moved property files to src/main/resources
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@396 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
ch.ko123
241
src/main/resources/WebGoatLabels_english.properties
Normal file
241
src/main/resources/WebGoatLabels_english.properties
Normal file
@ -0,0 +1,241 @@
|
||||
#General
|
||||
LessonCompleted=Congratulations. You have successfully completed this lesson.
|
||||
RestartLesson=Restart this Lesson
|
||||
SolutionVideos=Solution Videos
|
||||
ErrorGenerating=Error generating
|
||||
InvalidData=Invalid Data
|
||||
|
||||
|
||||
#HttpBasics.java
|
||||
EnterYourName=Enter your Name
|
||||
Go!=Go!
|
||||
|
||||
#BasicAuthentication.java
|
||||
BasicAuthHeaderNameIncorrect=Basic Authentication header name is incorrect.
|
||||
BasicAuthHeaderValueIncorrect=Basic Authentication header value is incorrect.
|
||||
BasicAuthenticationWhatIsNameOfHeader=What is the name of the authentication header:
|
||||
BasicAuthenticationWhatIsDecodedValueOfHeader=What is the decoded value of the authentication header:
|
||||
Submit=Submit
|
||||
BasicAuthenticationGreenStars1=Close your browser and login as
|
||||
BasicAuthenticationGreenStars2= to get your green stars back.
|
||||
BasicAuthenticationStage1Completed=Congratulations, you have figured out the mechanics of basic authentication. - Now you must try to make WebGoat reauthenticate you as: - username: basic - password: basic. Use the Basic Authentication Menu to start at login page.
|
||||
BasicAuthenticationAlmostThere1=You're almost there! You've modified the
|
||||
BasicAuthenticationAlmostThere2= header but you are still logged in as
|
||||
BasicAuthenticationAlmostThere3=. Look at the request after you typed in the 'basic' user credentials and submitted the request. Remember the order of events that occur during Basic Authentication.
|
||||
BasicAuthenticationReallyClose=You're really close! Changing the session cookie caused the server to create a new session for you. This did not cause the server to reauthenticate you. When you figure out how to force the server to perform an authentication request, you have to authenticate as:<br><br> user name: basic<br> password: basic<br>
|
||||
BasicAuthenticationUseTheHints=Use the hints! One at a time...
|
||||
|
||||
BasicAuthenticationHint1=Basic authentication uses a cookie to pass the credentials. Use a proxy to intercept the request. Look at the cookies.
|
||||
|
||||
BasicAuthenticationHint2=Basic authentication uses Base64 encoding to 'scramble' the " + "user's login credentials.
|
||||
BasicAuthenticationHint3=Basic authentication uses 'Authorization' as the cookie name to " + "store the user's credentials.
|
||||
BasicAuthenticationHint4=Use WebScarab -> Tools -> Transcoder to Base64 decode the value in the Authorization cookie.
|
||||
|
||||
BasicAuthenticationHint5=Basic authentication uses a cookie to pass the credentials. Use a proxy to intercept the request. Look at the cookies.
|
||||
BasicAuthenticationHint6=Before the WebServer requests credentials from the client, the current session is checked for validitity.
|
||||
BasicAuthenticationHint7=If the session is invalid the webserver will use the basic authentication credentials
|
||||
BasicAuthenticationHint8=If the session is invalid and the basic authentication credentials are invalid, new credentials will be requested from the client.
|
||||
BasicAuthenticationHint9=Intercept the request and corrupt the JSESSIONID and the Authorization header.
|
||||
|
||||
|
||||
#WeakAuthenticationCookie.java
|
||||
InvalidCookie=Invalid cookie
|
||||
IdentityRemembered=Your identity has been remembered
|
||||
InvalidUsernameAndPassword=Invalid username and password entered.
|
||||
UserName=User Name
|
||||
Password=Password
|
||||
Login=Login
|
||||
RequiredFields=Required Fields
|
||||
WeakAuthenticationCookiePleaseSignIn=Please sign in to your account. See the OWASP admin if you do not have an account.
|
||||
SignIn=Sign in
|
||||
PasswordForgotten=Goodbye! Your password has been forgotten
|
||||
WelcomeUser=Welcome,
|
||||
YouHaveBeenAuthenticatedWith=You have been authenticated with
|
||||
Logout=Logout
|
||||
Refresh=Refresh
|
||||
|
||||
WeakAuthenticationCookieHints1=The server authenticates the user using a cookie, if you send the right cookie.
|
||||
WeakAuthenticationCookieHints2=Is the AuthCookie value guessable knowing the username and password?
|
||||
WeakAuthenticationCookieHints3=Add 'AuthCookie=********;' to the Cookie: header using <A href=\"http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project\">WebScarab</A>.
