Moved challenge 4 to challenge 6 and introduced new sql injection challenge 5
This commit is contained in:
Nanne Baars
@ -11,8 +11,8 @@ li.active{border-bottom:3px solid silver;}
|
||||
.btn-plus{cursor:pointer;font-size:7px;display:flex;align-items:center;padding:5px;padding-left:10px;padding-right:10px;border:1px solid gray;border-radius:2px;border-left:0px;}
|
||||
div.section > div {width:100%;display:inline-flex;}
|
||||
div.section > div > input {margin:0px;padding-left:5px;font-size:10px;padding-right:5px;max-width:18%;text-align:center;}
|
||||
.attr,.attr2{cursor:pointer;margin-right:5px;height:20px;font-size:10px;padding:2px;border:1px solid gray;border-radius:2px;}
|
||||
.attr.active,.attr2.active{ border:1px solid orange;}
|
||||
.attr,.attr2{cursor:pointer;margin-right:5px;height:20px;font-size:11px;padding:2px;border:1px solid gray;border-radius:2px;}
|
||||
.attr.active,.attr2.active{ border:2px solid orange;}
|
||||
|
||||
@media (max-width: 426px) {
|
||||
.container {margin-top:0px !important;}
|
||||
|
||||
@ -1,96 +1,12 @@
|
||||
.panel-login {
|
||||
border-color: #ccc;
|
||||
-webkit-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
-moz-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
a.list-group-item {
|
||||
height:auto;
|
||||
}
|
||||
.panel-login>.panel-heading {
|
||||
color: #00415d;
|
||||
background-color: #fff;
|
||||
border-color: #fff;
|
||||
text-align:center;
|
||||
a.list-group-item.active small {
|
||||
color:#fff;
|
||||
}
|
||||
.panel-login>.panel-heading a{
|
||||
text-decoration: none;
|
||||
color: #666;
|
||||
font-weight: bold;
|
||||
font-size: 15px;
|
||||
-webkit-transition: all 0.1s linear;
|
||||
-moz-transition: all 0.1s linear;
|
||||
transition: all 0.1s linear;
|
||||
}
|
||||
.panel-login>.panel-heading a.active{
|
||||
color: #029f5b;
|
||||
font-size: 18px;
|
||||
}
|
||||
.panel-login>.panel-heading hr{
|
||||
margin-top: 10px;
|
||||
margin-bottom: 0px;
|
||||
clear: both;
|
||||
border: 0;
|
||||
height: 1px;
|
||||
background-image: -webkit-linear-gradient(left,rgba(0, 0, 0, 0),rgba(0, 0, 0, 0.15),rgba(0, 0, 0, 0));
|
||||
background-image: -moz-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
background-image: -ms-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
background-image: -o-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
}
|
||||
.panel-login input[type="text"],.panel-login input[type="email"],.panel-login input[type="password"] {
|
||||
height: 45px;
|
||||
border: 1px solid #ddd;
|
||||
font-size: 16px;
|
||||
-webkit-transition: all 0.1s linear;
|
||||
-moz-transition: all 0.1s linear;
|
||||
transition: all 0.1s linear;
|
||||
}
|
||||
.panel-login input:hover,
|
||||
.panel-login input:focus {
|
||||
outline:none;
|
||||
-webkit-box-shadow: none;
|
||||
-moz-box-shadow: none;
|
||||
box-shadow: none;
|
||||
border-color: #ccc;
|
||||
}
|
||||
.btn-login {
|
||||
background-color: #59B2E0;
|
||||
outline: none;
|
||||
color: #fff;
|
||||
font-size: 14px;
|
||||
height: auto;
|
||||
font-weight: normal;
|
||||
padding: 14px 0;
|
||||
text-transform: uppercase;
|
||||
border-color: #59B2E6;
|
||||
}
|
||||
.btn-login:hover,
|
||||
.btn-login:focus {
|
||||
color: #fff;
|
||||
background-color: #53A3CD;
|
||||
border-color: #53A3CD;
|
||||
}
|
||||
.forgot-password {
|
||||
text-decoration: underline;
|
||||
color: #888;
|
||||
}
|
||||
.forgot-password:hover,
|
||||
.forgot-password:focus {
|
||||
text-decoration: underline;
|
||||
color: #666;
|
||||
