diff --git a/ webgoat/main/build.xml b/ webgoat/main/build.xml index 84fc9aed5..ad7cc6be2 100644 --- a/ webgoat/main/build.xml +++ b/ webgoat/main/build.xml @@ -92,25 +92,27 @@ - - - + - - +--> + - + @@ -118,15 +120,15 @@ description="Build the WebGoat application"> - + - - + @@ -167,7 +169,8 @@ - @@ -178,21 +181,25 @@ - +--> - + + + - +--> + + + + + - @@ -229,17 +239,17 @@ - - - - + + - + @@ -275,7 +285,7 @@ - + @@ -294,7 +304,7 @@ - + @@ -313,9 +323,11 @@ + + diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/LessonSource.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/LessonSource.java index c4ef193d2..f7ebe2adc 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/LessonSource.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/LessonSource.java @@ -39,87 +39,109 @@ import org.owasp.webgoat.session.WebSession; * for free software projects. * * For details, please see http://code.google.com/p/webgoat/ - * - * @author Bruce Mayhew WebGoat - * @created October 28, 2003 + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 */ public class LessonSource extends HammerHead { /** - * - */ - private static final long serialVersionUID = 2588430536196446145L; + * + */ + private static final long serialVersionUID = 2588430536196446145L; - /** - * Description of the Field + /** + * Description of the Field */ public final static String START_SOURCE_SKIP = "START_OMIT_SOURCE"; public final static String END_SOURCE_SKIP = "END_OMIT_SOURCE"; - /** - * Description of the Method - * - * @param request Description of the Parameter - * @param response Description of the Parameter - * @exception IOException Description of the Exception - * @exception ServletException Description of the Exception + * Description of the Method + * + * @param request + * Description of the Parameter + * @param response + * Description of the Parameter + * @exception IOException + * Description of the Exception + * @exception ServletException + * Description of the Exception */ public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { - String source = null; - - try - { - //System.out.println( "Entering doPost: " ); - //System.out.println( " - request " + request); - //System.out.println( " - principle: " + request.getUserPrincipal() ); - //setCacheHeaders(response, 0); - WebSession session = (WebSession) request.getSession(true) - .getAttribute(WebSession.SESSION); - session.update(request, response, this.getServletName()); // FIXME: Too much in this call. - - // Get the Java source of the lesson. FIXME: Not needed - source = getSource(session); - - int scr = session.getCurrentScreen(); - Course course = session.getCourse(); - AbstractLesson lesson = course.getLesson(session, scr, - AbstractLesson.USER_ROLE); - lesson.getLessonTracker(session).setViewedSource(true); - } - catch (Throwable t) - { - t.printStackTrace(); - log("ERROR: " + t); - } - finally - { - try - { - this.writeSource(source, response); - } - catch (Throwable thr) - { - thr.printStackTrace(); - log(request, "Could not write error screen: " - + thr.getMessage()); - } - //System.out.println( "Leaving doPost: " ); - - } + String source = null; + + try + { + // System.out.println( "Entering doPost: " ); + // System.out.println( " - request " + request); + // System.out.println( " - principle: " + request.getUserPrincipal() + // ); + // setCacheHeaders(response, 0); + WebSession session = (WebSession) request.getSession(true).getAttribute( + WebSession.SESSION); + // FIXME: Too much in this call. + session.update(request, response, this.getServletName()); + + String showSolution = session.getParser().getRawParameter("solution"); + if (showSolution != null) + { + // FIXME: we could probably just forward off to the file if the file + // existed. However, we do provide some feedback from the + // getSolution() method if something goes wrong. + + // Get the Java solution of the lesson. + source = getSolution(session); + + int scr = session.getCurrentScreen(); + Course course = session.getCourse(); + AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE); + lesson.getLessonTracker(session).setViewedSolution(true); + + + } else + { + + // Get the Java source of the lesson. FIXME: Not needed + source = getSource(session); + + int scr = session.getCurrentScreen(); + Course course = session.getCourse(); + AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE); + lesson.getLessonTracker(session).setViewedSource(true); + } + } + catch (Throwable t) + { + t.printStackTrace(); + log("ERROR: " + t); + } + finally + { + try + { + this.writeSource(source, response); + } + catch (Throwable thr) + { + thr.printStackTrace(); + log(request, "Could not write error screen: " + thr.getMessage()); + } + // System.out.println( "Leaving doPost: " ); + + } } - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value */ protected String getSource(WebSession s) { @@ -131,8 +153,7 @@ public class LessonSource extends HammerHead if (s.isUser() || s.isChallenge()) { - AbstractLesson lesson = course.getLesson(s, scr, - AbstractLesson.USER_ROLE); + AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE); if (lesson != null) { @@ -141,22 +162,51 @@ public class LessonSource extends HammerHead } if (source == null) { - return "Source code is not available. Contact " + s.getWebgoatContext().getFeedbackAddress(); + return "Source code is not available. Contact " + + s.getWebgoatContext().getFeedbackAddress(); } - return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" - + END_SOURCE_SKIP, "Code Section Deliberately Omitted")); + return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP, + "Code Section Deliberately Omitted")); } + protected String getSolution(WebSession s) + { + + String source = null; + int scr = s.getCurrentScreen(); + Course course = s.getCourse(); + + if (s.isUser() || s.isChallenge()) + { + + AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE); + + if (lesson != null) + { + source = lesson.getSolution(s); + } + } + if (source == null) + { + return "Solution is not available. Contact " + + s.getWebgoatContext().getFeedbackAddress(); + } + return (source); + } + + /** - * Description of the Method - * - * @param s Description of the Parameter - * @param response Description of the Parameter - * @exception IOException Description of the Exception + * Description of the Method + * + * @param s + * Description of the Parameter + * @param response + * Description of the Parameter + * @exception IOException + * Description of the Exception */ - protected void writeSource(String s, HttpServletResponse response) - throws IOException + protected void writeSource(String s, HttpServletResponse response) throws IOException { response.setContentType("text/html"); diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java index 5279991d6..24160a4f1 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java @@ -99,6 +99,8 @@ public abstract class AbstractLesson extends Screen implements Comparable private String lessonPlanFileName; + private String lessonSolutionFileName; + private WebgoatContext webgoatContext; /** @@ -557,6 +559,40 @@ public abstract class AbstractLesson extends Screen implements Comparable } + public String getSolution(WebSession s) + { + String source = null; + String src = null; + + try + { + src = readFromFile(new BufferedReader( + new FileReader(s.getWebResource(getLessonSolutionFileName()))), + false); + } + catch (IOException e) + { + s.setMessage("Could not find the solution file"); + src = ("Could not find the solution file"); + } + + Html html = new Html(); + + Head head = new Head(); + head.addElement(new Title(getLessonSolutionFileName())); + + Body body = new Body(); + body.addElement(new StringElement(src)); + + html.addElement(head); + html.addElement(body); + + source = html.toString(); + + return src; + } + + /** * Get the link that can be used to request this screen. * @@ -821,6 +857,16 @@ public abstract class AbstractLesson extends Screen implements Comparable this.lessonPlanFileName = lessonPlanFileName; } + public String getLessonSolutionFileName() + { + return lessonSolutionFileName; + } + + + public void setLessonSolutionFileName(String lessonSolutionFileName) + { + this.lessonSolutionFileName = lessonSolutionFileName; + } public String getSourceFileName() { diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java index d122df17c..9d06acce3 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java @@ -16,6 +16,7 @@ import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.PRE; import org.apache.ecs.html.TD; +import org.apache.ecs.html.TH; import org.apache.ecs.html.TR; import org.apache.ecs.html.Table; import org.owasp.webgoat.session.DatabaseUtilities; @@ -50,247 +51,233 @@ import org.owasp.webgoat.session.WebSession; * * For details, please see http://code.google.com/p/webgoat/ * - * @author Sherif Koussa Macadamian Technologies. + * @author Sherif Koussa Macadamian + * Technologies. */ public class BackDoors extends SequentialLessonAdapter { - private static Connection connection = null; + private static Connection connection = null; - private final static Integer DEFAULT_RANKING = new Integer(80); + private final static Integer DEFAULT_RANKING = new Integer(80); - private final static String USERNAME = "username"; + private final static String USERNAME = "username"; - private final static String SELECT_ST = "select userid, password, ssn, salary from employee where userid="; + private final static String SELECT_ST = "select userid, password, ssn, salary, email from employee where userid="; - private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt( - "Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0); + private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt( + "Macadamian Technologies").setBorder(0).setHspace(0).setVspace(0); - protected Element createContent(WebSession s) - { - return super.createStagedContent(s); - } - - - protected Element doStage1(WebSession s) throws Exception - { - return concept1(s); - } - - - protected Element doStage2(WebSession s) throws Exception - { - return concept2(s); - } - - - protected Element concept1(WebSession s) throws Exception - { - ElementContainer ec = new ElementContainer(); - - ec.addElement(makeUsername(s)); - - try + protected Element createContent(WebSession s) { - String userInput = s.getParser().getRawParameter(USERNAME, ""); - if (!userInput.equals("")) - { - userInput = SELECT_ST + userInput; - String[] arrSQL = userInput.split(";"); - Connection conn = getConnection(s); - Statement statement = conn.createStatement( - ResultSet.TYPE_SCROLL_INSENSITIVE, - ResultSet.CONCUR_READ_ONLY); - if (arrSQL.length == 2) - { - statement.executeUpdate(arrSQL[1]); + return super.createStagedContent(s); + } - getLessonTracker(s).setStage(2); - s - .setMessage("You have succeeded in exploiting the vulnerable query and created another SQL statement. Now move to stage 2 to learn how to create a backdoor or a DB worm"); + protected Element doStage1(WebSession s) throws Exception + { + return concept1(s); + } + + protected Element doStage2(WebSession s) throws Exception + { + return concept2(s); + } + + protected Element concept1(WebSession s) throws Exception + { + ElementContainer ec = new ElementContainer(); + + ec.addElement(makeUsername(s)); + + try + { + String userInput = s.getParser().getRawParameter(USERNAME, ""); + if (!userInput.equals("")) + { + userInput = SELECT_ST + userInput; + String[] arrSQL = userInput.split(";"); + Connection conn = getConnection(s); + Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, + ResultSet.CONCUR_READ_ONLY); + if (arrSQL.length == 2) + { + statement.executeUpdate(arrSQL[1]); + + getLessonTracker(s).setStage(2); + s.setMessage("You have succeeded in exploiting the vulnerable query and created another SQL statement. Now move to stage 2 to learn how to create a backdoor or a DB worm"); + } + + ResultSet rs = statement.executeQuery(arrSQL[0]); + if (rs.next()) + { + Table t = new Table(0).setCellSpacing(0).setCellPadding(0).setBorder(1); + TR tr = new TR(); + tr.addElement(new TH("User ID")); + tr.addElement(new TH("Password")); + tr.addElement(new TH("SSN")); + tr.addElement(new TH("Salary")); + tr.addElement(new TH("E-Mail")); + t.addElement(tr); + while (rs.next()) + { + tr = new TR(); + tr.addElement(new TD(rs.getString("userid"))); + tr.addElement(new TD(rs.getString("password"))); + tr.addElement(new TD(rs.getString("ssn"))); + tr.addElement(new TD(rs.getString("salary"))); + tr.addElement(new TD(rs.getString("email"))); + t.addElement(tr); + } + ec.addElement(t); + } + } + } + catch (Exception ex) + { + ec.addElement(new PRE(ex.getMessage())); + } + return ec; + } + + protected Element concept2(WebSession s) throws Exception + { + ElementContainer ec = new ElementContainer(); + ec.addElement(makeUsername(s)); + + String userInput = s.getParser().getRawParameter(USERNAME, ""); + + if (!userInput.equals("")) + { + String[] arrSQL = userInput.split(";"); + if (arrSQL.length == 2) + { + if (userInput.toUpperCase().indexOf("CREATE TRIGGER") != 0) + { + makeSuccess(s); + } + } + + } + return ec; + } + + public String getInstructions(WebSession s) + { + String instructions = ""; + + if (!getLessonTracker(s).getCompleted()) + { + switch (getStage(s)) + { + case 1: + instructions = "Stage " + getStage(s) + + ": Use String SQL Injection to execute more than one SQL Statement. "; + instructions = instructions + + " The first stage of this lesson is to teach you how to use a vulnerable field to create two SQL "; + instructions = instructions + + " statements. The first is the system's while the second is totally yours."; + instructions = instructions + + " Your account ID is 101. This page allows you to see your password, ssn and salary."; + instructions = instructions + + " Try to inject another update to update salary to something higher"; + break; + case 2: + instructions = "Stage " + getStage(s) + + ": Use String SQL Injection to inject a backdoor. "; + instructions = instructions + + " The second stage of this lesson is to teach you how to use a vulneable fields to inject the DB work or the backdoor."; + instructions = instructions + + " Now try to use the same technique to inject a trigger that would act as "; + instructions = instructions + " SQL backdoor, the syntax of a trigger is:
"; + instructions = instructions + + " CREATE TRIGGER myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET email='john@hackme.com'WHERE userid = NEW.userid
"; + instructions = instructions + + " Note that nothing will actually be executed because the current underlying DB doesn't support triggers."; + break; + } } - ResultSet rs = statement.executeQuery(arrSQL[0]); - if (rs.next()) + return instructions; + } + + protected Element makeUsername(WebSession s) + { + ElementContainer ec = new ElementContainer(); + StringBuffer script = new StringBuffer(); + script.append(""); + ec.addElement(new StringElement(script.toString())); + + ec.addElement(new StringElement("User ID: ")); + Input username = new Input(Input.TEXT, "username", ""); + ec.addElement(username); + + String userInput = s.getParser().getRawParameter("username", ""); + + ec.addElement(new BR()); + ec.addElement(new BR()); + + String formattedInput = "" + userInput + ""; + ec.addElement(new Div(SELECT_ST + formattedInput)); + + Input b = new Input(); + + b.setName("Submit"); + b.setType(Input.SUBMIT); + b.setValue("Submit"); + + ec.addElement(new PRE(b)); + + return ec; + } + + public static synchronized Connection getConnection(WebSession s) throws SQLException, + ClassNotFoundException + { + if (connection == null) { - Table t = new Table(0).setCellSpacing(0).setCellPadding(0) - .setBorder(1); - TR tr = new TR(); - tr.addElement(new TD("User ID")); - tr.addElement(new TD("Password")); - tr.addElement(new TD("SSN")); - tr.addElement(new TD("Salary")); - t.addElement(tr); - tr = new TR(); - tr.addElement(new TD(rs.getString("userid"))); - tr.addElement(new TD(rs.getString("password"))); - tr.addElement(new TD(rs.getString("ssn"))); - tr.addElement(new TD(rs.getString("salary"))); - t.addElement(tr); - ec.addElement(t); + connection = DatabaseUtilities.getConnection(s); } - } + + return connection; } - catch (Exception ex) + + public Element getCredits() { - ec.addElement(new PRE(ex.getMessage())); + return super.getCustomCredits("Created by Sherif Koussa ", MAC_LOGO); } - return ec; - } - - protected Element concept2(WebSession s) throws Exception - { - ElementContainer ec = new ElementContainer(); - ec.addElement(makeUsername(s)); - - String userInput = s.getParser().getRawParameter(USERNAME, ""); - - if (!userInput.equals("")) + protected List getHints(WebSession s) { - String[] arrSQL = userInput.split(";"); - if (arrSQL.length == 2) - { - if (userInput.toUpperCase().indexOf("CREATE TRIGGER") != 0) - { - makeSuccess(s); - } - } - + List hints = new ArrayList(); + hints.add("Your user id is 101. Use it to see your information"); + hints.add("A semi-colon usually ends a SQL statement and starts a new one."); + hints.add("Try this 101 or 1=1; update employee set salary=100000"); + hints.add("For stage 2, Try 101; CREATE TRIGGER myBackDoor BEFORE INSERT ON " + + "employee FOR EACH ROW BEGIN UPDATE employee SET email='john@hackme.com' WHERE userid = NEW.userid"); + return hints; } - return ec; - } - - public String getInstructions(WebSession s) - { - String instructions = ""; - - if (!getLessonTracker(s).getCompleted()) + protected Category getDefaultCategory() { - switch (getStage(s)) - { - case 1: - instructions = "Stage " - + getStage(s) - + ": Use String SQL Injection to execute more than one SQL Statement. "; - instructions = instructions - + " The first stage of this lesson is to teach you how to use a vulnerable field to create two SQL "; - instructions = instructions - + " statements. The first is the system's while the second is totally yours."; - instructions = instructions - + " Your account ID is 101. This page allows you to see your password, ssn and salary."; - instructions = instructions - + " Try to inject another update to update salary to something higher"; - break; - case 2: - instructions = "Stage " - + getStage(s) - + ": Use String SQL Injection to inject a backdoor. "; - instructions = instructions - + " The second stage of this lesson is to teach you how to use a vulneable fields to inject the DB work or the backdoor."; - instructions = instructions - + " Now try to use the same technique to inject a trigger that would act as "; - instructions = instructions - + " SQL backdoor, the syntax of a trigger is:
"; - instructions = instructions - + " CREATE TRIGGER myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET email='john@hackme.com'WHERE userid = NEW.userid
"; - instructions = instructions - + " Note that nothing will actually be executed because the current underlying DB doesn't support triggers."; - break; - } + return Category.A6; } - return instructions; - } - - - protected Element makeUsername(WebSession s) - { - ElementContainer ec = new ElementContainer(); - StringBuffer script = new StringBuffer(); - script.append(""); - ec.addElement(new StringElement(script.toString())); - - ec.addElement(new StringElement("User ID: ")); - Input username = new Input(Input.TEXT, "username", ""); - ec.addElement(username); - - String userInput = s.getParser().getRawParameter("username", ""); - - ec.addElement(new BR()); - ec.addElement(new BR()); - - String formattedInput = "" + userInput - + ""; - ec.addElement(new Div(SELECT_ST + formattedInput)); - - Input b = new Input(); - - b.setName("Submit"); - b.setType(Input.SUBMIT); - b.setValue("Submit"); - - ec.addElement(new PRE(b)); - - return ec; - } - - - public static synchronized Connection getConnection(WebSession s) - throws SQLException, ClassNotFoundException - { - if (connection == null) + protected Integer getDefaultRanking() { - connection = DatabaseUtilities.getConnection(s); + return DEFAULT_RANKING; } - return connection; - } - - - public Element getCredits() - { - return super.getCustomCredits("Created by Sherif Koussa ", MAC_LOGO); - } - - - protected List getHints(WebSession s) - { - List hints = new ArrayList(); - hints.add("Your user id is 101. Use it to see your information"); - hints - .add("A semi-colon usually ends a SQL statement and starts a new one."); - hints.add("Try this 101; update employee set salary=100000"); - hints - .add("For stage 2, Try 101; CREATE TRIGGER myBackDoor BEFORE INSERT ON customers FOR EACH ROW BEGIN UPDATE customers SET email='john@hackme.com'WHERE userid = NEW.userid"); - return hints; - } - - - protected Category getDefaultCategory() - { - return Category.A6; - } - - - protected Integer getDefaultRanking() - { - return DEFAULT_RANKING; - } - - - public String getTitle() - { - return ("How to Use Database Backdoors "); - } + public String getTitle() + { + return ("How to Use Database Backdoors "); + } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BasicAuthentication.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BasicAuthentication.java index a6dc78ba5..b3cb4bf68 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BasicAuthentication.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BasicAuthentication.java @@ -6,14 +6,11 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; -import org.apache.ecs.html.A; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; import org.apache.ecs.html.TR; import org.apache.ecs.html.Table; - import org.owasp.webgoat.session.ECSFactory; import org.owasp.webgoat.session.WebSession; @@ -51,8 +48,6 @@ import org.owasp.webgoat.session.WebSession; */ public class BasicAuthentication extends SequentialLessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private static final String EMPTY_STRING = ""; private static final String WEBGOAT_BASIC = "webgoat_basic"; @@ -334,8 +329,4 @@ public class BasicAuthentication extends SequentialLessonAdapter return ("Basic Authentication"); } - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java index 7e897e725..569605c98 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java @@ -44,9 +44,11 @@ import org.owasp.webgoat.session.WebSession; * for free software projects. * * For details, please see http://code.google.com/p/webgoat/ - * - * @author Chuck Willis Chuck's web site (this lesson is heavily based on Jeff Williams' SQL Injection lesson - * @created January 14, 2005 + * + * @author Chuck Willis Chuck's web + * site (this lesson is heavily based on Jeff Williams' SQL + * Injection lesson + * @created January 14, 2005 */ public class BlindSqlInjection extends LessonAdapter { @@ -57,12 +59,12 @@ public class BlindSqlInjection extends LessonAdapter private static Connection connection = null; - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value */ protected Element createContent(WebSession s) { @@ -77,66 +79,54 @@ public class BlindSqlInjection extends LessonAdapter ec.addElement(new P().addElement("Enter your Account Number: ")); - String accountNumber = s.getParser().getRawParameter(ACCT_NUM, - "101"); - Input input = new Input(Input.TEXT, ACCT_NUM, accountNumber - .toString()); + String accountNumber = s.getParser().getRawParameter(ACCT_NUM, "101"); + Input input = new Input(Input.TEXT, ACCT_NUM, accountNumber.toString()); ec.addElement(input); Element b = ECSFactory.makeButton("Go!"); ec.addElement(b); - String query = "SELECT * FROM user_data WHERE userid = " - + accountNumber; + String query = "SELECT * FROM user_data WHERE userid = " + accountNumber; String answer_query; if (runningOnWindows()) { answer_query = "SELECT TOP 1 first_name FROM user_data WHERE userid = " + TARGET_ACCT_NUM; - } - else + } else { - answer_query = "SELECT first_name FROM user_data WHERE userid = " - + TARGET_ACCT_NUM; + answer_query = "SELECT first_name FROM user_data WHERE userid = " + TARGET_ACCT_NUM; } try { Statement answer_statement = connection.createStatement( - ResultSet.TYPE_SCROLL_INSENSITIVE, - ResultSet.CONCUR_READ_ONLY); - ResultSet answer_results = answer_statement - .executeQuery(answer_query); + ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY); + ResultSet answer_results = answer_statement.executeQuery(answer_query); answer_results.first(); - if (accountNumber.toString() - .equals(answer_results.getString(1))) + System.out.println("Account: " + accountNumber ); + System.out.println("Answer : " + answer_results.getString(1)); + if (accountNumber.toString().equals(answer_results.getString(1))) { makeSuccess(s); - } - else + } else { Statement statement = connection.createStatement( - ResultSet.TYPE_SCROLL_INSENSITIVE, - ResultSet.CONCUR_READ_ONLY); + ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY); ResultSet results = statement.executeQuery(query); if ((results != null) && (results.first() == true)) { - ec.addElement(new P() - .addElement("Account number is valid")); - } - else + ec.addElement(new P().addElement("Account number is valid")); + } else { - ec.addElement(new P() - .addElement("Invalid account number")); + ec.addElement(new P().addElement("Invalid account number")); } } } catch (SQLException sqle) { - ec.addElement(new P() - .addElement("An error occurred, please try again.")); + ec.addElement(new P().addElement("An error occurred, please try again.")); } } catch (Exception e) @@ -148,34 +138,31 @@ public class BlindSqlInjection extends LessonAdapter return (ec); } - /** - * Gets the category attribute of the SqlInjection object - * - * @return The category value + * Gets the category attribute of the SqlInjection object + * + * @return The category value */ protected Category getDefaultCategory() { return Category.A6; } - /** - * Gets the credits attribute of the AbstractLesson object - * - * @return The credits value + * Gets the credits attribute of the AbstractLesson object + * + * @return The credits value */ public Element getCredits() { - return new StringElement( - "By Chuck Willis"); + return new StringElement("By Chuck Willis"); } - /** * - * Determines the OS that WebGoat is running on. Needed because different DB backends - * are used on the different OSes (Access on Windows, InstantDB on others) + * Determines the OS that WebGoat is running on. Needed because different DB + * backends are used on the different OSes (Access on Windows, InstantDB on + * others) * * @return true if running on Windows, false otherwise */ @@ -185,18 +172,16 @@ public class BlindSqlInjection extends LessonAdapter if (os.toLowerCase().indexOf("window") != -1) { return true; - } - else + } else { return false; } } - /** - * Gets the hints attribute of the DatabaseFieldScreen object - * - * @return The hints value + * Gets the hints attribute of the DatabaseFieldScreen object + * + * @return The hints value */ protected List getHints(WebSession s) { @@ -210,9 +195,8 @@ public class BlindSqlInjection extends LessonAdapter + "down the character using > and <" + "

The backend database is Microsoft Access. Keep that in mind if you research SQL functions " + "on the Internet since different databases use some different functions and syntax."); - hints - .add("This is the code for the query being built and issued by WebGoat:

" - + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); + hints.add("This is the code for the query being built and issued by WebGoat:

" + + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); hints .add("The application is taking your input and inserting it at the end of a pre-formed SQL command. " + "You will need to make use of the following SQL functions: " @@ -239,8 +223,7 @@ public class BlindSqlInjection extends LessonAdapter + ") , 2 , 1) ) > 109 ); " + "

If you get back that account number is valid, then yes. If get back that the number is " + "invalid then answer is no."); - } - else + } else { hints .add("Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. " @@ -250,9 +233,8 @@ public class BlindSqlInjection extends LessonAdapter hints .add("The database backend is InstantDB. Here is a reference guide : http://www.instantdb.com/doc/syntax.html"); - hints - .add("This is the code for the query being built and issued by WebGoat:

" - + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); + hints.add("This is the code for the query being built and issued by WebGoat:

" + + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); hints .add("THIS HINT IS FOR THE MS ACCESS DB. IT NEEDS TO BE ALTERED FOR THE INSTANTDB BACKEND.