|
||||
WeakAuthenticationCookieHints4=After logging in as webgoat a cookie is added. 65432ubphcfx<br/>After logging in as aspect a cookie is added. 65432udfqtb<br/>Is there anything similar about the cookies and the login names?
|
||||
|
||||
#RemoteAdminFlaw.java
|
||||
RemoteAdminFlawHint1=WebGoat has 2 admin interfaces.
|
||||
RemoteAdminFlawHint2=WebGoat has one admin interface that is controlled via a URL parameter and is 'hackable'
|
||||
RemoteAdminFlawHint3=WebGoat has one admin interface that is controlled via server side security constraints and should not be 'hackable'
|
||||
RemoteAdminFlawHint4=Follow the Source!
|
||||
RemoteAdminFlawHint5=On success you will see new submenu items in the menupoint 'Admin Functions'
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#PathBasedAccessControl.java
|
||||
CurrentDirectory=Current Directory is:
|
||||
ChooseFileToView=Choose the file to view:
|
||||
ViewFile=View File
|
||||
AccessDenied=Access denied
|
||||
ItAppears1=It appears that you are on the right track. Commands that may compromise the operating system have been disabled. You are only allowed to see one file in this directory.
|
||||
ItAppears2=It appears that you are on the right track. Commands that may compromise the operating system have been disabled. You are only allowed to see files in the webgoat directory.
|
||||
CongratsAccessToFileAllowed=Congratulations! Access to file allowed
|
||||
FileInAllowedDirectory=File is already in allowed directory - try again!
|
||||
AccessToFileDenied1=Access to file/directory "
|
||||
AccessToFileDenied2=" denied
|
||||
FileTooLarge=File is too large
|
||||
FileBinary=File is binary
|
||||
TheFollowingError=The following error occurred while accessing the file: <
|
||||
PathBasedAccessControlInstr1=The '
|
||||
PathBasedAccessControlInstr2=' user has access to all the files in the lesson_plans/English directory. Try to break the access control mechanism and access a resource that is not in the listed directory. After selecting a file to view, WebGoat will report if access to the file was granted. An interesting file to try and obtain might be a file like tomcat/conf/tomcat-users.xml
|
||||
ErrorGenerating=Error generating
|
||||
ViewingFile=Viewing file:
|
||||
File=File:
|
||||
Dir=Dir:
|
||||
IsFile= - isFile():
|
||||
Exists= - exists():
|
||||
PathBasedAccessControlHint1=Most operating systems allow special characters in the path.
|
||||
PathBasedAccessControlHint2=Use a file explorer to find the tomcat\\webapps\\WebGoat\\lesson_plans directory");
|
||||
PathBasedAccessControlHint3=Try .. in the path
|
||||
PathBasedAccessControlHint4=Try ..\\..\\..\\LICENSE
|
||||
|
||||
|
||||
|
||||
|
||||
#CommandInjection.java
|
||||
Command=Command
|
||||
CommandInjectionRightTrack1=It appears that you are on the right track. Commands that may compromise the operating system have been disabled. The following commands are allowed: netstat -a, dir, ls, ifconfig, and ipconfig.
|
||||
CommandInjectionRightTrack2=It appears that you are on the right track. Commands that may compromise the operating system have been disabled. This lesson is a command injection lesson, not access control.
|
||||
YouAreCurrentlyViewing=You are currently viewing:
|
||||
SelectFileFromListBelow=select file from list below
|
||||
SelectLessonPlanToView=Select the lesson plan to view:
|
||||
View=View
|
||||
CommandInjectionHint1=The application is using a system command to return the contents of a file.
|
||||
CommandInjectionHint2=The ampersand(&) separates commands in the Windows 2000 command shell. In Unix the separator is typically a semi-colon(;)
|
||||
CommandInjectionHint3=Use a proxy to insert & netstat -a on Windows or ;netstat -a on Unix.
|
||||
CommandInjectionHint4=Note that the server may enclose the submitted file name within quotes
|
||||
|
||||
|
||||
|
||||
#NumericSqlInjection.java
|
||||
NumericSqlInjectionSecondStage=Bet you can't do it again! This lesson has detected your successfull attack and has now switched to a defensive mode. Try again to attack a parameterized query.
|
||||
NoResultsMatched=No results matched. Try Again.
|
||||
NumericSqlInjectionSecondStage2=Now that you have successfully performed an SQL injection, try the same type of attack on a parameterized query.
|
||||
ErrorParsingAsNumber=Error parsing station as a number:
|
||||
SelectYourStation=Select your local weather station:
|
||||
|
||||
SqlNumericInjectionHint1=The application is taking the input from the select box and inserts it at the end of a pre-formed SQL command.
