() { + return 1; + } + + @Override + public String getTitle() { + return "SQL Injection (mitigations)"; + } + + @Override + public String getId() { + return "SqlInjectionMitigations"; + } +} diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjection.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjection.html index 0cdcc1d49..bdbe8095e 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjection.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjection.html @@ -71,78 +71,4 @@

        -
        -
        -
        - -
        -
        -
        -
        -
        - - - - - - - -
        Name:
        -
        -
        -
        -
        -
        -
        -
        - - - - - - - -
        Password:
        -
        -
        -
        -
        - -
        -
        -
        -
        - -
        -
        -
        - -
        -
        -
        - -
        -
        -
        - -
        -
        -
        - -
        -
        -
        - -
        -
        -
        - diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html new file mode 100644 index 000000000..3c4a1d6ec --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html @@ -0,0 +1,85 @@ + + + + + +
        +
        +
        + + +
        +
        +
        + +
        +
        +
        +
        +
        + + + + + + + +
        Name:
        +
        +
        +
        +
        +
        +
        +
        + + + + + + + +
        Password:
        +
        +
        +
        +
        + +
        +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + + diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html new file mode 100644 index 000000000..3c4a1d6ec --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html @@ -0,0 +1,85 @@ + + + + + +
        +
        +
        + + +
        +
        +
        + +
        +
        +
        +
        +
        + + + + + + + +
        Name:
        +
        +
        +
        +
        +
        +
        +
        + + + + + + + +
        Password:
        +
        +
        +
        +
        + +
        +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + +
        +
        +
        + + diff --git a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties index e63a9fb5c..52cc02fe2 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties @@ -6,8 +6,9 @@ SqlStringInjectionHint1=The application is taking your input and inserting it at SqlStringInjectionHint2=This is the code for the query being built and issued by WebGoat:

        "SELECT * FROM user_data WHERE last_name = "accountName" SqlStringInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ]. -SqlStringInjectionHint5=Try adding a union to the query, the number of columns should match. -SqlStringInjectionHint6=Try entering [ Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- ]. +SqlStringInjectionHint5=First try to find out the number of columns by adding a group by 1,2,3 etc to the query. +SqlStringInjectionHint6=Try adding a union to the query, the number of columns should match. +SqlStringInjectionHint7=Try entering [ Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- ]. sql-injection.5a.success=You have succeed: {0} sql-injection.5a.no.results=No results matched. Try Again. diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjectionAdvanced_plan.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjectionAdvanced_plan.adoc new file mode 100644 index 000000000..c9a75b8a6 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjectionAdvanced_plan.adoc @@ -0,0 +1,8 @@ +== Concept + +This lesson describes the more advanced topics for an SQL injection. + +== Goals + +** Combining SQL Injection Techniques +** Blind SQL injection diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content10.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content10.adoc index c0ad3d455..2e4a775d1 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content10.adoc +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content10.adoc @@ -1,35 +1,28 @@ == Parameterized Queries – Java Example +[source,java] ------------------------------------------------------- -// Parser returns only valid string data -String accountID = getParser().getStringParameter(ACCT_ID, ""); -String data = null; -try -{ - // Read only database connection - Statement connection = DatabaseUtilities.getConnection(READ_ONLY); - - // Build a fully qualified query - String query = "SELECT first_name, last_name, acct_id, balance - FROM user_data WHERE acct_id = ?"; - PreparedStatement statement = connection.prepareStatement(query); - statement.setString(1, accountID); - ResultSet results = statement.executeQuery(); - if ((results != null) && (results.first() == true)) - { - // Only one record should be returned for this query - Results.last(); - if (results.getRow() <= 2) - { - data = processAccount(results); - } - else { // Handle the error – Database integrity issue } - } - else { // Handle the error – no records found } +public static String loadAccount() { + // Parser returns only valid string data + String accountID = getParser().getStringParameter(ACCT_ID, ""); + String data = null; + String query = "SELECT first_name, last_name, acct_id, balance FROM user_data WHERE acct_id = ?"; + try (Connection connection = null; + PreparedStatement statement = connection.prepareStatement(query)) { + statement.setString(1, accountID); + ResultSet results = statement.executeQuery(); + if (results != null && results.first()) { + results.last(); // Only one record should be returned for this query + if (results.getRow() <= 2) { + data = processAccount(results); + } else { + // Handle the error – Database integrity issue + } + } else { + // Handle the error – no records found } + } + } catch (SQLException sqle) { + // Log and handle the SQL Exception } + } + return data; } -catch (SQLException sqle) { // Log and handle the SQL Exception } -catch (Exception e) { // Log and handle the Exception } -finally { // Always close connection in finally block - DatabaseUtilities.closeConnection(); -} -return data; ------------------------------------------------------- diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_plan.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_plan.adoc index 2865b3d81..6fd7064aa 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_plan.adoc +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_plan.adoc @@ -9,5 +9,4 @@ This lesson describes what is Structured Query Language (SQL) and how it can be * The user will demonstrate knowledge on: ** String SQL Injection ** Numeric SQL Injection -** Combining SQL Injection Techniques From ee912f734b348c21ca90a410979fc3e1897b5947 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Tue, 13 Jun 2017 06:43:03 +0200 Subject: [PATCH 30/41] Added SQL injection from challenge to lesson and added content for a blind sql injection --- .../webgoat/plugin/SqlInjectionChallenge.java | 136 ++++++++++++++++++ .../src/main/resources/css/challenge.css | 96 +++++++++++++ .../resources/html/SqlInjectionAdvanced.html | 127 +++++++++++++--- .../html/SqlInjectionMitigation.html | 85 ----------- .../html/SqlInjectionMitigations.html | 34 +++++ .../src/main/resources/js/challenge.js | 18 +++ .../en/SqlInjection_challenge.adoc | 4 + .../en/SqlInjection_content6c.adoc | 59 ++++++++ 8 files changed, 451 insertions(+), 108 deletions(-) create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java create mode 100644 webgoat-lessons/sql-injection/src/main/resources/css/challenge.css delete mode 100644 webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html create mode 100644 webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html create mode 100644 webgoat-lessons/sql-injection/src/main/resources/js/challenge.js create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_challenge.adoc create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java new file mode 100644 index 000000000..f47076500 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java @@ -0,0 +1,136 @@ +package org.owasp.webgoat.plugin; + +import lombok.extern.slf4j.Slf4j; +import org.apache.commons.lang3.RandomStringUtils; +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.DatabaseUtilities; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.util.StringUtils; +import org.springframework.web.bind.annotation.PutMapping; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import java.sql.*; + +import static org.springframework.web.bind.annotation.RequestMethod.POST; + +/** + * @author nbaars + * @since 4/8/17. + */ +@AssignmentPath("SqlInjection/challenge") +@Slf4j +public class SqlInjectionChallenge extends AssignmentEndpoint { + + private static final String PASSWORD_TOM = "thisisasecretfortomonly"; + //Make it more random at runtime (good luck guessing) + private static final String USERS_TABLE_NAME = "challenge_users_6" + RandomStringUtils.randomAlphabetic(16); + + @Autowired + private WebSession webSession; + + public SqlInjectionChallenge() { + log.info("Challenge 6 tablename is: {}", USERS_TABLE_NAME); + } + + @PutMapping //assignment path is bounded to class so we use different http method :-) + @ResponseBody + public AttackResult registerNewUser(@RequestParam String username_reg, @RequestParam String email_reg, @RequestParam String password_reg) throws Exception { + AttackResult attackResult = checkArguments(username_reg, email_reg, password_reg); + + if (attackResult == null) { + Connection connection = DatabaseUtilities.getConnection(webSession); + checkDatabase(connection); + + String checkUserQuery = "select userid from " + USERS_TABLE_NAME + " where userid = '" + username_reg + "'"; + Statement statement = connection.createStatement(); + ResultSet resultSet = statement.executeQuery(checkUserQuery); + + if (resultSet.next()) { + attackResult = failed().feedback("user.exists").feedbackArgs(username_reg).build(); + } else { + PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO " + USERS_TABLE_NAME + " VALUES (?, ?, ?)"); + preparedStatement.setString(1, username_reg); + preparedStatement.setString(2, email_reg); + preparedStatement.setString(3, password_reg); + preparedStatement.execute(); + attackResult = success().feedback("user.created").feedbackArgs(username_reg).build(); + } + } + return attackResult; + } + + private AttackResult checkArguments(String username_reg, String email_reg, String password_reg) { + if (StringUtils.isEmpty(username_reg) || StringUtils.isEmpty(email_reg) || StringUtils.isEmpty(password_reg)) { + return failed().feedback("input.invalid").build(); + } + if (username_reg.length() > 250 || email_reg.length() > 30 || password_reg.length() > 30) { + return failed().feedback("input.invalid").build(); + } + return null; + } + + @RequestMapping(method = POST) + @ResponseBody + public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception { + Connection connection = DatabaseUtilities.getConnection(webSession); + checkDatabase(connection); + + PreparedStatement statement = connection.prepareStatement("select password from " + USERS_TABLE_NAME + " where userid = ? and password = ?"); + statement.setString(1, username_login); + statement.setString(2, password_login); + ResultSet resultSet = statement.executeQuery(); + + if (resultSet.next() && "tom".equals(username_login)) { + return success().build(); + } else { + return failed().feedback("NoResultsMatched").build(); + } + } + + private void checkDatabase(Connection connection) throws SQLException { + try { + Statement statement = connection.createStatement(); + statement.execute("select 1 from " + USERS_TABLE_NAME); + } catch (SQLException e) { + createChallengeTable(connection); + } + } + + private void createChallengeTable(Connection connection) { + Statement statement = null; + try { + statement = connection.createStatement(); + String dropTable = "DROP TABLE " + USERS_TABLE_NAME; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + log.info("Delete failed, this does not point to an error table might not have been present..."); + } + log.debug("Challenge 6 - Creating tables for users {}", USERS_TABLE_NAME); + try { + String createTableStatement = "CREATE TABLE " + USERS_TABLE_NAME + + " (" + "userid varchar(250)," + + "email varchar(30)," + + "password varchar(30)" + + ")"; + statement.executeUpdate(createTableStatement); + + String insertData1 = "INSERT INTO " + USERS_TABLE_NAME + " VALUES ('larry', 'larry@webgoat.org', 'larryknows')"; + String insertData2 = "INSERT INTO " + USERS_TABLE_NAME + " VALUES ('tom', 'tom@webgoat.org', '" + PASSWORD_TOM + "')"; + String insertData3 = "INSERT INTO " + USERS_TABLE_NAME + " VALUES ('alice', 'alice@webgoat.org', 'rt*(KJ()LP())$#**')"; + String insertData4 = "INSERT INTO " + USERS_TABLE_NAME + " VALUES ('eve', 'eve@webgoat.org', '**********')"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + } catch (SQLException e) { + log.error("Unable create table", e); + } + } + +} + diff --git a/webgoat-lessons/sql-injection/src/main/resources/css/challenge.css b/webgoat-lessons/sql-injection/src/main/resources/css/challenge.css new file mode 100644 index 000000000..6a8635ae6 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/css/challenge.css @@ -0,0 +1,96 @@ +.panel-login { + border-color: #ccc; + -webkit-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2); + -moz-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2); + box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2); +} +.panel-login>.panel-heading { + color: #00415d; + background-color: #fff; + border-color: #fff; + text-align:center; +} +.panel-login>.panel-heading a{ + text-decoration: none; + color: #666; + font-weight: bold; + font-size: 15px; + -webkit-transition: all 0.1s linear; + -moz-transition: all 0.1s linear; + transition: all 0.1s linear; +} +.panel-login>.panel-heading a.active{ + color: #029f5b; + font-size: 18px; +} +.panel-login>.panel-heading hr{ + margin-top: 10px; + margin-bottom: 0px; + clear: both; + border: 0; + height: 1px; + background-image: -webkit-linear-gradient(left,rgba(0, 0, 0, 0),rgba(0, 0, 0, 0.15),rgba(0, 0, 0, 0)); + background-image: -moz-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0)); + background-image: -ms-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0)); + background-image: -o-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0)); +} +.panel-login input[type="text"],.panel-login input[type="email"],.panel-login input[type="password"] { + height: 45px; + border: 1px solid #ddd; + font-size: 16px; + -webkit-transition: all 0.1s linear; + -moz-transition: all 0.1s linear; + transition: all 0.1s linear; +} +.panel-login input:hover, +.panel-login input:focus { + outline:none; + -webkit-box-shadow: none; + -moz-box-shadow: none; + box-shadow: none; + border-color: #ccc; +} +.btn-login { + background-color: #59B2E0; + outline: none; + color: #fff; + font-size: 14px; + height: auto; + font-weight: normal; + padding: 14px 0; + text-transform: uppercase; + border-color: #59B2E6; +} +.btn-login:hover, +.btn-login:focus { + color: #fff; + background-color: #53A3CD; + border-color: #53A3CD; +} +.forgot-password { + text-decoration: underline; + color: #888; +} +.forgot-password:hover, +.forgot-password:focus { + text-decoration: underline; + color: #666; +} + +.btn-register { + background-color: #1CB94E; + outline: none; + color: #fff; + font-size: 14px; + height: auto; + font-weight: normal; + padding: 14px 0; + text-transform: uppercase; + border-color: #1CB94A; +} +.btn-register:hover, +.btn-register:focus { + color: #fff; + background-color: #1CA347; + border-color: #1CA347; +} diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html index 3c4a1d6ec..a4b749dc6 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionAdvanced.html @@ -52,34 +52,115 @@
      - -
      -
      -
      -
      -
      -
      -
      +
      +
      +
      +
      + + +
      +
      +
      +
      +
      + +
      +
      +
      +
      +
      +
      +
      +
      -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - -
      -
      -
      diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html deleted file mode 100644 index 3c4a1d6ec..000000000 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigation.html +++ /dev/null @@ -1,85 +0,0 @@ - - - - - -
      -
      -
      - - -
      -
      -
      - -
      -
      -
      -
      -
      - - - - - - - -
      Name:
      -
      -
      -
      -
      -
      -
      -
      - - - - - - - -
      Password:
      -
      -
      -
      -
      - -
      -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - -
      -
      -
      - - diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html new file mode 100644 index 000000000..6bb7187f3 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html @@ -0,0 +1,34 @@ + + + + + +
      +
      +
      + +
      +
      +
      + +
      +
      +
      + +
      +
      +
      + +
      +
      +
      + +
      +
      +
      + +
      +
      +
      + + diff --git a/webgoat-lessons/sql-injection/src/main/resources/js/challenge.js b/webgoat-lessons/sql-injection/src/main/resources/js/challenge.js new file mode 100644 index 000000000..9107e1176 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/js/challenge.js @@ -0,0 +1,18 @@ +$(function() { + + $('#login-form-link').click(function(e) { + $("#login-form").delay(100).fadeIn(100); + $("#register-form").fadeOut(100); + $('#register-form-link').removeClass('active'); + $(this).addClass('active'); + e.preventDefault(); + }); + $('#register-form-link').click(function(e) { + $("#register-form").delay(100).fadeIn(100); + $("#login-form").fadeOut(100); + $('#login-form-link').removeClass('active'); + $(this).addClass('active'); + e.preventDefault(); + }); + +}); \ No newline at end of file diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_challenge.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_challenge.adoc new file mode 100644 index 000000000..0fdb4f2d3 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_challenge.adoc @@ -0,0 +1,4 @@ +We now explained the basic steps involved in an SQL injection. In this assignment you will need to combine all +the things we explained in the SQL lessons. + +Have fun! \ No newline at end of file diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc new file mode 100644 index 000000000..d81a9d1c9 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc @@ -0,0 +1,59 @@ +=== Blind SQL Injection + +Blind SQL injection is a type of SQL injection attack that asks the database true or false +questions and determines the answer based on the applications response. This attack is often used when the web +application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL +injection. + +==== Difference + +Let's first start with the difference between a normal SQL injection and a blind SQL injection. In a normal +SQL injection the error messages from the database are displayed and gives enough information to find out how +the query is working. Or in the case of an union based SQL injection the application does not reflect the information +directly on the webpage. So in the case where nothing is displayed you will need to start asking the database questions +based on a true or false statement. That's why a blind SQL injection is much more difficult to exploit. + +There are several different types of blind SQL injections: content based and time based SQL injections. + + +==== Example + +In this case we are trying to ask the database a boolean question based on for example a unique id, for example +suppose we have the following url: `https://my-shop.com?article=4` +On the server side this query will be translated as follows: + +---- +SELECT * from articles where article_id = 4 +---- + +When we want to exploit this we change the url into: `https://my-shop.com?article=4 AND 1=1` +This will be translated to: + +---- +SELECT * from articles where article_id = 4 AND 1 = 1 +---- + +If the browser will return the same page as it used to when using `https://my-shop.com?article=4` you know the +website is vulnerable for a blind SQL injection. +If the browser responds with a page not found or something else you know a blind SQL injection might not work. +You can now change the SQL query and test for example: `https://my-shop.com?article=4 AND 1=2` which will not return +anything because the query returns false. + +So but how do we actually take advantage of this? Above we only asked the database for trivial question but you can +for example also use the following url: `https://my-shop.com?article=4 AND substring(database_version(),1,1) = 2` + +Most of the time you start by finding which type of database is used, based on the type of database you can find +the system tables of the database you can enumerate all the tables present in the database. With this information +you can start getting information from all the tables and you are able to dump the database. +Be aware that this approach might not work if the privileges of the database are setup correctly (meaning the +system tables cannot be queried with the user used to connect from the web application to the database). + + +Another way is called a time based SQL injection, in this case you will ask the database to wait before returning +the result. You might need to use this if you are totally blind so there is no difference between the response you +can use for example: + +---- +article = 4; sleep(10) -- +---- + From a4844674195034274907a3b27d13c80cd1be9a49 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 15 Jun 2017 19:02:51 +0200 Subject: [PATCH 31/41] Adding extra lesson for order by clauses --- .../webgoat/CleanupLocalProgressFiles.java | 11 +- .../org/owasp/webgoat/session/CreateDB.java | 1769 ++++++++--------- .../{ => advanced}/SqlInjectionAdvanced.java | 2 +- .../{ => advanced}/SqlInjectionChallenge.java | 2 +- .../{ => introduction}/SqlInjection.java | 2 +- .../SqlInjectionLesson5a.java | 2 +- .../SqlInjectionLesson5b.java | 2 +- .../SqlInjectionLesson6a.java | 6 +- .../SqlInjectionLesson6b.java | 2 +- .../webgoat/plugin/mitigation/Servers.java | 56 + .../mitigation/SqlInjectionLesson12a.java | 46 + .../SqlInjectionMitigations.java | 2 +- .../html/SqlInjectionMitigations.html | 78 + .../resources/i18n/WebGoatLabels.properties | 4 + .../src/main/resources/js/assignment12.js | 61 + .../en/SqlInjection_content12a.adoc | 48 + .../en/SqlInjection_content6c.adoc | 6 +- .../lessonPlans/en/SqlInjection_order_by.adoc | 4 + .../plugin/SqlInjectionLesson12aTest.java | 80 + .../plugin/SqlInjectionLesson5aTest.java | 1 + 20 files changed, 1246 insertions(+), 938 deletions(-) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => advanced}/SqlInjectionAdvanced.java (97%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => advanced}/SqlInjectionChallenge.java (99%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjection.java (97%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjectionLesson5a.java (99%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjectionLesson5b.java (98%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjectionLesson6a.java (95%) rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjectionLesson6b.java (98%) create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java create mode 100644 webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java rename webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/{ => mitigation}/SqlInjectionMitigations.java (97%) create mode 100644 webgoat-lessons/sql-injection/src/main/resources/js/assignment12.js create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc create mode 100644 webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_order_by.adoc create mode 100644 webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java b/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java index 9200a8a5a..6e9e89985 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java @@ -4,6 +4,7 @@ import lombok.extern.slf4j.Slf4j; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression; import org.springframework.context.annotation.Configuration; +import org.springframework.util.FileSystemUtils; import javax.annotation.PostConstruct; import java.io.File; @@ -23,14 +24,6 @@ public class CleanupLocalProgressFiles { @PostConstruct public void clean() { File dir = new File(webgoatHome); - if (dir.exists()) { - File[] progressFiles = dir.listFiles(f -> f.getName().endsWith(".progress")); - if (progressFiles != null) { - log.info("Removing stored user preferences..."); - for (File f : progressFiles) { - f.delete(); - } - } - } + FileSystemUtils.deleteRecursively(dir); } } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java index 4031e0c82..725507cac 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java @@ -7,756 +7,708 @@ import java.sql.Statement; /** - ************************************************************************************************* - * - * + * ************************************************************************************************ + *