The application is taking your input and inserting it at the end of a pre-formed SQL command. " + "You will need to make use of the following SQL functions: " @@ -283,11 +265,10 @@ public class BlindSqlInjection extends LessonAdapter return hints; } - /** - * Gets the instructions attribute of the SqlInjection object - * - * @return The instructions value + * Gets the instructions attribute of the SqlInjection object + * + * @return The instructions value */ public String getInstructions(WebSession s) { @@ -297,35 +278,34 @@ public class BlindSqlInjection extends LessonAdapter + "

The goal is to find the value of " + "the first_name in table user_data for userid " + TARGET_ACCT_NUM - + ". Put that name in the form to pass the lesson."; + + ". Put the discovered name in the form to pass the lesson. Only the discovered name " + + "should be put into the form field, paying close attention to the spelling and capitalization."; return (instructions); } private final static Integer DEFAULT_RANKING = new Integer(70); - protected Integer getDefaultRanking() { return DEFAULT_RANKING; } - /** - * Gets the title attribute of the DatabaseFieldScreen object - * - * @return The title value + * Gets the title attribute of the DatabaseFieldScreen object + * + * @return The title value */ public String getTitle() { return ("How to Perform Blind SQL Injection"); } - /** - * Constructor for the DatabaseFieldScreen object - * - * @param s Description of the Parameter + * Constructor for the DatabaseFieldScreen object + * + * @param s + * Description of the Parameter */ public void handleRequest(WebSession s) { diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java index 98e1a0a6c..1518a9e8c 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java @@ -5,6 +5,9 @@ import java.io.File; import java.io.FileReader; import java.io.FileWriter; import java.io.OutputStreamWriter; +import java.net.DatagramPacket; +import java.net.DatagramSocket; +import java.net.InetAddress; import java.net.Socket; import java.sql.Connection; import java.sql.ResultSet; @@ -20,13 +23,11 @@ import javax.servlet.http.Cookie; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; -import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.BR; import org.apache.ecs.html.Center; import org.apache.ecs.html.H1; import org.apache.ecs.html.HR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.TD; @@ -67,755 +68,755 @@ import org.owasp.webgoat.util.ExecResults; * for free software projects. * * For details, please see http://code.google.com/p/webgoat/ - * - * @author Bruce Mayhew WebGoat - * @created October 28, 2003 + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 */ public class Challenge2Screen extends SequentialLessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); + private static final String USER_COOKIE = "user"; - private static final String USER_COOKIE = "user"; + private static final String JSP = ".jsp"; - private static final String JSP = ".jsp"; + private static final String WEBGOAT_CHALLENGE = "webgoat_challenge"; - private static final String WEBGOAT_CHALLENGE = "webgoat_challenge"; + private static final String WEBGOAT_CHALLENGE_JSP = WEBGOAT_CHALLENGE + JSP; - private static final String WEBGOAT_CHALLENGE_JSP = WEBGOAT_CHALLENGE + JSP; + private static final String PROCEED_TO_NEXT_STAGE = "Proceed to the next stage..."; - private static final String PROCEED_TO_NEXT_STAGE = "Proceed to the next stage..."; + /** + * Description of the Field + */ + protected final static String CREDIT = "Credit"; - /** - * Description of the Field - */ - protected final static String CREDIT = "Credit"; + /** + * Description of the Field + */ + protected final static String PROTOCOL = "File"; - /** - * Description of the Field - */ - protected final static String PROTOCOL = "File"; + /** + * Description of the Field + */ + protected final static String MESSAGE = "Message"; - /** - * Description of the Field - */ - protected final static String MESSAGE = "Message"; + /** + * Description of the Field + */ + protected final static String PARAM = "p"; - /** - * Description of the Field - */ - protected final static String PARAM = "p"; + /** + * Description of the Field + */ + protected final static String PASSWORD = "Password"; - /** - * Description of the Field - */ - protected final static String PASSWORD = "Password"; + /** + * Description of the Field + */ + protected final static String USER = "s"; - /** - * Description of the Field - */ - protected final static String USER = "s"; + /** + * Description of the Field + */ + protected final static String USERNAME = "Username"; - /** - * Description of the Field - */ - protected final static String USERNAME = "Username"; + private static Connection connection = null; - private static Connection connection = null; + private String pass = "goodbye"; - private String pass = "goodbye"; + private String user = "youaretheweakestlink"; - private String user = "youaretheweakestlink"; - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - */ - protected Element createContent(WebSession s) - { - return super.createStagedContent(s); - } - - - /** - * Determine the username and password - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - protected Element doStage1(WebSession s) throws Exception - { - setStage(s, 1); - - String username = s.getParser().getStringParameter(USERNAME, ""); - String password = s.getParser().getStringParameter(PASSWORD, ""); - - if (username.equals(user) && password.equals(pass)) + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + */ + protected Element createContent(WebSession s) { - s.setMessage("Welcome to stage 2 -- get credit card numbers!"); - setStage(s, 2); - - return (doStage2(s)); + return super.createStagedContent(s); } - s.setMessage("Invalid login"); - - ElementContainer ec = new ElementContainer(); - ec.addElement(makeLogin(s)); - - // - // these are red herrings for the first stage - Input input = new Input(Input.HIDDEN, USER, "White"); - ec.addElement(input); - - Cookie newCookie = new Cookie(USER_COOKIE, "White"); - s.getResponse().addCookie(newCookie); - // - - return (ec); - } - - - // get creditcards from database - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - protected Element doStage2(WebSession s) throws Exception - { - // - - Cookie newCookie = new Cookie(USER_COOKIE, "White"); - s.getResponse().addCookie(newCookie); - - ElementContainer ec = new ElementContainer(); - if (s.getParser().getStringParameter(Input.SUBMIT, "").equals( - PROCEED_TO_NEXT_STAGE + "(3)")) + /** + * Determine the username and password + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + protected Element doStage1(WebSession s) throws Exception { - s.setMessage("Welcome to stage 3 -- deface the site"); - setStage(s, 3); - // Reset the defaced webpage so the lesson can start over - resetWebPage(s); - return doStage3(s); + setStage(s, 1); + + String username = s.getParser().getStringParameter(USERNAME, ""); + String password = s.getParser().getStringParameter(PASSWORD, ""); + phoneHome(s, "User: " + user + " --> " + "Pass: " + pass); + + if (username.equals(user) && password.equals(pass)) + { + s.setMessage("Welcome to stage 2 -- get credit card numbers!"); + setStage(s, 2); + + return (doStage2(s)); + } + + s.setMessage("Invalid login"); + + ElementContainer ec = new ElementContainer(); + ec.addElement(makeLogin(s)); + + // + // these are red herrings for the first stage + Input input = new Input(Input.HIDDEN, USER, "White"); + ec.addElement(input); + + Cookie newCookie = new Cookie(USER_COOKIE, "White"); + s.getResponse().addCookie(newCookie); + // + + return (ec); } - if (connection == null) + // get creditcards from database + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + protected Element doStage2(WebSession s) throws Exception { - connection = DatabaseUtilities.getConnection(s); + // + + Cookie newCookie = new Cookie(USER_COOKIE, "White"); + s.getResponse().addCookie(newCookie); + + ElementContainer ec = new ElementContainer(); + if (s.getParser().getStringParameter(Input.SUBMIT, "") + .equals(PROCEED_TO_NEXT_STAGE + "(3)")) + { + s.setMessage("Welcome to stage 3 -- deface the site"); + setStage(s, 3); + // Reset the defaced webpage so the lesson can start over + resetWebPage(s); + return doStage3(s); + } + + if (connection == null) + { + connection = DatabaseUtilities.getConnection(s); + } + + Statement statement3 = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, + ResultSet.CONCUR_READ_ONLY); + // pull the USER_COOKIE from the cookies + String user = getCookie(s); + String query = "SELECT * FROM user_data WHERE last_name = '" + user + "'"; + Vector v = new Vector(); + try + { + ResultSet results = statement3.executeQuery(query); + + while (results.next()) + { + String type = results.getString("cc_type"); + String num = results.getString("cc_number"); + v.addElement(type + "-" + num); + } + if (v.size() > 2) + { + ResultSetMetaData resultsMetaData = results.getMetaData(); + ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData)); + ec.addElement(ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE + "(3)")); + } else + { + s.setMessage("Try to get all the credit card numbers"); + ec.addElement(buildCart(s)); + + // Table t = ECSFactory.makeTable( s.isColor(), + // HtmlColor.ALICEBLUE ); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth( + "90%").setAlign("center"); + + ec.addElement(new BR()); + TR tr = new TR(); + tr.addElement(new TD().addElement("Please select credit card for this purchase: ")); + Element p = ECSFactory.makePulldown(CREDIT, v); + tr.addElement(new TD().addElement(p).setAlign("right")); + t.addElement(tr); + + tr = new TR(); + Element b = ECSFactory.makeButton("Buy Now!"); + tr.addElement(new TD().addElement(b)); + t.addElement(tr); + ec.addElement(t); + + ec.addElement(new BR()); + Input input = new Input(Input.HIDDEN, USER, "White"); + ec.addElement(input); + } + } + catch (Exception e) + { + s.setMessage("An error occurred in the woods"); + } + + return (ec); + // } - Statement statement3 = connection.createStatement( - ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY); - // pull the USER_COOKIE from the cookies - String user = getCookie(s); - String query = "SELECT * FROM user_data WHERE last_name = '" + user - + "'"; - Vector v = new Vector(); - try + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + /* + * (non-Javadoc) + * + * @see lessons.LessonAdapter#doStage3(session.WebSession) + */ + protected Element doStage3(WebSession s) throws Exception { - ResultSet results = statement3.executeQuery(query); + // - while (results.next()) - { - String type = results.getString("cc_type"); - String num = results.getString("cc_number"); - v.addElement(type + "-" + num); - } - if (v.size() > 2) - { - ResultSetMetaData resultsMetaData = results.getMetaData(); - ec.addElement(DatabaseUtilities.writeTable(results, - resultsMetaData)); - ec.addElement(ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE - + "(3)")); - } - else - { - s.setMessage("Try to get all the credit card numbers"); - ec.addElement(buildCart(s)); + ElementContainer ec = new ElementContainer(); + if (s.getParser().getStringParameter(Input.SUBMIT, "") + .equals(PROCEED_TO_NEXT_STAGE + "(4)")) + { + setStage(s, 4); + // Reset the defaced webpage so the lesson can start over + resetWebPage(s); + return doStage4(s); + } - //Table t = ECSFactory.makeTable( s.isColor(), HtmlColor.ALICEBLUE ); - Table t = new Table().setCellSpacing(0).setCellPadding(2) - .setBorder(0).setWidth("90%").setAlign("center"); + // execute the possible attack first to determine if site is defaced. + ElementContainer netstatResults = getNetstatResults(s); + if (isDefaced(s)) + { + ec.addElement(new HR()); + s.setMessage("CONGRATULATIONS - You have defaced the site!"); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setWidth("90%").setAlign( + "center"); + if (s.isColor()) + { + t.setBorder(1); + } + TR tr = new TR(); + tr.addElement(new TD().setAlign("center").addElement( + ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE + "(4)"))); + t.addElement(tr); + tr = new TR(); + tr.addElement(new TD().addElement(showDefaceAttempt(s))); + t.addElement(tr); + ec.addElement(t); + return ec; + } else + { + // Setup the screen content + try + { + ec.addElement(new H1("Current Network Status:")); + ec.addElement(netstatResults); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setWidth("90%").setAlign( + "center"); + if (s.isColor()) + { + t.setBorder(1); + } + String[] list = { "TCP", "TCPv6", "IP", "IPv6", "UDP", "UDPv6" }; + + TR tr = new TR(); + tr.addElement(new TD().addElement(ECSFactory.makeButton("View Network"))); + tr.addElement(new TD().setWidth("35%").addElement( + ECSFactory.makePulldown(PROTOCOL, list, "", 5))); + t.addElement(tr); + + ec.addElement(t); + } + catch (Exception e) + { + ec.addElement(new P() + .addElement("Select a message to read from the Message List below")); + } + + ec.addElement(new HR()); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setWidth("90%").setAlign( + "center"); + if (s.isColor()) + { + t.setBorder(1); + } + TR tr = new TR(); + tr.addElement(new TD().addElement(showDefaceAttempt(s))); + t.addElement(tr); + ec.addElement(t); + } + return (ec); + // + } + + private boolean isDefaced(WebSession s) + { + // + boolean defaced = false; + try + { + // get current text and compare to the new text + String origpath = s.getContext().getRealPath( + WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); + String masterFilePath = s.getContext().getRealPath(WEBGOAT_CHALLENGE_JSP); + String defacedText = getFileText(new BufferedReader(new FileReader(origpath)), false); + String origText = getFileText(new BufferedReader(new FileReader(masterFilePath)), false); + + defaced = (!origText.equals(defacedText)); + } + catch (Exception e) + { + e.printStackTrace(); + } + return defaced; + // + } + + private Element showDefaceAttempt(WebSession s) throws Exception + { + ElementContainer ec = new ElementContainer(); + + // get current text and compare to the new text + String origpath = s.getContext().getRealPath( + WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); + String defaced = getFileText(new BufferedReader(new FileReader(origpath)), false); + String origText = getFileText(new BufferedReader(new FileReader(s.getContext().getRealPath( + WEBGOAT_CHALLENGE_JSP))), false); + + // show webgoat.jsp text + ec.addElement(new H1().addElement("Original Website Text")); + ec.addElement(new P().addElement(origText)); + ec.addElement(new HR()); + ec.addElement(new H1().addElement("Defaced Website Text")); + ec.addElement(new P().addElement(defaced)); + ec.addElement(new HR()); + + return ec; + } + + private void resetWebPage(WebSession s) + { + try + { + // get current text and compare to the new text + String defacedpath = s.getContext().getRealPath( + WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); + String masterFilePath = s.getContext().getRealPath(WEBGOAT_CHALLENGE_JSP); + + // replace the defaced text with the original + File usersFile = new File(defacedpath); + FileWriter fw = new FileWriter(usersFile); + fw.write(getFileText(new BufferedReader(new FileReader(masterFilePath)), false)); + fw.close(); + // System.out.println("webgoat_guest replaced: " + getFileText( new + // BufferedReader( new FileReader( defacedpath ) ), false ) ); + } + catch (Exception e) + { + e.printStackTrace(); + } + } + + protected Category getDefaultCategory() + { + return Category.CHALLENGE; + } + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + protected Element doStage4(WebSession s) throws Exception + { + makeSuccess(s); + ElementContainer ec = new ElementContainer(); + ec.addElement(new H1().addElement("Thanks for coming!")); ec.addElement(new BR()); + ec + .addElement(new H1() + .addElement("Please remember that you will be caught and fired if you use these techniques for evil.")); + + return (ec); + } + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + protected Element doStage5(WebSession s) throws Exception + { + // + ElementContainer ec = new ElementContainer(); + return (ec); + // + } + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + * @exception Exception + * Description of the Exception + */ + protected Element doStage6(WebSession s) throws Exception + { + return (new StringElement("not yet")); + } + + /** + * Gets the hints attribute of the ChallengeScreen object + * + * @return The hints value + */ + protected List getHints(WebSession s) + { + // + + List hints = new ArrayList(); + hints.add("You need to gain access to the Java source code for this lesson."); + hints.add("Seriously, no more hints -- it's a CHALLENGE!"); + hints.add("Come on -- give it a rest!"); + if (getStage(s) != 1) + ; + { + hints.add("Persistance is always rewarded"); + } + + return hints; + + // + } + + protected Element makeLogin(WebSession s) + { + ElementContainer ec = new ElementContainer(); + + ec.addElement(new H1().addElement("Sign In ")); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%") + .setAlign("center"); + + if (s.isColor()) + { + t.setBorder(1); + } + TR tr = new TR(); tr - .addElement(new TD() - .addElement("Please select credit card for this purchase: ")); - Element p = ECSFactory.makePulldown(CREDIT, v); - tr.addElement(new TD().addElement(p).setAlign("right")); + .addElement(new TH() + .addElement( + "Please sign in to your account. See the OWASP admin if you do not have an account.") + .setColSpan(2).setAlign("left")); t.addElement(tr); tr = new TR(); - Element b = ECSFactory.makeButton("Buy Now!"); - tr.addElement(new TD().addElement(b)); + tr.addElement(new TD().addElement("*Required Fields").setWidth("30%")); t.addElement(tr); + + tr = new TR(); + tr.addElement(new TD().addElement(" ").setColSpan(2)); + t.addElement(tr); + + TR row1 = new TR(); + TR row2 = new TR(); + row1.addElement(new TD(new B(new StringElement("*User Name: ")))); + row2.addElement(new TD(new B(new StringElement("*Password: ")))); + + Input input1 = new Input(Input.TEXT, USERNAME, ""); + Input input2 = new Input(Input.PASSWORD, PASSWORD, ""); + row1.addElement(new TD(input1)); + row2.addElement(new TD(input2)); + t.addElement(row1); + t.addElement(row2); + + Element b = ECSFactory.makeButton("Login"); + t.addElement(new TR(new TD(b))); ec.addElement(t); - ec.addElement(new BR()); - Input input = new Input(Input.HIDDEN, USER, "White"); - ec.addElement(input); - } - } - catch (Exception e) - { - s.setMessage("An error occurred in the woods"); + return (ec); } - return (ec); - // - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - /* (non-Javadoc) - * @see lessons.LessonAdapter#doStage3(session.WebSession) - */ - protected Element doStage3(WebSession s) throws Exception - { - // - - ElementContainer ec = new ElementContainer(); - if (s.getParser().getStringParameter(Input.SUBMIT, "").equals( - PROCEED_TO_NEXT_STAGE + "(4)")) + /** + * Gets the instructions attribute of the ChallengeScreen object + * + * @return The instructions value + */ + public String getInstructions(WebSession s) { - setStage(s, 4); - // Reset the defaced webpage so the lesson can start over - resetWebPage(s); - return doStage4(s); + String instructions = "Your mission is to break the authentication scheme, " + + "steal all the credit cards from the database, and then deface the website. " + + "You will have to use many of the techniques you have learned in the other lessons. " + + "The main webpage for this site is 'webgoat_challenge_<username>.jsp'"; + + return (instructions); } - // execute the possible attack first to determine if site is defaced. - ElementContainer netstatResults = getNetstatResults(s); - if (isDefaced(s)) + /** + * Gets the ranking attribute of the ChallengeScreen object + * + * @return The ranking value + */ + protected Integer getDefaultRanking() { - ec.addElement(new HR()); - s.setMessage("CONGRATULATIONS - You have defaced the site!"); - Table t = new Table().setCellSpacing(0).setCellPadding(2).setWidth( - "90%").setAlign("center"); - if (s.isColor()) - { - t.setBorder(1); - } - TR tr = new TR(); - tr.addElement(new TD().setAlign("center").addElement( - ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE + "(4)"))); - t.addElement(tr); - tr = new TR(); - tr.addElement(new TD().addElement(showDefaceAttempt(s))); - t.addElement(tr); - ec.addElement(t); - return ec; + return new Integer(130); } - else - { - // Setup the screen content - try - { - ec.addElement(new H1("Current Network Status:")); - ec.addElement(netstatResults); - Table t = new Table().setCellSpacing(0).setCellPadding(2) - .setWidth("90%").setAlign("center"); + /** + * This is a deliberate 'backdoor' that would send user name and password + * back to the remote host. Obviously, sending the password back to the + * remote host isn't that useful but... you get the idea + * + * @param s + * Description of the Parameter + * @param message + * Description of the Parameter + */ + protected void phoneHome(WebSession s, String message) + { + try + { + InetAddress addr = InetAddress.getByName(s.getRequest().getRemoteHost()); + DatagramPacket dp = new DatagramPacket(message.getBytes(), message.length()); + DatagramSocket sock = new DatagramSocket(); + sock.connect(addr, 1234); + System.out.println(" Sending message to " + sock.getInetAddress()); + sock.send(dp); + sock.close(); + } + catch (Exception e) + { + System.out.println("Couldn't phone home"); + e.printStackTrace(); + } + } + + /** + * Gets the title attribute of the ChallengeScreen object + * + * @return The title value + */ + public String getTitle() + { + return ("The CHALLENGE!"); + } + + /** + * Description of the Method + * + * @param text + * Description of the Parameter + * @return Description of the Return Value + */ + protected ElementContainer getNetstatResults(WebSession s) + { + // + + ElementContainer ec = new ElementContainer(); + + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1).setWidth("90%") + .setAlign("center"); + if (s.isColor()) { - t.setBorder(1); + t.setBorder(1); } - String[] list = { "TCP", "TCPv6", "IP", "IPv6", "UDP", "UDPv6" }; TR tr = new TR(); - tr.addElement(new TD().addElement(ECSFactory - .makeButton("View Network"))); - tr.addElement(new TD().setWidth("35%").addElement( - ECSFactory.makePulldown(PROTOCOL, list, "", 5))); + tr.addElement(new TH().addElement("Protocol").setWidth("7%")); + tr.addElement(new TH().addElement("Local Address").setWidth("80%")); + tr.addElement(new TH().addElement("Foreign Address").setWidth("10%")); + tr.addElement(new TH().addElement("State").setWidth("3%")); + t.addElement(tr); + + String protocol = s.getParser().getRawParameter(PROTOCOL, "tcp"); + + String osName = System.getProperty("os.name"); + ExecResults er = null; + if (osName.indexOf("Windows") != -1) + { + String cmd = "cmd.exe /c netstat -a -p " + protocol; + er = Exec.execSimple(cmd); + } else + { + String[] cmd = { "/bin/sh", "-c", "netstat -a -p " + protocol }; + er = Exec.execSimple(cmd); + } + + String results = er.getOutput(); + StringTokenizer lines = new StringTokenizer(results, "\n"); + String line = lines.nextToken(); + // System.out.println(line); + int start = 0; + while (start == 0 && lines.hasMoreTokens()) + { + if ((line.indexOf("Proto") != -1)) + { + start++; + } else + { + line = lines.nextToken(); + } + } + while (start > 0 && lines.hasMoreTokens()) + { + // in order to avoid a ill-rendered screen when the user performs + // command injection, we will wrap the screen at 4 columns + int columnCount = 4; + tr = new TR(); + StringTokenizer tokens = new StringTokenizer(lines.nextToken(), "\t "); + while (tokens.hasMoreTokens() && columnCount-- > 0) + { + tr.addElement(new TD().addElement(tokens.nextToken())); + } + t.addElement(tr); + } + // parse the results + ec.addElement(t); + return (ec); + // + + } + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @return Description of the Return Value + */ + protected Element makeClues(WebSession s) + { + return new StringElement("Clues not Available :)"); + } + + protected Element makeHints(WebSession s) + { + return new StringElement("Hint: Find the hints"); + } + + /** + * Description of the Method + * + * @param s + * Description of the Parameter + * @param message + * Description of the Parameter + */ + protected void sendMessage(Socket s, String message) + { + try + { + OutputStreamWriter osw = new OutputStreamWriter(s.getOutputStream()); + osw.write(message); + } + catch (Exception e) + { + System.out.println("Couldn't write " + message + " to " + s); + e.printStackTrace(); + } + } + + protected Element buildCart(WebSession s) + { + ElementContainer ec = new ElementContainer(); + + ec.addElement(new HR().setWidth("90%")); + ec.addElement(new Center().addElement(new H1().addElement("Shopping Cart "))); + Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1).setWidth("90%") + .setAlign("center"); + + if (s.isColor()) + { + t.setBorder(1); + } + + TR tr = new TR(); + tr.addElement(new TH().addElement("Shopping Cart Items -- To Buy Now").setWidth("80%")); + tr.addElement(new TH().addElement("Price:").setWidth("10%")); + tr.addElement(new TH().addElement("Quantity:").setWidth("3%")); + tr.addElement(new TH().addElement("Total").setWidth("7%")); + t.addElement(tr); + + tr = new TR(); + tr.addElement(new TD().addElement("Sympathy Bouquet")); + tr.addElement(new TD().addElement("59.99").setAlign("right")); + tr.addElement(new TD().addElement(" 1 ").setAlign("right")); + tr.addElement(new TD().addElement("59.99")); t.addElement(tr); ec.addElement(t); - } - catch (Exception e) - { - ec - .addElement(new P() - .addElement("Select a message to read from the Message List below")); - } - ec.addElement(new HR()); - Table t = new Table().setCellSpacing(0).setCellPadding(2).setWidth( - "90%").setAlign("center"); - if (s.isColor()) - { - t.setBorder(1); - } - TR tr = new TR(); - tr.addElement(new TD().addElement(showDefaceAttempt(s))); - t.addElement(tr); - ec.addElement(t); + t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("90%").setAlign( + "center"); + + if (s.isColor()) + { + t.setBorder(1); + } + + ec.addElement(new BR()); + tr = new TR(); + tr.addElement(new TD().addElement("The total charged to your credit card:")); + tr.addElement(new TD().addElement("59.99")); + t.addElement(tr); + + ec.addElement(t); + + return (ec); } - return (ec); - // - } - - private boolean isDefaced(WebSession s) - { - // - boolean defaced = false; - try + public boolean canHaveClues() { - // get current text and compare to the new text - String origpath = s.getContext().getRealPath( - WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); - String masterFilePath = s.getContext().getRealPath( - WEBGOAT_CHALLENGE_JSP); - String defacedText = getFileText(new BufferedReader(new FileReader( - origpath)), false); - String origText = getFileText(new BufferedReader(new FileReader( - masterFilePath)), false); - - defaced = (!origText.equals(defacedText)); + return false; } - catch (Exception e) + + /** + * Gets the cookie attribute of the CookieScreen object + * + * @param s + * Description of the Parameter + * @return The cookie value + */ + protected String getCookie(WebSession s) { - e.printStackTrace(); + Cookie[] cookies = s.getRequest().getCookies(); + + for (int i = 0; i < cookies.length; i++) + { + if (cookies[i].getName().equalsIgnoreCase(USER_COOKIE)) + { + return (cookies[i].getValue()); + } + } + + return (null); } - return defaced; - // - } - - - private Element showDefaceAttempt(WebSession s) throws Exception - { - ElementContainer ec = new ElementContainer(); - - // get current text and compare to the new text - String origpath = s.getContext().getRealPath( - WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); - String defaced = getFileText(new BufferedReader( - new FileReader(origpath)), false); - String origText = getFileText(new BufferedReader(new FileReader(s - .getContext().getRealPath(WEBGOAT_CHALLENGE_JSP))), false); - - // show webgoat.jsp text - ec.addElement(new H1().addElement("Original Website Text")); - ec.addElement(new P().addElement(origText)); - ec.addElement(new HR()); - ec.addElement(new H1().addElement("Defaced Website Text")); - ec.addElement(new P().addElement(defaced)); - ec.addElement(new HR()); - - return ec; - } - - - private void resetWebPage(WebSession s) - { - try - { - // get current text and compare to the new text - String defacedpath = s.getContext().getRealPath( - WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP); - String masterFilePath = s.getContext().getRealPath( - WEBGOAT_CHALLENGE_JSP); - - // replace the defaced text with the original - File usersFile = new File(defacedpath); - FileWriter fw = new FileWriter(usersFile); - fw.write(getFileText(new BufferedReader(new FileReader( - masterFilePath)), false)); - fw.close(); - // System.out.println("webgoat_guest replaced: " + getFileText( new BufferedReader( new FileReader( defacedpath ) ), false ) ); - } - catch (Exception e) - { - e.printStackTrace(); - } - } - - - protected Category getDefaultCategory() - { - return Category.CHALLENGE; - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - protected Element doStage4(WebSession s) throws Exception - { - makeSuccess(s); - ElementContainer ec = new ElementContainer(); - ec.addElement(new H1().addElement("Thanks for coming!")); - ec.addElement(new BR()); - ec - .addElement(new H1() - .addElement("Please remember that you will be caught and fired if you use these techniques for evil.")); - - return (ec); - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - protected Element doStage5(WebSession s) throws Exception - { - // - ElementContainer ec = new ElementContainer(); - return (ec); - // - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - * @exception Exception Description of the Exception - */ - protected Element doStage6(WebSession s) throws Exception - { - return (new StringElement("not yet")); - } - - - /** - * Gets the hints attribute of the ChallengeScreen object - * - * @return The hints value - */ - protected List getHints(WebSession s) - { - // - - List hints = new ArrayList(); - hints - .add("You need to gain access to the Java source code for this lesson."); - hints.add("Seriously, no more hints -- it's a CHALLENGE!"); - hints.add("Come on -- give it a rest!"); - if (getStage(s) != 1) - ; - { - hints.add("Persistance is always rewarded"); - } - - return hints; - - // - } - - - protected Element makeLogin(WebSession s) - { - ElementContainer ec = new ElementContainer(); - - ec.addElement(new H1().addElement("Sign In ")); - Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0) - .setWidth("90%").setAlign("center"); - - if (s.isColor()) - { - t.setBorder(1); - } - - TR tr = new TR(); - tr - .addElement(new TH() - .addElement( - "Please sign in to your account. See the OWASP admin if you do not have an account.") - .setColSpan(2).setAlign("left")); - t.addElement(tr); - - tr = new TR(); - tr.addElement(new TD().addElement("*Required Fields").setWidth("30%")); - t.addElement(tr); - - tr = new TR(); - tr.addElement(new TD().addElement(" ").setColSpan(2)); - t.addElement(tr); - - TR row1 = new TR(); - TR row2 = new TR(); - row1.addElement(new TD(new B(new StringElement("*User Name: ")))); - row2.addElement(new TD(new B(new StringElement("*Password: ")))); - - Input input1 = new Input(Input.TEXT, USERNAME, ""); - Input input2 = new Input(Input.PASSWORD, PASSWORD, ""); - row1.addElement(new TD(input1)); - row2.addElement(new TD(input2)); - t.addElement(row1); - t.addElement(row2); - - Element b = ECSFactory.makeButton("Login"); - t.addElement(new TR(new TD(b))); - ec.addElement(t); - - return (ec); - } - - - /** - * Gets the instructions attribute of the ChallengeScreen object - * - * @return The instructions value - */ - public String getInstructions(WebSession s) - { - String instructions = "Your mission is to break the authentication scheme, " - + "steal all the credit cards from the database, and then deface the website. " - + "You will have to use many of the techniques you have learned in the other lessons. " - + "The main webpage for this site is 'webgoat_challenge_<username>.jsp'"; - - return (instructions); - } - - - /** - * Gets the ranking attribute of the ChallengeScreen object - * - * @return The ranking value - */ - protected Integer getDefaultRanking() - { - return