|
||||
SqlNumericInjectionHint2=This is the code for the query being built and issued by WebGoat:<br><br>"SELECT * FROM weather_data WHERE station = " + station
|
||||
SqlNumericInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true.
|
||||
SqlNumericInjectionHint4=Try to intercept the post request with WebScarab and replace the station with [ 101 OR 1 = 1 ].
|
||||
|
||||
|
||||
|
||||
|
||||
#StringSqlInjection.java
|
||||
StringSqlInjectionSecondStage=Now that you have successfully performed an SQL injection, try the same type of attack on a parameterized query. Restart the lesson if you wish to return to the injectable query.
|
||||
EnterLastName=Enter your last name:
|
||||
NoResultsMatched=No results matched. Try Again.
|
||||
SqlStringInjectionHint1=The application is taking your input and inserting it at the end of a pre-formed SQL command.
|
||||
SqlStringInjectionHint2=This is the code for the query being built and issued by WebGoat:<br><br> "SELECT * FROM user_data WHERE last_name = "accountName"
|
||||
SqlStringInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true
|
||||
SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ].
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#LogSpoofing.java
|
||||
LoginFailedForUserName=Login failed for username
|
||||
LoginSucceededForUserName=LOGIN SUCCEEDED FOR USERNAME
|
||||
LogSpoofingHint1=Try to fool the human eye by using new lines.
|
||||
LogSpoofingHint2=Use CR (%0d) and LF (%0a) for a new line.
|
||||
LogSpoofingHint3=Try: Smith%0d%0aLogin Succeeded for username: admin
|
||||
LogSpoofingHint4=Try: Smith%0d%0aLogin Succeeded for username: admin<script>alert(document.cookie)</script>
|
||||
|
||||
#StoredXss.java
|
||||
StoredXssHint1=You can put HTML tags in your message.
|
||||
StoredXssHint1=Bury a SCRIPT tag in the message to attack anyone who reads it.
|
||||
StoredXssHint1=Enter this: <script language=\"javascript\" type=\"text/javascript\">alert(\"Ha Ha Ha\");</script> in the message field.
|
||||
StoredXssHint1=Enter this: <script>alert(document.cookie);</script> in the message field.
|
||||
MessageContentsFor=Message Contents For
|
||||
Title=Title
|
||||
PostedBy=Posted by
|
||||
CouldNotFindMessage=Could not find this message
|
||||
Message=Message
|
||||
MessageList=Message List
|
||||
CouldNotAddMessage=Could not add message to database
|
||||
ErroGeneratingMessageList=Error while getting message list.
|
||||
|
||||
#ReflectedXSS.java
|
||||
ReflectedXSSWhoops1=Whoops! You entered
|
||||
ReflectedXSSWhoops2= instead of your three digit code. Please try again.
|
||||
ShoppingCart=Shopping Cart
|
||||
ShoppingCartItems=Shopping Cart Items -- To Buy Now
|
||||
Price=Price
|
||||
Quantity=Quantity
|
||||
Total=Total
|
||||
TotalChargedCreditCard=The total charged to your credit card
|
||||
UpdateCart=UpdateCart
|
||||
EnterCreditCard=Enter your credit card number
|
||||
Enter3DigitCode=Enter your three digit access code
|
||||
Purchase=Purchase
|
||||
ReflectedXSSHint1=A simple script is <SCRIPT>alert('bang!');</SCRIPT>.
|
||||
ReflectedXSSHint2=Can you get the script to disclose the JSESSIONID cookie?
|
||||
ReflectedXSSHint3=You can use <SCRIPT>alert(document.cookie);</SCRIPT> to access the session id cookie
|
||||
ReflectedXSSHint4=Can you get the script to access the credit card form field?
|
||||
ReflectedXSSHint5=Try a cross site trace (XST) Command:<br><script type=\"text/javascript\">if ( navigator.appName.indexOf(\"Microsoft\") !=-1){var xmlHttp = new ActiveXObject(\"Microsoft.XMLHTTP\");xmlHttp.open(\"TRACE\", \"./\", false); xmlHttp.send();str1=xmlHttp.responseText; while (str1.indexOf(\"\\n\") > -1) str1 = str1.replace(\"\\n\",\"<br>\"); document.write(str1);}</script>");
|
||||
|
||||
#HtmlClues.java
|
||||
HtmlCluesBINGO=BINGO -- admin authenticated
|
||||
HtmlCluesHint1=You can view the HTML source by selecting 'view source' in the browser menu.
|
||||
HtmlCluesHint2=There are lots of clues in the HTML
|
||||
HtmlCluesHint3=Search for the word HIDDEN, look at URLs, look for comments.
