dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modified final hint to point to the correct mapping (/conf instead of /config). Minor code syntax cleanup

Browse Source 
git-svn-id: http://webgoat.googlecode.com/svn/trunk@110 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
esheri3 2007-02-02 15:04:37 +00:00
parent e748aa0e90
commit dda693f0ff
1 changed files with 45 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForcedBrowsing.java
View File

@ -53,8 +53,7 @@ public class ForcedBrowsing extends LessonAdapter
private final static String SUCCEEDED = "succeeded"; private final static String SUCCEEDED = "succeeded";
private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt( private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt("Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0);
"Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0);
/** /**
* Description of the Method * Description of the Method
@ -65,19 +64,16 @@ public class ForcedBrowsing extends LessonAdapter
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
String success = new String(s.getParser().getStringParameter(SUCCEEDED, String success = new String(s.getParser().getStringParameter(SUCCEEDED,""));
""));
if (success.length() != 0 && success.equals("yes")) if (success.length() != 0 && success.equals("yes"))
{ {
ec.addElement(new BR().addElement(new H1() ec.addElement(new BR().addElement(new H1().addElement("Welcome to WebGoat Configuration Page")));
.addElement("Welcome to WebGoat Configuration Page")));
ec.addElement(new BR()); ec.addElement(new BR());
Table t1 = new Table().setCellSpacing(0).setCellPadding(0) Table t1 = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("center");
.setBorder(0).setWidth("90%").setAlign("center");
TR tr = new TR(); TR tr = new TR();
tr.addElement(new TD( tr.addElement(new TD(new StringElement("Set Admin Privileges for: ")));
new StringElement("Set Admin Privileges for: ")));
Input input1 = new Input(Input.TEXT, "", ""); Input input1 = new Input(Input.TEXT, "", "");
tr.addElement(new TD(input1)); tr.addElement(new TD(input1));
@ -98,9 +94,7 @@ public class ForcedBrowsing extends LessonAdapter
} }
else else
{ {
ec ec.addElement("Can you try to force browse to the config page which should only be accessed by maintenance personnel.");
.addElement("Can you try to force browse to the config page which "
+ "should only be accessed by maintenance personnel.");
} }
return ec; return ec;
} }
@ -113,7 +107,6 @@ public class ForcedBrowsing extends LessonAdapter
*/ */
protected Category getDefaultCategory() protected Category getDefaultCategory()
{ {
return AbstractLesson.A10; return AbstractLesson.A10;
} }
@ -128,9 +121,8 @@ public class ForcedBrowsing extends LessonAdapter
List<String> hints = new ArrayList<String>(); List<String> hints = new ArrayList<String>();
hints.add("Try to guess the URL for the config page"); hints.add("Try to guess the URL for the config page");
hints.add("The config page is guessable and hackable"); hints.add("The config page is guessable and hackable");
hints hints.add("Play with the URL and try to guess what the can you replace 'attack' with.");
.add("Play with the URL and try to guess what the can you replace 'attack' with."); hints.add("Try to navigate to http://localhost/WebGoat/conf");
hints.add("Try to navigate to http://localhost/WebGoat/config");
return hints; return hints;
} }