new Integer(130); - } - - - /** - * Gets the title attribute of the ChallengeScreen object - * - * @return The title value - */ - public String getTitle() - { - return ("The CHALLENGE!"); - } - - - /** - * Description of the Method - * - * @param text Description of the Parameter - * @return Description of the Return Value - */ - protected ElementContainer getNetstatResults(WebSession s) - { - // - - ElementContainer ec = new ElementContainer(); - - Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1) - .setWidth("90%").setAlign("center"); - - if (s.isColor()) - { - t.setBorder(1); - } - - TR tr = new TR(); - tr.addElement(new TH().addElement("Protocol").setWidth("7%")); - tr.addElement(new TH().addElement("Local Address").setWidth("80%")); - tr.addElement(new TH().addElement("Foreign Address").setWidth("10%")); - tr.addElement(new TH().addElement("State").setWidth("3%")); - t.addElement(tr); - - String protocol = s.getParser().getRawParameter(PROTOCOL, "tcp"); - - String osName = System.getProperty("os.name"); - ExecResults er = null; - if (osName.indexOf("Windows") != -1) - { - String cmd = "cmd.exe /c netstat -a -p " + protocol; - er = Exec.execSimple(cmd); - } - else - { - String[] cmd = { "/bin/sh", "-c", "netstat -a -p " + protocol }; - er = Exec.execSimple(cmd); - } - - String results = er.getOutput(); - StringTokenizer lines = new StringTokenizer(results, "\n"); - String line = lines.nextToken(); - //System.out.println(line); - int start = 0; - while (start == 0 && lines.hasMoreTokens()) - { - if ((line.indexOf("Proto") != -1)) - { - start++; - } - else - { - line = lines.nextToken(); - } - } - while (start > 0 && lines.hasMoreTokens()) - { - // in order to avoid a ill-rendered screen when the user performs - // command injection, we will wrap the screen at 4 columns - int columnCount = 4; - tr = new TR(); - StringTokenizer tokens = new StringTokenizer(lines.nextToken(), - "\t "); - while (tokens.hasMoreTokens() && columnCount-- > 0) - { - tr.addElement(new TD().addElement(tokens.nextToken())); - } - t.addElement(tr); - } - // parse the results - ec.addElement(t); - return (ec); - // - - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @return Description of the Return Value - */ - protected Element makeClues(WebSession s) - { - return new StringElement("Clues not Available :)"); - } - - - protected Element makeHints(WebSession s) - { - return new StringElement("Hint: Find the hints"); - } - - - /** - * Description of the Method - * - * @param s Description of the Parameter - * @param message Description of the Parameter - */ - protected void sendMessage(Socket s, String message) - { - try - { - OutputStreamWriter osw = new OutputStreamWriter(s.getOutputStream()); - osw.write(message); - } - catch (Exception e) - { - System.out.println("Couldn't write " + message + " to " + s); - e.printStackTrace(); - } - } - - - protected Element buildCart(WebSession s) - { - ElementContainer ec = new ElementContainer(); - - ec.addElement(new HR().setWidth("90%")); - ec.addElement(new Center().addElement(new H1() - .addElement("Shopping Cart "))); - Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1) - .setWidth("90%").setAlign("center"); - - if (s.isColor()) - { - t.setBorder(1); - } - - TR tr = new TR(); - tr.addElement(new TH().addElement("Shopping Cart Items -- To Buy Now") - .setWidth("80%")); - tr.addElement(new TH().addElement("Price:").setWidth("10%")); - tr.addElement(new TH().addElement("Quantity:").setWidth("3%")); - tr.addElement(new TH().addElement("Total").setWidth("7%")); - t.addElement(tr); - - tr = new TR(); - tr.addElement(new TD().addElement("Sympathy Bouquet")); - tr.addElement(new TD().addElement("59.99").setAlign("right")); - tr.addElement(new TD().addElement(" 1 ").setAlign("right")); - tr.addElement(new TD().addElement("59.99")); - t.addElement(tr); - - ec.addElement(t); - - t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0) - .setWidth("90%").setAlign("center"); - - if (s.isColor()) - { - t.setBorder(1); - } - - ec.addElement(new BR()); - tr = new TR(); - tr.addElement(new TD() - .addElement("The total charged to your credit card:")); - tr.addElement(new TD().addElement("59.99")); - t.addElement(tr); - - ec.addElement(t); - - return (ec); - } - - - public boolean canHaveClues() - { - return false; - } - - - /** - * Gets the cookie attribute of the CookieScreen object - * - * @param s Description of the Parameter - * @return The cookie value - */ - protected String getCookie(WebSession s) - { - Cookie[] cookies = s.getRequest().getCookies(); - - for (int i = 0; i < cookies.length; i++) - { - if (cookies[i].getName().equalsIgnoreCase(USER_COOKIE)) - { - return (cookies[i].getValue()); - } - } - - return (null); - } - - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CommandInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CommandInjection.java index 8d126adcf..d2a2c8328 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CommandInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CommandInjection.java @@ -9,12 +9,9 @@ import java.util.StringTokenizer; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; -import org.apache.ecs.html.A; import org.apache.ecs.html.BR; import org.apache.ecs.html.HR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.P; - import org.owasp.webgoat.session.ECSFactory; import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.util.Exec; @@ -49,13 +46,11 @@ import org.owasp.webgoat.util.ExecResults; * * For details, please see http://code.google.com/p/webgoat/ * - * @author Jeff Williams Aspect Security + * @author Bruce Mayhew WebGoat * @created October 28, 2003 */ public class CommandInjection extends LessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private final static String HELP_FILE = "HelpFile"; private String osName = System.getProperty("os.name"); @@ -355,9 +350,4 @@ public class CommandInjection extends LessonAdapter { return "How to Perform Command Injection"; } - - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpBasics.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpBasics.java index 31b0df5bc..e31ba0406 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpBasics.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpBasics.java @@ -6,10 +6,9 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; -import org.apache.ecs.html.A; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; -import org.owasp.webgoat.session.*; +import org.owasp.webgoat.session.ECSFactory; +import org.owasp.webgoat.session.WebSession; /******************************************************************************* * @@ -45,8 +44,6 @@ import org.owasp.webgoat.session.*; */ public class HttpBasics extends LessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private final static String PERSON = "person"; @@ -135,9 +132,4 @@ public class HttpBasics extends LessonAdapter { return ("Http Basics"); } - - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/LessonAdapter.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/LessonAdapter.java index b87072645..47ef1765f 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/LessonAdapter.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/LessonAdapter.java @@ -53,9 +53,6 @@ import org.owasp.webgoat.session.WebSession; public abstract class LessonAdapter extends AbstractLesson { - final static IMG WEBGOAT_LOGO = new IMG("images/logos/WebGoat.jpg").setAlt( - "WebGoat Logo").setBorder(0).setHspace(0).setVspace(0); - /** * Description of the Method @@ -174,14 +171,7 @@ public abstract class LessonAdapter extends AbstractLesson */ public Element getCredits() { - if (getClass().getResource("images/logos/WebGoat.jpg") != null) - { - return getCustomCredits("Presented by ", WEBGOAT_LOGO); - } - else - { - return new StringElement(); - } + return new StringElement(); } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ReflectedXSS.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ReflectedXSS.java index 0a1886055..a7bec094b 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ReflectedXSS.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/ReflectedXSS.java @@ -6,12 +6,10 @@ import java.util.regex.Pattern; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; -import org.apache.ecs.html.A; import org.apache.ecs.html.BR; import org.apache.ecs.html.Center; import org.apache.ecs.html.H1; import org.apache.ecs.html.HR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.TD; import org.apache.ecs.html.TH; @@ -56,8 +54,6 @@ import org.owasp.webgoat.util.HtmlEncoder; public class ReflectedXSS extends LessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - /** * Description of the Method * @@ -295,8 +291,4 @@ public class ReflectedXSS extends LessonAdapter return "How to Perform Reflected Cross Site Scripting (XSS) Attacks"; } - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java index 23b5ca4d1..3c7098848 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java @@ -52,11 +52,11 @@ public class RoleBasedAccessControl extends GoatHillsFinancial { private final static Integer DEFAULT_RANKING = new Integer(125); - public final static String STAGE1 = "Break Functional Access Control"; + public final static String STAGE1 = "Bypass Business Layer Access Control"; public final static String STAGE2 = "Add Business Layer Access Control"; - public final static String STAGE3 = "Break Data Layer Access Control"; + public final static String STAGE3 = "Bypass Data Layer Access Control"; public final static String STAGE4 = "Add Data Layer Access Control"; diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java index e3dfc3e6a..3c7d000e0 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java @@ -14,9 +14,7 @@ import java.util.TreeMap; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; -import org.apache.ecs.html.A; import org.apache.ecs.html.BR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Option; import org.apache.ecs.html.P; import org.apache.ecs.html.PRE; @@ -59,8 +57,6 @@ import org.owasp.webgoat.session.WebSession; */ public class SqlNumericInjection extends SequentialLessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private final static String STATION_ID = "station"; private static Connection connection = null; @@ -405,8 +401,4 @@ public class SqlNumericInjection extends SequentialLessonAdapter } } - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java index df42d393d..24d45d39b 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java @@ -11,9 +11,7 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; -import org.apache.ecs.html.A; import org.apache.ecs.html.BR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.P; import org.apache.ecs.html.PRE; @@ -55,8 +53,6 @@ import org.owasp.webgoat.session.WebSession; */ public class SqlStringInjection extends SequentialLessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private final static String ACCT_NAME = "account_name"; private static Connection connection = null; @@ -320,9 +316,5 @@ public class SqlStringInjection extends SequentialLessonAdapter e.printStackTrace(System.out); } } - - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } + } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java index 9f69ddfeb..91bbe9218 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java @@ -9,21 +9,18 @@ import java.util.List; import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; -import org.apache.ecs.html.A; import org.apache.ecs.html.B; import org.apache.ecs.html.BR; import org.apache.ecs.html.Center; import org.apache.ecs.html.H1; import org.apache.ecs.html.H3; import org.apache.ecs.html.HR; -import org.apache.ecs.html.IMG; import org.apache.ecs.html.Input; import org.apache.ecs.html.TD; import org.apache.ecs.html.TH; import org.apache.ecs.html.TR; import org.apache.ecs.html.Table; import org.apache.ecs.html.TextArea; - import org.owasp.webgoat.session.ECSFactory; import org.owasp.webgoat.session.WebSession; @@ -62,8 +59,6 @@ import org.owasp.webgoat.session.WebSession; public class UncheckedEmail extends LessonAdapter { - public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0)); - private final static String MESSAGE = "msg"; private final static String TO = "to"; @@ -264,9 +259,5 @@ public class UncheckedEmail extends LessonAdapter { return ("How to Exploit Unchecked Email"); } - - public Element getCredits() - { - return super.getCustomCredits("", ASPECT_LOGO); - } + } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/Course.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/Course.java index da7ab99fc..575ddd6c7 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/Course.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/Course.java @@ -403,6 +403,7 @@ public class Course { String absoluteFile = (String)fileItr.next(); String fileName = getFileName(absoluteFile); + //System.out.println("Course: looking at file: " + absoluteFile); if(absoluteFile.endsWith(classFile)) { @@ -410,11 +411,18 @@ public class Course lesson.setSourceFileName(absoluteFile); } - if(absoluteFile.endsWith(".html") && className.endsWith(fileName)) + if(absoluteFile.startsWith("/lesson_plans") && absoluteFile.endsWith(".html") && className.endsWith(fileName)) { //System.out.println("DEBUG: setting lesson plan file " + absoluteFile + " for lesson " + lesson.getClass().getName()); + //System.out.println("fileName: " + fileName + " == className: " + className ); lesson.setLessonPlanFileName(absoluteFile); } + if(absoluteFile.startsWith("/lesson_solutions") && absoluteFile.endsWith(".html") && className.endsWith(fileName)) + { + System.out.println("DEBUG: setting lesson solution file " + absoluteFile + " for lesson " + lesson.getClass().getName()); + System.out.println("fileName: " + fileName + " == className: " + className ); + lesson.setLessonSolutionFileName(absoluteFile); + } } } } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java index 5fcb2dbee..7f06bb49d 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/CreateDB.java @@ -459,6 +459,7 @@ public class CreateDB + "address1 VARCHAR(80)," + "address2 VARCHAR(80)," + "manager INT," + "start_date CHAR(8)," + "salary INT," + "ccn VARCHAR(30)," + "ccn_limit INT," + + "email VARCHAR(30)," // reason for the recent write-up + "disciplined_date CHAR(8)," // date of write up, NA otherwise + "disciplined_notes VARCHAR(60)," // reason for the recent write-up + "personal_description VARCHAR(60)" // We can be rude here @@ -474,49 +475,49 @@ public class CreateDB String insertData1 = "INSERT INTO employee VALUES (101, 'Larry', 'Stooge', '386-09-5451', 'larry'," + "'Technician','443-689-0192','9175 Guilford Rd','New York, NY', 102, 01012000,55000,'2578546969853547'," - + "5000,010106,'Constantly harassing coworkers','Does not work well with others')"; + + "5000,'larry@stooges.com',010106,'Constantly harassing coworkers','Does not work well with others')"; String insertData2 = "INSERT INTO employee VALUES (102, 'Moe', 'Stooge', '936-18-4524','moe'," - + "'CSO','443-938-5301', '3013 AMD Ave', 'New York, NY', 112, 03082003, 140000, 'NA', 0, 0101013, " + + "'CSO','443-938-5301', '3013 AMD Ave', 'New York, NY', 112, 03082003, 140000, 'NA', 0, 'moe@stooges.com', 0101013, " + "'Hit Curly over head', 'Very dominating over Larry and Curly')"; String insertData3 = "INSERT INTO employee VALUES (103, 'Curly', 'Stooge', '961-08-0047','curly'," - + "'Technician','410-667-6654', '1112 Crusoe Lane', 'New York, NY', 102, 02122001, 50000, 'NA', 0, 0101014, " + + "'Technician','410-667-6654', '1112 Crusoe Lane', 'New York, NY', 102, 02122001, 50000, 'NA', 0, 'curly@stooges.com', 0101014, " + "'Hit Moe back', 'Owes three-thousand to company for fradulent purchases')"; String insertData4 = "INSERT INTO employee VALUES (104, 'Eric', 'Walker', '445-66-5565','eric'," - + "'Engineer','410-887-1193', '1160 Prescott Rd', 'New York, NY', 107, 12152005, 13000, 'NA', 0, 0101013, " + + "'Engineer','410-887-1193', '1160 Prescott Rd', 'New York, NY', 107, 12152005, 13000, 'NA', 0, 'eric@modelsrus.com',0101013, " + "'Bothering Larry about webgoat problems', 'Late. Always needs help. Too intern-ish.')"; String insertData5 = "INSERT INTO employee VALUES (105, 'Tom', 'Cat', '792-14-6364','tom'," - + "'Engineer','443-599-0762', '2211 HyperThread Rd.', 'New York, NY', 106, 01011999, 80000, '5481360857968521', 30000, 0, " + + "'Engineer','443-599-0762', '2211 HyperThread Rd.', 'New York, NY', 106, 01011999, 80000, '5481360857968521', 30000, 'tom@wb.com', 0, " + "'NA', 'Co-Owner.')"; String insertData6 = "INSERT INTO employee VALUES (106, 'Jerry', 'Mouse', '858-55-4452','jerry'," - + "'Human Resources','443-699-3366', '3011 Unix Drive', 'New York, NY', 102, 01011999, 70000, '6981754825013564', 20000, 0, " + + "'Human Resources','443-699-3366', '3011 Unix Drive', 'New York, NY', 102, 01011999, 70000, '6981754825013564', 20000, 'jerry@wb.com', 0, " + "'NA', 'Co-Owner.')"; String insertData7 = "INSERT INTO employee VALUES (107, 'David', 'Giambi', '439-20-9405','david'," - + "'Human Resources','610-521-8413', '5132 DIMM Avenue', 'New York, NY', 102, 05011999, 100000, '6981754825018101', 10000, 061402, " + + "'Human Resources','610-521-8413', '5132 DIMM Avenue', 'New York, NY', 102, 05011999, 100000, '6981754825018101', 10000, 'david@modelsrus.com', 061402, " + "'Hacked into accounting server. Modified personal pay.', 'Strong work habbit. Questionable ethics.')"; String insertData8 = "INSERT INTO employee VALUES (108, 'Bruce', 'McGuirre', '707-95-9482','bruce'," - + "'Engineer','610-282-1103', '8899 FreeBSD Drive ', 'New York, NY', 107, 03012000, 110000, '6981754825854136', 30000, 061502, " + + "'Engineer','610-282-1103', '8899 FreeBSD Drive ', 'New York, NY', 107, 03012000, 110000, '6981754825854136', 30000, 'bruce@modelsrus.com', 061502, " + "'Tortuous Boot Camp workout at 5am. Employees felt sick.', 'Enjoys watching others struggle in exercises.')"; String insertData9 = "INSERT INTO employee VALUES (109, 'Sean', 'Livingston', '136-55-1046','sean'," - + "'Engineer','610-878-9549', '6422 dFlyBSD Road', 'New York, NY', 107, 06012003, 130000, '6981754825014510', 5000, 072804, " + + "'Engineer','610-878-9549', '6422 dFlyBSD Road', 'New York, NY', 107, 06012003, 130000, '6981754825014510', 5000, 'sean@modelsrus.com', 072804, " + "'Late to work 30 days in row due to excessive Halo 2', 'Has some fascination with Steelers. Go Ravens.')"; String insertData10 = "INSERT INTO employee VALUES (110, 'Joanne', 'McDougal', '789-54-2413','joanne'," - + "'Human Resources','610-213-6341', '5567 Broadband Lane', 'New York, NY', 106, 01012001, 90000, '6981754825081054', 300, 112005, " + + "'Human Resources','610-213-6341', '5567 Broadband Lane', 'New York, NY', 106, 01012001, 90000, '6981754825081054', 300, 'joanne@modelsrus.com', 112005, " + "'Used company cc to purchase new car. Limit adjusted.', 'Finds it necessary to leave early every day.')"; String insertData11 = "INSERT INTO employee VALUES (111, 'John', 'Wayne', '129-69-4572', 'john'," - + "'CTO','610-213-1134', '129 Third St', 'New York, NY', 112, 01012001, 200000, '4437334565679921', 300, 112005, " + + "'CTO','610-213-1134', '129 Third St', 'New York, NY', 112, 01012001, 200000, '4437334565679921', 300, 'john@guns.com', 112005, " + "'', '')"; String insertData12 = "INSERT INTO employee VALUES (112, 'Neville', 'Bartholomew', '111-111-1111', 'socks'," - + "'CEO','408-587-0024', '1 Corporate Headquarters', 'San Jose, CA', 112, 03012000, 450000, '4803389267684109', 300, 112005, " + + "'CEO','408-587-0024', '1 Corporate Headquarters', 'San Jose, CA', 112, 03012000, 450000, '4803389267684109', 300000, 'neville@modelsrus.com', 112005, " + "'', '')"; statement.executeUpdate(insertData1); @@ -660,6 +661,11 @@ public class CreateDB String insertData27 = "INSERT INTO auth VALUES('" + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWHINTS + "')"; + // Add a permission for the webgoat role to see the solution. + // The challenge(s) will change the default role to "challenge" + String insertData28 = "INSERT INTO auth VALUES('" + + AbstractLesson.USER_ROLE + "','" + WebSession.SHOWSOLUTION + + "')"; statement.executeUpdate(insertData1); statement.executeUpdate(insertData2); @@ -696,6 +702,7 @@ public class CreateDB statement.executeUpdate(insertData25_2); statement.executeUpdate(insertData26); statement.executeUpdate(insertData27); + statement.executeUpdate(insertData28); } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/LessonTracker.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/LessonTracker.java index 8d3ebe573..bfb8bcfbf 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/LessonTracker.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/LessonTracker.java @@ -56,6 +56,8 @@ public class LessonTracker private boolean viewedSource = false; + private boolean viewedSolution = false; + Properties lessonProperties = new Properties(); @@ -147,6 +149,11 @@ public class LessonTracker } + public boolean getViewedSolution() + { + return viewedSource; + } + /** * Description of the Method */ @@ -327,6 +334,15 @@ public class LessonTracker this.viewedSource = viewedSource; } + /** + * Sets the viewedSource attribute of the LessonTracker object + * + * @param viewedSource The new viewedSource value + */ + public void setViewedSolution(boolean viewedSolution) + { + this.viewedSolution = viewedSolution; + } /** * Allows the storing of properties for the logged in and a screen. diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebSession.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebSession.java index 2bf949c5f..3320558ea 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebSession.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebSession.java @@ -125,6 +125,8 @@ public class WebSession public final static String SHOWSOURCE = "ShowSource"; + public final static String SHOWSOLUTION = "ShowSolution"; + public final static String SHOWHINTS = "ShowHints"; public final static String SHOW = "show"; @@ -139,6 +141,8 @@ public class WebSession public final static String SHOW_SOURCE = "Source"; + public final static String SHOW_SOLUTION = "Solution"; + public final static String DEBUG = "debug"; /** @@ -189,6 +193,8 @@ public class WebSession private boolean showSource = false; + private boolean showSolution = false; + private boolean completedHackableAdmin = false; private int currentMenu; @@ -206,6 +212,7 @@ public class WebSession showParams = webgoatContext.isShowParams(); showCookies = webgoatContext.isShowCookies(); showSource = webgoatContext.isShowSource(); + showSolution = webgoatContext.isShowSolution(); showRequest = webgoatContext.isShowRequest(); this.context = context; course = new Course(); @@ -489,6 +496,12 @@ public class WebSession //return getCurrentLesson().getSource(this); } + public String getSolution() + { + return "Sorry. No solution is available."; + //return getCurrentLesson().getSolution(this); + } + public String getInstructions() { return getCurrentLesson().getInstructions(this); @@ -761,6 +774,11 @@ public class WebSession return ( showSource ); } + public boolean showSolution() + { + return ( showSolution ); + } + /** * Gets the userName attribute of the WebSession object * @@ -913,6 +931,11 @@ public class WebSession content = getSource(); //showSource = true; } + else if ( showCommand.equalsIgnoreCase( SHOW_SOLUTION ) ) + { + content = getSolution(); + //showSource = true; + } else if ( showCommand.equalsIgnoreCase( SHOW_NEXTHINT ) ) { getNextHint(); @@ -937,6 +960,7 @@ public class WebSession // System.out.println( "showParams:" + showParams ); // System.out.println( "showSource:" + showSource ); + // System.out.println( "showSolution:" + showSolution ); // System.out.println( "showCookies:" + showCookies ); // System.out.println( "showRequest:" + showRequest ); diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebgoatContext.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebgoatContext.java index 588a21601..094d10515 100755 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebgoatContext.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/session/WebgoatContext.java @@ -24,6 +24,8 @@ public class WebgoatContext { public final static String SHOWSOURCE = "ShowSource"; + public final static String SHOWSOLUTION = "ShowSolution"; + public final static String SHOWHINTS = "ShowHints"; public final static String DEFUSEOSCOMMANDS = "DefuseOSCommands"; @@ -50,6 +52,8 @@ public class WebgoatContext { private boolean showSource = false; + private boolean showSolution = false; + private boolean defuseOSCommands = false; private boolean enterprise = false; @@ -76,6 +80,7 @@ public class WebgoatContext { showParams = "true".equals( servlet.getInitParameter( SHOWPARAMS ) ); showCookies = "true".equals( servlet.getInitParameter( SHOWCOOKIES ) ); showSource = "true".equals( servlet.getInitParameter( SHOWSOURCE ) ); + showSolution = "true".equals( servlet.getInitParameter( SHOWSOLUTION ) ); defuseOSCommands = "true".equals( servlet.getInitParameter( DEFUSEOSCOMMANDS ) ); enterprise = "true".equals( servlet.getInitParameter( ENTERPRISE ) ); codingExercises = "true".equals( servlet.getInitParameter( CODING_EXERCISES ) ); @@ -178,4 +183,8 @@ public class WebgoatContext { return showSource; } + public boolean isShowSolution() { + return showSolution; + } + } diff --git a/ webgoat/main/project/WebContent/WEB-INF/web-unix.xml b/ webgoat/main/project/WebContent/WEB-INF/web-unix.xml deleted file mode 100644 index a7acfa348..000000000 --- a/ webgoat/main/project/WebContent/WEB-INF/web-unix.xml +++ /dev/null @@ -1,344 +0,0 @@ - - - - - - - WebGoat - - This web application is designed to demonstrate web - application security flaws for the purpose of educating - developers and security professionals about web - application security problems. Please contact Bruce Mayhew - (webgoat@owasp.org) if you have any questions. - - - - - - - - email - WebGoat@owasp.org - - The EMAIL address of the administrator to whom questions - and comments about this application should be addressed. - - - - - - - AxisServlet - Apache-Axis Servlet - - org.apache.axis.transport.http.AxisServlet - - - - - AdminServlet - Axis Admin Servlet - - org.apache.axis.transport.http.AdminServlet - - 100 - - - - SOAPMonitorService - SOAPMonitorService - - org.apache.axis.monitor.SOAPMonitorService - - - SOAPMonitorPort - 5001 - - 100 - - - - WebGoat - - This servlet plays the "controller" role in the MVC architecture - used in this application. - - The initialization parameter namess for this servlet are the - "servlet path" that will be received by this servlet (after the - filename extension is removed). The corresponding value is the - name of the action class that will be used to process this request. - - org.owasp.webgoat.HammerHead - - - debug - false - - - - CookieDebug - true - - - - DefuseOSCommands - false - - - - Enterprise - true - - - - CodingExercises - true - - - - - - - FeedbackAddress - - <A HREF=mailto:webgoat@owasp.org>webgoat@owasp.org</A> - - - - - DatabaseDriver - - org.hsqldb.jdbcDriver - - - - - DatabaseConnectionString - - - jdbc:hsqldb:mem:${USER} - - - - - - 5 - - - - - - LessonSource - - This servlet returns the Java source of the current lesson. - - org.owasp.webgoat.LessonSource - - - - Catcher - - This servlet catches any posts and marks the appropriate lesson property. - - org.owasp.webgoat.Catcher - - - - conf - /lessons/ConfManagement/config.jsp - - - - - - AxisServlet - /servlet/AxisServlet - - - - AxisServlet - *.jws - - - - AxisServlet - /services/* - - - - SOAPMonitorService - /SOAPMonitor - - - - - - - WebGoat - /attack - - - - LessonSource - /source - - - - Catcher - /catcher - - - - conf - /conf - - - - - - - 2880 - - - - wmv - video/x-ms-wmv - - - - - - Link to the UserDatabase instance from which we request lists of - defined role names. Typically, this will be connected to the global - user database with a ResourceLink element in server.xml or the context - configuration file for the Manager web application. - - users - - org.apache.catalina.UserDatabase - - - - - - - - WebGoat Application - /* - - - webgoat_user - webgoat_admin - webgoat_challenge - - - - - - WebGoat Application Source - /JavaSource/* - - - server_admin - - - - - - - BASIC - WebGoat Application - - - - - The role that is required to administrate WebGoat - webgoat_admin - - - - The role that is required to start the challenge log viewer - webgoat_challenge - - - - The role that is required to use WebGoat - webgoat_user - - - - This role is for admins only - server_admin - - - - diff --git a/ webgoat/main/project/WebContent/WEB-INF/web-windows.xml b/ webgoat/main/project/WebContent/WEB-INF/web-windows.xml deleted file mode 100644 index a7acfa348..000000000 --- a/ webgoat/main/project/WebContent/WEB-INF/web-windows.xml +++ /dev/null @@ -1,344 +0,0 @@ - - - - - - - WebGoat - - This web application is designed to demonstrate web - application security flaws for the purpose of educating - developers and security professionals about web - application security problems. Please contact Bruce Mayhew - (webgoat@owasp.org) if you have any questions. - - - - - - - - email - WebGoat@owasp.org - - The EMAIL address of the administrator to whom questions - and comments about this application should be addressed. - - - - - - - AxisServlet - Apache-Axis Servlet - - org.apache.axis.transport.http.AxisServlet - - - - - AdminServlet - Axis Admin Servlet - - org.apache.axis.transport.http.AdminServlet - - 100 - - - - SOAPMonitorService - SOAPMonitorService - - org.apache.axis.monitor.SOAPMonitorService - - - SOAPMonitorPort - 5001 - - 100 - - - - WebGoat - - This servlet plays the "controller" role in the MVC architecture - used in this application. - - The initialization parameter namess for this servlet are the - "servlet path" that will be received by this servlet (after the - filename extension is removed). The corresponding value is the - name of the action class that will be used to process this request. - - org.owasp.webgoat.HammerHead - - - debug - false - - - - CookieDebug - true - - - - DefuseOSCommands - false - - - - Enterprise - true - - - - CodingExercises - true - - - - - - - FeedbackAddress - - <A HREF=mailto:webgoat@owasp.org>webgoat@owasp.org</A> - - - - - DatabaseDriver - - org.hsqldb.jdbcDriver - - - - - DatabaseConnectionString - - - jdbc:hsqldb:mem:${USER} - - - - - - 5 - - - - - - LessonSource - - This servlet returns the Java source of the current lesson. - - org.owasp.webgoat.LessonSource - - - - Catcher - - This servlet catches any posts and marks the appropriate lesson property. - - org.owasp.webgoat.Catcher - - - - conf - /lessons/ConfManagement/config.jsp - - - - - - AxisServlet - /servlet/AxisServlet - - - - AxisServlet - *.jws - - - - AxisServlet - /services/* - - - - SOAPMonitorService - /SOAPMonitor - - - - - - - WebGoat - /attack - - - - LessonSource - /source - - - - Catcher - /catcher - - - - conf - /conf - - - - - - - 2880 - - - - wmv - video/x-ms-wmv - - - - - - Link to the UserDatabase instance from which we request lists of - defined role names. Typically, this will be connected to the global - user database with a ResourceLink element in server.xml or the context - configuration file for the Manager web application. - - users - - org.apache.catalina.UserDatabase - - - - - - - - WebGoat Application - /* - - - webgoat_user - webgoat_admin - webgoat_challenge - - - - - - WebGoat Application Source - /JavaSource/* - - - server_admin - - - - - - - BASIC - WebGoat Application - - - - - The role that is required to administrate WebGoat - webgoat_admin - - - - The role that is required to start the challenge log viewer - webgoat_challenge - - - - The role that is required to use WebGoat - webgoat_user - - - - This role is for admins only - server_admin - - - - diff --git a/ webgoat/main/project/WebContent/images/logos/G2.jpg b/ webgoat/main/project/WebContent/images/logos/G2.jpg deleted file mode 100644 index 9fc1aadd9..000000000 Binary files a/ webgoat/main/project/WebContent/images/logos/G2.jpg and /dev/null differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix.html b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix.html new file mode 100644 index 000000000..457b0ee7d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix.html @@ -0,0 +1,707 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: Using an +Access Control Matrix