|
||||
|
||||
#JavaScriptValidation.java
|
||||
3LowerCase=Field1: exactly three lowercase characters
|
||||
Exactly3Digits=Field2: exactly three digits
|
||||
LettersNumbersSpaceOnly=Field3: letters, numbers, and space only
|
||||
EnumerationOfNumbers=Field4: enumeration of numbers
|
||||
SimpleZipCode=Field5: simple zip code
|
||||
ZIPDashFour=Field6: zip with optional dash four
|
||||
USPhoneNumber=Field7: US phone number with or without dashes
|
||||
|
||||
ServerSideValidationViolation=Server side validation violation: You succeeded for
|
||||
JavaScriptValidationHint1=The validation is happening in your browser.
|
||||
JavaScriptValidationHint2=Try modifying the values with a proxy after they leave your browser
|
||||
JavaScriptValidationHint3=Another way is to delete the JavaScript before you view the page.
|
||||
|
||||
#HiddenFieldTampering.java
|
||||
TotalPriceIs=Your total price is
|
||||
ThisAmountCharged=This amount will be charged to your credit card immediately.
|
||||
|
||||
HiddenFieldTamperingHint1=This application is using hidden fields to transmit price information to the server.
|
||||
HiddenFieldTamperingHint2=Use a program to intercept and change the value in the hidden field.
|
||||
HiddenFieldTamperingHint3=Use <A href=\"http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project\">WebScarab</A> to change the price of the TV from "
|
||||
HiddenFieldTamperingHint32= to
|
||||
|
||||
# Modify data with SQL Injection
|
||||
EnterUserid=Enter your userid:
|
||||
SqlModifyDataHint1=You can use SQL Injection to execute more than one SQL statement.
|
||||
SqlModifyDataHint2=Use a semicolon (;) to separate SQL statements.
|
||||
SqlModifyDataHint3=Modify data using a SQL UPDATE Statement.
|
||||
SqlModifyDataHint4=For details and examples for SQL UPDATE statements, see <A href=\"http://www.w3schools.com/SQl/sql_update.asp\">http://www.w3schools.com/SQl/sql_update.asp</A>
|
||||
SqlModifyDataHint5=SOLUTION:<br/>foo'; UPDATE salaries SET salary=9999999 WHERE userid='jsmith
|
||||
|
||||
# Modify data with SQL Injection
|
||||
SqlAddDataHint1=You can use SQL Injection to execute more than one SQL statement.
|
||||
SqlAddDataHint2=Use a semicolon (;) to separate SQL statements. You will also need to comment out some characters that come after the injection with a double hyphen (--).
|
||||
SqlAddDataHint3=Modify data using a SQL INSERT Statement.
|
||||
SqlAddDataHint4=For details and examples for SQL INSERT statements, see <A href=\"http://www.w3schools.com/SQl/sql_insert.asp\">http://www.w3schools.com/SQl/sql_insert.asp</A>
|
||||
SqlAddDataHint5=SOLUTION:<br/>bar'; INSERT INTO salaries VALUES ('cwillis', 999999); --
|
||||
|
||||
# Bypass Html Field Restrictions
|
||||
BypassHtmlFieldRestrictionsHint1=You must re-enable the disabled form field or manually add its parameter name to your request.
|
||||
BypassHtmlFieldRestrictionsHint2=You can use <A href=\"http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project\">WebScarab</A> to intercept requests and make changes.
|
||||
BypassHtmlFieldRestrictionsHint3=Rather than using <A href=\"http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project\">WebScarab</A>, you could instead use the <A href=\"http://chrispederick.com/work/web-developer/\">Web Developer</a> and/or <A href=\"http://devels-playground.blogspot.com/\">Hackbar</a> Firefox extensions to complete this lesson.
|
||||
|
||||
|
||||
|
||||
|
||||
208
src/main/resources/WebGoatLabels_german.properties
Normal file
208
src/main/resources/WebGoatLabels_german.properties
Normal file
@ -0,0 +1,208 @@
|
||||
#General
|
||||
LessonCompleted=Herzlichen Gl<47>ckwunsch! Sie haben diese Lektion erfolgreich abgeschlossen.
|
||||
RestartLesson=Lektion neu beginnen
|
||||
SolutionVideos=L<EFBFBD>sungsvideos
|
||||
ErrorGenerating=Fehler beim Generieren von
|
||||
InvalidData=Ung<EFBFBD>ltige Daten
|
||||
|
||||
#HttpBasics.java
|
||||
EnterYourName=Geben Sie Ihren Namen ein
|
||||
Go!=Los gehts!
|
||||
|
||||
#BasicAuthentication.java
|
||||
BasicAuthHeaderNameIncorrect=Basic Authentication Header Name ist inkorrekt.
|
||||
BasicAuthHeaderValueIncorrect=Basic Authentication Header Wert ist inkorrekt.