}
|
||||
|
||||
.btn-register {
|
||||
background-color: #1CB94E;
|
||||
outline: none;
|
||||
color: #fff;
|
||||
font-size: 14px;
|
||||
height: auto;
|
||||
font-weight: normal;
|
||||
padding: 14px 0;
|
||||
text-transform: uppercase;
|
||||
border-color: #1CB94A;
|
||||
}
|
||||
.btn-register:hover,
|
||||
.btn-register:focus {
|
||||
color: #fff;
|
||||
background-color: #1CA347;
|
||||
border-color: #1CA347;
|
||||
.stars {
|
||||
margin:20px auto 1px;
|
||||
}
|
||||
.img-responsive {
|
||||
min-width: 100%;
|
||||
}
|
||||
@ -1,12 +0,0 @@
|
||||
a.list-group-item {
|
||||
height:auto;
|
||||
}
|
||||
a.list-group-item.active small {
|
||||
color:#fff;
|
||||
}
|
||||
.stars {
|
||||
margin:20px auto 1px;
|
||||
}
|
||||
.img-responsive {
|
||||
min-width: 100%;
|
||||
}
|
||||
@ -0,0 +1,96 @@
|
||||
.panel-login {
|
||||
border-color: #ccc;
|
||||
-webkit-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
-moz-box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
box-shadow: 0px 2px 3px 0px rgba(0,0,0,0.2);
|
||||
}
|
||||
.panel-login>.panel-heading {
|
||||
color: #00415d;
|
||||
background-color: #fff;
|
||||
border-color: #fff;
|
||||
text-align:center;
|
||||
}
|
||||
.panel-login>.panel-heading a{
|
||||
text-decoration: none;
|
||||
color: #666;
|
||||
font-weight: bold;
|
||||
font-size: 15px;
|
||||
-webkit-transition: all 0.1s linear;
|
||||
-moz-transition: all 0.1s linear;
|
||||
transition: all 0.1s linear;
|
||||
}
|
||||
.panel-login>.panel-heading a.active{
|
||||
color: #029f5b;
|
||||
font-size: 18px;
|
||||
}
|
||||
.panel-login>.panel-heading hr{
|
||||
margin-top: 10px;
|
||||
margin-bottom: 0px;
|
||||
clear: both;
|
||||
border: 0;
|
||||
height: 1px;
|
||||
background-image: -webkit-linear-gradient(left,rgba(0, 0, 0, 0),rgba(0, 0, 0, 0.15),rgba(0, 0, 0, 0));
|
||||
background-image: -moz-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
background-image: -ms-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
background-image: -o-linear-gradient(left,rgba(0,0,0,0),rgba(0,0,0,0.15),rgba(0,0,0,0));
|
||||
}
|
||||
.panel-login input[type="text"],.panel-login input[type="email"],.panel-login input[type="password"] {
|
||||
height: 45px;
|
||||
border: 1px solid #ddd;
|
||||
font-size: 16px;
|
||||
-webkit-transition: all 0.1s linear;
|
||||
-moz-transition: all 0.1s linear;
|
||||
transition: all 0.1s linear;
|
||||
}
|
||||
.panel-login input:hover,
|
||||
.panel-login input:focus {
|
||||
outline:none;
|
||||
-webkit-box-shadow: none;
|
||||
-moz-box-shadow: none;
|
||||
box-shadow: none;
|
||||
border-color: #ccc;
|
||||
}
|
||||
.btn-login {
|
||||
background-color: #59B2E0;
|
||||
outline: none;
|
||||
color: #fff;
|
||||
font-size: 14px;
|
||||
height: auto;
|
||||
font-weight: normal;
|
||||
padding: 14px 0;
|
||||
text-transform: uppercase;
|
||||
border-color: #59B2E6;
|
||||
}
|
||||
.btn-login:hover,
|
||||
.btn-login:focus {
|
||||
color: #fff;
|
||||
background-color: #53A3CD;
|
||||
border-color: #53A3CD;
|
||||
}
|
||||
.forgot-password {
|
||||
text-decoration: underline;
|
||||
color: #888;
|
||||
}
|
||||
.forgot-password:hover,
|
||||
.forgot-password:focus {
|
||||
text-decoration: underline;
|
||||
color: #666;
|
||||
}
|
||||
|
||||
.btn-register {
|
||||
background-color: #1CB94E;
|
||||
outline: none;
|
||||
color: #fff;
|
||||
font-size: 14px;
|
||||
height: auto;
|
||||
font-weight: normal;
|
||||
padding: 14px 0;
|
||||
text-transform: uppercase;
|
||||
border-color: #1CB94A;
|
||||