+ +

 

+ +

Concept / +Topic To Teach:

+ + + +

In a +role-based access control scheme, a role represents a set of access permissions +and privileges. A user can be assigned one or more roles. A role-based access +control scheme normally consists of two parts: role permission management and +role assignment. A broken role-based access control scheme might allow a user +to perform accesses that are not allowed by his/her assigned roles, or somehow +allow privilege escalation to an unauthorized role.

+ +

 

+ +

General +Goal(s):

+ +

Each user is +a member of a role that is allowed to access only certain resources. Your goal +is to explore the access control rules that govern this site. Only the [Admin] +group should have access to the 'Account Manager' resource.

+ +

 

+ +

Solution:

+ +

 

+ +

This exercise +is straightforward. You need to find a user where you can access a resource +that you shouldn’t be able to access.

+ +

After a few attempts +you will learn that Larry can access resources of the role Account Manager.

+ +

 

+ +

+ +

Figure 1 Lesson 9

+ +

 

+ +

+ +

Figure 2 Lesson 9 Completed

+ +

 

+ +
+ + +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/Thumbs.db b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/Thumbs.db new file mode 100644 index 000000000..b269eb3f5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/Thumbs.db differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/filelist.xml new file mode 100644 index 000000000..d016d8ce4 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/filelist.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image001.png new file mode 100644 index 000000000..ebb3f8cb8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image002.jpg new file mode 100644 index 000000000..eca131d99 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image003.png new file mode 100644 index 000000000..5efe24680 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image004.jpg new file mode 100644 index 000000000..64245b784 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/AccessControlMatrix_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors.html b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors.html new file mode 100644 index 000000000..02b8ab91b --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors.html @@ -0,0 +1,841 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Create Database Back Door Attacks.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

How to Create +Database Back Door Attacks.

+ +

 

+ +

How the +attacks works:

+ +

Databases are +used usually as a backend for web applications. Also it is used as a media of +storage. It can also be used as a place to store a malicious activity such as a +trigger. A trigger is called by the database management system upon the +execution of another database operation like insert, select, update or delete. +An attacker for example can create a trigger that would set his email address +instead of every new user's email address.

+ +

 

+ +

General +Goal(s):

+ +

Your +goal should be to learn how you can exploit a vulnerable query to create a +trigger.
+You will not be able to actually create one in this lesson because the +underlying database engine used with WebGoat doesn't support triggers.
+Your login ID is 101.

+ +

 

+ +

+ +

Figure 1 Database backdoor

+ +

 

+ +

Solution:

+ +

Enter your user ID 101 to see how the application works.

+ +

 

+ +

+ +

Figure 2 User ID is 101

+ +

 

+ +

As you +probably noticed, the input is not validated so very easy to do SQL Injection. +To have two SQL queries executed, you need to separate them using a sem-colon. +For example select * from employees; drop table employees will first select all +the users from employees and then drop the table employees. Not all databases +support multiple SQL statements.

+ +

 

+ +

Here you need +to update the salary of the employees. This requires an update query like +update employees set salary=10000.

+ +

 

+ +

Inject this +for the user ID: 101; update employee set salary=10000

+ +

 

+ +

+ +

Figure 3 Update query

+ +

 

+ +

+ +

Figure 4 Stage 1 completed

+ +

 

+ +

To create a +database trigger, you need to inject the following SQL: CREATE TRIGGER +myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET +email='john@hackme.com'WHERE userid = NEW.userid

+ +

 

+ +

+ +

Figure 5 Insert trigger

+ +

 

+ +

+ +

Figure 6 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/filelist.xml new file mode 100644 index 000000000..0c8218170 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/filelist.xml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image001.png new file mode 100644 index 000000000..5a4d94ac7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image003.png new file mode 100644 index 000000000..8150275d8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image005.png new file mode 100644 index 000000000..62ebf88f6 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image007.png new file mode 100644 index 000000000..9960dbc61 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image009.png new file mode 100644 index 000000000..be39f6ac3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image011.png new file mode 100644 index 000000000..ef6e16606 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image013.jpg new file mode 100644 index 000000000..c25f12992 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image014.jpg new file mode 100644 index 000000000..08f893f3d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image015.jpg new file mode 100644 index 000000000..08c662842 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image016.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image016.jpg new file mode 100644 index 000000000..9299a4a2f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image016.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image017.jpg new file mode 100644 index 000000000..49760e726 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image018.jpg new file mode 100644 index 000000000..735ea196b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BackDoors_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication.html b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication.html new file mode 100644 index 000000000..f129f30c8 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication.html @@ -0,0 +1,932 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: Basic +Authentication

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Basic +Authentication is used to protect server side resources. The web server will send +a 401 authentication request with the response for the requested resource. The +client side browser will then prompt the user for a user name and password +using a browser supplied dialog box. The browser will base64 encode the user +name and password and send those credentials back to the web server. The web +server will then validate the credentials and return the requested resource if +the credentials are correct.

+ +

These +credentials are automatically resent for each page protected with this +mechanism without requiring the user to enter their credentials again.

+ +

 

+ +

General +Goal(s):

+ +

For this +lesson, your goal is to understand Basic Authentication and answer the +questions below.

+ +

 

+ +

+ +

Figure 1 Lesson 13

+ +

 

+ +

To learn the +name of the authentication header you must click “Submit” and intercept the +request with WebScarab.

+ +

 

+ +

+ +

Figure 2 Intercepted request

+ +

 

+ +

The HTTP +header that contains the Basic Authentication information is called +“Authorization”. This value Z3Vlc3Q6Z3Vlc3Q= is Base64 encoded. You can decode +this by using WebScarab – Tools – Transcoder.

+ +

 

+ +

+ +

Figure 3 WebScarabs Transcoder

+ +

 

+ +

Click Base64 +decode.

+ +

 

+ +

+ +

Figure 4 Decode value

+ +

 

+ +

These values must +be used to complete the questions.

+ +

 

+ +

+ +

Figure 5 Answers

+ +

 

+ +

 

+ +

+ +

Figure 6 Part 1 completed

+ +

 

+ +

For this +lesson it is very important that you understand how the JSESSIONID cookie is +used for session management and how the basic authorization header is used for +authentication.

+ +

+ +

 

+ +

When WebGoat +is able to retrieve a valid session you are automatically redirected to the +lesson you are working on. When there is no valid session, WebGoat will create +a new JSESSIONID and you will see the first lesson, HTTP Basics.

+ +

 

+ +

When there is +no session cookie, WebGoat will first verify if you already authenticated. If +not, you will get a pop-up window from the browser that requests your user name +and password (guest/guest). After the user credentials are validated, you will +access the Start-page of WebGoat and WebGoat will create a new JSESSIONID for +this session.

+ +

 

+ +

To access +WebGoat as the user basic, you need to corrupt the existing JSESSIONID and the +Authorization header. You can do this in WebScarab. Intercept the request and +delete a character from the JSESSIONID value and the Authorization header.

+ +

WebGoat will +require you to authenticate, so you now enter for the user name basic and for +the password basic. This logs you on as the user basic.

+ +

 

+ +

Remember our +JSESSIONID? This JSESSIONID is a non-persistent cookie which is set during our +first visit. Every request from the browser to WebGoat will have this cookie +value. Corrupting this value in the previous request will not change the cookie +value stored in browser memory and that is the reason why the old JSESSIONID +cookie is sent in every request.

+ +

 

+ +

+ +

Figure 7 Basic Authentication

+ +

 

+ +

You clearly +see that the JSESSIONID is the same like in the previous request, but the +Authorization header now contains the Base 64 encoded value of basic:basic (you +can decode this value in WebScarab – Tools – Transcoder).

+ +

+ +

Figure 8 Logged on as user basic

+ +

 

+ +

 

+ +

Because of the +valid JSESSIONID, WebGoat retrieves the authenticated user via the server-side +session object using getSession().getUser(). To make WebGoat believe that you +are authenticated as basic, you need to corrupt the JSESSIONID, as shown in the +screenshot below.

+ +

 

+ +

+ +

Figure 9 Corrupt JSESSIONID

+ +

 

+ +

 

+ +

+ +

Figure 10 Start page for user basic

+ +

 

+ +

Now you are +redirected to the WebGoat start page. The JSESSIONID is changed and you lost all +your green stars because the basic user hasn’t completed any lesson. Go to the +lesson “Basic Authentication” to complete this lesson.

+ +

 

+ +

+ +

Figure 11 Lesson 13 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/filelist.xml new file mode 100644 index 000000000..7f6641efb --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/filelist.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image001.png new file mode 100644 index 000000000..58cb8db49 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image003.png new file mode 100644 index 000000000..e7380275b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image005.png new file mode 100644 index 000000000..6984b9e74 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image007.png new file mode 100644 index 000000000..bebf90cda Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image009.png new file mode 100644 index 000000000..917746bad Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image011.png new file mode 100644 index 000000000..05f16f195 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image013.png new file mode 100644 index 000000000..f66852324 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image015.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image015.png new file mode 100644 index 000000000..d167a7f35 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image015.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image017.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image017.png new file mode 100644 index 000000000..9139ad257 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image017.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image019.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image019.png new file mode 100644 index 000000000..f8604adae Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image019.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image021.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image021.png new file mode 100644 index 000000000..5788c8d43 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image021.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image023.png b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image023.png new file mode 100644 index 000000000..368d0d456 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image023.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image025.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image025.jpg new file mode 100644 index 000000000..b1aeffb19 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image025.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image026.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image026.jpg new file mode 100644 index 000000000..8addcb872 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image026.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image027.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image027.jpg new file mode 100644 index 000000000..0245a850c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image027.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image028.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image028.jpg new file mode 100644 index 000000000..9e6b65ff8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image028.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image029.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image029.jpg new file mode 100644 index 000000000..3586cede5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image029.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image030.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image030.jpg new file mode 100644 index 000000000..cdc430d9b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image030.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image031.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image031.jpg new file mode 100644 index 000000000..e9bb7a278 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image031.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image032.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image032.jpg new file mode 100644 index 000000000..b4e1f851a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image032.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image033.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image033.jpg new file mode 100644 index 000000000..468293b14 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image033.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image034.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image034.jpg new file mode 100644 index 000000000..3a463c317 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image034.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image035.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image035.jpg new file mode 100644 index 000000000..32f9278c2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image035.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image036.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image036.jpg new file mode 100644 index 000000000..1ab696dcd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/image036.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BasicAuthentication_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection.html new file mode 100644 index 000000000..44fbeb577 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection.html @@ -0,0 +1,904 @@ + + + + + + + + + + + + + + + + + + + +
+ +

 

+ +

Lesson Plan Title: How to Perform Blind SQL Injection

+ +

 

+ +

Concept / Topic To Teach:

+ +

SQL injection +attacks represent a serious threat to any database-driven site. The methods behind +an attack are easy to learn and the damage caused can range from considerable +to complete system compromise. Despite these risks an incredible number of +systems on the internet are susceptible to this form of attack.