      + *

      * This file is part of WebGoat, an Open Web Application Security Project utility. For details, * please see http://www.owasp.org/ - * + *

      * Copyright (c) 2002 - 20014 Bruce Mayhew - * + *

      * This program is free software; you can redistribute it and/or modify it under the terms of the * GNU General Public License as published by the Free Software Foundation; either version 2 of the * License, or (at your option) any later version. - * + *

      * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. - * + *

      * You should have received a copy of the GNU General Public License along with this program; if * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA * 02111-1307, USA. - * + *

      * Getting Source ============== - * + *

      * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software * projects. * * @author Jeff Williams Aspect Security * @version $Id: $Id */ -public class CreateDB -{ - - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * - * @exception SQLException - * Description of the Exception - */ - private void createMessageTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Drop admin user table - try - { - String dropTable = "DROP TABLE messages"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop message database"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE messages (" + "num int not null," + "title varchar(50)," - + "message varchar(200)," + "user_name varchar(50) not null, " + "lesson_type varchar(50) not null" - + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating message database " + e.getLocalizedMessage()); - } - } +public class CreateDB { /** * Description of the Method * * @param connection Description of the Parameter - * - * @exception SQLException Description of the Exception + * @throws SQLException Description of the Exception */ - private void createMFEImagesTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Drop mfe_images table - try - { - String dropTable = "DROP TABLE mfe_images"; - statement.executeUpdate(dropTable); - } - catch (SQLException e) - { - System.out.println("Info - Could not drop mfe_images table from database"); - } - - // Create the new mfe_images table - try - { - String createTableStatement = "CREATE TABLE mfe_images (" - + "user_name varchar(50) not null, " - + "image_relative_url varchar(50) not null" - + ")"; - statement.executeUpdate(createTableStatement); - } - catch (SQLException e) - { - System.out.println("Error creating mfe_images table in database " + e.getLocalizedMessage()); - } + private void createServersTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + // Drop servers table + try { + String dropTable = "DROP TABLE servers"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop servers table"); + } + + // Create the new table + try { + String createTableStatement = "CREATE TABLE servers" + + " (" + "id varchar(10)," + + "hostname varchar(20)," + + "ip varchar(20)," + + "mac varchar(20)," + + "status varchar(20)," + + "description varchar(40)" + + ")"; + statement.executeUpdate(createTableStatement); + + String insertData1 = "INSERT INTO servers VALUES ('1', 'webgoat-dev', '192.168.4.0', 'AA:BB:11:22:CC:DD', 'online', 'Development server')"; + String insertData2 = "INSERT INTO servers VALUES ('2', 'webgoat-tst', '192.168.2.1', 'EE:FF:33:44:AB:CD', 'online', 'Test server')"; + String insertData3 = "INSERT INTO servers VALUES ('3', 'webgoat-acc', '192.168.3.3', 'EF:12:FE:34:AA:CC', 'offline', 'Acceptance server')"; + String insertData4 = "INSERT INTO servers VALUES ('4', 'webgoat-pre-prod', '192.168.6.4', 'EF:12:FE:34:AA:CC', 'offline', 'Pre-production server')"; + String insertData5 = "INSERT INTO servers VALUES ('4', 'webgoat-prd', '104.130.219.202', 'FA:91:EB:82:DC:73', 'out of order', 'Production server')"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + } catch (SQLException e) { + System.out.println("Error creating product table " + e.getLocalizedMessage()); + } + } + + + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createMessageTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + // Drop admin user table + try { + String dropTable = "DROP TABLE messages"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop message database"); + } + + // Create the new table + try { + String createTableStatement = "CREATE TABLE messages (" + "num int not null," + "title varchar(50)," + + "message varchar(200)," + "user_name varchar(50) not null, " + "lesson_type varchar(50) not null" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating message database " + e.getLocalizedMessage()); + } + } + + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createMFEImagesTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + // Drop mfe_images table + try { + String dropTable = "DROP TABLE mfe_images"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop mfe_images table from database"); + } + + // Create the new mfe_images table + try { + String createTableStatement = "CREATE TABLE mfe_images (" + + "user_name varchar(50) not null, " + + "image_relative_url varchar(50) not null" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating mfe_images table in database " + e.getLocalizedMessage()); + } } - - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * - * @exception SQLException - * Description of the Exception - */ - private void createProductTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - // Drop admin user table - try - { - String dropTable = "DROP TABLE product_system_data"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop product table"); - } + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createProductTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - // Create the new table - try - { - String createTableStatement = "CREATE TABLE product_system_data (" - + "productid varchar(6) not null primary key," + "product_name varchar(20)," + "price varchar(10)" - + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating product table " + e.getLocalizedMessage()); - } + // Drop admin user table + try { + String dropTable = "DROP TABLE product_system_data"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop product table"); + } - // Populate - String insertData1 = "INSERT INTO product_system_data VALUES ('32226','Dog Bone','$1.99')"; - String insertData2 = "INSERT INTO product_system_data VALUES ('35632','DVD Player','$214.99')"; - String insertData3 = "INSERT INTO product_system_data VALUES ('24569','60 GB Hard Drive','$149.99')"; - String insertData4 = "INSERT INTO product_system_data VALUES ('56970','80 GB Hard Drive','$179.99')"; - String insertData5 = "INSERT INTO product_system_data VALUES ('14365','56 inch HDTV','$6999.99')"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - } + // Create the new table + try { + String createTableStatement = "CREATE TABLE product_system_data (" + + "productid varchar(6) not null primary key," + "product_name varchar(20)," + "price varchar(10)" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating product table " + e.getLocalizedMessage()); + } - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * - * @exception SQLException - * Description of the Exception - */ - private void createUserAdminTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Drop admin user table - try - { - String dropTable = "DROP TABLE user_system_data"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop user admin table"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE user_system_data (" + "userid varchar(5) not null primary key," - + "user_name varchar(12)," + "password varchar(10)," + "cookie varchar(30)" + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating user admin table " + e.getLocalizedMessage()); - } - - // Populate - String insertData1 = "INSERT INTO user_system_data VALUES ('101','jsnow','passwd1', '')"; - String insertData2 = "INSERT INTO user_system_data VALUES ('102','jdoe','passwd2', '')"; - String insertData3 = "INSERT INTO user_system_data VALUES ('103','jplane','passwd3', '')"; - String insertData4 = "INSERT INTO user_system_data VALUES ('104','jeff','jeff', '')"; - String insertData5 = "INSERT INTO user_system_data VALUES ('105','dave','dave', '')"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - } - - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * - * @exception SQLException - * Description of the Exception - */ - private void createUserDataTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Delete table if there is one - try - { - String dropTable = "DROP TABLE user_data"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop user table"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE user_data (" + "userid int not null," - + "first_name varchar(20)," + "last_name varchar(20)," + "cc_number varchar(30)," - + "cc_type varchar(10)," + "cookie varchar(20)," + "login_count int" + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating user table " + e.getLocalizedMessage()); - } - - // Populate it - String insertData1 = "INSERT INTO user_data VALUES (101,'Joe','Snow','987654321','VISA',' ',0)"; - String insertData2 = "INSERT INTO user_data VALUES (101,'Joe','Snow','2234200065411','MC',' ',0)"; - String insertData3 = "INSERT INTO user_data VALUES (102,'John','Smith','2435600002222','MC',' ',0)"; - String insertData4 = "INSERT INTO user_data VALUES (102,'John','Smith','4352209902222','AMEX',' ',0)"; - String insertData5 = "INSERT INTO user_data VALUES (103,'Jane','Plane','123456789','MC',' ',0)"; - String insertData6 = "INSERT INTO user_data VALUES (103,'Jane','Plane','333498703333','AMEX',' ',0)"; - String insertData7 = "INSERT INTO user_data VALUES (10312,'Jolly','Hershey','176896789','MC',' ',0)"; - String insertData8 = "INSERT INTO user_data VALUES (10312,'Jolly','Hershey','333300003333','AMEX',' ',0)"; - String insertData9 = "INSERT INTO user_data VALUES (10323,'Grumpy','youaretheweakestlink','673834489','MC',' ',0)"; - String insertData10 = "INSERT INTO user_data VALUES (10323,'Grumpy','youaretheweakestlink','33413003333','AMEX',' ',0)"; - String insertData11 = "INSERT INTO user_data VALUES (15603,'Peter','Sand','123609789','MC',' ',0)"; - String insertData12 = "INSERT INTO user_data VALUES (15603,'Peter','Sand','338893453333','AMEX',' ',0)"; - String insertData13 = "INSERT INTO user_data VALUES (15613,'Joesph','Something','33843453533','AMEX',' ',0)"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - statement.executeUpdate(insertData7); - statement.executeUpdate(insertData8); - statement.executeUpdate(insertData9); - statement.executeUpdate(insertData10); - statement.executeUpdate(insertData11); - statement.executeUpdate(insertData12); - statement.executeUpdate(insertData13); - - } - - private void createLoginTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Delete table if there is one - try - { - String dropTable = "DROP TABLE user_login"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop user_login table"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE user_login (" + "userid varchar(5)," - + "webgoat_user varchar(20)" + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating user_login table " + e.getLocalizedMessage()); - } - - } - - // creates the table pins which is used in the blind sql injection lesson - private void createBlindSQLLessonTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Delete table if there is one - try - { - String dropTable = "DROP TABLE pins"; - statement.executeUpdate(dropTable); - } - catch (SQLException e) - { - System.out.println("Info - Could not drop pins table"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE pins (" - + "cc_number varchar(30)," - + "pin int," - + "name varchar(20)" - + ")"; - statement.executeUpdate(createTableStatement); - } - catch (SQLException e) - { - System.out.println("Error creating pins table " + e.getLocalizedMessage()); - } - - // Populate it - String insertData1 = "INSERT INTO pins VALUES ('987654321098765', 1234, 'Joe')"; - String insertData2 = "INSERT INTO pins VALUES ('1234567890123456', 4567, 'Jack')"; - String insertData3 = "INSERT INTO pins VALUES ('4321432143214321', 4321, 'Jill')"; - String insertData4 = "INSERT INTO pins VALUES ('1111111111111111', 7777, 'Jim')"; - String insertData5 = "INSERT INTO pins VALUES ('1111222233334444', 2364, 'John')"; - - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - + // Populate + String insertData1 = "INSERT INTO product_system_data VALUES ('32226','Dog Bone','$1.99')"; + String insertData2 = "INSERT INTO product_system_data VALUES ('35632','DVD Player','$214.99')"; + String insertData3 = "INSERT INTO product_system_data VALUES ('24569','60 GB Hard Drive','$149.99')"; + String insertData4 = "INSERT INTO product_system_data VALUES ('56970','80 GB Hard Drive','$179.99')"; + String insertData5 = "INSERT INTO product_system_data VALUES ('14365','56 inch HDTV','$6999.99')"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); } - - // creates the table salaries which is used in the lessons - // which add or modify data using sql injection - private void createModifyWithSQLLessonTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - - // Delete table if there is one - try - { - String dropTable = "DROP TABLE salaries"; - statement.executeUpdate(dropTable); - } - catch (SQLException e) - { - System.out.println("Info - Could not drop salaries table"); - } - - // Create the new table - try - { - String createTableStatement = "CREATE TABLE salaries (" - + "userid varchar(50)," - + "salary int" - + ")"; - statement.executeUpdate(createTableStatement); - } - catch (SQLException e) - { - System.out.println("Error creating salaries table " + e.getLocalizedMessage()); - } - - // Populate it - String insertData1 = "INSERT INTO salaries VALUES ('jsmith', 20000)"; - String insertData2 = "INSERT INTO salaries VALUES ('lsmith', 45000)"; - String insertData3 = "INSERT INTO salaries VALUES ('wgoat', 100000)"; - String insertData4 = "INSERT INTO salaries VALUES ('rjones', 777777)"; - String insertData5 = "INSERT INTO salaries VALUES ('manderson', 65000)"; - - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - + + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createUserAdminTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + // Drop admin user table + try { + String dropTable = "DROP TABLE user_system_data"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop user admin table"); + } + + // Create the new table + try { + String createTableStatement = "CREATE TABLE user_system_data (" + "userid varchar(5) not null primary key," + + "user_name varchar(12)," + "password varchar(10)," + "cookie varchar(30)" + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating user admin table " + e.getLocalizedMessage()); + } + + // Populate + String insertData1 = "INSERT INTO user_system_data VALUES ('101','jsnow','passwd1', '')"; + String insertData2 = "INSERT INTO user_system_data VALUES ('102','jdoe','passwd2', '')"; + String insertData3 = "INSERT INTO user_system_data VALUES ('103','jplane','passwd3', '')"; + String insertData4 = "INSERT INTO user_system_data VALUES ('104','jeff','jeff', '')"; + String insertData5 = "INSERT INTO user_system_data VALUES ('105','dave','dave', '')"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); } - - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * - * @exception SQLException - * Description of the Exception - */ - private void createWeatherDataTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); - // Delete table if there is one - try - { - String dropTable = "DROP TABLE weather_data"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop weather table"); - } + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createUserDataTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - // Create the new table - try - { - String createTableStatement = "CREATE TABLE weather_data (" + "station int not null," - + "name varchar(20) not null," + "state char(2) not null," + "min_temp int not null," - + "max_temp int not null" + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating weather table " + e.getLocalizedMessage()); - } + // Delete table if there is one + try { + String dropTable = "DROP TABLE user_data"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop user table"); + } - // Populate it - String insertData1 = "INSERT INTO weather_data VALUES (101,'Columbia','MD',-10,102)"; - String insertData2 = "INSERT INTO weather_data VALUES (102,'Seattle','WA',-15,90)"; - String insertData3 = "INSERT INTO weather_data VALUES (103,'New York','NY',-10,110)"; - String insertData4 = "INSERT INTO weather_data VALUES (104,'Houston','TX',20,120)"; - String insertData5 = "INSERT INTO weather_data VALUES (10001,'Camp David','MD',-10,100)"; - String insertData6 = "INSERT INTO weather_data VALUES (11001,'Ice Station Zebra','NA',-60,30)"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - } + // Create the new table + try { + String createTableStatement = "CREATE TABLE user_data (" + "userid int not null," + + "first_name varchar(20)," + "last_name varchar(20)," + "cc_number varchar(30)," + + "cc_type varchar(10)," + "cookie varchar(20)," + "login_count int" + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating user table " + e.getLocalizedMessage()); + } - /** - * Create users with tans - * - * @param connection - * @throws SQLException - */ - private void createTanUserDataTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + // Populate it + String insertData1 = "INSERT INTO user_data VALUES (101,'Joe','Snow','987654321','VISA',' ',0)"; + String insertData2 = "INSERT INTO user_data VALUES (101,'Joe','Snow','2234200065411','MC',' ',0)"; + String insertData3 = "INSERT INTO user_data VALUES (102,'John','Smith','2435600002222','MC',' ',0)"; + String insertData4 = "INSERT INTO user_data VALUES (102,'John','Smith','4352209902222','AMEX',' ',0)"; + String insertData5 = "INSERT INTO user_data VALUES (103,'Jane','Plane','123456789','MC',' ',0)"; + String insertData6 = "INSERT INTO user_data VALUES (103,'Jane','Plane','333498703333','AMEX',' ',0)"; + String insertData7 = "INSERT INTO user_data VALUES (10312,'Jolly','Hershey','176896789','MC',' ',0)"; + String insertData8 = "INSERT INTO user_data VALUES (10312,'Jolly','Hershey','333300003333','AMEX',' ',0)"; + String insertData9 = "INSERT INTO user_data VALUES (10323,'Grumpy','youaretheweakestlink','673834489','MC',' ',0)"; + String insertData10 = "INSERT INTO user_data VALUES (10323,'Grumpy','youaretheweakestlink','33413003333','AMEX',' ',0)"; + String