dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modified final hint to point to the correct mapping (/conf instead of /config). Minor code syntax cleanup

Browse Source 
git-svn-id: http://webgoat.googlecode.com/svn/trunk@110 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
esheri3 2007-02-02 15:04:37 +00:00
parent e748aa0e90
commit dda693f0ff
1 changed files with 45 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ForcedBrowsing.java
View File

@ -53,8 +53,7 @@ public class ForcedBrowsing extends LessonAdapter
private final static String SUCCEEDED = "succeeded"; private final static String SUCCEEDED = "succeeded";
private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt( private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt("Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0);
"Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0);
/** /**
* Description of the Method * Description of the Method
@ -64,45 +63,40 @@ public class ForcedBrowsing extends LessonAdapter
*/ */
protected Element createContent(WebSession s) protected Element createContent(WebSession s)
{ {
ElementContainer ec = new ElementContainer(); ElementContainer ec = new ElementContainer();
String success = new String(s.getParser().getStringParameter(SUCCEEDED, String success = new String(s.getParser().getStringParameter(SUCCEEDED,""));
""));
if (success.length() != 0 && success.equals("yes")) if (success.length() != 0 && success.equals("yes"))
{ {
ec.addElement(new BR().addElement(new H1() ec.addElement(new BR().addElement(new H1().addElement("Welcome to WebGoat Configuration Page")));
.addElement("Welcome to WebGoat Configuration Page"))); ec.addElement(new BR());
ec.addElement(new BR()); Table t1 = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("center");
Table t1 = new Table().setCellSpacing(0).setCellPadding(0)
.setBorder(0).setWidth("90%").setAlign("center"); TR tr = new TR();
tr.addElement(new TD(new StringElement("Set Admin Privileges for: ")));
TR tr = new TR();
tr.addElement(new TD( Input input1 = new Input(Input.TEXT, "", "");
new StringElement("Set Admin Privileges for: "))); tr.addElement(new TD(input1));
t1.addElement(tr);
Input input1 = new Input(Input.TEXT, "", "");
tr.addElement(new TD(input1)); tr = new TR();
t1.addElement(tr); tr.addElement(new TD(new StringElement("Set Admin Password:")));
tr = new TR(); input1 = new Input(Input.PASSWORD, "", "");
tr.addElement(new TD(new StringElement("Set Admin Password:"))); tr.addElement(new TD(input1));
t1.addElement(tr);
input1 = new Input(Input.PASSWORD, "", "");
tr.addElement(new TD(input1)); Element b = ECSFactory.makeButton("Submit");
t1.addElement(tr); t1.addElement(new TR(new TD(b).setColSpan(2).setAlign("right")));
ec.addElement(t1);
Element b = ECSFactory.makeButton("Submit");
t1.addElement(new TR(new TD(b).setColSpan(2).setAlign("right"))); makeSuccess(s);
ec.addElement(t1); }
else
makeSuccess(s); {
} ec.addElement("Can you try to force browse to the config page which should only be accessed by maintenance personnel.");
else }
{ return ec;
ec
.addElement("Can you try to force browse to the config page which "
+ "should only be accessed by maintenance personnel.");
}
return ec;
} }
@ -113,8 +107,7 @@ public class ForcedBrowsing extends LessonAdapter
*/ */
protected Category getDefaultCategory() protected Category getDefaultCategory()
{ {
return AbstractLesson.A10;
return AbstractLesson.A10;
} }
@ -125,13 +118,12 @@ public class ForcedBrowsing extends LessonAdapter
*/ */
public List getHints() public List getHints()
{ {
List<String> hints = new ArrayList<String>(); List<String> hints = new ArrayList<String>();
hints.add("Try to guess the URL for the config page"); hints.add("Try to guess the URL for the config page");
hints.add("The config page is guessable and hackable"); hints.add("The config page is guessable and hackable");
hints hints.add("Play with the URL and try to guess what the can you replace 'attack' with.");
.add("Play with the URL and try to guess what the can you replace 'attack' with."); hints.add("Try to navigate to http://localhost/WebGoat/conf");
hints.add("Try to navigate to http://localhost/WebGoat/config"); return hints;
return hints;
} }
private final static Integer DEFAULT_RANKING = new Integer(15); private final static Integer DEFAULT_RANKING = new Integer(15);
@ -139,7 +131,7 @@ public class ForcedBrowsing extends LessonAdapter
protected Integer getDefaultRanking() protected Integer getDefaultRanking()
{ {
return DEFAULT_RANKING; return DEFAULT_RANKING;
} }
@ -150,12 +142,12 @@ public class ForcedBrowsing extends LessonAdapter
*/ */
public String getTitle() public String getTitle()
{ {
return ("Forced Browsing"); return ("Forced Browsing");
} }
public Element getCredits() public Element getCredits()
{ {
return super.getCustomCredits("Created by Sherif Koussa ", MAC_LOGO); return super.getCustomCredits("Created by Sherif Koussa ", MAC_LOGO);
} }
} }