+ +

 

+ +

Not only is +it a threat easily instigated, it is also a threat that, with a little +common-sense and forethought, can be almost totally prevented. This lesson will +show the student several examples of SQL injection.

+ +

 

+ +

It is always +good practice to sanitize all input data, especially data that will used in OS +command, scripts, and database queries.

+ +

 

+ +

General Goal(s):

+ +

The user +should be able to view all records in the specified table.  The user could add new records or modify +existing records.

+ +

 

+ +

From the hints J

+ +

Compound SQL +statements can be made by joining multiple tests with keywords like AND and OR. +Create a SQL statement that you can use as a true/false test and then select +the first character of the target element and do a start narrowing down the +character using > and <

+ +

 

+ +

The backend +database is Microsoft Access. Keep that in mind if you research SQL functions +on the Internet since different databases use some different functions and +syntax.

+ +

This is the +code for the query being built and issued by WebGoat:

+ +

 

+ +

"SELECT +* FROM user_data WHERE userid = " + accountNumber

+ +

The +application is taking your input and inserting it at the end of a pre-formed +SQL command. You will need to make use of the following SQL functions:

+ +

 

+ +

SELECT - +query for your target data and get a string

+ +

 

+ +

mid(string, +start, length) - returns a substring of string starting at the start character +and going for length characters

+ +

 

+ +

asc(string) +will return the ascii value of the first character in string

+ +

 

+ +

> and < +- once you have a character's value, compare it to a choosen one

+ +

Example: is +the first character of the first_name of userid 15613 less than 'M' (ascii 77)? +

+ +

 

+ +

101 AND (asc( +mid((SELECT first_name FROM user_data WHERE userid=15613) , 1 , 1) ) < 77 ); +

+ +

 

+ +

If you get +back that account number is valid, then yes. If get back that the number +isinvalid then answer is no.

+ +

Another +example: is the second character of the first_name of userid 15613 greater than +'m' (ascii 109)?

+ +

 

+ +

101 AND (asc( +mid((SELECT first_name FROM user_data WHERE userid=15613) , 2 , 1) ) > 109 +);

+ +

 

+ +

If you get back +that account number is valid, then yes. If get back that the number is invalid +then answer is no.

+ +

 

+ +

+ +

Figure 1 Lesson 16

+ +

For the +query: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE userid=15613) +, 1 , 1) ) < 77 ); you will get a “Account number is valid”. If the +character is bigger then the value you get an invalid account error message.

+ +

 

+ +

+ +

Figure 2 Invalid account number

+ +

 

+ +

You can +change the < to = to make sure that you have the correct value.

+ +

This results +in the query 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 1 , 1) ) = 74 );

+ +

 

+ +

+ +

Figure 3 First character

+ +

 

+ +

So you know +that ascii(74) is capital J. Now do the same for the second and all other +characters.

+ +

 

+ +

 

+ +

 

+ +

The query for +the second character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 2 , 1) ) = 111 );

+ +

Ascii(111) = +o, so you have now Jo.

+ +

 

+ +

+ +

 

+ +

For the third +character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 3 , 1) ) = 101 ); Ascii(101) = e

+ +

For the +fourth character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 4 , 1) ) = 115 ); Ascii(115) = s

+ +

For the fifth +character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 5 , 1) ) = 112); Ascii(112) = p

+ +

For the sixth +character: 101 AND (asc( mid((SELECT first_name FROM user_data WHERE +userid=15613) , 6 , 1) ) = 104); Ascii(104) = h

+ +

 

+ +

So the name +that you found is Joesph. Enter this in the text field to complete this lesson.

+ +

 

+ +

+ +

Figure 4 Enter the name Joesph

+ +

 

+ +

+ +

Figure 5 Lesson 16 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/filelist.xml new file mode 100644 index 000000000..085ceea56 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/filelist.xml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image001.png new file mode 100644 index 000000000..5fef4d85b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image003.png new file mode 100644 index 000000000..950942ed9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image005.png new file mode 100644 index 000000000..8c3ee5181 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image007.png new file mode 100644 index 000000000..54ea1bcb2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image009.png new file mode 100644 index 000000000..3668266c4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image011.png new file mode 100644 index 000000000..9987542b3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image013.jpg new file mode 100644 index 000000000..f5c8d4841 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image014.jpg new file mode 100644 index 000000000..68702bb41 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image015.jpg new file mode 100644 index 000000000..b6e84a5fe Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image016.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image016.jpg new file mode 100644 index 000000000..93a58e837 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image016.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image017.jpg new file mode 100644 index 000000000..6055cba63 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image018.jpg new file mode 100644 index 000000000..2e2bf3fc5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/BlindSqlInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF.html b/ webgoat/main/project/WebContent/lesson_solutions/CSRF.html new file mode 100644 index 000000000..f8f7b0a4e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CSRF.html @@ -0,0 +1,868 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Cross Site Request Forgery.

+ +

 

+ +

Concept +/ Topic To Teach:

+ +

This +lesson teaches how to perform Cross Site Request Forgery (CSRF) attacks.

+ +

 

+ +

How +the attacks works:

+ +

Cross-Site +Request Forgery (CSRF/XSRF) is an attack that tricks the victim into loading a +page that contains img links like the one below:

+ +

<img +src="http://www.mybank.com/sendFunds.do?acctId=123456"/>

+ +

When +the victim's browser attempts to render this page, it will issue a request to +www.mybank.com to the transferFunds.do page with the specified parameters. The +browser will think the link is to get an image, even though it actually is a +funds transfer function. The request will include any cookies associated with +the site. Therefore, if the user has authenticated to the site, and has either +a permanent cookie or even a current session cookie, the site will have no way +to distinguish this from a legitimate user request. In this way, the attacker +can make the victim perform actions that they didn't intend to, such as logout, +purchase item, or any other function provided by the vulnerable website

+ +

 

+ +

General +Goal(s):

+ +

Your +goal is to send an email to a newsgroup that contains an image whose URL is +pointing to a malicious request. Try to include a 1x1 pixel image that includes +a URL. The URL should point to the CSRF lesson with an extra parameter +"transferFunds=4000". You can copy the shortcut from the left hand +menu by right clicking on the left hand menu and choosing copy shortcut. +Whoever receives this email and happens to be authenticated at that time will +have his funds transferred. When you think the attack is successful, refresh +the page and you will find the green check on the left hand side menu.

+ +

 

+ +

+ +

Figure 1 How to perform CSRF

+ +

 

+ +

Solution:

+ +

 

+ +

To +complete this lesson you need to embed HTML code in the message box. This HTML +code should contain a image tag linking to an URL that is not a real image  will but start a transaction on the web +server instead.

+ +

 

+ +

The +format of an image in html is <img src="[URL]" width="1" +height="1" />

+ +

The transaction can be triggered by an URL to the +current lesson and an extra parameter “transferFunds’ and the amount. The +width=1 and height=1 will not show the image.

+ +

 

+ +

This payload will work:

+ +

<img +src=”http://localhost/WebGoat/attack?Screen=81&menu=210&transferFunds=5000” +width="1" height="1" />

+ +

 

+ +

So create a new message with title “Test” and a +message with the payload.

+ +

+ +

Figure 2 Insert payload

+ +

 

+ +

The page will refresh and you will see a new message +in the message list.

+ +

 

+ +

+ +

Figure 3 New message test

+ +

 

+ +

Click +on the message test. This will download the message and display the contents as +HTML, executing the payload. Examine the HTTP Request in WebScarab that is +generated when the browers tries to render the image tag.

+ +

 

+ +

+ +

Figure 4 CSRF attack

+ +

 

+ +

Now +you need to refresh the page to get the green star next to the lesson.

+ +

 

+ +

+ +

Figure 5 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/filelist.xml new file mode 100644 index 000000000..7f94019c7 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/filelist.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image001.png new file mode 100644 index 000000000..9d82bd95a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image003.png new file mode 100644 index 000000000..2189df262 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image005.png new file mode 100644 index 000000000..95949f62b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image007.png new file mode 100644 index 000000000..7bf06a985 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image009.png new file mode 100644 index 000000000..d0e2f233c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image011.jpg new file mode 100644 index 000000000..fbb254bd8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image012.jpg new file mode 100644 index 000000000..32dbb3c02 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image013.jpg new file mode 100644 index 000000000..8d76909d8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image014.jpg new file mode 100644 index 000000000..be9c8e294 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image015.jpg new file mode 100644 index 000000000..ef71f6923 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CSRF_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection.html new file mode 100644 index 000000000..81b42cee0 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection.html @@ -0,0 +1,738 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Perform Command Injection

+ +

 

+ +

Concept / Topic To Teach:

+ +

Command +injection attacks represent a serious threat to any parameter-driven site. The methods +behind an attack are easy to learn and the damage caused can range from +considerable to complete system compromise. Despite these risks an incredible +number of systems on the internet are susceptible to this form of attack.

+ +

 

+ +

Not only is +it a threat easily instigated, it is also a threat that, with a little +common-sense and forethought, can be almost totally prevented. This lesson will +show the student several examples of parameter injection.

+ +

 

+ +

It is always +good practice to sanitize all input data, especially data that will used in OS +command, scripts, and database queries.

+ +

 

+ +

General Goal(s):

+ +

The user +should be able to execute any command on the hosting OS.

+ +

 

+ +

+ +

Figure 1 Lesson 16

+ +

 

+ +

Solution:

+ +

 

+ +

Select a +lesson from the drop-down box and click on “View”.

+ +

 

+ +

+ +

 

+ +

Intercept the +request with WebScarab when you click on “View”. Append “ & netstat –an +& ipconfig to the HelpFile parameter. Do not forget the double quote!

+ +

 

+ +

+ +

Figure 2 Injecting command netstat & ipconfig

+ +

 

+ +

The result +contains the output of the command netstat and ipconfig.

+ +

 

+ +

+ +

Figure 3 Command Injection results

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/filelist.xml new file mode 100644 index 000000000..c778dd663 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image001.png new file mode 100644 index 000000000..95185ac08 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image003.png new file mode 100644 index 000000000..bb6e1e518 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image005.png new file mode 100644 index 000000000..9c7ecd242 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image007.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image007.jpg new file mode 100644 index 000000000..d82452e33 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image007.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image008.jpg new file mode 100644 index 000000000..67162e723 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image009.jpg new file mode 100644 index 000000000..916c6fdc1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/CommandInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection.html new file mode 100644 index 000000000..a85e47911 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection.html @@ -0,0 +1,865 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform DOM Injection Attack.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

How to +perform DOM injection attacks.

+ +

 

+ +

How the +attacks works:

+ +

Some applications +specially the ones that uses AJAX manipulates and updates the DOM directly +using JavaScript, DHTML and eval() method.
+An attacker may take advantage of that by intercepting the reply and try to +inject some javascript commands to exploit his attacks.

+ +

 

+ +

General +Goal(s):

+ +

* +Your victim is a system that takes an activation key to allow you to use it.
+* Your goal should be to try to get to enable the activate button.
+* Take some time to see the HTML source in order to understand how the key +validation process works.

+ +

 

+ +

+ +

Figure 1 AJAX Security - DOM Injection

+ +

 

+ +

Solution:

+ +

 

+ +

AJAX requires +XML communication between the browser and the web application. When you view +the source of the HTML page, you will notice the usage of XMLHttpRequest:

+ +

 

+ +

<script>

+ +

function +validate() {

+ +

var keyField += document.getElementById('key');

+ +

var url = +'/WebGoat/attack?Screen=80&menu=1150&from=ajax&key=' + +encodeURIComponent(keyField.value);

+ +

if (typeof +XMLHttpRequest != 'undefined') {

+ +

req += new XMLHttpRequest();

+ +

} else if +(window.ActiveXObject) {

+ +

req += new ActiveXObject('Microsoft.XMLHTTP');

+ +

   }

+ +

   req.open('GET', url, true);

+ +

   req.onreadystatechange = callback;

+ +

   req.send(null);

+ +

}

+ +

function +callback() {

+ +

    if (req.readyState == 4) {

+ +

        if (req.status == 200) {

+ +

            var message = req.responseText;

+ +

                                     eval(message);

+ +

        }}}

+ +

</script>

+ +

 

+ +

The XML +response contains JavaScript that will activate the button so that you are able +to click on it. This requires you to inject JavaScript to manipulate the +Document Object Model of the HTML page in the browser. This requires +intercepting the HTTP response in WebScarab!

+ +

 

+ +

Enter a +license key (for example ‘a’) and intercept the HTTP Request and HTTP Response +in WebScarab.

+ +

 

+ +

+ +

Figure 2 HTTP Request

+ +

 

+ +

+ +

Figure 3 HTTP Response

+ +

 

+ +

Intercept the +reply and replace the body with document.forms[0].SUBMIT.disabled = false;

+ +

 

+ +

+ +

Figure 4 Updated HTTP Response

+ +

 

+ +

The button “Activate!” is now enabled!

+ +

 

+ +

+ +

Figure 5 Activate! Button is enabled

+ +

 

+ +

+ +

Figure 6 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/filelist.xml new file mode 100644 index 000000000..44904329e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/filelist.xml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image001.png new file mode 100644 index 000000000..8d3b529b0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image002.jpg new file mode 100644 index 000000000..3f3bccdf5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image003.png new file mode 100644 index 000000000..9effd17b9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image004.jpg new file mode 100644 index 000000000..016c16e12 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image005.png new file mode 100644 index 000000000..844b00d92 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image006.jpg new file mode 100644 index 000000000..c3349b050 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image007.png new file mode 100644 index 000000000..d0b0aec8e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image008.jpg new file mode 100644 index 000000000..18a4764fe Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image009.png new file mode 100644 index 000000000..d1021bceb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image010.jpg new file mode 100644 index 000000000..e9bc078c3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image011.png new file mode 100644 index 000000000..efe585a32 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image012.jpg new file mode 100644 index 000000000..dd8bf4ac4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOMInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login.html b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login.html new file mode 100644 index 000000000..3a5440d3c --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login.html @@ -0,0 +1,704 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: Denial of +Service from Multiple Logins

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Denial of +service attacks are a major issue in web applications. If the end user cannot conduct +business or perform the service offered by the web application, then both time +and money is wasted.

+ +

 

+ +

General +Goal(s):

+ +

This site +allows a user to login multiple times. This site has a database connection pool +that allows 2 connections. You must obtain a list of valid users and create a +total of 3 logins.

+ +

Solution:

+ +

 

+ +

This site +allows a user to login multiple times. There is a database connection pool that +allows 2 connections. You must obtain a list of valid users and create a total +of 3 logins.

+ +

 

+ +

Let’s try a +SQL Injection attack. Enter in the password field ' or '1' = '1

+ +

 

+ +

+ +

Figure 1 Lesson 20

+ +

 

+ +

Login with +user name jsnow and password passwd1. Then login with user name jdoe and +password passwd1. And finally login with jplane and passwd3.

+ +

 

+ +

+ +

Figure 2 Lesson 20 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/filelist.xml new file mode 100644 index 000000000..065d671e4 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/filelist.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image001.png new file mode 100644 index 000000000..dc2669fe2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image002.jpg new file mode 100644 index 000000000..6f5c75387 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image003.png new file mode 100644 index 000000000..45396104d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image004.jpg new file mode 100644 index 000000000..372cdca56 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/DOS_Login_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication.html b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication.html new file mode 100644 index 000000000..e390225f3 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication.html @@ -0,0 +1,741 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Bypass a Fail Open +Authentication Scheme

+ +

 

+ +

Concept / Topic To Teach: Abusing error handling.

+ +

 

+ +

This lesson presents +the basics for understanding the "fail open" condition regarding +authentication. The security term, “fail open” describes a behavior of a +verification mechanism. This is when an error (i.e. unexpected exception) +occurs during a verification method causing that method to evaluate to true. +This is especially dangerous during login.

+ +

 

+ +

General Goal(s):

+ +

The user +should be able to bypass the authentication check.

+ +

 

+ +

+ +

Figure 1 Lesson 19

+ +

 

+ +

Solution:

+ +

 

+ +

Enter user +name webgoat and click “Login”. Intercept the request with WebScarab.

+ +

 

+ +

+ +

Figure 2 Intercepted request

+ +

 

+ +

Click on the +variable “Password” and click “Delete”. Click “Accept changes”.

+ +

 

+ +

+ +

Figure 3 Password variable is deleted

+ +

 

+ +

You are now +“authenticated” as WebGoat.

+ +

 

+ +

+ +

Figure 4 Lesson 19 Completed

+ +

 

+ +

The problem +is that the exception handler in the Java code is executing a catch block for successful +authentication. The exception occurs because there is a NullPointer exception +when reading out the password parameter.

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/filelist.xml new file mode 100644 index 000000000..bdb35f85a --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image001.png new file mode 100644 index 000000000..44e09369d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image003.png new file mode 100644 index 000000000..1cf2cc012 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image005.png new file mode 100644 index 000000000..9f5747a75 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image007.png new file mode 100644 index 000000000..0845266c4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image009.jpg new file mode 100644 index 000000000..c871b0225 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image010.jpg new file mode 100644 index 000000000..74cec6054 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image011.jpg new file mode 100644 index 000000000..29defb100 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image012.jpg new file mode 100644 index 000000000..09d5ac828 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/FailOpenAuthentication_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing.html b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing.html new file mode 100644 index 000000000..6a23e21dd --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing.html @@ -0,0 +1,767 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Forced Browsing Attacks.

+ +

 

+ +

Concept +/ Topic To Teach:

+ +

How +to Exploit Forced Browsing.

+ +

 

+ +

How +the attacks works:

+ +

Forced +browsing is a technique used by attackers to gain access to resources that are +not referenced, but are nevertheless accessible. One technique is to manipulate +the URL in the browser by deleting sections from the end until an unprotected +directory is found

+ +

 

+ +

General +Goal(s):

+ +

Your +goal should be to try to guess the URL for the "config" interface.
+The "config" URL is only available to the maintenance personnel.
+The application doesn't check for horizontal privileges.

+ +

 

+ +

+ +

Figure 1 Insecure configuration +management – Forced Browsing

+ +

 

+ +

Solution:

+ +

If you want to access a restricted page, you need to +be able to guess the URI to access the page, for example /admin.

+ +

In this environment, WebGoat consists of different +servlets that live in the WebGoat application. The main servlet is /attack, +what could be the servlet for config?

+ +

 

+ +

Try to access /WebGoat/config, +/WebGoat/configuration, /WebGoat/conf, ….

+ +

 

+ +

+ +

Figure 2 No /WebGoat/config

+ +

 

+ +

+ +

Figure 3 No /WebGoat/configuration

+ +

 

+ +

+ +

Figure 4 Bingo for /WebGoat/conf

+ +

 

+ +

This +could be automated with a tool like Wikto 2.0

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/filelist.xml new file mode 100644 index 000000000..6616ecc49 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image001.png new file mode 100644 index 000000000..c9047d693 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image002.jpg new file mode 100644 index 000000000..101e688a4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image003.png new file mode 100644 index 000000000..569dc0098 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image004.jpg new file mode 100644 index 000000000..6fe272fa4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image005.png new file mode 100644 index 000000000..f2945e2b0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image006.jpg new file mode 100644 index 000000000..7ec274b62 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image007.png new file mode 100644 index 000000000..a001e7963 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image008.jpg new file mode 100644 index 000000000..672f7af05 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForcedBrowsing_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword.html b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword.html new file mode 100644 index 000000000..5cacb7445 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword.html @@ -0,0 +1,828 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Exploit the Forgot Password Page

+ +

 

+ +

Concept / +Topic To Teach:

+ + + +

Web +applications frequently provide their users the ability to retrieve a forgotten +password. Unfortunately, many web applications fail to implement the mechanism +properly. The information required to verify the identity of the user is often +overly simplistic.

+ +

 

+ +

General +Goal(s):

+ +

Users can +retrieve their password if they can answer the secret question properly. There +is no lock-out mechanism on this 'Forgot Password' page. Your username is +'webgoat' and your favorite color is 'red'. The goal is to retrieve the +password of another user.

+ +

 

+ +

Solution:

+ +

 

+ +

This lesson +will show you how easy it is to guess a secret question and retrieve somebody +else his password.

+ +

 

+ +

+ +

Figure 1 Lesson 10

+ +

 

+ +

When you +enter the user name webgoat and then the answer “red” for your favorite color, +you will get a password reminder, only not via e-mail.

+ +

 

+ +

+ +

Figure 2 Submit the answer red

+ +

 

+ +

+ +

Figure 3 Password reminder for user webgoat

+ +

 

+ +

The password +for user webgoat is webgoat. This is a weak password policy, which is also a +bad thing J

+ +

 

+ +

Now you need +to guess the password for another user. The text tells you something about an +“OWASP admin”. So let’s try “admin” for a user name.

+ +

 

+ +

+ +

Figure 4 Is there a user admin?

+ +

 

+ +

This works. +Now you need the guess some colors.

+ +

 

+ +

+ +

Figure 5 There is a user admin!

+ +

 

+ +

 

+ +

Try blue, red +and green for example.

+ +

 

+ +

+ +

Figure 6 No blue

+ +

 

+ +

Blue is an +incorrect response.

+ +

 

+ +

+ +

Figure 7 It's green!

+ +

 

+ +

Green is the +correct answer and now you know the difficult password for user admin.

+ +

 

+ +
+ + +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/filelist.xml new file mode 100644 index 000000000..ec8ce5b70 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/filelist.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image001.png new file mode 100644 index 000000000..3e10c76d3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image003.png new file mode 100644 index 000000000..11a7001dc Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image005.png new file mode 100644 index 000000000..033f2e8c8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image007.png new file mode 100644 index 000000000..664c24a06 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image009.png new file mode 100644 index 000000000..e0e2ffb7c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image011.png new file mode 100644 index 000000000..4542c5240 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image013.png new file mode 100644 index 000000000..f72055656 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image015.jpg new file mode 100644 index 000000000..1f670723b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image016.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image016.jpg new file mode 100644 index 000000000..6f8105ce7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image016.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image017.jpg new file mode 100644 index 000000000..76540dad8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image018.jpg new file mode 100644 index 000000000..76c23e5ea Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image019.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image019.jpg new file mode 100644 index 000000000..fc38db81d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image019.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image020.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image020.jpg new file mode 100644 index 000000000..c5a2f719f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image020.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image021.jpg new file mode 100644 index 000000000..5798c0713 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ForgotPassword_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering.html b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering.html new file mode 100644 index 000000000..5dc07bcae --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering.html @@ -0,0 +1,685 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Exploit Hidden Fields

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Developers +will use hidden fields for tracking, login, pricing, etc.. information on a +loaded page. While this is a convenient and easy mechanism for the developer, +they often don't validate the information that is received from the hidden +field. This lesson will teach the attacker to find and modify hidden fields to +obtain a product for a price other than the price specified

+ +

 

+ +

General +Goal(s):

+ +

The user +should be able to exploit a hidden field to obtain a product at an incorrect +price.

+ +

 

+ +

+ +

Figure 1 Lesson 4

+ +

 

+ +

Solution:

+ +

 

+ +

To change the +hidden field you need to start your favorite HTTP Interceptor. You can use +WebScarab from OWASP to intercept the request and change the hidden field. +Configure your browser to use a local proxy. In Internet Explorer you can do +this via “Tools” – “Internet Options” – “Connections” – “LAN Settings”. You +must define proxy “localhost” with port 8008.