insertData11 = "INSERT INTO user_data VALUES (15603,'Peter','Sand','123609789','MC',' ',0)"; + String insertData12 = "INSERT INTO user_data VALUES (15603,'Peter','Sand','338893453333','AMEX',' ',0)"; + String insertData13 = "INSERT INTO user_data VALUES (15613,'Joesph','Something','33843453533','AMEX',' ',0)"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + statement.executeUpdate(insertData7); + statement.executeUpdate(insertData8); + statement.executeUpdate(insertData9); + statement.executeUpdate(insertData10); + statement.executeUpdate(insertData11); + statement.executeUpdate(insertData12); + statement.executeUpdate(insertData13); - // Delete table if there is one - try - { - String dropTable = "DROP TABLE user_data_tan"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop user_data_tan table"); - } + } - // Create the new table - try - { - String createTableStatement = "CREATE TABLE user_data_tan (" + "userid int not null," - + "first_name varchar(20)," + "last_name varchar(20)," + "cc_number varchar(30)," - + "cc_type varchar(10)," + "cookie varchar(20)," + "login_count int," + "password varchar(20)" - + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating user_data_tan table " + e.getLocalizedMessage()); - } + private void createLoginTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - // Populate it - String insertData1 = "INSERT INTO user_data_tan VALUES (101,'Joe','Snow','987654321','VISA',' ',0, 'banana')"; - String insertData2 = "INSERT INTO user_data_tan VALUES (102,'Jane','Plane','74589864','MC',' ',0, 'tarzan')"; - String insertData3 = "INSERT INTO user_data_tan VALUES (103,'Jack','Sparrow','68659365','MC',' ',0, 'sniffy')"; + // Delete table if there is one + try { + String dropTable = "DROP TABLE user_login"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop user_login table"); + } - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - } + // Create the new table + try { + String createTableStatement = "CREATE TABLE user_login (" + "userid varchar(5)," + + "webgoat_user varchar(20)" + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating user_login table " + e.getLocalizedMessage()); + } - /** - * Create the Table for the tans - * - * @param connection - * @throws SQLException - */ - private void createTanTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + } - // Delete table if there is one - try - { - String dropTable = "DROP TABLE tan"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop tan table"); - } + // creates the table pins which is used in the blind sql injection lesson + private void createBlindSQLLessonTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - // Create the new table - try - { - String createTableStatement = "CREATE TABLE tan (" + "userid int not null," + "tanNr int," + "tanValue int" - + ")"; - statement.executeUpdate(createTableStatement); - } catch (SQLException e) - { - System.out.println("Error creating tan table " + e.getLocalizedMessage()); - } + // Delete table if there is one + try { + String dropTable = "DROP TABLE pins"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop pins table"); + } - // Populate it - String insertData1 = "INSERT INTO tan VALUES (101,1,15161)"; - String insertData2 = "INSERT INTO tan VALUES (101,2,4894)"; - String insertData3 = "INSERT INTO tan VALUES (101,3,18794)"; - String insertData4 = "INSERT INTO tan VALUES (101,4,1564)"; - String insertData5 = "INSERT INTO tan VALUES (101,5,45751)"; + // Create the new table + try { + String createTableStatement = "CREATE TABLE pins (" + + "cc_number varchar(30)," + + "pin int," + + "name varchar(20)" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating pins table " + e.getLocalizedMessage()); + } - String insertData6 = "INSERT INTO tan VALUES (102,1,15648)"; - String insertData7 = "INSERT INTO tan VALUES (102,2,92156)"; - String insertData8 = "INSERT INTO tan VALUES (102,3,4879)"; - String insertData9 = "INSERT INTO tan VALUES (102,4,9458)"; - String insertData10 = "INSERT INTO tan VALUES (102,5,4879)"; + // Populate it + String insertData1 = "INSERT INTO pins VALUES ('987654321098765', 1234, 'Joe')"; + String insertData2 = "INSERT INTO pins VALUES ('1234567890123456', 4567, 'Jack')"; + String insertData3 = "INSERT INTO pins VALUES ('4321432143214321', 4321, 'Jill')"; + String insertData4 = "INSERT INTO pins VALUES ('1111111111111111', 7777, 'Jim')"; + String insertData5 = "INSERT INTO pins VALUES ('1111222233334444', 2364, 'John')"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - statement.executeUpdate(insertData7); - statement.executeUpdate(insertData8); - statement.executeUpdate(insertData9); - statement.executeUpdate(insertData10); + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); - } + } - // -------------------------------------------------------------------------- - // -------------------------------------------------------------------------- - // - // The tables below are for WebGoat Financials - // - // DO NOT MODIFY THESE TABLES - unless you change the org chart - // and access control matrix documents - // - // -------------------------------------------------------------------------- - // -------------------------------------------------------------------------- + // creates the table salaries which is used in the lessons + // which add or modify data using sql injection + private void createModifyWithSQLLessonTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - private void createEmployeeTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + // Delete table if there is one + try { + String dropTable = "DROP TABLE salaries"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop salaries table"); + } - try - { - String dropTable = "DROP TABLE employee"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop employee table"); - } + // Create the new table + try { + String createTableStatement = "CREATE TABLE salaries (" + + "userid varchar(50)," + + "salary int" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating salaries table " + e.getLocalizedMessage()); + } - // Create Table - try - { - String createTable = "CREATE TABLE employee (" - // + "userid INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY," - + "userid INT NOT NULL PRIMARY KEY," + "first_name VARCHAR(20)," + "last_name VARCHAR(20)," - + "ssn VARCHAR(12)," + "password VARCHAR(10)," + "title VARCHAR(20)," + "phone VARCHAR(13)," - + "address1 VARCHAR(80)," + "address2 VARCHAR(80)," + "manager INT," + "start_date CHAR(8)," - + "salary INT," + "ccn VARCHAR(30)," + "ccn_limit INT," + "email VARCHAR(30)," // reason - // for the recent write-up - + "disciplined_date CHAR(8)," // date of write up, NA otherwise - + "disciplined_notes VARCHAR(60)," // reason for the recent write-up - + "personal_description VARCHAR(60)" // We can be rude here - // + ",CONSTRAINT fl UNIQUE NONCLUSTERED (first_name, last_name)" - + ")"; + // Populate it + String insertData1 = "INSERT INTO salaries VALUES ('jsmith', 20000)"; + String insertData2 = "INSERT INTO salaries VALUES ('lsmith', 45000)"; + String insertData3 = "INSERT INTO salaries VALUES ('wgoat', 100000)"; + String insertData4 = "INSERT INTO salaries VALUES ('rjones', 777777)"; + String insertData5 = "INSERT INTO salaries VALUES ('manderson', 65000)"; - statement.executeUpdate(createTable); - } catch (SQLException e) - { - System.out.println("Error: unable to create employee table " + e.getLocalizedMessage()); - } + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); - String insertData1 = "INSERT INTO employee VALUES (101, 'Larry', 'Stooge', '386-09-5451', 'larry'," - + "'Technician','443-689-0192','9175 Guilford Rd','New York, NY', 102, 01012000,55000,'2578546969853547'," - + "5000,'larry@stooges.com',010106,'Constantly harassing coworkers','Does not work well with others')"; + } - String insertData2 = "INSERT INTO employee VALUES (102, 'Moe', 'Stooge', '936-18-4524','moe'," - + "'CSO','443-938-5301', '3013 AMD Ave', 'New York, NY', 112, 03082003, 140000, 'NA', 0, 'moe@stooges.com', 0101013, " - + "'Hit Curly over head', 'Very dominating over Larry and Curly')"; + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + */ + private void createWeatherDataTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - String insertData3 = "INSERT INTO employee VALUES (103, 'Curly', 'Stooge', '961-08-0047','curly'," - + "'Technician','410-667-6654', '1112 Crusoe Lane', 'New York, NY', 102, 02122001, 50000, 'NA', 0, 'curly@stooges.com', 0101014, " - + "'Hit Moe back', 'Owes three-thousand to company for fradulent purchases')"; + // Delete table if there is one + try { + String dropTable = "DROP TABLE weather_data"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop weather table"); + } - String insertData4 = "INSERT INTO employee VALUES (104, 'Eric', 'Walker', '445-66-5565','eric'," - + "'Engineer','410-887-1193', '1160 Prescott Rd', 'New York, NY', 107, 12152005, 13000, 'NA', 0, 'eric@modelsrus.com',0101013, " - + "'Bothering Larry about webgoat problems', 'Late. Always needs help. Too intern-ish.')"; + // Create the new table + try { + String createTableStatement = "CREATE TABLE weather_data (" + "station int not null," + + "name varchar(20) not null," + "state char(2) not null," + "min_temp int not null," + + "max_temp int not null" + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating weather table " + e.getLocalizedMessage()); + } - String insertData5 = "INSERT INTO employee VALUES (105, 'Tom', 'Cat', '792-14-6364','tom'," - + "'Engineer','443-599-0762', '2211 HyperThread Rd.', 'New York, NY', 106, 01011999, 80000, '5481360857968521', 30000, 'tom@wb.com', 0, " - + "'NA', 'Co-Owner.')"; + // Populate it + String insertData1 = "INSERT INTO weather_data VALUES (101,'Columbia','MD',-10,102)"; + String insertData2 = "INSERT INTO weather_data VALUES (102,'Seattle','WA',-15,90)"; + String insertData3 = "INSERT INTO weather_data VALUES (103,'New York','NY',-10,110)"; + String insertData4 = "INSERT INTO weather_data VALUES (104,'Houston','TX',20,120)"; + String insertData5 = "INSERT INTO weather_data VALUES (10001,'Camp David','MD',-10,100)"; + String insertData6 = "INSERT INTO weather_data VALUES (11001,'Ice Station Zebra','NA',-60,30)"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + } - String insertData6 = "INSERT INTO employee VALUES (106, 'Jerry', 'Mouse', '858-55-4452','jerry'," - + "'Human Resources','443-699-3366', '3011 Unix Drive', 'New York, NY', 102, 01011999, 70000, '6981754825013564', 20000, 'jerry@wb.com', 0, " - + "'NA', 'Co-Owner.')"; + /** + * Create users with tans + * + * @param connection + * @throws SQLException + */ + private void createTanUserDataTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - String insertData7 = "INSERT INTO employee VALUES (107, 'David', 'Giambi', '439-20-9405','david'," - + "'Human Resources','610-521-8413', '5132 DIMM Avenue', 'New York, NY', 102, 05011999, 100000, '6981754825018101', 10000, 'david@modelsrus.com', 061402, " - + "'Hacked into accounting server. Modified personal pay.', 'Strong work habbit. Questionable ethics.')"; + // Delete table if there is one + try { + String dropTable = "DROP TABLE user_data_tan"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop user_data_tan table"); + } - String insertData8 = "INSERT INTO employee VALUES (108, 'Bruce', 'McGuirre', '707-95-9482','bruce'," - + "'Engineer','610-282-1103', '8899 FreeBSD Drive ', 'New York, NY', 107, 03012000, 110000, '6981754825854136', 30000, 'bruce@modelsrus.com', 061502, " - + "'Tortuous Boot Camp workout at 5am. Employees felt sick.', 'Enjoys watching others struggle in exercises.')"; + // Create the new table + try { + String createTableStatement = "CREATE TABLE user_data_tan (" + "userid int not null," + + "first_name varchar(20)," + "last_name varchar(20)," + "cc_number varchar(30)," + + "cc_type varchar(10)," + "cookie varchar(20)," + "login_count int," + "password varchar(20)" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating user_data_tan table " + e.getLocalizedMessage()); + } - String insertData9 = "INSERT INTO employee VALUES (109, 'Sean', 'Livingston', '136-55-1046','sean'," - + "'Engineer','610-878-9549', '6422 dFlyBSD Road', 'New York, NY', 107, 06012003, 130000, '6981754825014510', 5000, 'sean@modelsrus.com', 072804, " - + "'Late to work 30 days in row due to excessive Halo 2', 'Has some fascination with Steelers. Go Ravens.')"; + // Populate it + String insertData1 = "INSERT INTO user_data_tan VALUES (101,'Joe','Snow','987654321','VISA',' ',0, 'banana')"; + String insertData2 = "INSERT INTO user_data_tan VALUES (102,'Jane','Plane','74589864','MC',' ',0, 'tarzan')"; + String insertData3 = "INSERT INTO user_data_tan VALUES (103,'Jack','Sparrow','68659365','MC',' ',0, 'sniffy')"; - String insertData10 = "INSERT INTO employee VALUES (110, 'Joanne', 'McDougal', '789-54-2413','joanne'," - + "'Human Resources','610-213-6341', '5567 Broadband Lane', 'New York, NY', 106, 01012001, 90000, '6981754825081054', 300, 'joanne@modelsrus.com', 112005, " - + "'Used company cc to purchase new car. Limit adjusted.', 'Finds it necessary to leave early every day.')"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + } - String insertData11 = "INSERT INTO employee VALUES (111, 'John', 'Wayne', '129-69-4572', 'john'," - + "'CTO','610-213-1134', '129 Third St', 'New York, NY', 112, 01012001, 200000, '4437334565679921', 300, 'john@guns.com', 112005, " - + "'', '')"; - String insertData12 = "INSERT INTO employee VALUES (112, 'Neville', 'Bartholomew', '111-111-1111', 'socks'," - + "'CEO','408-587-0024', '1 Corporate Headquarters', 'San Jose, CA', 112, 03012000, 450000, '4803389267684109', 300000, 'neville@modelsrus.com', 112005, " - + "'', '')"; + /** + * Create the Table for the tans + * + * @param connection + * @throws SQLException + */ + private void createTanTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - statement.executeUpdate(insertData7); - statement.executeUpdate(insertData8); - statement.executeUpdate(insertData9); - statement.executeUpdate(insertData10); - statement.executeUpdate(insertData11); - statement.executeUpdate(insertData12); + // Delete table if there is one + try { + String dropTable = "DROP TABLE tan"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop tan table"); + } - } + // Create the new table + try { + String createTableStatement = "CREATE TABLE tan (" + "userid int not null," + "tanNr int," + "tanValue int" + + ")"; + statement.executeUpdate(createTableStatement); + } catch (SQLException e) { + System.out.println("Error creating tan table " + e.getLocalizedMessage()); + } - private void createRolesTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + // Populate it + String insertData1 = "INSERT INTO tan VALUES (101,1,15161)"; + String insertData2 = "INSERT INTO tan VALUES (101,2,4894)"; + String insertData3 = "INSERT INTO tan VALUES (101,3,18794)"; + String insertData4 = "INSERT INTO tan VALUES (101,4,1564)"; + String insertData5 = "INSERT INTO tan VALUES (101,5,45751)"; - try - { - String dropTable = "DROP TABLE roles"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop roles table"); - } + String insertData6 = "INSERT INTO tan VALUES (102,1,15648)"; + String insertData7 = "INSERT INTO tan VALUES (102,2,92156)"; + String insertData8 = "INSERT INTO tan VALUES (102,3,4879)"; + String insertData9 = "INSERT INTO tan VALUES (102,4,9458)"; + String insertData10 = "INSERT INTO tan VALUES (102,5,4879)"; - try - { - String createTable = "CREATE TABLE roles (" + "userid INT NOT NULL," + "role VARCHAR(10) NOT NULL," - + "PRIMARY KEY (userid, role)" + ")"; + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + statement.executeUpdate(insertData7); + statement.executeUpdate(insertData8); + statement.executeUpdate(insertData9); + statement.executeUpdate(insertData10); - statement.executeUpdate(createTable); - } catch (SQLException e) - { - System.out.println("Error: Unable to create role table: " + e.getLocalizedMessage()); - } + } - String insertData1 = "INSERT INTO roles VALUES (101, 'employee')"; - String insertData2 = "INSERT INTO roles VALUES (102, 'manager')"; - String insertData3 = "INSERT INTO roles VALUES (103, 'employee')"; - String insertData4 = "INSERT INTO roles VALUES (104, 'employee')"; - String insertData5 = "INSERT INTO roles VALUES (105, 'employee')"; - String insertData6 = "INSERT INTO roles VALUES (106, 'hr')"; - String insertData7 = "INSERT INTO roles VALUES (107, 'manager')"; - String insertData8 = "INSERT INTO roles VALUES (108, 'employee')"; - String insertData9 = "INSERT INTO roles VALUES (109, 'employee')"; - String insertData10 = "INSERT INTO roles VALUES (110, 'hr')"; - String insertData11 = "INSERT INTO roles VALUES (111, 'admin')"; - String insertData12 = "INSERT INTO roles VALUES (112, 'admin')"; + // -------------------------------------------------------------------------- + // -------------------------------------------------------------------------- + // + // The tables below are for WebGoat Financials + // + // DO NOT MODIFY THESE TABLES - unless you change the org chart + // and access control matrix documents + // + // -------------------------------------------------------------------------- + // -------------------------------------------------------------------------- - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - statement.executeUpdate(insertData7); - statement.executeUpdate(insertData8); - statement.executeUpdate(insertData9); - statement.executeUpdate(insertData10); - statement.executeUpdate(insertData11); - statement.executeUpdate(insertData12); - } + private void createEmployeeTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - private void createAuthTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + try { + String dropTable = "DROP TABLE employee"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop employee table"); + } - try - { - String dropTable = "DROP TABLE auth"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop auth table"); - } + // Create Table + try { + String createTable = "CREATE TABLE employee (" + // + "userid INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY," + + "userid INT NOT NULL PRIMARY KEY," + "first_name VARCHAR(20)," + "last_name VARCHAR(20)," + + "ssn VARCHAR(12)," + "password VARCHAR(10)," + "title VARCHAR(20)," + "phone VARCHAR(13)," + + "address1 VARCHAR(80)," + "address2 VARCHAR(80)," + "manager INT," + "start_date CHAR(8)," + + "salary INT," + "ccn VARCHAR(30)," + "ccn_limit