|
||||
BasicAuthenticationWhatIsNameOfHeader=Was ist der Name des Authentication Header:
|
||||
BasicAuthenticationWhatIsDecodedValueOfHeader=Was ist der dekodierte Wert des Authentication Header:
|
||||
Submit=Abschicken
|
||||
BasicAuthenticationGreenStars1=Schlie<EFBFBD>en Sie Ihren Browser und loggen sich Sich als
|
||||
BasicAuthenticationGreenStars2= ein um Ihre gr<67>nen Sterne wiederzubekommen.
|
||||
BasicAuthenticationStage1Completed=Herzlichen Gl<47>ckwunsch, Sie haben die Grundlagen von Basic Authentication verstanden - Jetzt versuchen Sie sich von WebGoat als: username: basic - password: basic authentisieren zu lassen. Benutzen Sie das Basic Authentication Menu um eine Login Seite zu <20>ffnen.
|
||||
BasicAuthenticationAlmostThere1=Sie Sind fast da! Sie haben den
|
||||
BasicAuthenticationAlmostThere2= Header manipuliert aber Sie sind immernoch als
|
||||
BasicAuthenticationAlmostThere3= eingeloggt. Schauen Sie sich den Request an nachdem Sie die 'basic' Authentisierungsdaten eingetippt haben und die Anfrage abgeschickt haben. Halten Sie sich die Reihenfolge der Ereignisse die bei Basic Authentication eintreten vor Augen.
|
||||
BasicAuthenticationReallyClose=Sie sind sehr nahe dran! Durch das <20>ndern des Session Cookie haben Sie den Server dazu gebracht eine neue Session f<>r Sie zu erstellen. Dies hat sie allerdings nicht re-authentisiert. Wenn Sie herausgefunden haben wie Sie den Server dazu zwingen k<>nnen Sie zu re-authentisieren dann authentisieren Sie sich als:<br><br> user name: basic<br> password: basic<br>
|
||||
BasicAuthenticationUseTheHints=Benutzen Sie die Hinweise! Einen nach dem anderen...
|
||||
BasicAuthenticationHint1=Basic authentication uses a cookie to pass the credentials. Use a proxy to intercept the request. Look at the cookies.
|
||||
|
||||
BasicAuthenticationHint2=Basic authentication uses Base64 encoding to 'scramble' the " + "user's login credentials.
|
||||
BasicAuthenticationHint3=Basic authentication uses 'Authorization' as the cookie name to " + "store the user's credentials.
|
||||
BasicAuthenticationHint4=Use WebScarab -> Tools -> Transcoder to Base64 decode the value in the Authorization cookie.
|
||||
|
||||
BasicAuthenticationHint5=Basic authentication uses a cookie to pass the credentials. Use a proxy to intercept the request. Look at the cookies.
|
||||
BasicAuthenticationHint6=Before the WebServer requests credentials from the client, the current session is checked for validitity.
|
||||
BasicAuthenticationHint7=If the session is invalid the webserver will use the basic authentication credentials
|
||||
BasicAuthenticationHint8=If the session is invalid and the basic authentication credentials are invalid, new credentials will be requested from the client.
|
||||
BasicAuthenticationHint9=Intercept the request and corrupt the JSESSIONID and the Authorization header.
|
||||
|
||||
|
||||
|
||||
#WeakAuthenticationCookie.java
|
||||
InvalidCookie=Ung<EFBFBD>ltiger Cookie!
|
||||
IdentityRemembered=Ihre Identit<69>t wurde abgespeichert
|
||||
InvalidUsernameAndPassword=Benutzername und Passwort ung<6E>ltig.
|
||||
UserName=Benutzername
|
||||
Password=Passwort
|
||||
Login=Anmelden
|
||||
RequiredFields=*Ben<65>tigte Felder
|
||||
WeakAuthenticationCookiePleaseSignIn=Bitte melden Sie sich an. Kontaktieren Sie den OWASP Administrator wenn Sie keine Anmeldedaten haben.
|
||||
SignIn=Anmeldung
|
||||
PasswordForgotten=Auf Wiedersehen! Ihr Passwort wurde vergessen
|
||||
WelcomeUser=Willkommen,
|
||||
YouHaveBeenAuthenticatedWith=Sie wurden authentisiert mit
|
||||
Logout=Abmelden
|
||||
Refresh=Neu Laden
|
||||
|
||||
WeakAuthenticationCookieHints1=The server authenticates the user using a cookie, if you send the right cookie.
|
||||
WeakAuthenticationCookieHints2=Is the AuthCookie value guessable knowing the username and password?
|
||||
WeakAuthenticationCookieHints3=Add 'AuthCookie=********;' to the Cookie: header using <A href=\"http://www.owasp.org/development/webscarab\">WebScarab</A>.