+ +

 

+ +

+ +

Figure 2 Set local proxy in Internet Explorer

+ +

 

+ +

Start +WebScarab

+ +

 

+ +

+ +

Figure 3 Intercept request with WebScarab

+ +

 

+ +

+ +

Figure 4 Change the Price variable to 1

+ +

 

+ +

+ +

Figure 5 Lesson 4 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/filelist.xml new file mode 100644 index 000000000..a94e9430b --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/filelist.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image001.png new file mode 100644 index 000000000..3757d471d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image003.png new file mode 100644 index 000000000..e3ba2d5cd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image005.png new file mode 100644 index 000000000..1f0d5ebef Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image007.png new file mode 100644 index 000000000..a715a8db2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image009.png new file mode 100644 index 000000000..2914f15ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image011.jpg new file mode 100644 index 000000000..06d8b5434 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image012.jpg new file mode 100644 index 000000000..3be37d0cf Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image013.jpg new file mode 100644 index 000000000..7feef4395 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image014.jpg new file mode 100644 index 000000000..6bbe14316 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image015.jpg new file mode 100644 index 000000000..02de6c5eb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HiddenFieldTampering_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues.html b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues.html new file mode 100644 index 000000000..6bcefd9a7 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues.html @@ -0,0 +1,677 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Discover Clues in the HTML

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Developers +are notorious for leaving statements like FIXME's, Code Broken, Hack, etc... +inside the source code.  Review the source code for any comments +denoting passowrds, backdoors, or something doesn't work right. 

+ +

 

+ +

General +Goal(s):

+ +

The user +should be able to bypass the authentication check.

+ +

 

+ +

+ +

Figure 1 Lesson 3

+ +

 

+ +

Right-click +the page and select “View source”

+ +

+ +

Figure 2 View Source

+ +

 

+ +

Solution:

+ +

 

+ +

 

+ +

Examine the +HTML source.

+ +

 

+ +

+ +

 

+ +

In the HTML +source there is a comment that contains a user name admin and a password +adminpw. Enter these values in WebGoat and click “Login”

+ +

 

+ +

+ +

Figure 3 Enter discovered credentials

+ +

 

+ +

+ +

Figure 4 Lesson 3 Completed

+ +

 

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/filelist.xml new file mode 100644 index 000000000..b8f56a1ec --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/filelist.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image001.png new file mode 100644 index 000000000..16a985f95 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image003.png new file mode 100644 index 000000000..6c3b652b2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image005.png new file mode 100644 index 000000000..baccb3c43 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image007.png new file mode 100644 index 000000000..7fe1df7d1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image009.png new file mode 100644 index 000000000..4e0f0026e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image011.jpg new file mode 100644 index 000000000..5c887a646 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image012.jpg new file mode 100644 index 000000000..80456d498 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image013.jpg new file mode 100644 index 000000000..38b875113 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image014.jpg new file mode 100644 index 000000000..3a8f380ac Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image015.jpg new file mode 100644 index 000000000..a9d131b57 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HtmlClues_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics.html b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics.html new file mode 100644 index 000000000..3fd649f6d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics.html @@ -0,0 +1,635 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: Http +Basics

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +presents the basics for understanding the transfer of data between the browser +and the web application.
+
+Client Request: How HTTP works:

+ +

All HTTP transactions +follow the same general format. Each client request and server response has +three parts: the request or response line, a header section, and the entity +body. The client initiates a transaction as follows:
+
+The client contacts the server and sends a document request

+ +


+        GET /index.html?param=value HTTP/1.0
+
+Next, the client sends optional header information to inform the server of its +configuration and the document formats it will accept.
+
+        User-Agent: Mozilla/4.06 Accept: image/gif, +image/jpeg, */*
+
+After sending the request and headers, the client may send additional data. +This data is mostly used by CGI programs using the POST method.

+ +

 

+ +

General +Goal(s):

+ +

Enter your +name in the input field below and press "go" to submit. The server +will accept the request, reverse the input, and display it back to the user, +illustrating the basics of handling an HTTP request.
+
+The user should become familiar with the features of WebGoat by manipulating +the above buttons to view hints, show the HTTP request parameters, the HTTP +request cookies, and the Java source code.

+ +

 

+ +

Solution:

+ +

Click “Show +Params” and ‘Show Cookies”.

+ +

+ +

Figure 1 Enter your name

+ +

 

+ +

Fill out your +name and click the button Go!

+ +

 

+ +

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/filelist.xml new file mode 100644 index 000000000..2d81880c2 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/filelist.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image001.png new file mode 100644 index 000000000..783a404ed Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image003.png new file mode 100644 index 000000000..7d0a0830c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image005.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image005.jpg new file mode 100644 index 000000000..7b9b508a5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image005.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image006.jpg new file mode 100644 index 000000000..cb6599a1f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpBasics_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly.html b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly.html new file mode 100644 index 000000000..467dcc903 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly.html @@ -0,0 +1,863 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: HttpOnly Test

+ +

 

+ +

Concept / Topic To +Teach:

+ + + +

To +help mitigate the cross site scripting threat, Microsoft has introduced a new cookie +attribute entitled 'HttpOnly.' If this flag is set, then the browser should not +allow client-side script to access the cookie. Since the attribute is +relatively new, several browsers neglect to handle the new attribute properly.

+ +

 

+ +

General Goal(s):

+ +

The +purpose of this lesson is to test whether your browser supports the HTTPOnly +cookie flag. Note the value of the unique2u cookie. If your browser supports +HTTPOnly, and you enable it for a cookie, client side code should NOT be able +to read OR write to that cookie, but the browser can still send its value to +the server. Some browsers only prevent client side read access, but don't +prevent write access.

+ +

 

+ +

+ +

Figure 1 Lesson HTTPOnly Test

+ +

 

+ +

Solution:

+ +

 

+ +

HTTPOnly +is not configured. When you click on “Read Cookie” you will get the following +pop-up in JavaScript, displaying the cookies

+ +

 

+ +

+ +

Figure 2 All cookies

+ +

 

+ +

Select +“Yes” to turn HTTPOnly on. Intercept the HTTP Request and HTTP Response in +WebScarab.

+ +

 

+ +

+ +

Figure 3 HTTP Request

+ +

 

+ +

+ +

Figure 4 HTTP Response with HTTPOnly +cookie

+ +

 

+ +

 

+ +

Click +on “Read cookie”. You will see the JSESSIONID which is not using HTTPOnly.

+ +

+ +

Figure 5 Only JSESSIONID

+ +

 

+ +

+ +

Figure 6 HTTPOnly Success

+ +

 

+ +

Click +on “Write cookie” which again only shows the JSESSIONID cookie.

+ +

 

+ +

+ +

Figure 7 JSESSIONID cookie

+ +

 

+ +

+ +

Figure 8 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/filelist.xml new file mode 100644 index 000000000..b6972bfed --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/filelist.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image001.png new file mode 100644 index 000000000..169190729 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image003.png new file mode 100644 index 000000000..597cc80eb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image005.png new file mode 100644 index 000000000..24e98dab8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image007.png new file mode 100644 index 000000000..6b5f8cb64 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image009.png new file mode 100644 index 000000000..443fc7029 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image011.png new file mode 100644 index 000000000..a378ec244 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image013.png new file mode 100644 index 000000000..98535fdfe Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image015.jpg new file mode 100644 index 000000000..efbe77300 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image016.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image016.jpg new file mode 100644 index 000000000..195c2529b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image016.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image017.jpg new file mode 100644 index 000000000..91d8d9c6d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image018.jpg new file mode 100644 index 000000000..adc7a901e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image019.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image019.jpg new file mode 100644 index 000000000..acfd921d1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image019.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image020.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image020.jpg new file mode 100644 index 000000000..4c564391a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image020.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image021.jpg new file mode 100644 index 000000000..56107235b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpOnly_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting.html b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting.html new file mode 100644 index 000000000..4dc8c80b9 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting.html @@ -0,0 +1,1015 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Http Splitting

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches how to perform HTTP Splitting attacks.

+ +

 

+ +

How the +attacks works:

+ +

The attacker +passes malicious code to the web server together with normal input. A victim +application will not be checking for CR (carriage return, also given by %0d or +\r) and LF (line feed, also given by %0a or \n)characters. These characters not +only give attackers control of the remaining headers and body of the response +the application intends to send, but also allows them to create additional +responses entirely under their control.
+The effect of an HTTP Splitting attack is maximized when accompanied with a +Cache Poisoning. The goal of Cache Poisoning attack is to poison the cache of +the victim by fooling the cache to believe that the page hijacked using the +HTTP splitting is a good one and it is indeed the server's copy.
+The attack happens using the HTTP Splitting attack plus adding the Last-Modified: +header and setting it to a future date. This will force the browser to send If-Modified-Since +request header, which gives the attacker the chance to intercept the server's +reply and replace it with a '304 Not Modified' reply. A sample of a 304 response +is:
+HTTP/1.1 304 Not Modified
+Date: Fri, 30 Dec 2005 17:32:47 GMT

+ +

 

+ +

General +Goal(s):

+ + + +

This lesson +has two stages. Stage 1 teaches you how to do HTTP Splitting attacks while +stage 2 builds on that to teach you how to elevate HTTP Splitting to Cache Poisoning.
+Enter a language for the system to search by. You will notice that the +application is redirecting your request to another resource on the server. You +should be able to use the CR (%0d) and LF (%0a) to exploit the attack. Your +exercise should be to force the server to send a 200 OK. If the screen changed +as an effect to your attack, just go back to the homepage and after stage 2 is +exploited successfully you will find the green check in the left menu.

+ +

 

+ +

+ +

 

+ +

Solution:

+ +

 

+ +

Because the +input is not validated you can inject any HTTP syntax, carriage returns and +line-feed you want.

+ +

 

+ +

Enter a +language to examine what’s going on. You do have WebScarab intercepting HTTP +requests and responses?

+ +

 

+ +

+ +

Figure 1 Language en

+ +

+ +

Figure 2 HTTP Request

+ +

 

+ +

+ +

Figure 3 First HTTP Response

+ +

 

+ +

+ +

Figure 4 Second HTTP Request

+ +

 

+ +

Now inject +for the language en%0d%0a%0d%0a%0d%0a

+ +

 

+ +

+ +

Figure 5 First HTTP Request

+ +

 

+ +

+ +

Figure 6 First HTTP Response

+ +

 

+ +

The +Content-Length: 0 will tell the server that the first request is over.

+ +

A 200 OK +message looks like this: HTTP/1.1 200 OK

+ +

 

+ +

Lets see what +you can do with: foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Hacked +J</html>

+ +

 

+ +

+ +

Figure 7 HTTP Splitting attack

+ +

 

+ +

+ +

Figure 8 HTTP Response

+ +

 

+ +

+ +

Figure 9 Second HTTP Request

+ +

 

+ +

+ +

Figure 10 Second HTTP Response

+ +

 

+ +

+ +

Figure 11 Hacked!

+ +

 

+ +

Hit the “Back” +button of your browser.

+ +

 

+ +

+ +

Figure 12 Stage 1 completed

+ +

 

+ +

Now you know +how to do HTTP Splitting. You can abuse this technique to do a cache poisoning +attack.

+ +

 

+ +

Cache +poisoning requires manipulating the Last-Modified header. This must be changed +to a date in the future.

+ +

Inject: foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aLast-Modified:%20Mon,%2027%20Oct%202003%2014:50:18%20GMT%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Hacked +J</html>

+ +

 

+ +

+ +

Figure 13 Inject cache poisoning

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/filelist.xml new file mode 100644 index 000000000..8b4e1e66e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/filelist.xml @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image001.png new file mode 100644 index 000000000..a3cecc9aa Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image003.png new file mode 100644 index 000000000..d62c55ea3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image005.png new file mode 100644 index 000000000..4168195ac Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image007.png new file mode 100644 index 000000000..d9f29ebed Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image009.png new file mode 100644 index 000000000..c75a97ac6 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image011.png new file mode 100644 index 000000000..addd9bce4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image013.png new file mode 100644 index 000000000..4f70cbce7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image015.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image015.png new file mode 100644 index 000000000..08c036f4e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image015.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image017.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image017.png new file mode 100644 index 000000000..9dccc349f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image017.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image019.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image019.png new file mode 100644 index 000000000..17708a3d7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image019.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image021.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image021.png new file mode 100644 index 000000000..59bec4ece Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image021.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image023.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image023.png new file mode 100644 index 000000000..8887f463b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image023.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image025.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image025.png new file mode 100644 index 000000000..83279f010 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image025.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image027.png b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image027.png new file mode 100644 index 000000000..ac9b0590f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image027.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image029.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image029.jpg new file mode 100644 index 000000000..1f2923a0d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image029.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image030.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image030.jpg new file mode 100644 index 000000000..5c309829a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image030.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image031.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image031.jpg new file mode 100644 index 000000000..296995e6d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image031.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image032.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image032.jpg new file mode 100644 index 000000000..04b19c12d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image032.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image033.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image033.jpg new file mode 100644 index 000000000..1e20add5b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image033.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image034.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image034.jpg new file mode 100644 index 000000000..cc30af047 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image034.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image035.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image035.jpg new file mode 100644 index 000000000..0e01db1ea Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image035.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image036.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image036.jpg new file mode 100644 index 000000000..51964a9bb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image036.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image037.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image037.jpg new file mode 100644 index 000000000..9f8efcbb7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image037.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image038.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image038.jpg new file mode 100644 index 000000000..036e50e47 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image038.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image039.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image039.jpg new file mode 100644 index 000000000..81b54f365 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image039.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image040.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image040.jpg new file mode 100644 index 000000000..caf41923a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image040.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image041.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image041.jpg new file mode 100644 index 000000000..cd100cf63 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image041.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image042.jpg b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image042.jpg new file mode 100644 index 000000000..9a48ce5a4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/image042.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/HttpSplitting_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection.html new file mode 100644 index 000000000..49e2bac05 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection.html @@ -0,0 +1,805 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform JSON Injection

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches how to perform JSON Injection Attacks.

+ +

 

+ +

How the +attacks works:

+ +

JavaScript Object +Notation (JSON) is a simple and effective lightweight data exchange format. +JSON can be in a lot of forms such as arrays, lists, hashtables and other data +structures. JSON is widely used in AJAX and Web2.0 application and is favored +by programmers over XML because of its ease of use and speed. However, JSON, +like XML is prone to Injection attacks. A malicious attacker can inject the +reply from the server and inject some arbitrary values in there.

+ +

 

+ +

General +Goal(s):

+ +

You +are traveling from Boston, MA- Airport code BOS to Seattle, WA - Airport code +SEA.
+Once you enter the three digit code of the airport, an AJAX request will be +executed asking for the ticket price.
+You will notice that there are two flights available, an expensive one with no +stops and another cheaper one with 2 stops.
+Your goal is to try to get the one with no stops but for a cheaper price.

+ +

 

+ +

+ +

Figure 1 AJAX Security - JSON Injection

+ +

 

+ +

Solution:

+ +

Like with the previous lessons you need to manipulate the HTTP Response +using WebScarab.

+ +

 

+ +

Examine the normal flow by entering the airport code BOS and SEA and +intercept the HTTP Request and the HTTP Response in WebScarab.

+ +

 

+ +

+ +

Figure 2 Intercept HTTP Request

+ +

 

+ +

+ +

Figure 3 Intercept HTTP Response

+ +

 

+ +

Change the +price for the expensive flight of $600 to $100 and click “Accept changes”.

+ +

 

+ +

 

+ +

+ +

Figure 4 Updated price

+ +

 

+ +

+ +

Figure 5 Injected result

+ +

 

+ +

Select the flight +with no stops and the updated price and click “Submit”.

+ +

 

+ +

+ +

Figure 6 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/filelist.xml new file mode 100644 index 000000000..3f7752feb --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/filelist.xml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image001.png new file mode 100644 index 000000000..cfdb7b042 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image003.png new file mode 100644 index 000000000..217f69bd7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image005.png new file mode 100644 index 000000000..affeaa193 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image007.png new file mode 100644 index 000000000..709f70b6a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image009.png new file mode 100644 index 000000000..b7d120e45 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image011.png new file mode 100644 index 000000000..3d93d05e5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image013.jpg new file mode 100644 index 000000000..21504eb14 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image014.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image014.jpg new file mode 100644 index 000000000..cf6cc7471 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image014.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image015.jpg new file mode 100644 index 000000000..ccd96c071 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image016.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image016.jpg new file mode 100644 index 000000000..3710a91c1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image016.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image017.jpg new file mode 100644 index 000000000..fecffb54d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image018.jpg new file mode 100644 index 000000000..f4edbeeb7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JSONInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation.html b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation.html new file mode 100644 index 000000000..58d4b79e7 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation.html @@ -0,0 +1,841 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Bypass Client Side JavaScript Validation

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Client-side validation +should not be considered a secure means of validating parameters. This +validation only helps reducing the amount of server processing time for normal +users who do not know the format of required input. Attackers can bypass these +mechanisms easily in various ways. Any client-side validation should be +duplicated on the server side. This will greatly reduce the likelihood of +insecure parameter values being used in the application.

+ +

 

+ +

General +Goal(s):

+ +

For this +exercise, the web site requires that you follow certain rules when you fill out +a form. The user should be able to break those rules, and send the website +input that it wasn't expecting.

+ +

+ +

 

+ +

Figure 1 Lesson 6

+ +

 

+ +

There are two +ways to complete this lesson. The first one is to submit a valid request like +the one from the screenshot above and intercept this using WebScarab. The +second way is to intercept the HTTP Response when loading the page and remove +the Javascript that validates the values.

+ +

 

+ +

Solution 1

+ +

 

+ +

+ +

Figure 2 Intercept request

+ +

 

+ +

Add different +symbols to the fields and click “Accept changes”.

+ +

 

+ +

+ +

Figure 3 Change parameters

+ +

 

+ +

+ +

Figure 4 Lesson 6 Completed

+ +

 

+ +

Solution 2

+ +

 

+ +

Reload the +page by clicking on the menu item “How to bypass Client-Side Javascript +Validation” and intercept the response in WebScarab.

+ +

 

+ +

+ +

Figure 5 Enable “Intercept responses”

+ +

 

+ +

+ +

Figure 6 Intercepted response

+ +

 

+ +

If you remove +the onclick=’validate();’ the “Submit” button will not work anymore.

+ +

Locate the +validate() Javascript function in the HTML page.

+ +

 

+ +

+ +

Figure 7 The function validate()

+ +

 

+ +

Removing the regular +expressions will remove the Javascript validation and submit the form.

+ +

 

+ +

+ +

Figure 8 Changed validate() function

+ +

 

+ +

Click “Accept +changes”. This returns a HTML page like before but without any regular +expression checks.

+ +

 

+ +

+ +

Figure 9 It looks the same

+ +

 

+ +

Change the +fields in the HTML page to contain symbols like @#@@# and click “Submit”.

+ +

 

+ +

+ +

Figure 10 No more regular expression checks

+ +

 

+ +

+ +

Figure 11 Lesson 6 Completed

+ +

 

+ +
+ + +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/filelist.xml new file mode 100644 index 000000000..aa9eb0b16 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/filelist.xml @@ -0,0 +1,29 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image001.png new file mode 100644 index 000000000..bb24a6c8f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image002.jpg new file mode 100644 index 000000000..ac600b733 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image003.png new file mode 100644 index 000000000..20f3f3871 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image004.jpg new file mode 100644 index 000000000..0ffa3bfe7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image005.png new file mode 100644 index 000000000..a189bb3d8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image006.jpg new file mode 100644 index 000000000..2e361f07f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image007.png new file mode 100644 index 000000000..2e74b5ec7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image008.jpg new file mode 100644 index 000000000..34cf88ebb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image009.gif b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image009.gif new file mode 100644 index 000000000..1779f251e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image009.gif differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image010.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image010.png new file mode 100644 index 000000000..88661381a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image010.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image011.jpg new file mode 100644 index 000000000..ab68d0731 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image012.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image012.png new file mode 100644 index 000000000..4d3ab3e2f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image012.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image013.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image013.jpg new file mode 100644 index 000000000..3ba19dd7e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image013.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image014.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image014.png new file mode 100644 index 000000000..90ea086b2 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image014.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image015.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image015.jpg new file mode 100644 index 000000000..47033c76c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image015.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image016.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image016.png new file mode 100644 index 000000000..36393c423 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image016.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image017.jpg new file mode 100644 index 000000000..02087fd18 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image018.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image018.png new file mode 100644 index 000000000..6fa005b7c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image018.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image019.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image019.jpg new file mode 100644 index 000000000..fa77e0a36 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image019.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image020.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image020.png new file mode 100644 index 000000000..43737e5d1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image020.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image021.jpg new file mode 100644 index 000000000..9cde03d4b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image022.png b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image022.png new file mode 100644 index 000000000..24ef81f2b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image022.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image023.jpg b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image023.jpg new file mode 100644 index 000000000..8fbe215fd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/image023.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/JavaScriptValidation_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing.html b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing.html new file mode 100644 index 000000000..35fcaeaf1 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing.html @@ -0,0 +1,793 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Log Spoofing.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches attempts to fool the human eye.

+ +

 

+ +

How the +attacks works: The attack +is based on fooling the human eye in log files. An attacker can erase his +traces from the logs using this attack.

+ +

 

+ +

General +Goal(s):

+ +

The +grey area below represents what is going to be logged in the web server's log +file.
+Your goal is to make it like a username "admin" has succeeded into +logging in.
+Elevate your attack by adding a script to the log file.  

+ +

 

+ +

+ +

Figure 1 Log Spoofing

+ +

 

+ +

Solution:

+ +

 

+ +

This lesson accepts any input for a username and appends the information +to the log file.

+ +

 

+ +

Enter for username the text: smith Login Succeeded for username admin

+ +

 

+ +

+ +

Figure 2 Log spoof with long text

+ +

 

+ +

The text is added to the same line, not a new line. But any input is +allowed.

+ +

In this way you can inject carriage return (%0d) and line feed (%0a) to +the application.

+ +

 

+ +

Fill out the following text for the username: Smith%0d%0aLogin Succeeded +for username: admin

+ +

 

+ +

+ +

Figure 3 Lesson completed

+ +

 

+ +

An attacker +can use this attack to add malicious JavaScript to the log file, which will be +viewed by the administrator using a browser. What happens when you inject admin +<script>alert(document.cookie)</script> for the username?

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/Thumbs.db b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/Thumbs.db new file mode 100644 index 000000000..c8864bbfb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/Thumbs.db differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/filelist.xml new file mode 100644 index 000000000..66f2f27d6 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image001.png new file mode 100644 index 000000000..59ffaca93 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image003.png new file mode 100644 index 000000000..100684c5f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image005.png new file mode 100644 index 000000000..0174b03b0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image007.jpg b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image007.jpg new file mode 100644 index 000000000..50abf182f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image007.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image008.jpg new file mode 100644 index 000000000..afd0c3eb3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image009.jpg new file mode 100644 index 000000000..259e28f16 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/LogSpoofing_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl.html b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl.html new file mode 100644 index 000000000..70661cf1e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl.html @@ -0,0 +1,650 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Bypass a Path Based Access +Control Scheme

+ +

Concept / Topic To Teach: +
+In a path based access control scheme, +an attacker can traverse a path by providing relative path information. +Therefore an attacker can use relative paths to access files that normally are +not directly accessible by anyone, or would otherwise be denied if requested +directly.

+ +

General Goal(s): +
+The user should be able to +access a file that is not in the listed directory.

+ +

+ +

Figure 1 Lesson 8

+ +

 

+ +

Solution:

+ +

 

+ +

This lesson +can be solved by intercepting the filename in WebScarab and replacing it with +../main.jsp which is a file located in a folder below the current directory.

+ +

 

+ +

+ +

Figure 2 Change the variable File

+ +

 

+ +

+ +

Figure 3 Lessen 8 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/filelist.xml new file mode 100644 index 000000000..496ea3696 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image001.png new file mode 100644 index 000000000..089968f01 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image002.jpg new file mode 100644 index 000000000..4d4b17604 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image003.png new file mode 100644 index 000000000..0bc317162 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image004.jpg new file mode 100644 index 000000000..7978fe44b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image005.png new file mode 100644 index 000000000..4f0de1d74 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image006.jpg new file mode 100644 index 000000000..4d4491eb3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/PathBasedAccessControl_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS.html b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS.html new file mode 100644 index 000000000..cf6dc625d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS.html @@ -0,0 +1,685 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Perform Reflected Cross Site +Scripting (XSS) Attacks

+ +

Concept / Topic To Teach:
+It is always a good practice to validate +all input on the server side. XSS can occur when unvalidated user input is used +in an HTTP response. In a reflected XSS attack, an attacker can craft a URL +with the attack script and post it to another website, email it, or otherwise +get a victim to click on it.