INT," + "email VARCHAR(30)," // reason + // for the recent write-up + + "disciplined_date CHAR(8)," // date of write up, NA otherwise + + "disciplined_notes VARCHAR(60)," // reason for the recent write-up + + "personal_description VARCHAR(60)" // We can be rude here + // + ",CONSTRAINT fl UNIQUE NONCLUSTERED (first_name, last_name)" + + ")"; - try - { - String createTable = "CREATE TABLE auth (" + "role VARCHAR(10) NOT NULL," - + "functionid VARCHAR(20) NOT NULL," + "PRIMARY KEY (role, functionid)" + ")"; + statement.executeUpdate(createTable); + } catch (SQLException e) { + System.out.println("Error: unable to create employee table " + e.getLocalizedMessage()); + } - statement.executeUpdate(createTable); - } catch (SQLException e) - { - System.out.println("Error: unable to create auth table: " + e.getLocalizedMessage()); - } + String insertData1 = "INSERT INTO employee VALUES (101, 'Larry', 'Stooge', '386-09-5451', 'larry'," + + "'Technician','443-689-0192','9175 Guilford Rd','New York, NY', 102, 01012000,55000,'2578546969853547'," + + "5000,'larry@stooges.com',010106,'Constantly harassing coworkers','Does not work well with others')"; - String insertData1 = "INSERT INTO auth VALUES('employee', 'Logout')"; - String insertData2 = "INSERT INTO auth VALUES('employee', 'ListStaff')"; - String insertData3 = "INSERT INTO auth VALUES('employee', 'ViewProfile')"; - String insertData4 = "INSERT INTO auth VALUES('employee', 'EditProfile')"; - String insertData4_1 = "INSERT INTO auth VALUES('employee', 'SearchStaff')"; - String insertData4_2 = "INSERT INTO auth VALUES('employee', 'FindProfile')"; - String insertData5 = "INSERT INTO auth VALUES('manager', 'Logout')"; - String insertData6 = "INSERT INTO auth VALUES('manager', 'ListStaff')"; - String insertData7 = "INSERT INTO auth VALUES('manager', 'ViewProfile')"; - String insertData7_1 = "INSERT INTO auth VALUES('manager', 'SearchStaff')"; - String insertData7_2 = "INSERT INTO auth VALUES('manager', 'FindProfile')"; - // String insertData8 = "INSERT INTO auth VALUES('manager', 'EditProfile')"; - // String insertData9 = "INSERT INTO auth VALUES('manager', 'CreateProfile')"; - // String insertData10 = "INSERT INTO auth VALUES('manager', 'DeleteProfile')"; - // String insertData11 = "INSERT INTO auth VALUES('manager', 'UpdateProfile')"; - String insertData12 = "INSERT INTO auth VALUES('hr', 'Logout')"; - String insertData13 = "INSERT INTO auth VALUES('hr', 'ListStaff')"; - String insertData14 = "INSERT INTO auth VALUES('hr', 'ViewProfile')"; - String insertData15 = "INSERT INTO auth VALUES('hr', 'EditProfile')"; - String insertData16 = "INSERT INTO auth VALUES('hr', 'CreateProfile')"; - String insertData17 = "INSERT INTO auth VALUES('hr', 'DeleteProfile')"; - String insertData18 = "INSERT INTO auth VALUES('hr', 'UpdateProfile')"; - String insertData18_1 = "INSERT INTO auth VALUES('hr', 'SearchStaff')"; - String insertData18_2 = "INSERT INTO auth VALUES('hr', 'FindProfile')"; - String insertData19 = "INSERT INTO auth VALUES('admin', 'Logout')"; - String insertData20 = "INSERT INTO auth VALUES('admin', 'ListStaff')"; - String insertData21 = "INSERT INTO auth VALUES('admin', 'ViewProfile')"; - String insertData22 = "INSERT INTO auth VALUES('admin', 'EditProfile')"; - String insertData23 = "INSERT INTO auth VALUES('admin', 'CreateProfile')"; - String insertData24 = "INSERT INTO auth VALUES('admin', 'DeleteProfile')"; - String insertData25 = "INSERT INTO auth VALUES('admin', 'UpdateProfile')"; - String insertData25_1 = "INSERT INTO auth VALUES('admin', 'SearchStaff')"; - String insertData25_2 = "INSERT INTO auth VALUES('admin', 'FindProfile')"; + String insertData2 = "INSERT INTO employee VALUES (102, 'Moe', 'Stooge', '936-18-4524','moe'," + + "'CSO','443-938-5301', '3013 AMD Ave', 'New York, NY', 112, 03082003, 140000, 'NA', 0, 'moe@stooges.com', 0101013, " + + "'Hit Curly over head', 'Very dominating over Larry and Curly')"; + + String insertData3 = "INSERT INTO employee VALUES (103, 'Curly', 'Stooge', '961-08-0047','curly'," + + "'Technician','410-667-6654', '1112 Crusoe Lane', 'New York, NY', 102, 02122001, 50000, 'NA', 0, 'curly@stooges.com', 0101014, " + + "'Hit Moe back', 'Owes three-thousand to company for fradulent purchases')"; + + String insertData4 = "INSERT INTO employee VALUES (104, 'Eric', 'Walker', '445-66-5565','eric'," + + "'Engineer','410-887-1193', '1160 Prescott Rd', 'New York, NY', 107, 12152005, 13000, 'NA', 0, 'eric@modelsrus.com',0101013, " + + "'Bothering Larry about webgoat problems', 'Late. Always needs help. Too intern-ish.')"; + + String insertData5 = "INSERT INTO employee VALUES (105, 'Tom', 'Cat', '792-14-6364','tom'," + + "'Engineer','443-599-0762', '2211 HyperThread Rd.', 'New York, NY', 106, 01011999, 80000, '5481360857968521', 30000, 'tom@wb.com', 0, " + + "'NA', 'Co-Owner.')"; + + String insertData6 = "INSERT INTO employee VALUES (106, 'Jerry', 'Mouse', '858-55-4452','jerry'," + + "'Human Resources','443-699-3366', '3011 Unix Drive', 'New York, NY', 102, 01011999, 70000, '6981754825013564', 20000, 'jerry@wb.com', 0, " + + "'NA', 'Co-Owner.')"; + + String insertData7 = "INSERT INTO employee VALUES (107, 'David', 'Giambi', '439-20-9405','david'," + + "'Human Resources','610-521-8413', '5132 DIMM Avenue', 'New York, NY', 102, 05011999, 100000, '6981754825018101', 10000, 'david@modelsrus.com', 061402, " + + "'Hacked into accounting server. Modified personal pay.', 'Strong work habbit. Questionable ethics.')"; + + String insertData8 = "INSERT INTO employee VALUES (108, 'Bruce', 'McGuirre', '707-95-9482','bruce'," + + "'Engineer','610-282-1103', '8899 FreeBSD Drive ', 'New York, NY', 107, 03012000, 110000, '6981754825854136', 30000, 'bruce@modelsrus.com', 061502, " + + "'Tortuous Boot Camp workout at 5am. Employees felt sick.', 'Enjoys watching others struggle in exercises.')"; + + String insertData9 = "INSERT INTO employee VALUES (109, 'Sean', 'Livingston', '136-55-1046','sean'," + + "'Engineer','610-878-9549', '6422 dFlyBSD Road', 'New York, NY', 107, 06012003, 130000, '6981754825014510', 5000, 'sean@modelsrus.com', 072804, " + + "'Late to work 30 days in row due to excessive Halo 2', 'Has some fascination with Steelers. Go Ravens.')"; + + String insertData10 = "INSERT INTO employee VALUES (110, 'Joanne', 'McDougal', '789-54-2413','joanne'," + + "'Human Resources','610-213-6341', '5567 Broadband Lane', 'New York, NY', 106, 01012001, 90000, '6981754825081054', 300, 'joanne@modelsrus.com', 112005, " + + "'Used company cc to purchase new car. Limit adjusted.', 'Finds it necessary to leave early every day.')"; + + String insertData11 = "INSERT INTO employee VALUES (111, 'John', 'Wayne', '129-69-4572', 'john'," + + "'CTO','610-213-1134', '129 Third St', 'New York, NY', 112, 01012001, 200000, '4437334565679921', 300, 'john@guns.com', 112005, " + + "'', '')"; + String insertData12 = "INSERT INTO employee VALUES (112, 'Neville', 'Bartholomew', '111-111-1111', 'socks'," + + "'CEO','408-587-0024', '1 Corporate Headquarters', 'San Jose, CA', 112, 03012000, 450000, '4803389267684109', 300000, 'neville@modelsrus.com', 112005, " + + "'', '')"; + + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + statement.executeUpdate(insertData7); + statement.executeUpdate(insertData8); + statement.executeUpdate(insertData9); + statement.executeUpdate(insertData10); + statement.executeUpdate(insertData11); + statement.executeUpdate(insertData12); + + } + + private void createRolesTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + try { + String dropTable = "DROP TABLE roles"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop roles table"); + } + + try { + String createTable = "CREATE TABLE roles (" + "userid INT NOT NULL," + "role VARCHAR(10) NOT NULL," + + "PRIMARY KEY (userid, role)" + ")"; + + statement.executeUpdate(createTable); + } catch (SQLException e) { + System.out.println("Error: Unable to create role table: " + e.getLocalizedMessage()); + } + + String insertData1 = "INSERT INTO roles VALUES (101, 'employee')"; + String insertData2 = "INSERT INTO roles VALUES (102, 'manager')"; + String insertData3 = "INSERT INTO roles VALUES (103, 'employee')"; + String insertData4 = "INSERT INTO roles VALUES (104, 'employee')"; + String insertData5 = "INSERT INTO roles VALUES (105, 'employee')"; + String insertData6 = "INSERT INTO roles VALUES (106, 'hr')"; + String insertData7 = "INSERT INTO roles VALUES (107, 'manager')"; + String insertData8 = "INSERT INTO roles VALUES (108, 'employee')"; + String insertData9 = "INSERT INTO roles VALUES (109, 'employee')"; + String insertData10 = "INSERT INTO roles VALUES (110, 'hr')"; + String insertData11 = "INSERT INTO roles VALUES (111, 'admin')"; + String insertData12 = "INSERT INTO roles VALUES (112, 'admin')"; + + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + statement.executeUpdate(insertData7); + statement.executeUpdate(insertData8); + statement.executeUpdate(insertData9); + statement.executeUpdate(insertData10); + statement.executeUpdate(insertData11); + statement.executeUpdate(insertData12); + } + + private void createAuthTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); + + try { + String dropTable = "DROP TABLE auth"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop auth table"); + } + + try { + String createTable = "CREATE TABLE auth (" + "role VARCHAR(10) NOT NULL," + + "functionid VARCHAR(20) NOT NULL," + "PRIMARY KEY (role, functionid)" + ")"; + + statement.executeUpdate(createTable); + } catch (SQLException e) { + System.out.println("Error: unable to create auth table: " + e.getLocalizedMessage()); + } + + String insertData1 = "INSERT INTO auth VALUES('employee', 'Logout')"; + String insertData2 = "INSERT INTO auth VALUES('employee', 'ListStaff')"; + String insertData3 = "INSERT INTO auth VALUES('employee', 'ViewProfile')"; + String insertData4 = "INSERT INTO auth VALUES('employee', 'EditProfile')"; + String insertData4_1 = "INSERT INTO auth VALUES('employee', 'SearchStaff')"; + String insertData4_2 = "INSERT INTO auth VALUES('employee', 'FindProfile')"; + String insertData5 = "INSERT INTO auth VALUES('manager', 'Logout')"; + String insertData6 = "INSERT INTO auth VALUES('manager', 'ListStaff')"; + String insertData7 = "INSERT INTO auth VALUES('manager', 'ViewProfile')"; + String insertData7_1 = "INSERT INTO auth VALUES('manager', 'SearchStaff')"; + String insertData7_2 = "INSERT INTO auth VALUES('manager', 'FindProfile')"; + // String insertData8 = "INSERT INTO auth VALUES('manager', 'EditProfile')"; + // String insertData9 = "INSERT INTO auth VALUES('manager', 'CreateProfile')"; + // String insertData10 = "INSERT INTO auth VALUES('manager', 'DeleteProfile')"; + // String insertData11 = "INSERT INTO auth VALUES('manager', 'UpdateProfile')"; + String insertData12 = "INSERT INTO auth VALUES('hr', 'Logout')"; + String insertData13 = "INSERT INTO auth VALUES('hr', 'ListStaff')"; + String insertData14 = "INSERT INTO auth VALUES('hr', 'ViewProfile')"; + String insertData15 = "INSERT INTO auth VALUES('hr', 'EditProfile')"; + String insertData16 = "INSERT INTO auth VALUES('hr', 'CreateProfile')"; + String insertData17 = "INSERT INTO auth VALUES('hr', 'DeleteProfile')"; + String insertData18 = "INSERT INTO auth VALUES('hr', 'UpdateProfile')"; + String insertData18_1 = "INSERT INTO auth VALUES('hr', 'SearchStaff')"; + String insertData18_2 = "INSERT INTO auth VALUES('hr', 'FindProfile')"; + String insertData19 = "INSERT INTO auth VALUES('admin', 'Logout')"; + String insertData20 = "INSERT INTO auth VALUES('admin', 'ListStaff')"; + String insertData21 = "INSERT INTO auth VALUES('admin', 'ViewProfile')"; + String insertData22 = "INSERT INTO auth VALUES('admin', 'EditProfile')"; + String insertData23 = "INSERT INTO auth VALUES('admin', 'CreateProfile')"; + String insertData24 = "INSERT INTO auth VALUES('admin', 'DeleteProfile')"; + String insertData25 = "INSERT INTO auth VALUES('admin', 'UpdateProfile')"; + String insertData25_1 = "INSERT INTO auth VALUES('admin', 'SearchStaff')"; + String insertData25_2 = "INSERT INTO auth VALUES('admin', 'FindProfile')"; // // Add a permission for the webgoat role to see the source. // // The challenge(s) will change the default role to "challenge" @@ -764,274 +716,261 @@ public class CreateDB // + "')"; // String insertData27 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWHINTS // + "')"; - // Add a permission for the webgoat role to see the solution. - // The challenge(s) will change the default role to "challenge" + // Add a permission for the webgoat role to see the solution. + // The challenge(s) will change the default role to "challenge" // String insertData28 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOLUTION // + "')"; - statement.executeUpdate(insertData1); - statement.executeUpdate(insertData2); - statement.executeUpdate(insertData3); - statement.executeUpdate(insertData4); - statement.executeUpdate(insertData4_1); - statement.executeUpdate(insertData4_2); - statement.executeUpdate(insertData5); - statement.executeUpdate(insertData6); - statement.executeUpdate(insertData7); - statement.executeUpdate(insertData7_1); - statement.executeUpdate(insertData7_2); - // statement.executeUpdate(insertData8); - // statement.executeUpdate(insertData9); - // statement.executeUpdate(insertData10); - // statement.executeUpdate(insertData11); - statement.executeUpdate(insertData12); - statement.executeUpdate(insertData13); - statement.executeUpdate(insertData14); - statement.executeUpdate(insertData15); - statement.executeUpdate(insertData16); - statement.executeUpdate(insertData17); - statement.executeUpdate(insertData18); - statement.executeUpdate(insertData18_1); - statement.executeUpdate(insertData18_2); - statement.executeUpdate(insertData19); - statement.executeUpdate(insertData20); - statement.executeUpdate(insertData21); - statement.executeUpdate(insertData22); - statement.executeUpdate(insertData23); - statement.executeUpdate(insertData24); - statement.executeUpdate(insertData25); - statement.executeUpdate(insertData25_1); - statement.executeUpdate(insertData25_2); - //statement.executeUpdate(insertData26); - //statement.executeUpdate(insertData27); - //statement.executeUpdate(insertData28); - } + statement.executeUpdate(insertData1); + statement.executeUpdate(insertData2); + statement.executeUpdate(insertData3); + statement.executeUpdate(insertData4); + statement.executeUpdate(insertData4_1); + statement.executeUpdate(insertData4_2); + statement.executeUpdate(insertData5); + statement.executeUpdate(insertData6); + statement.executeUpdate(insertData7); + statement.executeUpdate(insertData7_1); + statement.executeUpdate(insertData7_2); + // statement.executeUpdate(insertData8); + // statement.executeUpdate(insertData9); + // statement.executeUpdate(insertData10); + // statement.executeUpdate(insertData11); + statement.executeUpdate(insertData12); + statement.executeUpdate(insertData13); + statement.executeUpdate(insertData14); + statement.executeUpdate(insertData15); + statement.executeUpdate(insertData16); + statement.executeUpdate(insertData17); + statement.executeUpdate(insertData18); + statement.executeUpdate(insertData18_1); + statement.executeUpdate(insertData18_2); + statement.executeUpdate(insertData19); + statement.executeUpdate(insertData20); + statement.executeUpdate(insertData21); + statement.executeUpdate(insertData22); + statement.executeUpdate(insertData23); + statement.executeUpdate(insertData24); + statement.executeUpdate(insertData25); + statement.executeUpdate(insertData25_1); + statement.executeUpdate(insertData25_2); + //statement.executeUpdate(insertData26); + //statement.executeUpdate(insertData27); + //statement.executeUpdate(insertData28); + } - private void createOwnershipTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + private void createOwnershipTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - try - { - String dropTable = "DROP TABLE ownership"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop ownership table"); - } + try { + String dropTable = "DROP TABLE ownership"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop ownership table"); + } - try - { - String createTable = "CREATE TABLE ownership (" + "employer_id INT NOT NULL," + "employee_id INT NOT NULL," - + "PRIMARY KEY (employee_id, employer_id)" + ")"; + try { + String createTable = "CREATE TABLE ownership (" + "employer_id INT NOT NULL," + "employee_id INT NOT NULL," + + "PRIMARY KEY (employee_id, employer_id)" + ")"; - statement.executeUpdate(createTable); - } catch (SQLException e) - { - System.out.println("Error: unable to create ownership table: " + e.getLocalizedMessage()); - } + statement.executeUpdate(createTable); + } catch (SQLException e) { + System.out.println("Error: unable to create ownership table: " + e.getLocalizedMessage()); + } - String inputData = "INSERT INTO ownership VALUES (112, 101)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 102)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 103)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 104)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 105)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 106)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 107)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 108)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 109)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 110)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 111)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (112, 112)"; - statement.executeUpdate(inputData); + String inputData = "INSERT INTO ownership VALUES (112, 101)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 102)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 103)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 104)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 105)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 106)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 107)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 108)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 109)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 110)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 111)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (112, 112)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 101)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 102)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 103)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 