|
||||
WeakAuthenticationCookieHints4=After logging in as webgoat a cookie is added. 65432ubphcfx<br/>After logging in as aspect a cookie is added. 65432udfqtb<br/>Is there anything similar about the cookies and the login names?
|
||||
|
||||
#RemoteAdminFlaw.java
|
||||
RemoteAdminFlawHint1=WebGoat has 2 admin interfaces.
|
||||
RemoteAdminFlawHint2=WebGoat has one admin interface that is controlled via a URL parameter and is 'hackable'
|
||||
RemoteAdminFlawHint3=WebGoat has one admin interface that is controlled via server side security constraints and should not be 'hackable'
|
||||
RemoteAdminFlawHint4=Follow the Source!
|
||||
RemoteAdminFlawHint5=On success you will see new submenu items in the menupoint 'Admin Functions'
|
||||
|
||||
|
||||
|
||||
#PathBasedAccessControl.java
|
||||
CurrentDirectory=Das aktuelle Verzeichnis ist:
|
||||
ChooseFileToView=W<EFBFBD>hlen Sie die Datei zum Anzeigen:
|
||||
ViewFile=Datei anzeigen
|
||||
AccessDenied=Zugang verweigert
|
||||
ItAppears1=Es scheint als w<>ren Sie auf dem richtigen Weg. Befehle die das Betriebssystem beeinflussen k<>nnten werden ignoriert. Sie d<>rfen nur eine Datei in diesem Verzeichnis anzeigen.
|
||||
ItAppears2=Es scheint als w<>ren Sie auf dem richtigen Weg. Befehle die das Betriebssystem beeinflussen k<>nnten werden ignoriert. Sie d<>rfen nur Dateien im WebGoat Verzeichnis anzeigen.
|
||||
CongratsAccessToFileAllowed=Herzlichen Gl<47>ckwunsch! Zugang zur Datei gew<65>hrt
|
||||
FileInAllowedDirectory=Die Datei ist bereits in einem erlaubten Verzeichnis - Versuchen Sie es erneut!
|
||||
AccessToFileDenied1=Zugang zu Datei/Verzeichnis "
|
||||
AccessToFileDenied2=" verweigert
|
||||
FileTooLarge=Datei ist zu gro<72>
|
||||
FileBinary=Datei hat bin<69>r-Inhalt
|
||||
TheFollowingError=Der folgende Fehler trat auf beim Zugriff auf die Datei: <
|
||||
PathBasedAccessControlInstr1=Der '
|
||||
PathBasedAccessControlInstr2=' Benutzer hat Zugriff auf alle Dateien im lesson_plans/English Verzeichnis. Versuchen Sie den Zugangsmechanismus zu brechen indem Sie auf eine Resource zugreifen die nicht im gelisteten Verzeichnis liegt. Nachdem Sie eine Datei ausgew<65>hlt haben, wird WebGoat Ihnen sagen ob Sie Zugriff darauf haben. Eine interessante Datei k<>nnte tomcat/conf/tomcat-users.xml sein.
|
||||
ErrorGenerating=Fehler beim Generieren von
|
||||
ViewingFile=Anzeige von Datei:
|
||||
File=Datei:
|
||||
Dir=Verzeichnis:
|
||||
IsFile= - isFile() (ist eine Datei):
|
||||
Exists= - exists() (existiert):
|
||||
|
||||
PathBasedAccessControlHint1=Most operating systems allow special characters in the path.
|
||||
PathBasedAccessControlHint2=Use a file explorer to find the tomcat\\webapps\\WebGoat\\lesson_plans directory");
|
||||
PathBasedAccessControlHint3=Try .. in the path
|
||||
PathBasedAccessControlHint4=Try ..\\..\\..\\LICENSE
|
||||
|
||||
|
||||
#CommandInjection.java
|
||||
Command=Befehl
|
||||
CommandInjectionRightTrack1=Es scheint, dass Sie auf dem richtigen Weg sind. Befehle die das Betriebssystem kompromittieren k<>nnen wurden deaktiviert. Die folgenden Befehle sind erlaubt: netstat -a, dir, ls, ifconfig und ipconfig.
|
||||
CommandInjectionRightTrack2=Es scheint, dass Sie auf dem richtigen Weg sind. Befehle die das Betriebssystem kompromittieren k<>nnen wurden deaktiviert. In dieser Lektion geht es um das Einschleusen von Befehlen, nicht um Zugangskontrolle.
|
||||
YouAreCurrentlyViewing=Sie betrachten gerade:
|
||||
SelectFileFromListBelow=w<EFBFBD>hlen Sie eine Datei aus der Liste
|
||||
SelectLessonPlanToView=W<EFBFBD>hlen Sie die zu betrachtende Lektion aus:
|
||||
View=Anzeigen
|
||||
CommandInjectionHint1=The application is using a system command to return the contents of a file.