+ +

General Goal(s):
+For this exercise, your +mission is to come up with some input containing a script. You have to try to +get this page to reflect that input back to your browser, which will execute +the script and do something bad.

+ +

+ +

Figure 1 Lesson 15

+ +

 

+ +

Solution:

+ +

 

+ +

Enter +<script>alert('Bang!')</script> for the PIN value

+ +

 

+ +

+ +

Figure 2 Lesson 15 Completed

+ +

 

+ +
+ + +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/filelist.xml new file mode 100644 index 000000000..8ebcbe37d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/filelist.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image001.png new file mode 100644 index 000000000..6ff72a45b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image003.png new file mode 100644 index 000000000..e44f2e566 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image005.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image005.jpg new file mode 100644 index 000000000..73cdb0bbf Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image005.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image006.jpg new file mode 100644 index 000000000..fb2e1977e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ReflectedXSS_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw.html b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw.html new file mode 100644 index 000000000..09c5164d1 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw.html @@ -0,0 +1,666 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: Remote +Admin Access

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Applications +will often have an administrative interface that allows privileged users access +to functionality that normal users shouldn't see. The application server will +often have an admin interface as well.

+ +

 

+ +

General +Goal(s):

+ +

Try to access +the administrative interface for WebGoat. You may also try to access the +administrative interface for Tomcat. The Tomcat admin interface can be accessed +via a URL (/admin) and will not count towards the completion of this lesson.

+ +

 

+ +

+ +

Figure 1 Lesson 7

+ +

 

+ +

Solution:

+ +

 

+ +

Append &admin=true to the URL in the +browser and hit “Enter”

+ +

 

+ +

Open the menu +“Admin functions” and notice that you have additional menu options like +“Database Dump”, “User Information” and “Product Information”.

+ +

 

+ +

+ +

Figure 2 Some extra admin functions

+ +

 

+ +

Clicking on +“User Information” will not work. This is because the URL behind “User +Information” is http://localhost/WebGoat/attack?Screen=71&menu=10 +does not contain the parameter admin=true. Rewrite the URL to become http://localhost/WebGoat/attack?Screen=71&menu=10&admin=true

+ +

 

+ +

Remark: the parameter Screen is generated +randomly and can be different in your environment!

+ +

 

+ +

+ +

Figure 3 Lesson 7 Completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/filelist.xml new file mode 100644 index 000000000..abc27092d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image001.png new file mode 100644 index 000000000..eb4392c2d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image002.jpg new file mode 100644 index 000000000..6301ccbb1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image003.png new file mode 100644 index 000000000..b6bf2f272 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image004.jpg new file mode 100644 index 000000000..d94ac96c1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image005.png new file mode 100644 index 000000000..4a274e847 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image006.jpg new file mode 100644 index 000000000..b93cbad84 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/RemoteAdminFlaw_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions.html b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions.html new file mode 100644 index 000000000..06ef67a06 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions.html @@ -0,0 +1,932 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Silent Transactions Attacks.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches how to perform silent transactions attacks.

+ +

 

+ +

How the +attacks works:

+ +

Any system that +silently processes transactions using a single submission is dangerous to the +client. For example, if a normal web application allows a simple URL +submission, a preset session attack will allow the attacker to complete a +transaction without the user’s authorization. In Ajax, it gets worse: the +transaction is silent; it happens with no user feedback on the page, so an +injected attack script may be able to steal money from the client without +authorization.

+ +

 

+ +

General +Goal(s):

+ +

This is a +sample internet banking application - money transfer page.

+ +

It shows +below your balance, the account you are transferring to and amount you will +transfer.
+The application uses AJAX to submit the transaction after doing some basic +client side validations.
+Your goal is to try to bypass the user's authorization and silently execute the +transaction.
+
+

+ +

+ +

Figure 1 AJAX Security - Silent transaction attacks

+ +

 

+ +

Solution:

+ +

This web +application uses JavaScript on the client to initiate a transaction for +transferring money. Examining the HTML source reveals that two JavaScript +functions are being used:

+ +

 

+ +

<script>

+ +

function +processData(){

+ +

 var accountNo = +document.getElementById('newAccount').value;

+ +

 var amount = +document.getElementById('amount').value;

+ +

 if ( accountNo == ''){

+ +

 alert('Please enter a valid account number to +transfer to.')

+ +

 return;

+ +

}

+ +

 else if ( amount == ''){

+ +

 alert('Please enter a valid amount to +transfer.')

+ +

 return;

+ +

}

+ +

 var balanceValue = +document.getElementById('balanceID').innerText;

+ +

 balanceValue = balanceValue.replace( new +RegExp('$') , '');

+ +

 if ( parseFloat(amount) > +parseFloat(balanceValue) ) {

+ +

 alert('You can not transfer more funds than +what is available in your balance.')

+ +

 return;

+ +

}

+ +

 document.getElementById('confirm').value  = 'Transferring'

+ +

submitData(accountNo, +amount);

+ +

 document.getElementById('confirm').value  = 'Confirm'

+ +

balanceValue += parseFloat(balanceValue) - parseFloat(amount);

+ +

balanceValue += balanceValue.toFixed(2);

+ +

document.getElementById('balanceID').innerText += balanceValue + '$';

+ +

}

+ +

function +submitData(accountNo, balance) {

+ +

var url = +'/WebGoat/attack?Screen=74&menu=1150&from=ajax&newAccount='+ +accountNo+ '&amount=' + balance +'&confirm=' + +document.getElementById('confirm').value;

+ +

if (typeof +XMLHttpRequest != 'undefined') {

+ +

req = new +XMLHttpRequest();

+ +

} else if +(window.ActiveXObject) {

+ +

req = new +ActiveXObject('Microsoft.XMLHTTP');

+ +

   }

+ +

   req.open('GET', url, true);

+ +

   req.onreadystatechange = callback;

+ +

   req.send(null);

+ +

}

+ +

function +callback() {

+ +

    if (req.readyState == 4) {

+ +

        if (req.status == 200) {

+ +

                   var result =  req.responseText ;

+ +

                                     var resultsDiv = +document.getElementById('resultsDiv');

+ +

                                                resultsDiv.innerHTML = '';

+ +

                                                resultsDiv.innerHTML += result;

+ +

        }}}

+ +

</script>

+ +

 

+ +

The function +processData() is called when the user fills out an account number and an amount +to transfer. The function processData() will check if the user has sufficient +balance before initiating the transaction. After validation of the balance, the +JavaScript function submitData(accountNo, balance) is called which actually +submits the required information, target account number and the amount to +transfer, to the back-end web application.

+ +

 

+ +

If you are +able to call this JavaScript function submitData(accountNo, balance) from the +browser, you are able to bypass the client-side validation and execute this +transaction silently, without an additional approval or digital signature of +the user.

+ +

 

+ +

The latest +generation of browsers allows to call JavaScript from the address bar, using +javascript:function();. Try to execute: javascript:submitData(1234556,11000);

+ +

 

+ +

+ +

Figure 2 Follow the hints....

+ +

 

+ +

+ +

Figure 3 HTTP Request generated from Javascript function +submitData(123456,110000);

+ +

 

+ +

 

+ +

+ +

Figure 4 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/filelist.xml new file mode 100644 index 000000000..dbcf5ad0e --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image001.png new file mode 100644 index 000000000..61f7e63a1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image003.png new file mode 100644 index 000000000..faf59c077 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image005.png new file mode 100644 index 000000000..4f4f0608a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image007.png new file mode 100644 index 000000000..04494b197 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image009.jpg new file mode 100644 index 000000000..b2529e37c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image010.jpg new file mode 100644 index 000000000..da2d8692a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image011.jpg new file mode 100644 index 000000000..efdefff06 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image012.jpg new file mode 100644 index 000000000..8375ab7cd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SilentTransactions_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest.html b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest.html new file mode 100644 index 000000000..f1e1a5059 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest.html @@ -0,0 +1,874 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Create a SOAP Request

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Web +Services communicate through the use of SOAP requests. These requests are +submitted to a web service in an attempt to execute a function defined in the +web service definition language (WSDL). Let's learn something about WSDL files. +Check out WebGoat's web service description language (WSDL) file.

+ +

 

+ +

General +Goal(s):

+ +

Try +connecting to the WSDL with a browser or Web Service tool. The URL for the web +service is: http://localhost/WebGoat/services/SoapRequest The WSDL can usually +be viewed by adding a ?WSDL on the end of the web service request.

+ +

 

+ +

+ +

Figure 1 - Lesson 21

+ +

 

+ +

Solution:

+ +

 

+ +

Click on the +URL “WebGoat WSDL” to examine the Webservices Description Language file.

+ +

 

+ +

+ +

Figure 2 - WSDL

+ +

 

+ +

Count the +number of operations like getFirstName. There are 4 operations defined.

+ +

 

+ +

+ +

Figure 3 Enter the ID

+ +

 

+ +

For the next +question the getFirstNameRequest method uses an int as parameter type. Enter +int and click “Submit”.

+ +

 

+ +

+ +

Figure 4 Stage 2 Completed

+ +

 

+ +

Intercept the +HTTP Request with WebScarab and click on the “Raw” tab. Make sure that +“Intercept Responses” is selected.

+ +

 

+ +
    +
  1. Change the POST header to open + the SoapRequest.
    2. +
  2. Change the Content-Type to + text/xml.
    3. +
  3. Add a header SOAPAction.
    4. +
  4. Append the XML envelope to the + request
    5. +
+ +

 

+ +

POST +http://neo:80/WebGoat/services/SoapRequest HTTP/1.1

+ +

Content-Type: +text/xml

+ +

SOAPAction: +

+ +

 

+ +

<?xml +version="1.0" encoding="UTF-8"?>

+ +

<SOAP-ENV:Envelope +xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"

+ +

xmlns:xsd="http://www.w3.org/2001/XMLSchema" +

+ +

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> +

+ +

  <SOAP-ENV:Body>

+ +

    <ns1:getFirstName +SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" +xmlns:ns1="http://lessons">

+ +

    <id +xsi:type="xsd:int">101</id>

+ +

    +</ns1:getFirstName> +

+ +

  </SOAP-ENV:Body>

+ +

</SOAP-ENV:Envelope>

+ +

 

+ +

The response +is Joe.

+ +

+ +

Figure 5 Intercept response

+ +

 

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/filelist.xml new file mode 100644 index 000000000..2c3012bc9 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/filelist.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image001.png new file mode 100644 index 000000000..baa4ba50f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image002.jpg new file mode 100644 index 000000000..f9ab80c9b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image003.png new file mode 100644 index 000000000..ab5ed9af8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image004.jpg new file mode 100644 index 000000000..c12c37f71 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image005.png new file mode 100644 index 000000000..f46b3b8f7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image006.jpg new file mode 100644 index 000000000..d7c4069ba Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image007.png new file mode 100644 index 000000000..a841fc1d5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image008.jpg new file mode 100644 index 000000000..2d4b523a5 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image009.png new file mode 100644 index 000000000..2b7656cc1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image010.jpg new file mode 100644 index 000000000..910fb47dc Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SoapRequest_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection.html new file mode 100644 index 000000000..b2cdc9750 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection.html @@ -0,0 +1,715 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to Perform Numeric SQL Injection

+ +

 

+ +

Concept / +Topic To Teach:

+ + +

+SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks, an incredible number of systems on the internet are susceptible to this form of attack. + +Not only is it a threat easily instigated, it is also a threat that, with a little common-sense and forethought, can easily be prevented. + +It is always good practice to sanitize all input data, especially data that will used in OS command, scripts, and database queiries, even if the threat of SQL injection has been prevented in some other manner.

+

 

+

General +Goal(s):

+ +

+The form below allows a user to view weather data. Try to inject an SQL string that results in all the weather data being displayed. + +

+ +

 

+ +

Solution:

+ +

 

+ +

+ +

 

+ +

The +application is taking your input and inserting it at the end of a pre-formed +SQL command.

+ +

Compound SQL +statements can be made by joining multiple tests with keywords like AND and OR. +Try appending a SQL statement that always resolves to true.

+ +

 

+ +

This is the +query: SELECT * FROM user_data WHERE userid = 101

+ +

 

+ +

What happens +if you insert 101 or 1=1?

+ +

 

+ +

+ +

Figure 1 Numeric SQL Injection

+ +

 

+ +

+ +

Figure 2 Lesson 17 Completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/filelist.xml new file mode 100644 index 000000000..ce53b8ce8 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image001.png new file mode 100644 index 000000000..4876d330e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image002.jpg new file mode 100644 index 000000000..11fa10d47 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image003.png new file mode 100644 index 000000000..272aa8b2b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image004.jpg new file mode 100644 index 000000000..38109d42f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image005.png new file mode 100644 index 000000000..f2868eb02 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image006.jpg new file mode 100644 index 000000000..eb31b8e72 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlNumericInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection.html new file mode 100644 index 000000000..3b57def06 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection.html @@ -0,0 +1,715 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform String SQL Injection

+ +

 

+ +

Concept / +Topic To Teach:

+ + + +

SQL injection +attacks represent a serious threat to any database-driven site. The methods +behind an attack are easy to learn and the damage caused can range from +considerable to complete system compromise. Despite these risks, an incredible +number of systems on the internet are susceptible to this form of attack.
+
+Not only is it a threat easily instigated, it is also a threat that, with a +little common-sense and forethought, can easily be prevented.
+
+It is always good practice to sanitize all input data, especially data that +will used in OS command, scripts, and database queiries, even if the threat of +SQL injection has been prevented in some other manner.

+ +

 

+ +

General +Goal(s):

+ +

The form +below allows a user to view their credit card numbers. Try to inject an SQL +string that results in all the credit card numbers being displayed. Try the +user name of 'Smith'.

+ +

 

+ +

Solution:

+ +

 

+ +

Compared with +the previous lesson, there is now a string parameter and not an integer.

+ +

Strings must be +terminated with single quotes to have a valid SQL Query.

+ +

 

+ +

+ +

Figure 1 Lesson 18

+ +

 

+ +

The query +used in this lesson is: SELECT * FROM user_data WHERE last_name = 'Your Name'

+ +

 

+ +

Enter for the +last name value: Erwin' OR '1'='1

+ +

 

+ +

+ +

Figure 2 Lesson 18 Completed

+ +

 

+ +
+ + +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/filelist.xml new file mode 100644 index 000000000..fd0a8d509 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/filelist.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image001.png new file mode 100644 index 000000000..030affe86 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image003.png new file mode 100644 index 000000000..83342678d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image005.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image005.jpg new file mode 100644 index 000000000..4154afc6a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image005.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image006.jpg new file mode 100644 index 000000000..dbe7cb0ad Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/SqlStringInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/filelist.xml new file mode 100644 index 000000000..a3cfc699b --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image001.png new file mode 100644 index 000000000..1ad882b5f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image003.png new file mode 100644 index 000000000..d44ec5c39 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image005.png new file mode 100644 index 000000000..5a5d10342 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image007.jpg b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image007.jpg new file mode 100644 index 000000000..ca84b8469 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image007.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image008.jpg new file mode 100644 index 000000000..8ece60e0a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image009.jpg new file mode 100644 index 000000000..c0313ee42 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/StoredXSS_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/StoredXss.html b/ webgoat/main/project/WebContent/lesson_solutions/StoredXss.html new file mode 100644 index 000000000..78fc547b2 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/StoredXss.html @@ -0,0 +1,705 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Perform Stored Cross Site +Scripting (XSS)

+ +

 

+ +

Concept / Topic To Teach:

+ +

It is always a +good practice to scrub all inputs, especially those inputs that will later be +used as parameters to OS commands, scripts, and database queries. It is +particularly important for content that will be permanently stored somewhere. +Users should not be able to create message content that could cause another +user to load an undesirable page or undesirable content when the user's message +is retrieved.

+ +

 

+ +

General Goal(s):

+ +

The user +should be able to add message content that cause another user to load an +undesirable page or content.

+ +

 

+ +

+ +

Figure 1 Lesson 14

+ +

 

+ +

Solution:

+ +

 

+ +

Enter this: <script language=”javascript” +type=”text/javascript”>alert(‘Ha Ha Ha’);</script> in the message text +box.

+ +

+ +

Figure 2 Stored message

+ +

 

+ +

+ +

Figure 3 Lesson 14 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem.html b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem.html new file mode 100644 index 000000000..462df8119 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem.html @@ -0,0 +1,670 @@ + + + + + + + + + + + + + + + + + + + +
+ +

 

+ +

Lesson +Plan Title: How to +Exploit Thread Safety Problems

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Web +applications can handle many HTTP requests simultaneously. Developers often use +variables that are not thread safe.  Thread safety means that the fields +of an object or class always maintain a valid state when used concurrently by +multiple threads. It is often possible to exploit a concurrency bug by loading +the same page as another user at the exact same time.
+Because all threads share the same method area, and the method area is where +all class variables are stored, multiple threads can attempt to use the same +class variables concurrently.

+ +

 

+ +

General +Goal(s):

+ +

The user +should be able to exploit the concurrency error in the web application and view +login information for another user that is attempting the same function at the +same time.

+ +

 

+ +

This will +require the use of two browser windows.

+ +

 

+ +

+ +

Figure 1 Lesson 2

+ +

 

+ +

Solution:

+ +

 

+ +

Open a new +browser window by pressing CTRL-N. Position the window so that you see both +input fields. Enter user name “dave” in the left window and user name “jeff” in +the right window.

+ +

Click very +fast on the submit button in the right window and then in the left window.

+ +

 

+ +

+ +

Figure 2 2 Browser Windows

+ +

 

+ +

The result +should be that you receive the same data in both windows, even when using a +different user name!

+ +

+ +

Figure 3 Lesson 2 Completed

+ +

 

+ +

The root-cause +of this exploit is that the Java code uses a static variable for the user name. +When submitting twice, the same thread and hence the same static variable +containing the username of the first request will be used.

+ +

This is +obvious when examining the Java code:

+ +

 

+ +

private +static String currentUser;

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/filelist.xml new file mode 100644 index 000000000..010502f71 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image001.png new file mode 100644 index 000000000..398af0841 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image002.jpg new file mode 100644 index 000000000..52526d118 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image003.png new file mode 100644 index 000000000..d22701fe3 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image004.jpg new file mode 100644 index 000000000..4b222b8f0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image007.png new file mode 100644 index 000000000..8c9ea75b7 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image009.jpg new file mode 100644 index 000000000..6a1c67f50 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/ThreadSafetyProblem_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS.html b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS.html new file mode 100644 index 000000000..fff4a9aac --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS.html @@ -0,0 +1,685 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Cross Site Tracing (XST) Attacks

+ +

 

+ +

Concept / +Topic To Teach:

+ +

It +is always a good practice to scrub all input, especially those inputs that will +later be used as parameters to OS commands, scripts, and database queries. It +is particularly important for content that will be permanently stored somewhere +in the application. Users should not be able to create message content that +could cause another user to load an undesireable page or undesireable content +when the user's message is retrieved.

+ +

 

+ +

General +Goal(s):

+ +

Tomcat is +configured to support the HTTP TRACE command. Your goal is to perform a Cross +Site Tracing (XST) attack.

+ +

 

+ +

Solution:

+ +

 

+ +

You need to +introduce a cross site trace attack. This can be realized by embedding the +following script in the three digit access code.

+ +

 

+ +

<script +type="text/javascript">if ( navigator.appName.indexOf("Microsoft") +!=-1) {var xmlHttp = new +ActiveXObject("Microsoft.XMLHTTP");xmlHttp.open("TRACE", +"./", false); xmlHttp.send();str1=xmlHttp.responseText; while +(str1.indexOf("\n") > -1) str1 = str1.replace("\n","<br>"); +document.write(str1);}</script>

+ +

 

+ +

+ +

Figure 1 Lesson 15

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/filelist.xml new file mode 100644 index 000000000..90de9a7db --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/filelist.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image001.png new file mode 100644 index 000000000..1a73bd667 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image002.jpg new file mode 100644 index 000000000..fd3b3d48e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/TraceXSS_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail.html b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail.html new file mode 100644 index 000000000..c1aa214dd --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail.html @@ -0,0 +1,672 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Exploit Unchecked Email

+ +

 

+ +

Concept / Topic To Teach:

+ +

It is always +a good practice to validate all inputs. Most sites allow non-authenticated users +to send e-mail to a 'friend'. This is a great mechanism for spammers to send +out email using your corporate mail server.

+ +

 

+ +

General Goal(s):

+ +

The user +should be able to send an obnoxious email message.

+ +

 

+ +

Solution:

+ +

Type a +malicious script like <script>alert(‘XSS’)</script> and click Send!

+ +

 

+ +

+ +

Figure 1 Lesson 5

+ +

 

+ +

 

+ +

 

+ +

+ +

Figure 2 Part 1 completed

+ +

 

+ +

The second +part of this lesson is to send a mail to a friend from OWASP. This can be +accomplished by intercepting the request with WebScarab and changing the hidden +field “to” from webgoat.admin@owasp.org +to bill.gates@microsoft.com

+ +

 

+ +

+ +

Figure 3 Change the variable to another e-mail +address

+ +

 

+ +

+ +

Figure 4 Lesson 5 Completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/filelist.xml new file mode 100644 index 000000000..679895ff7 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image001.png new file mode 100644 index 000000000..4c5655e62 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image002.jpg new file mode 100644 index 000000000..62a30cf94 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image003.png new file mode 100644 index 000000000..8fd3ad15c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image004.jpg new file mode 100644 index 000000000..2a5943d8f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image005.png new file mode 100644 index 000000000..861f3dc14 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image006.jpg new file mode 100644 index 000000000..fae87c128 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image007.png new file mode 100644 index 000000000..46049533d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image008.jpg new file mode 100644 index 000000000..fe5aa8442 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/UncheckedEmail_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning.html b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning.html new file mode 100644 index 000000000..b4aeb478c --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning.html @@ -0,0 +1,724 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform WSDL Scanning

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Web +Services communicate through the use of SOAP requests. These requests are +submitted to a web service in an attempt to execute a function defined in the +web service definition language (WSDL) file.

+ +

 

+ +

General +Goal(s):

+ +

This screen +is the API for a web service. Check the WSDL file for this web service and try +to get some customer credit numbers.

+ +

 

+ +

+ +

Figure 1 Lesson 22

+ +

 

+ +

Solution:

+ +

 

+ +

Open the WSDL +file in a new window. There is an operation getCreditCard.

+ +

 

+ +

+ +

 

+ +

Intercept the +request with WebScarab and change the parameter to getCreditCard

+ +

 

+ +

+ +

Figure 2 WebScarab raw request

+ +

 

+ +

+ +

Figure 3 Lesson 22 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/filelist.xml new file mode 100644 index 000000000..5f46ccf32 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image001.png new file mode 100644 index 000000000..3268c9b0a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image003.png new file mode 100644 index 000000000..25ea1988a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image005.png new file mode 100644 index 000000000..63f42f9de Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image007.png new file mode 100644 index 000000000..9ca7703d6 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image009.jpg new file mode 100644 index 000000000..fb0e23ea9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image010.jpg new file mode 100644 index 000000000..cb7259343 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image011.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image011.jpg new file mode 100644 index 000000000..300095af6 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image011.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image012.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image012.jpg new file mode 100644 index 000000000..2d00abf25 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/image012.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WSDLScanning_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie.html b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie.html new file mode 100644 index 000000000..1a7b454ee --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie.html @@ -0,0 +1,914 @@ + + + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Spoof an Authentication Cookie

+ +

 

+ +

Concept / Topic To Teach:

+ + + +

Many +applications will automatically log a user into their site if the right +authentication cookie is specified.   Some times the cookie values can be +guessed if the algorithm for generating the cookie can be obtained.  Some +times the cookies are left on the client machine and can be stolen by +exploiting another system vulnerability.  Some times the cookies maybe +intercepted using Cross site scripting.  This lesson tries to make the +student aware of authentication cookies and presents the student with a way to +defeat the cookie authentication method in this lesson.
+
+

+ + + +

General Goal(s):

+ +

The user +should be able to bypass the authentication check.

+ +

 

+ +

Solution:

+ +

 

+ +

Make sure +that you have “Show Cookies” enabled in WebGoat. And you need to disable the +feature “Inject know cookies into requests” in WebScarab otherwise WebScarab +will always inject your old cookie and not the new cookie.