104)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 105)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 106)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 107)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 108)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 109)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 110)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (102, 111)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 101)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 102)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 103)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 104)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 105)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 106)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 107)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 108)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 109)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 110)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (102, 111)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 101)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 102)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 103)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 104)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 105)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 106)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 107)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 108)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 109)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 110)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (111, 111)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 101)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 102)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 103)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 104)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 105)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 106)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 107)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 108)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 109)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 110)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (111, 111)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (106, 105)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (106, 106)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (106, 110)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (106, 105)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (106, 106)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (106, 110)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (101, 101)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (101, 101)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (103, 103)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (103, 103)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (107, 104)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (107, 108)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (107, 109)"; - statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (107, 107)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (107, 104)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (107, 108)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (107, 109)"; + statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (107, 107)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (105, 105)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (105, 105)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (110, 110)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (110, 110)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (104, 104)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (104, 104)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (108, 108)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (108, 108)"; + statement.executeUpdate(inputData); - inputData = "INSERT INTO ownership VALUES (109, 109)"; - statement.executeUpdate(inputData); + inputData = "INSERT INTO ownership VALUES (109, 109)"; + statement.executeUpdate(inputData); - } + } - // -------------------------------------------------------------------------- - // - // End of WebGoat Financials - // - // -------------------------------------------------------------------------- + // -------------------------------------------------------------------------- + // + // End of WebGoat Financials + // + // -------------------------------------------------------------------------- - /** - * Start creation of data for WebServices labs - */ + /** + * Start creation of data for WebServices labs + */ - private void createTransactionTable(Connection connection) throws SQLException - { - Statement statement = connection.createStatement(); + private void createTransactionTable(Connection connection) throws SQLException { + Statement statement = connection.createStatement(); - try - { - String dropTable = "DROP TABLE transactions"; - statement.executeUpdate(dropTable); - } catch (SQLException e) - { - System.out.println("Info - Could not drop transactions table"); - } + try { + String dropTable = "DROP TABLE transactions"; + statement.executeUpdate(dropTable); + } catch (SQLException e) { + System.out.println("Info - Could not drop transactions table"); + } - try - { - String createTable = "CREATE TABLE Transactions (" + "userName VARCHAR(16) NOT NULL, " - + "sequence INTEGER NOT NULL, " + "from_account VARCHAR(16) NOT NULL, " - + "to_account VARCHAR(16) NOT NULL, " + "transactionDate TIMESTAMP NOT NULL, " - + "description VARCHAR(255) NOT NULL, " + "amount INTEGER NOT NULL" + ")"; + try { + String createTable = "CREATE TABLE Transactions (" + "userName VARCHAR(16) NOT NULL, " + + "sequence INTEGER NOT NULL, " + "from_account VARCHAR(16) NOT NULL, " + + "to_account VARCHAR(16) NOT NULL, " + "transactionDate TIMESTAMP NOT NULL, " + + "description VARCHAR(255) NOT NULL, " + "amount INTEGER NOT NULL" + ")"; - statement.executeUpdate(createTable); - } catch (SQLException e) - { - System.out.println("Error: unable to create transactions table: " + e.getLocalizedMessage()); - throw e; - } + statement.executeUpdate(createTable); + } catch (SQLException e) { + System.out.println("Error: unable to create transactions table: " + e.getLocalizedMessage()); + throw e; + } - String[] data = new String[] { - "'dave', 0, '238-4723-4024', '324-7635-9867', '2008-02-06 21:40:00', 'Mortgage', '150'", - "'dave', 1, '238-4723-4024', '324-7635-9867', '2008-02-12 21:41:00', 'Car', '150'", - "'dave', 2, '238-4723-4024', '324-7635-9867', '2008-02-20 21:42:00', 'School fees', '150'", - "'CEO', 3, '348-6324-9872', '345-3490-8345', '2008-02-15 21:40:00', 'Rolls Royce', '-150000'", - "'CEO', 4, '348-6324-9872', '342-5893-4503', '2008-02-25 21:41:00', 'Mansion', '-150000'", - "'CEO', 5, '348-6324-9872', '980-2344-5492', '2008-02-27 21:42:00', 'Vacation', '-150000'", - "'jeff', 6, '934-2002-3485', '783-2409-8234', '2008-02-01 21:40:00', 'Vet', '250'", - "'jeff', 7, '934-2002-3485', '634-5879-0345', '2008-02-19 21:41:00', 'Doctor', '800'", - "'jeff', 8, '934-2002-3485', '435-4325-3358', '2008-02-20 21:42:00', 'X-rays', '200'", }; - try - { - for (int i = 0; i < data.length; i++) - { - statement.executeUpdate("INSERT INTO Transactions VALUES (" + data[i] + ");"); - } - } catch (SQLException sqle) - { - System.out.println("Error: Unable to insert transactions: " + sqle.getLocalizedMessage()); - int errorCode = sqle.getErrorCode(); - System.out.println("Error Code: " + errorCode); - // ignore exceptions for Oracle and SQL Server - if (errorCode != 911 && errorCode != 273) { throw sqle; } - } - } + String[] data = new String[]{ + "'dave', 0, '238-4723-4024', '324-7635-9867', '2008-02-06 21:40:00', 'Mortgage', '150'", + "'dave', 1, '238-4723-4024', '324-7635-9867', '2008-02-12 21:41:00', 'Car', '150'", + "'dave', 2, '238-4723-4024', '324-7635-9867', '2008-02-20 21:42:00', 'School fees', '150'", + "'CEO', 3, '348-6324-9872', '345-3490-8345', '2008-02-15 21:40:00', 'Rolls Royce', '-150000'", + "'CEO', 4, '348-6324-9872', '342-5893-4503', '2008-02-25 21:41:00', 'Mansion', '-150000'", + "'CEO', 5, '348-6324-9872', '980-2344-5492', '2008-02-27 21:42:00', 'Vacation', '-150000'", + "'jeff', 6, '934-2002-3485', '783-2409-8234', '2008-02-01 21:40:00', 'Vet', '250'", + "'jeff', 7, '934-2002-3485', '634-5879-0345', '2008-02-19 21:41:00', 'Doctor', '800'", + "'jeff', 8, '934-2002-3485', '435-4325-3358', '2008-02-20 21:42:00', 'X-rays', '200'",}; + try { + for (int i = 0; i < data.length; i++) { + statement.executeUpdate("INSERT INTO Transactions VALUES (" + data[i] + ");"); + } + } catch (SQLException sqle) { + System.out.println("Error: Unable to insert transactions: " + sqle.getLocalizedMessage()); + int errorCode = sqle.getErrorCode(); + System.out.println("Error Code: " + errorCode); + // ignore exceptions for Oracle and SQL Server + if (errorCode != 911 && errorCode != 273) { + throw sqle; + } + } + } - /** - * Description of the Method - * - * @param connection - * Description of the Parameter - * @exception SQLException - * Description of the Exception - * @throws java.sql.SQLException if any. - */ - public void makeDB(Connection connection) throws SQLException - { - System.out.println("Successful connection to database"); - createUserDataTable(connection); - createLoginTable(connection); - createBlindSQLLessonTable(connection); - createUserAdminTable(connection); - createProductTable(connection); - createMessageTable(connection); - createEmployeeTable(connection); - createRolesTable(connection); - createAuthTable(connection); - createOwnershipTable(connection); - createWeatherDataTable(connection); - createTransactionTable(connection); - createTanUserDataTable(connection); - createTanTable(connection); - createMFEImagesTable(connection); - createModifyWithSQLLessonTable(connection); - System.out.println("Success: creating tables."); - } + /** + * Description of the Method + * + * @param connection Description of the Parameter + * @throws SQLException Description of the Exception + * @throws java.sql.SQLException if any. + */ + public void makeDB(Connection connection) throws SQLException { + System.out.println("Successful connection to database"); + createServersTable(connection); + createUserDataTable(connection); + createLoginTable(connection); + createBlindSQLLessonTable(connection); + createUserAdminTable(connection); + createProductTable(connection); + createMessageTable(connection); + createEmployeeTable(connection); + createRolesTable(connection); + createAuthTable(connection); + createOwnershipTable(connection); + createWeatherDataTable(connection); + createTransactionTable(connection); + createTanUserDataTable(connection); + createTanTable(connection); + createMFEImagesTable(connection); + createModifyWithSQLLessonTable(connection); + System.out.println("Success: creating tables."); + } } diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionAdvanced.java similarity index 97% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionAdvanced.java index 5a8a28c25..3df685705 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionAdvanced.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionAdvanced.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.advanced; import org.owasp.webgoat.lessons.Category; import org.owasp.webgoat.lessons.NewLesson; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java similarity index 99% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java index f47076500..a81fa8299 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionChallenge.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.advanced; import lombok.extern.slf4j.Slf4j; import org.apache.commons.lang3.RandomStringUtils; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjection.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjection.java similarity index 97% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjection.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjection.java index 2ac3acc10..d5df3c88a 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjection.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjection.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import java.util.ArrayList; import java.util.List; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java similarity index 99% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5a.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java index 9eea9b173..87a776d2f 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5a.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java @@ -1,5 +1,5 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentHints; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java similarity index 98% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5b.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java index 595bb490d..deeaa7666 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson5b.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import org.owasp.webgoat.assignments.AssignmentEndpoint; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6a.java similarity index 95% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6a.java index 701e9a0e4..136723f8d 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6a.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6a.java @@ -1,5 +1,5 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentHints; @@ -14,8 +14,6 @@ import org.springframework.web.bind.annotation.ResponseBody; import java.io.IOException; import java.sql.*; -import static org.owasp.webgoat.plugin.SqlInjectionLesson5a.writeTable; - /*************************************************************************************************** * @@ -74,7 +72,7 @@ public class SqlInjectionLesson6a extends AssignmentEndpoint { ResultSetMetaData resultsMetaData = results.getMetaData(); StringBuffer output = new StringBuffer(); - output.append(writeTable(results, resultsMetaData)); + output.append(SqlInjectionLesson5a.writeTable(results, resultsMetaData)); results.last(); // If they get back more than one user they succeeded diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java similarity index 98% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6b.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java index 2bf828c90..df3f490e7 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionLesson6b.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java @@ -1,5 +1,5 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import org.owasp.webgoat.assignments.AssignmentEndpoint; import org.owasp.webgoat.assignments.AssignmentPath; diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java new file mode 100644 index 000000000..cb7ee35c0 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java @@ -0,0 +1,56 @@ +package org.owasp.webgoat.plugin.mitigation; + +import com.google.common.collect.Lists; +import lombok.AllArgsConstructor; +import lombok.Getter; +import lombok.SneakyThrows; +import org.owasp.webgoat.session.DatabaseUtilities; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.http.MediaType; +import org.springframework.web.bind.annotation.*; + +import java.sql.Connection; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.util.List; + +/** + * @author nbaars + * @since 6/13/17. + */ +@RestController +@RequestMapping("SqlInjection/servers") +public class Servers { + + @AllArgsConstructor + @Getter + private class Server { + + private String id; + private String hostname; + private String ip; + private String mac; + private String status; + private String description; + } + + @Autowired + private WebSession webSession; + + @GetMapping(produces = MediaType.APPLICATION_JSON_VALUE) + @SneakyThrows + @ResponseBody + public List sort(@RequestParam String column) { + Connection connection = DatabaseUtilities.getConnection(webSession); + PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column); + ResultSet rs = preparedStatement.executeQuery(); + List servers = Lists.newArrayList(); + while (rs.next()) { + Server server = new Server(rs.getString(1), rs.getString(2), rs.getString(3), rs.getString(4), rs.getString(5), rs.getString(6)); + servers.add(server); + } + return servers; + } + +} diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java new file mode 100644 index 000000000..b8237b8df --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java @@ -0,0 +1,46 @@ +package org.owasp.webgoat.plugin.mitigation; + +import lombok.SneakyThrows; +import lombok.extern.slf4j.Slf4j; +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.DatabaseUtilities; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import java.sql.*; + +/** + * @author nbaars + * @since 6/13/17. + */ +@AssignmentPath("SqlInjection/attack12a") +@AssignmentHints(value = {"SqlStringInjectionHint8", "SqlStringInjectionHint9", "SqlStringInjectionHint10", "SqlStringInjectionHint11"}) +@Slf4j +public class SqlInjectionLesson12a extends AssignmentEndpoint { + + @Autowired + private WebSession webSession; + + @RequestMapping(method = RequestMethod.POST) + @ResponseBody + @SneakyThrows + public AttackResult completed(@RequestParam String ip) { + Connection connection = DatabaseUtilities.getConnection(webSession); + PreparedStatement preparedStatement = connection.prepareStatement("select ip from servers where ip = ?"); + preparedStatement.setString(1, ip); + ResultSet resultSet = preparedStatement.executeQuery(); + if (resultSet.next()) { + return trackProgress(success().build()); + } + return trackProgress(failed().build()); + } +} + + diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionMitigations.java similarity index 97% rename from webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java rename to webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionMitigations.java index 291d9c98f..463c4dfdc 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/SqlInjectionMitigations.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionMitigations.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.mitigation; import org.owasp.webgoat.lessons.Category; import org.owasp.webgoat.lessons.NewLesson; diff --git a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html index 6bb7187f3..f34037088 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html +++ b/webgoat-lessons/sql-injection/src/main/resources/html/SqlInjectionMitigations.html @@ -27,6 +27,84 @@