|
||||
CommandInjectionHint2=The ampersand(&) separates commands in the Windows 2000 command shell. In Unix the separator is typically a semi-colon(;)
|
||||
CommandInjectionHint3=Use a proxy to insert & netstat -a on Windows or ;netstat -a on Unix.
|
||||
CommandInjectionHint4=Note that the server may enclose the submitted file name within quotes
|
||||
|
||||
|
||||
|
||||
#NumericSqlInjection.java
|
||||
SecondStage=Ich wette das k<>nnen Sie nicht wiederholen. Diese Lektion hat nun in einen defensiven Modus gewechselt. Versuchen Sie nun eine parametrisierte Anfrage anzugreifen.
|
||||
NoResultsMatched=Keine Resultate gefunden. Versuchen Sie es erneut.
|
||||
SecondStage2=Da sie nun erfolgreich eine SQL Injection durchgef<65>hrt haben, versuchen Sie denselben Typ von Angriff auf eine parametrisierte Anfrage.
|
||||
ErrorParsingAsNumber=Fehler beim interpretieren der Wetterstationsnummer als Zahl:
|
||||
SelectYourStation=W<EFBFBD>hlen Sie Ihre lokale Wetterstation aus:
|
||||
SqlNumericInjectionHint1=The application is taking the input from the select box and inserts it at the end of a pre-formed SQL command.
|
||||
SqlNumericInjectionHint2=This is the code for the query being built and issued by WebGoat:<br><br>"SELECT * FROM weather_data WHERE station = " + station
|
||||
SqlNumericInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true.
|
||||
SqlNumericInjectionHint4=Try to intercept the post request with WebScarab and replace the station with [ 101 OR 1 = 1 ].
|
||||
|
||||
|
||||
#StringSqlInjection.java
|
||||
StringSqlInjectionSecondStage=Da sie nun erfolgreich eine SQL Injection durchgef<65>hrt haben, versuchen Sie denselben Typ von Angriff auf eine parametrisierte Anfrage. Starten Sie Diese Lektion neu, wenn Sie zur verwundbaren SQL Anfrage gelangen m<>chten.
|
||||
EnterLastName=Geben Sie Ihren Nachnamen ein:
|
||||
NoResultsMatched=Keine Resultate gefunden, versuchen Sie es erneut
|
||||
SqlStringInjectionHint1=The application is taking your input and inserting it at the end of a pre-formed SQL command.
|
||||
SqlStringInjectionHint2=This is the code for the query being built and issued by WebGoat:<br><br> "SELECT * FROM user_data WHERE last_name = "accountName"
|
||||
SqlStringInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true
|
||||
SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ].
|
||||
|
||||
|
||||
#LogSpoofing.java
|
||||
LoginFailedForUserName=Login failed for username
|
||||
LoginSucceededForUserName=LOGIN SUCCEEDED FOR USERNAME
|
||||
LogSpoofingHint1=Versuchen Sie das menschliche Auge durch Einf<6E>gen von weiteren Zeilen zu verwirren
|
||||
LogSpoofingHint2=Benutzen Sie CR (%0d) und LF (%0a) f<>r eine neue Zeile.
|
||||
LogSpoofingHint3=Versuchen Sie: Smith%0d%0aLogin Succeeded for username: admin
|
||||
LogSpoofingHint4=Versuchen Sie: Smith%0d%0aLogin Succeeded for username: admin<script>alert(document.cookie)</script>
|
||||
|
||||
#StoredXss.java
|
||||
StoredXssHint1=Sie k<>nnen HTML tags in Ihre Nachricht einbauen.
|
||||
StoredXssHint1=Bauen Sie ein SCRIPT tag in Ihre Nachricht ein um jeden Anzugreifen der sie liest
|
||||
StoredXssHint1=Geben Sie: <script language=\"javascript\" type=\"text/javascript\">alert(\"Ha Ha Ha\");</script> in das Nachrichtenfeld ein.
|
||||
StoredXssHint1=Geben Sie: <script>alert(document.cookie);</script> in das Nachrichtenfeld ein.
|
||||
MessageContentsFor=Nachrichteninhalt f<>r
|
||||
Title=Titel
|
||||
PostedBy=Geschrieben von
|
||||
CouldNotFindMessage=Konnte diese Nachricht nicht finden
|
||||
Message=Nachricht
|
||||
MessageList=Nachrichtenliste
|
||||
CouldNotAddMessage=Could not add message to database
|
||||
ErroGeneratingMessageList=Error while getting message list.