+ +

 

+ +

+ +

Figure 1 Disable "Inject known cookies into +requests"

+ +

 

+ +

+ +

Figure 2 Logon with webgoat/webgoat

+ +

 

+ +

You can login +with webgoat/webgoat.

+ +

 

+ +

+ +

Figure 3 Logged on as webgoat

+ +

 

+ +

Hit +“Refresh”. This refresh will show our AuthCookie. And you are now authenticated +using this cookie and not with parameters like above.

+ +

 

+ +

+ +

 

+ +

There is a +new cookie called AuthCookie with values 65432ubphcfx. Logout and login with +aspect/aspect.

+ +

 

+ +

+ +

Figure 4 Logon as aspect/aspect

+ +

 

+ +

+ +

Figure 5 Logged on as aspect

+ +

 

+ +

Hit “Refresh” +to see the new cookie.

+ +

 

+ +

+ +

Figure 6 Cookie for user aspect

+ +

 

+ +

You have now +a different cookie value for AuthCookie: 65432udfgfb

+ +

 

+ + + + + + + + + + +
+

webgoat

+ 		+

ubphcfx

+
+

Aspect

+ 		+

udfgfb

+
+ +

 

+ +

This is an transposition +of the letters of the alphabet. Each letter is replaced with its successor, for +example t->u, a->b and the user name is reversed. So for user name alice the cookie will +contain the reversed user name ecila and the successors of the letters. This +results in fdjmb.

+ +

 

+ +

Login with +user name alice +and intercept the request in WebScarab. Add AuthCookie=65432fdjmb to the +existing cookie JSESSIONID.

+ +

 

+ +

 

+ +

 

+ +

+ +

Figure 7 Add AuthCookie to request

+ +

 

+ +

+ +

Figure 8 Lesson 11 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/filelist.xml new file mode 100644 index 000000000..ce42de1c0 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/filelist.xml @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image001.png new file mode 100644 index 000000000..edac8c19a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image003.png new file mode 100644 index 000000000..0306a8f1f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image005.png new file mode 100644 index 000000000..7afb889fe Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image007.png new file mode 100644 index 000000000..5c6c3d9c8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image009.png new file mode 100644 index 000000000..6d110d265 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image011.png new file mode 100644 index 000000000..6831d62bf Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image013.png new file mode 100644 index 000000000..c04235add Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image015.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image015.png new file mode 100644 index 000000000..b0a6eceb4 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image015.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image017.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image017.png new file mode 100644 index 000000000..78a1feb74 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image017.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image019.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image019.jpg new file mode 100644 index 000000000..a6e68a265 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image019.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image020.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image020.jpg new file mode 100644 index 000000000..338a42ed8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image020.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image021.jpg new file mode 100644 index 000000000..c1662c8f0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image022.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image022.jpg new file mode 100644 index 000000000..96f7253fd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image022.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image023.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image023.jpg new file mode 100644 index 000000000..c856ee032 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image023.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image024.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image024.jpg new file mode 100644 index 000000000..1cbf8ff3a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image024.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image025.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image025.jpg new file mode 100644 index 000000000..d9b59af8b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image025.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image026.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image026.jpg new file mode 100644 index 000000000..5d30443e1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image026.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image027.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image027.jpg new file mode 100644 index 000000000..dec137dce Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/image027.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakAuthenticationCookie_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID.html b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID.html new file mode 100644 index 000000000..32e11cc15 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID.html @@ -0,0 +1,895 @@ + + + + + + + + + + + + + + + + + + + +
+ +

 

+ +

Lesson +Plan Title: How to +Hijack a Session

+ +

 

+ +

Concept / +Topic To Teach:

+ + + +

Application +developers who develop their own session IDs frequently forget to incorporate +the complexity and randomness necessary for security. If the user specific +session ID is not complex and random, then the application is highly +susceptible to session-based brute force attacks.

+ +

 

+ +

General +Goal(s):

+ +

Try to access +an authenticated session belonging to someone else.

+ + + +

 

+ +

In this +lesson the purpose is to predict the WEAKID value. The WEAKID is used to +differentiate authenticated and anonymous users of WebGoat.

+ +

 

+ +

+ +

 

+ +

 

+ +

Solution:

+ +

 

+ +

The easiest +way to complete this lesson is to use WebScarab’s Session ID Analysis.

+ +

 

+ +

Go to +WebScarab and click on the button “SessionID Analysis”. Select the last POST +request from the “Previous requests” drop-down box.

+ +

+ +

Figure 1 WebScarabs SessionID Analysis

+ +

 

+ +

To make sure +that WebScarab is able to fetch the WEAKID cookie, you need to click the “Test” +button on the bottom of the screen. A pop-up window must be shown like below.

+ +

 

+ +

+ +

Figure 2 SessionID WEAKID discovered

+ +

 

+ +

If you don’t +have a pop-up window with the Extracted Sessionids, you must edit the Request. +You must delete the WEAKID value from the request. Without this cookie value, +WebGoat will return a HTTP Header “Set-Cookie: WEAKID=value” so WebScarab +learns about this value.

+ +

 

+ +

 

+ +

Fetch 50 +samples and examine the results. Enter “50” in the “Samples” window and click +the button “Fetch”. You will not see any information about progress.

+ +

 

+ +

+ +

 

+ +

Now you need +to go to the tab “Analysis”.

+ +

 

+ +

+ +

 

+ +

In the “Analysis” +pane you see nothing.

+ +

+ +

You must +select the Session Identifier WEAKID value from the drop-down box.

+ +

 

+ +

+ +

 

+ +

The WEAKID is +divided in 2 parts: the first part is an identifier that is added 1 in every +cookie and a time value. The time value is calculated at the moment that you +submit the request.

+ +

 

+ +

Notice that +there is sometimes a gap in the first value of the WEAKID, skipping with 1. The +value that is missing is the value that you need to know to log on. Now you +only need to calculate the timestamp. This can be brute-forced using Crowbar. +You know the previous timestamp and the next timestamp so you have a start and +end value.

+ +

 

+ +

+ +

 

+ +

There is a +value 16935 and a value 16937 with a numeric difference of 28110 instead of +14109, so there the WEAKID cookie is located. Copy and paste the raw HTTP +request in Crowbar:

+ +

+ +

Figure 3 Crowbar

+ +

 

+ +

 

+ +

 

+ +

 

+ +

Change target +to localhost and the port to 80.

+ +

Create a Base +response. Make sure that you see “How to hijack a session” in the middle +window.

+ +

 

+ +

Insert ##1## +in the WEAKID parameter where you want to brute-force the value. Start the +first loop at 363093, the last digits of the last cookie before the +authentication cookie and 363203, the first cookie after the authentication +cookie. We have to brute-force these values, but we are sure that they lie +between these two boundaries.

+ +

Examine the +results until you see a different fuzzy logic value (the blue line J), right-click it and click on “Show +reply”.

+ +

 

+ +

+ +

Figure 4 Lesson 12 Completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/filelist.xml new file mode 100644 index 000000000..082acf789 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/filelist.xml @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image001.png new file mode 100644 index 000000000..560ca80c0 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image003.png new file mode 100644 index 000000000..f0100265e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image005.png new file mode 100644 index 000000000..c42733b93 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image007.png new file mode 100644 index 000000000..a34c6751c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image010.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image010.png new file mode 100644 index 000000000..0c6fe9313 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image010.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image012.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image012.png new file mode 100644 index 000000000..46b787813 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image012.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image014.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image014.png new file mode 100644 index 000000000..bde7fd0bd Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image014.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image016.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image016.png new file mode 100644 index 000000000..d25bc4167 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image016.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image018.png b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image018.png new file mode 100644 index 000000000..bb0344681 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image018.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image020.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image020.jpg new file mode 100644 index 000000000..b825cea5d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image020.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image021.jpg new file mode 100644 index 000000000..a7fd9b516 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image022.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image022.jpg new file mode 100644 index 000000000..b38898623 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image022.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image023.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image023.jpg new file mode 100644 index 000000000..0c3616032 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image023.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image024.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image024.jpg new file mode 100644 index 000000000..632ca5835 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image024.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image025.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image025.jpg new file mode 100644 index 000000000..0ab015bbb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image025.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image026.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image026.jpg new file mode 100644 index 000000000..bc5a7fe32 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image026.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image027.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image027.jpg new file mode 100644 index 000000000..7bbdb5f09 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image027.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image028.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image028.jpg new file mode 100644 index 000000000..4530c95f9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image028.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image029.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image029.jpg new file mode 100644 index 000000000..112d5259b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/image029.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WeakSessionID_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection.html new file mode 100644 index 000000000..ec98e6c30 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection.html @@ -0,0 +1,916 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson Plan Title: How to Perform Web Service SAX +Injection

+ +

 

+ +

Concept / Topic To Teach:

+ + + +

Web Services +communicate through the use of SOAP requests. These requests are submitted to a +web service in an attempt to execute a function defined in the web service +definition language (WSDL) file.

+ +

 

+ +

General Goal(s):

+ +

Some web +interfaces make use of Web Services in the background. If the frontend relies +on the web service for all input validation, it may be possible to corrupt the +XML that the web interface sends.
+
+

+ +

In this +exercise, try to change the password for a user other than 101.

+ +

 

+ +

 

+ +

 

+ +

Solution:

+ +

 

+ +

To succeed +this lesson it is required to reset the password of the user with a different +user-ID then 101 (which is your user-ID)

+ +

.

+ +

When you fill +out a password and click on “Go!” the following XML request will be created, +submit and parsed by the SAX parser:

+ +

 

+ +
<?xml version='1.0' encoding='UTF-8'?>
<wsns0:Envelope
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
  xmlns:xsd='http://www.w3.org/2001/XMLSchema'
  xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'
  xmlns:wsns1='http://lessons.webgoat.owasp.org'>
  <wsns0:Body>
    <wsns1:changePassword>
      <id xsi:type='xsd:int'>101</id>
      <password xsi:type='xsd:string'>[password]</password>
    </wsns1:changePassword>
  </wsns0:Body>
</wsns0:Envelope>
+ +

 

+ +

SAX parsers will parse anything that +is well-formed, meaning that there are matching end and close tags and that the +schema is correct. When you are able to add a new changePAssword element with +corresponding id tag and password tag, the SAX parser will be more than happy +to change the password for the user-ID provided.

+ +

So you need to have something like +this as a final result:

+ +

 

+ +

<?xml version='1.0' +encoding='UTF-8'?>

+ +

<wsns0:Envelope

+ +

  +xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'

+ +

  +xmlns:xsd='http://www.w3.org/2001/XMLSchema'

+ +

  +xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'

+ +

  +xmlns:wsns1='http://lessons.webgoat.owasp.org'>

+ +

  +<wsns0:Body>

+ +

    +<wsns1:changePassword>

+ +

      +<id xsi:type='xsd:int'>101</id>

+ +

      +<password xsi:type='xsd:string'>[password]</password>

+ +

    +</wsns1:changePassword>

+ +

    +<wsns1:changePassword>

+ +

      +<id xsi:type='xsd:int'>102</id>

+ +

      +<password xsi:type='xsd:string'>notforyoutoknow</password>

+ +

    +</wsns1:changePassword>

+ +

  +</wsns0:Body>

+ +

</wsns0:Envelope>

+ +

 

+ +

This requires to inject:

+ +

newpassword</password>

+ +

    +</wsns1:changePassword>

+ +

    +<wsns1:changePassword>

+ +

      +<id xsi:type='xsd:int'>102</id>

+ +

      +<password xsi:type='xsd:string'>notforyoutoknow

+ +

 

+ +

There are field-limitations in the +HTML input field, so it is required to intercept the HTTP Request with +WebScarab and replace the parameter password with the payload.

+ +

 

+ +

Enter a password ‘test’ and click +“Go!”.

+ +

+ +

Figure +113 Reset password with test

+ +

 

+ +

Intercept the request in WebScarab and +replace the string test with the payload.

+ +

 

+ +

+ +

Figure +114 Intercept request

+ +

 

+ +

+ +

Figure +115 Inject XML payload

+ +

 

+ +

+ +

Figure +116 Lesson completed

+ +

 

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/filelist.xml new file mode 100644 index 000000000..56559fd6d --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/filelist.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image001.png new file mode 100644 index 000000000..ba76d14d9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image002.jpg new file mode 100644 index 000000000..24692deda Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image003.png new file mode 100644 index 000000000..be045e27f Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image004.jpg new file mode 100644 index 000000000..c6698ffba Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image005.png new file mode 100644 index 000000000..84e5ff852 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image006.jpg new file mode 100644 index 000000000..40dcd7832 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image007.png new file mode 100644 index 000000000..94b298db1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image008.jpg new file mode 100644 index 000000000..9faeaaac1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image009.png new file mode 100644 index 000000000..acdfd2592 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image010.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image010.jpg new file mode 100644 index 000000000..ad7400d38 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/image010.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSAXInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection.html new file mode 100644 index 000000000..80c381862 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection.html @@ -0,0 +1,765 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform Web Service SQL Injection

+ +

 

+ +

Concept / +Topic To Teach:

+ +

Web +Services communicate through the use of SOAP requests. These requests are +submitted to a web service in an attempt to execute a function defined in the +web service definition language (WSDL) file.

+ +

 

+ +

General +Goal(s):

+ +

Check the web +service description language (WSDL) file and try to obtain multiple customer +credit card numbers. You will not see the results returned to this screen. When +you believe you have suceeded, refresh the page and look for the 'green star'.

+ +

Solution:

+ +

 

+ +

This lesson +can be solved easily by using a web services tool called SOAPUI. But here you +will only use WebScarab. Go in WebScarab to the tab “Web Services”. You will +see a history of invoked web services or WSDL files.

+ +

 

+ +

+ +

Figure 1 Lesson 23

+ +

 

+ +

Open the +WebGoat WSDL file for this lesson (WsSqlInjection?WSDL) in a new window.

+ +

 

+ +

In WebScarab +you can select this WSDL from the top drop-down box. And WebScarab will parse +the XML file so you can select the operations to invoke. Then you can enter a +value for the parameters used to invoke the operation. For example fill out the +integer 101 for the ID value and click “Execute”. WebScarab will pop-up a basic +authentication window. Enter guest/guest and click “Ok”.

+ +

 

+ +

+ +

Figure 2 Basic authentication

+ +

 

+ +

+ +

Figure 3 Webservice Response

+ +

 

+ +

What happens +if you change 101 to 1 OR 1=1? Will you get all the credit cards?

+ +

Yes J

+ +

 

+ +

+ +

Figure 4 All the credit cards

+ +

 

+ +

Remark: when you don’t get any responses you +might want to select the service and operation again from the drop-down box. A nice +feature here would be the ability to make a raw SOAP request.

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/filelist.xml new file mode 100644 index 000000000..2596e1075 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/filelist.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image001.png new file mode 100644 index 000000000..82abbd808 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image002.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image002.jpg new file mode 100644 index 000000000..60c86b971 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image002.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image003.png new file mode 100644 index 000000000..e658bb1b9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image004.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image004.jpg new file mode 100644 index 000000000..cb476bc0d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image004.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image005.png new file mode 100644 index 000000000..d1db6bcb8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image006.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image006.jpg new file mode 100644 index 000000000..f3e91d5e9 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image006.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image007.png new file mode 100644 index 000000000..d3bd79b6b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image008.jpg new file mode 100644 index 000000000..50c57e172 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/WsSqlInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection.html new file mode 100644 index 000000000..eaeac0ac9 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection.html @@ -0,0 +1,862 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform XML Injection Attacks.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches how to perform XML Injection attacks.

+ +

 

+ +

How the +attacks works:   

+ +

AJAX applications +use XML to exchange information with the server. This XML can be easily +intercepted and altered by a malicious attacker.

+ +

 

+ +

General +Goal(s):

+ +

WebGoat-Miles +Reward Miles shows all the rewards available. Once you've entered your account +ID, the lesson will show you your balance and the products you can afford. Your +goal is to try to add more rewards to your allowed set of rewards. Your account +ID is 836239.

+ +

 

+ +

+ +

Figure 1 AJAX Security - XML Injection

+ +

 

+ +

Solution:

+ +

 

+ +

To understand +the behavior of the AJAX application, enter your account number 836239 and +intercept the HTTP Request and HTTP Response using WebScarab.

+ +

 

+ +

+ +

Figure 2 Enter account number

+ +

 

+ +

+ +

Figure 3 Intercepted HTTP Request

+ +

 

+ +

+ +

Figure 4 Intercepted HTTP Response

+ +

 

+ +

From the HTTP Response you can see that you get back an XML +message with the rewards for your account:

+ +

 

+ +

<root>

+ +

<reward>WebGoat t-shirt 20 Pts</reward>

+ +

<reward>WebGoat Secure Kettle 50 Pts</reward>

+ +

<reward>WebGoat Mug 30 Pts</reward>

+ +

</root>

+ +

 

+ +

What happens if you intercept this HTTP Response and update +the XML message to become:

+ +

 

+ +

<root>

+ +

<reward>WebGoat t-shirt 20 Pts</reward>

+ +

<reward>WebGoat Secure Kettle 50 Pts</reward>

+ +

<reward>WebGoat Mug 30 Pts</reward>

+ +

<reward>WebGoat Core Duo Laptop 2000 +Pts</reward>

+ +

<reward>WebGoat Hawaii Cruise 3000 Pts</reward>

+ +

</root>

+ +

 

+ + +

+ +

Figure 5 Changed XML response

+ +

 

+ +

You need to +do this three times!

+ +

 

+ +

+ +

Figure 6 Injected XML results

+ +

 

+ +

+ +

Figure 7 Select your reward

+ +

 

+ +

Select the +Laptop and the Cruise and click “Submit”.

+ +

 

+ +

+ +

Figure 8 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/filelist.xml new file mode 100644 index 000000000..91acaa646 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/filelist.xml @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image001.png new file mode 100644 index 000000000..b32e9194e Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image003.png new file mode 100644 index 000000000..f0de7feb1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image005.png new file mode 100644 index 000000000..d2589d1b8 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image007.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image007.png new file mode 100644 index 000000000..d2489a851 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image007.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image009.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image009.png new file mode 100644 index 000000000..c2b095cd1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image009.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image011.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image011.png new file mode 100644 index 000000000..e316c46cb Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image011.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image013.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image013.png new file mode 100644 index 000000000..2c485734d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image013.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image015.png b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image015.png new file mode 100644 index 000000000..f59f4c79b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image015.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image017.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image017.jpg new file mode 100644 index 000000000..5cde78c29 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image017.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image018.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image018.jpg new file mode 100644 index 000000000..50a020099 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image018.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image019.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image019.jpg new file mode 100644 index 000000000..3ec8d20a1 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image019.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image020.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image020.jpg new file mode 100644 index 000000000..3181beb41 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image020.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image021.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image021.jpg new file mode 100644 index 000000000..164e97f7d Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image021.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image022.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image022.jpg new file mode 100644 index 000000000..155301a55 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image022.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image023.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image023.jpg new file mode 100644 index 000000000..3ed684669 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image023.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image024.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image024.jpg new file mode 100644 index 000000000..00a8ad33b Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/image024.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XMLInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection.html b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection.html new file mode 100644 index 000000000..d363b43e8 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection.html @@ -0,0 +1,780 @@ + + + + + + + + + + + + + + + + + + + +
+ +

Lesson +Plan Title: How to +Perform XPATH Injection Attacks.

+ +

 

+ +

Concept / +Topic To Teach:

+ +

This lesson +teaches how to perform XPath Injection attacks.

+ +

 

+ +

How the +attacks works:

+ +

Similar to SQL +Injection, XPATH Injection attacks occur when a web site uses user supplied +information to query XML data. By sending intentionally malformed information +into the web site, an attacker can find out how the XML data is structured or +access data that they may not normally have access to. They may even be able to +elevate their privileges on the web site if the xml data is being used for +authentication (such as an xml based user file). Querying XML is done with +XPath, a type of simple descriptive statement that allows the xml query to +locate a piece of information. Like SQL you can specify certain attributes to +find and patterns to match. When using XML for a web site it is common to +accept some form of input on the query string to identify the content to locate +and display on the page. This input must be sanitized to verify that it doesn't +mess up the XPath query and return the wrong data.

+ +

 

+ +

General +Goal(s):

+ +

The +form below allows employees to see all their personal data including their +salaries. Your account is Mike/test123. Your goal is to try to see other +employees data as well.

+ +

 

+ +

+ +

Figure 1 XPath Injection

+ +

 

+ +

 

+ +

 

+ +

 

+ +

Solution:

+ +

 

+ +

XPath injection is similar to SQL Injection. Input is not validated and +used to create a XPath query. Injecting Smith' or 1=1 or 'a'='a will log you on +as the first user defined in the system. Password is a required field, so there +you can enter whatever you want.

+ +

 

+ +

+ +

Figure 2 Inject XPath payload

+ +

 

+ +

+ +

Figure 3 Lesson completed

+ +

 

+ +
+ + + + + +
+ Solution by Erwin Geirnaert + ZION SECURITY
+ + + + diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/colorschememapping.xml b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/colorschememapping.xml new file mode 100644 index 000000000..b200daa38 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/colorschememapping.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/filelist.xml b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/filelist.xml new file mode 100644 index 000000000..3d5d19db6 --- /dev/null +++ b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/filelist.xml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image001.png b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image001.png new file mode 100644 index 000000000..c710b2228 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image001.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image003.png b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image003.png new file mode 100644 index 000000000..aa3b3886c Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image003.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image005.png b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image005.png new file mode 100644 index 000000000..c63e9830a Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image005.png differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image007.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image007.jpg new file mode 100644 index 000000000..a74456833 Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image007.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image008.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image008.jpg new file mode 100644 index 000000000..229e969db Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image008.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image009.jpg b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image009.jpg new file mode 100644 index 000000000..731010dab Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/image009.jpg differ diff --git a/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/themedata.thmx b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/themedata.thmx new file mode 100644 index 000000000..55426d8ec Binary files /dev/null and b/ webgoat/main/project/WebContent/lesson_solutions/XPATHInjection_files/themedata.thmx differ diff --git a/ webgoat/main/project/WebContent/main.jsp b/ webgoat/main/project/WebContent/main.jsp index b53e74b7c..9909203c5 100644 --- a/ webgoat/main/project/WebContent/main.jsp +++ b/ webgoat/main/project/WebContent/main.jsp @@ -125,12 +125,12 @@ StringBuffer buildList = new StringBuffer(); - Previous Hint + Previous Hint - Hints + Hints - Show Params + Show Params - Show Cookies + Show Cookies <% if (webSession.isAuthorizedInLesson(webSession.getRole(), WebSession.SHOWSOURCE)) @@ -155,14 +155,20 @@ StringBuffer buildList = new StringBuffer(); - Show Java + Show Java + + + Show Solution - Lesson Plans + Lesson Plans <%}%> +
diff --git a/ webgoat/main/project/WebContent/webgoat.jsp b/ webgoat/main/project/WebContent/webgoat.jsp index 50dc4daee..007a8ab0b 100644 --- a/ webgoat/main/project/WebContent/webgoat.jsp +++ b/ webgoat/main/project/WebContent/webgoat.jsp @@ -52,26 +52,26 @@
Documentation Contributers
+ +
OWASP Autumn of Code
+ (http://www.owasp.org/)
+
Sherif Koussa
(http://www.macadamian.com)
+
OWASP Spring of Code
+ (http://www.owasp.org/)
+
Erwin Geirnaert
(http://www.zionsecurity.com)
+
Sherif Koussa
(http://www.macadamian.com)
- -
Robert Sullivan
+
Robert Sullivan
(http://www.unitedhealthgroup.com/)
+
Erwin Geirnaert
+ (http://www.zionsecurity.com/)
- - -
OWASP Autumn of Code
- (http://www.owasp.org/)
-
Sherif Koussa
(http://www.macadamian.com)
- - - -
To all who have sent comments
- - -
 
+
To all who have sent comments
+ +
@@ -80,9 +80,15 @@
+ +
 
+
+
 
+
 
+
 
WARNING
While running this program, your machine is extremely vulnerable to attack. You should disconnect from the network while using this program. diff --git a/ webgoat/main/project/build.xml b/ webgoat/main/project/build.xml index ef607d673..8378ec65c 100644 --- a/ webgoat/main/project/build.xml +++ b/ webgoat/main/project/build.xml @@ -236,14 +236,18 @@ - + - +--> + + + + @@ -280,12 +284,13 @@ - - - - + +