      +
      +
      +
      + +
      +
      + +
      +
      +
      +
      +
      +
      +
      +

      List of servers +
      + +
      +

      +
      +
      + +
      + + + + + + + + + + + + + + +
      Hostname + IP MAC Status + Description +
      +
      +
      +
      +
      +
      +
      +
      +
      +
      +
      IP address webgoat-prd server:
      + +
      +
      + +
      +
      +
      +
      +
      +
      +
      +
      diff --git a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties index 52cc02fe2..8f4c69431 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/sql-injection/src/main/resources/i18n/WebGoatLabels.properties @@ -9,6 +9,10 @@ SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ]. SqlStringInjectionHint5=First try to find out the number of columns by adding a group by 1,2,3 etc to the query. SqlStringInjectionHint6=Try adding a union to the query, the number of columns should match. SqlStringInjectionHint7=Try entering [ Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- ]. +SqlStringInjectionHint8=Try sorting and look at the request +SqlStringInjectionHint9=Intercept the request and try to specify a different order by +SqlStringInjectionHint10=Use for example "(case when (true) then hostname else id end)" in the order by and see what happens +SqlStringInjectionHint11=Use for example "(case when (true) then hostname else id end)" in the order by and see what happens sql-injection.5a.success=You have succeed: {0} sql-injection.5a.no.results=No results matched. Try Again. diff --git a/webgoat-lessons/sql-injection/src/main/resources/js/assignment12.js b/webgoat-lessons/sql-injection/src/main/resources/js/assignment12.js new file mode 100644 index 000000000..b001e4572 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/js/assignment12.js @@ -0,0 +1,61 @@ +$(function () { + $('.col-check').hide(); + $('#btn-admin').on('click', function () { + if ($("#toolbar-admin").is(":visible")) { + $("#toolbar-admin").hide(); + $(".col-check").hide(); + } + else { + $("#toolbar-admin").show(); + $(".col-check").show(); + } + }); + + $('#btn-online').on('click', function () { + $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('success'); + $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('online'); + }); + $('#btn-offline').on('click', function () { + $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('warning'); + $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('offline'); + }); + $('#btn-out-of-order').on('click', function () { + $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('danger'); + $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('out of order'); + }); + +}); + +$(document).ready(function () { + getServers('id'); +}); + +var html = '' + + '' + + 'HOSTNAME' + + 'IP' + + 'MAC' + + 'ONLINE' + + 'DESCRIPTION' + + ''; + +function getServers(column) { + $.get("SqlInjection/servers?column=" + column, function (result, status) { + $("#servers").empty(); + for (var i = 0; i < result.length; i++) { + var server = html.replace('ID', result[i].id); + var status = "success"; + if (result[i].status === 'offline') { + status = "danger"; + } + server = server.replace('ONLINE', status); + server = server.replace('STATUS', status); + server = server.replace('HOSTNAME', result[i].hostname); + server = server.replace('IP', result[i].ip); + server = server.replace('MAC', result[i].mac); + server = server.replace('DESCRIPTION', result[i].description); + $("#servers").append(server); + } + + }); +} \ No newline at end of file diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc new file mode 100644 index 000000000..88d1a4f4c --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content12a.adoc @@ -0,0 +1,48 @@ +== Order by clause + +Question: Does a preparared statement always prevent against an SQL injection? +Answer: No it does not + +Let's take a look at the following statement: + +---- +select * from users order by lastname; +---- + +If we look at the specification of the SQL grammar the definition is as follows: + +---- +SELECT ... +FROM tableList +[WHERE Expression] +[ORDER BY orderExpression [, ...]] + +orderExpression: +{ columnNr | columnAlias | selectExpression } + [ASC | DESC] + +selectExpression: +{ Expression | COUNT(*) | { + COUNT | MIN | MAX | SUM | AVG | SOME | EVERY | + VAR_POP | VAR_SAMP | STDDEV_POP | STDDEV_SAMP +} ([ALL | DISTINCT][2]] Expression) } [[AS] label] + +Based on HSQLDB +---- + +This means an `orderExpression` van be a `selectExpression` which can be a function as well, so for example with +a `case` statement we might be able to ask the database some questions, like: + +---- +select * from users order by + (select case when (true) then lastname else firstname) +---- + +So we can substitute any kind of boolean operation in the `when(....)` part. The statement will just work because +it is a valid query whether you use a prepared statement or not an order by clause can by definition contain a +expression. + +=== Mitigation + +If you need to provide a sorting column in your web application you should implement a whitelist to validate the value +of the `order by` statement it should always be limited to something like 'firstname' or 'lastname'. diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc index d81a9d1c9..53fc5e140 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6c.adoc @@ -1,11 +1,11 @@ -=== Blind SQL Injection +== Blind SQL Injection Blind SQL injection is a type of SQL injection attack that asks the database true or false questions and determines the answer based on the applications response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection. -==== Difference +=== Difference Let's first start with the difference between a normal SQL injection and a blind SQL injection. In a normal SQL injection the error messages from the database are displayed and gives enough information to find out how @@ -16,7 +16,7 @@ based on a true or false statement. That's why a blind SQL injection is much mor There are several different types of blind SQL injections: content based and time based SQL injections. -==== Example +=== Example In this case we are trying to ask the database a boolean question based on for example a unique id, for example suppose we have the following url: `https://my-shop.com?article=4` diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_order_by.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_order_by.adoc new file mode 100644 index 000000000..6adb9156b --- /dev/null +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_order_by.adoc @@ -0,0 +1,4 @@ +In this assignment try to perform an SQL injection through the ORDER BY field. +Try to find the ip address of the `webgoat-prd` server. + +Note: The submit field of this assignment is *NOT* vulnerable for an SQL injection. \ No newline at end of file diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java new file mode 100644 index 000000000..b71e93191 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java @@ -0,0 +1,80 @@ +package org.owasp.webgoat.plugin; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.owasp.webgoat.plugin.introduction.SqlInjection; +import org.owasp.webgoat.plugins.LessonTest; +import org.owasp.webgoat.session.WebgoatContext; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.hamcrest.Matchers.is; +import static org.mockito.Mockito.when; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * @author nbaars + * @since 5/21/17. + */ +@RunWith(SpringJUnit4ClassRunner.class) +public class SqlInjectionLesson12aTest extends LessonTest { + + @Autowired + private WebgoatContext context; + + @Before + public void setup() throws Exception { + SqlInjection sql = new SqlInjection(); + + when(webSession.getCurrentLesson()).thenReturn(sql); + when(webSession.getWebgoatContext()).thenReturn(context); + this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build(); + } + + @Test + public void knownAccountShouldDisplayData() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + .param("column", "id")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()); + } + + @Test + public void trueShouldSortByHostname() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + .param("column", "(case when (true) then hostname else id end)")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); + } + + @Test + public void falseShouldSortById() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + .param("column", "(case when (true) then hostname else id end)")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); + } + + @Test + public void passwordIncorrectShouldOrderByHostname() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + .param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '192.%' THEN hostname ELSE id END")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-dev"))); + } + + @Test + public void passwordCorrectShouldOrderByHostname() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.get("/SqlInjection/servers") + .param("column", "CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-prd') LIKE '104.%' THEN hostname ELSE id END")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); + } +} \ No newline at end of file diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java index 54c99b481..b829546a6 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java @@ -3,6 +3,7 @@ package org.owasp.webgoat.plugin; import org.junit.Before; import org.junit.Test; import org.junit.runner.RunWith; +import org.owasp.webgoat.plugin.introduction.SqlInjection; import org.owasp.webgoat.plugins.LessonTest; import org.owasp.webgoat.session.WebgoatContext; import org.springframework.beans.factory.annotation.Autowired; From e9ad20cb30fee68c93ef3146c68a72dbeee06e5e Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 15 Jun 2017 19:06:50 +0200 Subject: [PATCH 32/41] Make sure we clean all the files below the .webgoat dir --- .../java/org/owasp/webgoat/CleanupLocalProgressFiles.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java b/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java index 6e9e89985..d0667fd9f 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/CleanupLocalProgressFiles.java @@ -24,6 +24,10 @@ public class CleanupLocalProgressFiles { @PostConstruct public void clean() { File dir = new File(webgoatHome); - FileSystemUtils.deleteRecursively(dir); + //do it safe, check whether the subdir mongodb is available as subdirectory + File[] mongoDir = dir.listFiles(f -> f.isDirectory() && f.getName().contains("mongodb")); + if (mongoDir != null && mongoDir.length == 1) { + FileSystemUtils.deleteRecursively(dir); + } } } From 36ad73c800919265626d4045c47baeb605cdc0d8 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 15 Jun 2017 23:36:51 +0200 Subject: [PATCH 33/41] Added more mitigations for XXE --- .../src/main/resources/lessonPlans/en/XXE_mitigation.adoc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc b/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc index 2ba1be885..2e30c8a40 100644 --- a/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc +++ b/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc @@ -19,3 +19,11 @@ xif.setProperty(XMLInputFactory.SUPPORT_DTD, true); ---- For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet + + +==== Validate + +Implement proper validation for the Content-type and Accept header do not simply rely on the framework to handle + the incoming request. Also if the client specifies a proper accept header return with a `406/Not Acceptable. + +` \ No newline at end of file From 78090572085c5973e00d9fb7a44a67a9bc2529dd Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 15 Jun 2017 23:38:04 +0200 Subject: [PATCH 34/41] Enabled the challenges again to make them visible for everybody who starts WebGoat --- .../src/main/resources/application.properties | 2 +- .../lessonPlans/en/Challenge_introduction.adoc | 6 ++++++ webgoat-server/pom.xml | 12 +++++------- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/webgoat-container/src/main/resources/application.properties b/webgoat-container/src/main/resources/application.properties index 5ac2c63c3..aa20c6c47 100644 --- a/webgoat-container/src/main/resources/application.properties +++ b/webgoat-container/src/main/resources/application.properties @@ -16,7 +16,7 @@ security.enable-csrf=false spring.resources.cache-period=0 spring.thymeleaf.cache=false -webgoat.clean=true +webgoat.clean=false webgoat.server.directory=${user.home}/.webgoat/ webgoat.user.directory=${user.home}/.webgoat/ webgoat.build.version=@project.version@ diff --git a/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc b/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc index 03774d6f7..d6037af18 100644 --- a/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc +++ b/webgoat-lessons/challenge/src/main/resources/lessonPlans/en/Challenge_introduction.adoc @@ -1,5 +1,11 @@ === Welcome to the WebGoat challenge (CTF) +==== Introduction + +The challenges contain more a CTF like lessons where we do not provide any explanations what you need to do, no hints +will be provided. You can use these challenges in a CTF style where you can run WebGoat on one server and all +participants can join and hack the challenges. A scoreboard is available at http://localhost:8080/WebGoat/scoreboard + :hardbreaks: In this CTF you will need to solve a couple of challenges, each challenge will give you a flag which you will need to post in order to gain points. diff --git a/webgoat-server/pom.xml b/webgoat-server/pom.xml index 03297cc02..ac3330917 100644 --- a/webgoat-server/pom.xml +++ b/webgoat-server/pom.xml @@ -72,8 +72,6 @@ - - com.spotify @@ -86,11 +84,11 @@ webgoat-container ${project.version} - - - - - + + org.owasp.webgoat.lesson + challenge + ${project.version} + org.owasp.webgoat.lesson bypass-restrictions From f1fd2145804da5ab66751e977b21c399f953db9d Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 15 Jun 2017 23:49:03 +0200 Subject: [PATCH 35/41] Added more testcases for the SQL lesson 12 --- .../SqlInjectionLesson5aTest.java | 3 +-- .../SqlInjectionLesson12aTest.java | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) rename webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/{ => introduction}/SqlInjectionLesson5aTest.java (97%) rename webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/{ => mitigation}/SqlInjectionLesson12aTest.java (81%) diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5aTest.java similarity index 97% rename from webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java rename to webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5aTest.java index b829546a6..4c544c17c 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson5aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5aTest.java @@ -1,9 +1,8 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.introduction; import org.junit.Before; import org.junit.Test; import org.junit.runner.RunWith; -import org.owasp.webgoat.plugin.introduction.SqlInjection; import org.owasp.webgoat.plugins.LessonTest; import org.owasp.webgoat.session.WebgoatContext; import org.springframework.beans.factory.annotation.Autowired; diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java similarity index 81% rename from webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java rename to webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java index b71e93191..70e42cfcb 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/SqlInjectionLesson12aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12aTest.java @@ -1,4 +1,4 @@ -package org.owasp.webgoat.plugin; +package org.owasp.webgoat.plugin.mitigation; import org.junit.Before; import org.junit.Test; @@ -77,4 +77,20 @@ public class SqlInjectionLesson12aTest extends LessonTest { .