|
||||
|
||||
|
||||
#ReflectedXSS.java
|
||||
ReflectedXSSWhoops1=Ups! Sie haben
|
||||
ReflectedXSSWhoops2= anstatt des drei stelligen Codes eingegeben. Bitte versuchen Sie es erneut.
|
||||
ShoppingCart=Warenkorb
|
||||
ShoppingCartItems=Inhalt des Warenkorbs -- Jetzt kaufen
|
||||
Price=Preis
|
||||
Quantity=Menge
|
||||
Total=Gesamt
|
||||
TotalChargedCreditCard=Der Gesamtbetrag, mit dem Ihre Kreditkarte belastet wird
|
||||
UpdateCart=Warenkorb aktualisieren
|
||||
EnterCreditCard=Geben Sie Ihre Kreditkartennummern ein
|
||||
Enter3DigitCode=Geben Sie Ihren 3-stelligen Sicherheitscode ein
|
||||
Purchase=Kaufen
|
||||
ReflectedXSSHint1=Ein einfaches Skript ist <SCRIPT>alert('bang!');</SCRIPT>.
|
||||
ReflectedXSSHint2=K<EFBFBD>nnen Sie das Skript dazu bringen den JSESSIONID Cookie zu ver<65>ffentlichen?
|
||||
ReflectedXSSHint3=Sie k<>nnen <SCRIPT>alert(document.cookie);</SCRIPT> benutzen um an den Session ID Cookie zu kommen
|
||||
ReflectedXSSHint4=K<EFBFBD>nnen Sie das Skript so gestalten, dass es an den Inhalt des Kreditkartenfeldes kommt?
|
||||
ReflectedXSSHint5=Versuchen Sie einen cross site trace (XST) Befehl:<br><script type=\"text/javascript\">if ( navigator.appName.indexOf(\"Microsoft\") !=-1){var xmlHttp = new ActiveXObject(\"Microsoft.XMLHTTP\");xmlHttp.open(\"TRACE\", \"./\", false); xmlHttp.send();str1=xmlHttp.responseText; while (str1.indexOf(\"\\n\") > -1) str1 = str1.replace(\"\\n\",\"<br>\"); document.write(str1);}</script>");
|
||||
|
||||
#HtmlClues.java
|
||||
HtmlCluesBINGO=BINGO -- admin authentisiert
|
||||
HtmlCluesHint1=Sie k<>nnen Sich den HTML Quellcode anschauen indem Sie "View Source" im Browser anklicken.
|
||||
HtmlCluesHint2=Es gibt viele Hinweise in HTML
|
||||
HtmlCluesHint3=Suchen Sie nach den Worten HIDDEN, schauen Sie sich URLs an und suchen Sie nach Kommentaren.
|
||||
|
||||
#JavaScriptValidation.java
|
||||
3LowerCase=Feld1: genau drei kleine Buchstaben
|
||||
Exactly3Digits=Feld2: genau drei Ziffern
|
||||
LettersNumbersSpaceOnly=Feld3: Buchstaben, Ziffern und Leerzeichen
|
||||
EnumerationOfNumbers=Feld4: ausgeschriebene Ziffern
|
||||
SimpleZipCode=Feld5: Einfach Postleitzahlen (5 stellige Zahl)
|
||||
ZIPDashFour=Feld6: Postleitzahlen mit optionalem Bindestrich und 4 stelliger Zahl
|
||||
USPhoneNumber=Feld7: Telefonnummer in den USA, mit oder ohne Bindestriche
|
||||
|
||||
ServerSideValidationViolation=Server-seitige Validierungsversto<74>: Sie waren erfolgreich f<>r
|
||||
JavaScriptValidationHint1=Die Validierung findet in Ihrem Browser statt.
|
||||
JavaScriptValidationHint2=Versuchen Sie den Wert zu ver<65>ndern nachdem er Ihren Browser verlassen hat.
|
||||
JavaScriptValidationHint3=Sie k<>nnen aber auch JavaScript abschalten, bevor Sie sich die Seite anschauen.
|
||||
|
||||
#HiddenFieldTampering.java
|
||||
TotalPriceIs=Der Gesamtpreis ist
|
||||
ThisAmountCharged=Ihre Kreditkarte wird sofort mit dem Betrag belastet
|
||||
|
||||
HiddenFieldTamperingHint1=Die Applikation nutzt ein verstecktes Feld um Preisinformationen an den Server zu <20>bertragen.
|
||||
HiddenFieldTamperingHint2=Benutzen Sie ein Programm um den Wert des versteckten Feldes abzufangen und zu ver<65>ndern.
|
||||
HiddenFieldTamperingHint3=Benutzen Sie <A href=\"http://www.owasp.org/development/webscarab\">WebScarab</A> um den Preis des Fernsehers auf einen anderen Wert einzustellen.
|
||||
HiddenFieldTamperingHint32= bis
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user