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()).andExpect(jsonPath("$[0].hostname", is("webgoat-acc"))); } + + @Test + public void postingCorrectAnswerShouldPassTheLesson() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a") + .param("ip", "104.130.219.202")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))); + } + + @Test + public void postingWrongAnswerShouldNotPassTheLesson() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack12a") + .param("ip", "192.168.219.202")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + } } \ No newline at end of file From e808abd5042c6f0391bd651e918258d185a52ba7 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Fri, 16 Jun 2017 00:23:40 +0200 Subject: [PATCH 36/41] Added testcase for SQL lesson 6a --- .../org/owasp/webgoat/plugins/LessonTest.java | 4 + .../SqlInjectionLesson6aTest.java | 81 +++++++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java index 4677b499c..3e6dffe9e 100644 --- a/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java +++ b/webgoat-container/src/test/java/org/owasp/webgoat/plugins/LessonTest.java @@ -4,6 +4,7 @@ import org.junit.Before; import org.owasp.webgoat.i18n.Language; import org.owasp.webgoat.i18n.PluginMessages; import org.owasp.webgoat.session.WebSession; +import org.owasp.webgoat.session.WebgoatContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.context.embedded.LocalServerPort; import org.springframework.boot.test.context.SpringBootTest; @@ -33,6 +34,8 @@ public abstract class LessonTest { protected PluginMessages messages; @MockBean protected WebSession webSession; + @Autowired + private WebgoatContext context; @MockBean private Language language; @@ -40,6 +43,7 @@ public abstract class LessonTest { public void init() { when(webSession.getUserName()).thenReturn("unit-test"); when(language.getLocale()).thenReturn(Locale.getDefault()); + when(webSession.getWebgoatContext()).thenReturn(context); } } diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java new file mode 100644 index 000000000..83f5b7777 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java @@ -0,0 +1,81 @@ +package org.owasp.webgoat.plugin.introduction; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.owasp.webgoat.plugins.LessonTest; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.hamcrest.Matchers.containsString; +import static org.hamcrest.Matchers.is; +import static org.mockito.Mockito.when; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * @author nbaars + * @since 6/15/17. + */ +@RunWith(SpringJUnit4ClassRunner.class) +public class SqlInjectionLesson6aTest extends LessonTest { + + @Before + public void setup() throws Exception { + when(webSession.getCurrentLesson()).thenReturn(new SqlInjection()); + this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build(); + } + + @Test + public void wrongSolution() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6a") + .param("userid_6a", "John")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + } + + @Test + public void wrongNumberOfColumns() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6a") + .param("userid_6a", "Smith' union select userid,user_name, password,cookie from user_system_data --")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.output", is("column number mismatch detected in rows of UNION, INTERSECT, EXCEPT, or VALUES operation"))); + } + + @Test + public void wrongDataTypeOfColumns() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6a") + .param("userid_6a", "Smith' union select 1,password, 1,'2','3', '4',1 from user_system_data --")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.output", containsString("incompatible data types in combination"))); + } + + @Test + public void correctSolution() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6a") + .param("userid_6a", "Smith' union select 1,password, '1','2','3', '4',1 from user_system_data --")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))) + .andExpect(jsonPath("$.feedback", containsString("dave"))); + } + + @Test + public void noResultsReturned() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6a") + .param("userid_6a", "Smith' and 1 = 2 --")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.feedback", is(messages.getMessage("sql-injection.6a.no.results")))); + } + + +} \ No newline at end of file From bf210de0132ddb844cb17dfedc58962d52c8854a Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Fri, 16 Jun 2017 00:33:02 +0200 Subject: [PATCH 37/41] Added testcase for SQL lesson 6b --- .../introduction/SqlInjectionLesson6b.java | 73 +++++++++---------- .../SqlInjectionLesson6aTest.java | 10 +-- .../SqlInjectionLesson6bTest.java | 46 ++++++++++++ 3 files changed, 84 insertions(+), 45 deletions(-) create mode 100644 webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6bTest.java diff --git a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java index df3f490e7..77bd7b66e 100644 --- a/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java +++ b/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6b.java @@ -10,7 +10,6 @@ import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; -import javax.servlet.http.HttpServletRequest; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; @@ -18,77 +17,71 @@ import java.sql.SQLException; import java.sql.Statement; - /*************************************************************************************************** - * - * + * + * * This file is part of WebGoat, an Open Web Application Security Project utility. For details, * please see http://www.owasp.org/ - * + * * Copyright (c) 2002 - 20014 Bruce Mayhew - * + * * This program is free software; you can redistribute it and/or modify it under the terms of the * GNU General Public License as published by the Free Software Foundation; either version 2 of the * License, or (at your option) any later version. - * + * * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. - * + * * You should have received a copy of the GNU General Public License along with this program; if * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA * 02111-1307, USA. - * + * * Getting Source ============== - * + * * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software * projects. - * + * * For details, please see http://webgoat.github.io - * + * * @author Bruce Mayhew WebGoat * @created October 28, 2003 */ @AssignmentPath("/SqlInjection/attack6b") public class SqlInjectionLesson6b extends AssignmentEndpoint { - @RequestMapping(method = RequestMethod.POST) - public @ResponseBody AttackResult completed(@RequestParam String userid_6b, HttpServletRequest request) throws IOException { - if (userid_6b.toString().equals(getPassword())) { - return trackProgress(success().build()); - } else { - return trackProgress(failed().build()); - } - } + @RequestMapping(method = RequestMethod.POST) + @ResponseBody + public AttackResult completed(@RequestParam String userid_6b) throws IOException { + if (userid_6b.toString().equals(getPassword())) { + return trackProgress(success().build()); + } else { + return trackProgress(failed().build()); + } + } - protected String getPassword() - { - - String password="dave"; - try - { + protected String getPassword() { + + String password = "dave"; + try { Connection connection = DatabaseUtilities.getConnection(getWebSession()); String query = "SELECT password FROM user_system_data WHERE user_name = 'dave'"; - - try - { + + try { Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, - ResultSet.CONCUR_READ_ONLY); + ResultSet.CONCUR_READ_ONLY); ResultSet results = statement.executeQuery(query); - if ((results != null) && (results.first() == true)) - { + if ((results != null) && (results.first() == true)) { password = results.getString("password"); } - } catch (SQLException sqle) - { - sqle.printStackTrace(); - // do nothing + } catch (SQLException sqle) { + sqle.printStackTrace(); + // do nothing } - } catch (Exception e) - { - e.printStackTrace(); - // do nothing + } catch (Exception e) { + e.printStackTrace(); + // do nothing } return (password); } diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java index 83f5b7777..be735f9c0 100644 --- a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6aTest.java @@ -34,7 +34,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "John")) .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()) - .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + .andExpect(jsonPath("$.lessonCompleted", is(false))); } @Test @@ -43,7 +43,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "Smith' union select userid,user_name, password,cookie from user_system_data --")) .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()) - .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.lessonCompleted", is(false))) .andExpect(jsonPath("$.output", is("column number mismatch detected in rows of UNION, INTERSECT, EXCEPT, or VALUES operation"))); } @@ -53,7 +53,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "Smith' union select 1,password, 1,'2','3', '4',1 from user_system_data --")) .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()) - .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.lessonCompleted", is(false))) .andExpect(jsonPath("$.output", containsString("incompatible data types in combination"))); } @@ -63,7 +63,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "Smith' union select 1,password, '1','2','3', '4',1 from user_system_data --")) .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()) - .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))) + .andExpect(jsonPath("$.lessonCompleted", is(true))) .andExpect(jsonPath("$.feedback", containsString("dave"))); } @@ -73,7 +73,7 @@ public class SqlInjectionLesson6aTest extends LessonTest { .param("userid_6a", "Smith' and 1 = 2 --")) .andDo(MockMvcResultHandlers.print()) .andExpect(status().isOk()) - .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))) + .andExpect(jsonPath("$.lessonCompleted", is(false))) .andExpect(jsonPath("$.feedback", is(messages.getMessage("sql-injection.6a.no.results")))); } diff --git a/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6bTest.java b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6bTest.java new file mode 100644 index 000000000..394d5baa9 --- /dev/null +++ b/webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6bTest.java @@ -0,0 +1,46 @@ +package org.owasp.webgoat.plugin.introduction; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.owasp.webgoat.plugins.LessonTest; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.hamcrest.Matchers.is; +import static org.mockito.Mockito.when; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/**a + * @author nbaars + * @since 6/16/17. + */ +@RunWith(SpringJUnit4ClassRunner.class) +public class SqlInjectionLesson6bTest extends LessonTest { + + @Before + public void setup() throws Exception { + when(webSession.getCurrentLesson()).thenReturn(new SqlInjection()); + this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build(); + } + + @Test + public void submitCorrectPassword() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6b") + .param("userid_6b", "dave")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))); + } + + @Test + public void submitWrongPassword() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/SqlInjection/attack6b") + .param("userid_6b", "John")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + } + +} \ No newline at end of file From edceba73fe2735857d4f67d3260cca6add21d4f5 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Fri, 16 Jun 2017 01:16:31 +0200 Subject: [PATCH 38/41] - Added testcases for bypassing frontend validation. - Improved layout of the lesson - Fixed JavaScript issues with 'let' --- webgoat-lessons/bypass-restrictions/pom.xml | 23 ------ .../resources/html/BypassRestrictions.html | 50 ++++++------ ...BypassRestrictions_FrontendValidation.adoc | 1 + .../en/BypassRestrictions_Intro.adoc | 3 +- ...assRestrictionsFrontendValidationTest.java | 76 +++++++++++++++++++ 5 files changed, 105 insertions(+), 48 deletions(-) create mode 100644 webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java diff --git a/webgoat-lessons/bypass-restrictions/pom.xml b/webgoat-lessons/bypass-restrictions/pom.xml index 0f5b02576..8775fdbd5 100755 --- a/webgoat-lessons/bypass-restrictions/pom.xml +++ b/webgoat-lessons/bypass-restrictions/pom.xml @@ -8,27 +8,4 @@ webgoat-lessons-parent 8.0-SNAPSHOT - - - - org.springframework.boot - spring-boot-starter-test - test - - - org.springframework.security - spring-security-test - 4.1.3.RELEASE - test - - - junit - junit - ${junit.version} - jar - test - - - - diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html index f8153ca3e..c27984c4f 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/html/BypassRestrictions.html @@ -52,63 +52,63 @@ enctype="application/json;charset=UTF-8" onsubmit="return validate()">
      - Field1: exactly three lowercase characters(^[a-z]{3}$) + Field 1: exactly three lowercase characters(^[a-z]{3}$)

      -
      Field2: exactly three digits(^[0-9]{3}$)
      +
      Field 2: exactly three digits(^[0-9]{3}$)

      -
      Field3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)
      +
      Field 3: letters, numbers, and space only(^[a-zA-Z0-9 ]*$)

      -
      Field4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)
      +
      Field 4: enumeration of numbers (^(one|two|three|four|five|six|seven|eight|nine)$)

      -
      Field5: simple zip code (^\d{5}$)
      +
      Field 5: simple zip code (^\d{5}$)

      -
      Field6: zip with optional dash four (^\d{5}(-\d{4})?$)
      +
      Field 6: zip with optional dash four (^\d{5}(-\d{4})?$)

      -
      Field7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
      +
      Field 7: US phone number with or without dashes (^[2-9]\d{2}-?\d{3}-?\d{4}$)
      -

      +

      +
      +
    diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc index 2f02262d0..67b4dd857 100644 --- a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_FrontendValidation.adoc @@ -1,4 +1,5 @@ == Validation + Often, there is some mechanism in place to prevent users from sending altered field values to server, such as validation before sending. Most of popular browsers such as Chrome don't allow editing scripts during runtime. We will have to circumvent diff --git a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc index 5743d6f9a..e75483bc8 100755 --- a/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc +++ b/webgoat-lessons/bypass-restrictions/src/main/resources/lessonPlans/en/BypassRestrictions_Intro.adoc @@ -1,10 +1,11 @@ - == Concept + Users have a great degree of control over the front-end of the web application. They can alter HTML code, sometimes also scripts. This is why apps that require certain format of input should also validate on server-side. == Goals + * The user should have a basic knowledge of HTML * The user should be able to tamper a request before sending (with proxy or other tool) * The user will be able to tamper with field restrictions and bypass client-side validation diff --git a/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java b/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java new file mode 100644 index 000000000..8fb0657fa --- /dev/null +++ b/webgoat-lessons/bypass-restrictions/src/test/java/org/owasp/webgoat/plugin/BypassRestrictionsFrontendValidationTest.java @@ -0,0 +1,76 @@ +package org.owasp.webgoat.plugin; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.owasp.webgoat.plugins.LessonTest; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.hamcrest.Matchers.is; +import static org.mockito.Mockito.when; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * @author nbaars + * @since 6/16/17. + */ +@RunWith(SpringJUnit4ClassRunner.class) +public class BypassRestrictionsFrontendValidationTest extends LessonTest { + + @Before + public void setup() throws Exception { + when(webSession.getCurrentLesson()).thenReturn(new BypassRestrictions()); + this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).build(); + } + + @Test + public void noChangesShouldNotPassTheLesson() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation") + .param("field1", "abc") + .param("field2", "123") + .param("field3", "abc ABC 123") + .param("field4", "seven") + .param("field5", "01101") + .param("field6", "90201 1111") + .param("field7", "301-604-4882") + .param("error", "2")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + } + + @Test + public void bypassAllFieldShouldPass() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation") + .param("field1", "abcd") + .param("field2", "1234") + .param("field3", "abc $ABC 123") + .param("field4", "ten") + .param("field5", "01101AA") + .param("field6", "90201 1111AA") + .param("field7", "301-604-4882$$") + .param("error", "0")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true))); + } + + @Test + public void notBypassingAllFieldShouldNotPass() throws Exception { + mockMvc.perform(MockMvcRequestBuilders.post("/BypassRestrictions/frontendValidation") + .param("field1", "abc") + .param("field2", "1234") + .param("field3", "abc $ABC 123") + .param("field4", "ten") + .param("field5", "01101AA") + .param("field6", "90201 1111AA") + .param("field7", "301-604-4882AA") + .param("error", "0")) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false))); + } + + +} \ No newline at end of file From b304dbb55291923b2df1ea023e41776bb3ffd236 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Tue, 20 Jun 2017 09:44:12 +0200 Subject: [PATCH 39/41] Changed to develop for coverage --- README.MD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.MD b/README.MD index ddef184bb..3a5d469b3 100644 --- a/README.MD +++ b/README.MD @@ -1,7 +1,7 @@ # WebGoat: A deliberately insecure Web Application [![Build Status](https://travis-ci.org/WebGoat/WebGoat.svg?branch=develop)](https://travis-ci.org/WebGoat/WebGoat) -[![Coverage Status](https://coveralls.io/repos/WebGoat/WebGoat/badge.svg?branch=master&service=github)](https://coveralls.io/github/WebGoat/WebGoat?branch=master) +[![Coverage Status](https://coveralls.io/repos/WebGoat/WebGoat/badge.svg?branch=develop&service=github)](https://coveralls.io/github/WebGoat/WebGoat?branch=master) [![Codacy Badge](https://api.codacy.com/project/badge/b69ee3a86e3b4afcaf993f210fccfb1d)](https://www.codacy.com/app/dm/WebGoat) [![Dependency Status](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa/badge.svg?style=flat)](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa) [![OWASP Labs](https://img.shields.io/badge/owasp-labs-orange.svg)](https://www.owasp.org/index.php/OWASP_Project_Inventory#tab=Labs_Projects) From ccb4e3813b2d871740788e455736a3cba65e3ea6 Mon Sep 17 00:00:00 2001 From: Jason White Date: Fri, 23 Jun 2017 14:46:09 -0400 Subject: [PATCH 40/41] #353 - lesson template/guide --- .../org/owasp/webgoat/MvcConfiguration.java | 1 + webgoat-lessons/pom.xml | 2 + .../webgoat-lesson-template/.DS_Store | Bin 0 -> 8196 bytes .../getting-started.txt | 55 +++++++++++++++ .../webgoat-lesson-template/pom.xml | 12 ++++ .../webgoat-lesson-template/src/.DS_Store | Bin 0 -> 8196 bytes .../src/main/.DS_Store | Bin 0 -> 10244 bytes .../src/main/java/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/owasp/.DS_Store | Bin 0 -> 8196 bytes .../src/main/java/org/owasp/webgoat/.DS_Store | Bin 0 -> 8196 bytes .../owasp/webgoat/plugin/LessonTemplate.java | 65 ++++++++++++++++++ .../owasp/webgoat/plugin/SampleAttack.java | 62 +++++++++++++++++ .../src/main/resources/.DS_Store | Bin 0 -> 6148 bytes .../src/main/resources/html/.DS_Store | Bin 0 -> 6148 bytes .../main/resources/html/LessonTemplate.html | 54 +++++++++++++++ .../resources/i18n/WebGoatLabels.properties | 7 ++ .../resources/images/firefox-proxy-config.png | Bin 0 -> 204442 bytes .../src/main/resources/js/idor.js | 18 +++++ .../en/lesson-template-attack.adoc | 3 + .../lessonPlans/en/lesson-template-intro.adoc | 19 +++++ .../lessonPlans/en/lesson-template-video.adoc | 7 ++ .../src/main/resources/video/sample-video.m4v | Bin 0 -> 21278272 bytes webgoat-server/pom.xml | 7 ++ 24 files changed, 312 insertions(+) create mode 100644 webgoat-lessons/webgoat-lesson-template/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/getting-started.txt create mode 100644 webgoat-lessons/webgoat-lesson-template/pom.xml create mode 100644 webgoat-lessons/webgoat-lesson-template/src/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/org/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/webgoat/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/webgoat/plugin/LessonTemplate.java create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/webgoat/plugin/SampleAttack.java create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/html/.DS_Store create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/html/LessonTemplate.html create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/i18n/WebGoatLabels.properties create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/images/firefox-proxy-config.png create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/js/idor.js create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-attack.adoc create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-intro.adoc create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/lessonPlans/en/lesson-template-video.adoc create mode 100644 webgoat-lessons/webgoat-lesson-template/src/main/resources/video/sample-video.m4v diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java index 1c949c85e..349904de9 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java @@ -124,6 +124,7 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter { registry.addResourceHandler("/images/**").addResourceLocations("classpath:/images/"); registry.addResourceHandler("/lesson_js/**").addResourceLocations("classpath:/js/"); registry.addResourceHandler("/lesson_css/**").addResourceLocations("classpath:/css/"); + registry.addResourceHandler("/video/**").addResourceLocations("classpath:/video/"); super.addResourceHandlers(registry); } diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index 5267c0099..5137709b1 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -27,6 +27,8 @@ xxe idor vulnerable-components + + diff --git a/webgoat-lessons/webgoat-lesson-template/.DS_Store b/webgoat-lessons/webgoat-lesson-template/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..0d597e3dbf596974fdd877729e0dab83badc8e41 GIT binary patch literal 8196 zcmeHLT}&KB9RL3hN_Y6M1BG%uY`qkbiidKAf@o6@xMCaH6g}X8qPTavz{X|wa=Uk+ zgos9?ZPcjI2VYFAAJx9-ix29HFE*{l_+U*+)ED1;GEpCV@WKD=EFb0Ltp~q-?YAOKVUD2m}b+k_d?PAxc@ugfEw*^p*}Pydwa~Qc`<~ z>RePvMtzy^<&uh=DSk^ikh0;mai{WjLUJ_(1>7=$}x~dpq?X_1pmy zQU+y!K!Ctz1jOE70uJOMo0(gGem4!rZEIV`P)X^IvYiSmuMiKfE`KaFW6z~r)h#%^ zYW|GZGBiEo*9TR1W~Dx4+vaLr&5RiO+$68@l5iDg@x95M`w2|8gIXUF&15jx3?dPMY|4n zEH3h26s6(r!#$_Qa*OBAzxVzJA71$A(q#z(`U?r{-T=y#HAFNgYi8&hgsTtI6zMjo z%;|V4YtOE~@$j8Zr#L8YL_&{bauU&NtBA6Sa8GS--z4V+M}Jf|Ro5u$N!8VzNxsV= zkWXZ7%m4Ot);0^X7FnvZs+ld2v)*HxDdTC~8Flq}SJcKGJMZ>+j-v*}3f&~H5!jv1 zxrS{yBYNH;$=Jopy2$>r)uHd$kfqM*GO9kjm+{Y(35|wx%GQLB=2^n^;eCp7M(F$UI+aq*qTvIKtICi= zLz7)Jv1Y~{HuNMBK!&!kn8GzSY^oXEl&bq!T;T&OU6kXO$`014RAY>d68N(;LPx5* z!w)L_vhuii_es@pPv>-NZB!2_%9yb9Xqv7mjfsPD_8Svzvckniv=?G<6#8KtvS7g+ zybQ0vtME3Qhl}tjd;wp>CAb3L!1r(smf~Q#JBJrydcLDTA^uDwpU90 zm}+Y@^Do{)>8)rM>92Y?`M=O?xl)j;x@LE6ozJ$O)!FiBw4NazDdensY*?A?4KsN? z+4c|xBMofdcH|u=cY)KDIB+;*|sEmmnilLd#lD3f;8*w^ z{w7+LA;&#fj}fBPKD-N?u?6oTVs#R!y72)#g2%8QkK+j(z#$@68b>{HX*h+`XkZ>4 zEMO7m@mYKhpT`&QMSKlk$2TP1HjwT33eBYS$mo-8)=nn1f|~{Sv1{gY&%SEWwz1@9 zwp$^Ksk~*{)-?4ah+YORsI(VNgAVTc)mM%qC~qhNC9=1$_y;(){r&$9eP_^FfIxu2 z&4mD#CR52?8q>U}^vv!p76O=^~eoIn%Ayiy<5kPJKIPUpI$yLN8e7Pj07fO0B Ul;nSO5fJSE!Tv7@c#Efh0lIMvPyhe` literal 0 HcmV?d00001 diff --git a/webgoat-lessons/webgoat-lesson-template/getting-started.txt b/webgoat-lessons/webgoat-lesson-template/getting-started.txt new file mode 100644 index 000000000..c0677c6b7 --- /dev/null +++ b/webgoat-lessons/webgoat-lesson-template/getting-started.txt @@ -0,0 +1,55 @@ +##### To include lesson template in build ##### +1. edit theh webgoat-server/pom.xml file and uncomment the section under ... + + +2. Also uncomment in webgoat-lessons/pom.xml where it says ... + + +##### To add a lesson to WebGoat ##### + +There are a number of moving parts and this sample lesson will help you navigate those parts. Most of your work will be done in two directories. To start though, you can copy this directory with the name of your-lesson in the webgoat-lessons directory. + +0. The POM file + a. change the ... + webgoat-lesson-template + ... line to give your lesson its own artifactId.That should be all you need to do there + +1. The Base Class ... + In webgoat-lessons/{your-lesson}/src/main/java, refactor the LessonTemplate.java class, changing ... + a. the category in which you want your lesson to be in. You can create a new category if you want, or put in an issue to have one added + b. The 'defaultRanking' will move your lesson up or down in the categories list + c. implement a new key name pair "lesson-template.title" (the key) and update the same key/value pair (your.key=your value) in src/main/resources/i18n/WebGoatLabels.properties + d. Implement a new value for the getId method, which leads us to ... + +2. The HTML content framing ... + a. Rename the provided file in src/main/resources/html using your value from the getId method in your lesson's base class (e.g. public String getId() { return "your-lesson"; } >> "your-lesson.html") + b. Modify that file following the commented instructions in there + c. In conjunction with this file you + +3. Assignment Endpoints + a. In the above html file, you will see an example of an 'attack form'. You can create endpoints to handle these attacks and provide the user feedback and simulated output. See the example file here as well as other existing lessons for ways to extend these. You will extend the AssignmentEndpoint as the example will show + b. You can also create supporting (non-assignment) endpoints, that are not evaluated/graded. + c. See other lesson examples for creating unit/integration tests for your project as well + + +4. Getting your lesson to show up + a. modify the webgoat-lessons/pom.xml to include your project in the section + + + webgoat-lesson-template + + + + b. modify the webgoat-server/pom.xml to add your project as a dependency in the section ... + + + +
    +
    + +
    + + +
    + +
    + + +
    +
    + + + + + +