}
|
||||
.btn-register:hover,
|
||||
.btn-register:focus {
|
||||
color: #fff;
|
||||
background-color: #1CA347;
|
||||
border-color: #1CA347;
|
||||
}
|
||||
@ -6,100 +6,50 @@
|
||||
<div class="lesson-page-wrapper">
|
||||
<div class="adoc-content" th:replace="doc:Challenge_4.adoc"></div>
|
||||
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/challenge4.css}"/>
|
||||
<script th:src="@{/lesson_js/bootstrap.min.js}" language="JavaScript"></script>
|
||||
<script th:src="@{/lesson_js/challenge4.js}" language="JavaScript"></script>
|
||||
<div class="attack-container">
|
||||
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
||||
<div class="container-fluid">
|
||||
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<div class="panel panel-login">
|
||||
<div class="panel-heading">
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<a href="#" class="active" id="login-form-link">Login</a>
|
||||
</div>
|
||||
<div class="col-xs-6">
|
||||
<a href="#" id="register-form-link">Register</a>
|
||||
</div>
|
||||
</div>
|
||||
<hr/>
|
||||
|
||||
<div class="well">
|
||||
<div class="pull-right">
|
||||
<div class="dropdown">
|
||||
<button type="button" data-toggle="dropdown" class="btn btn-default dropdown-toggle">
|
||||
<i class="fa fa-user"></i> <span class="caret"></span>
|
||||
</button>
|
||||
<ul class="dropdown-menu dropdown-menu-left">
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Guest')"
|
||||
th:text="Guest">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Tom')"
|
||||
th:text="Tom">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Jerry')"
|
||||
th:text="Jerry">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Sylvester')"
|
||||
th:text="Sylvester">current</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="panel-body">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<form id="login-form" class="attack-form" accept-charset="UNKNOWN"
|
||||
method="POST" name="form"
|
||||
action="/WebGoat/challenge/4"
|
||||
enctype="application/json;charset=UTF-8" role="form">
|
||||
<div class="form-group">
|
||||
<input type="text" name="username_login" id="username4" tabindex="1"
|
||||
class="form-control" placeholder="Username" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="password_login" id="password4" tabindex="2"
|
||||
class="form-control" placeholder="Password"/>
|
||||
</div>
|
||||
<div class="form-group text-center">
|
||||
<input type="checkbox" tabindex="3" class="" name="remember" id="remember"/>
|
||||
<label for="remember"> Remember me</label>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-sm-6 col-sm-offset-3">
|
||||
<input type="submit" name="login-submit" id="login-submit"
|
||||
tabindex="4" class="form-control btn-primary"
|
||||
value="Log In"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<div class="text-center">
|
||||
<a href="#" tabindex="5" class="forgot-password">Forgot
|
||||
Password?</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
<form id="register-form" class="attack-form" accept-charset="UNKNOWN"
|
||||
method="PUT" name="form"
|
||||
action="/WebGoat/challenge/4"
|
||||
enctype="application/json;charset=UTF-8" style="display: none;" role="form">
|
||||
<div class="form-group">
|
||||
<input type="text" name="username_reg" id="username" tabindex="1"
|
||||
class="form-control" placeholder="Username" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="email" name="email_reg" id="email" tabindex="1"
|
||||
class="form-control" placeholder="Email Address" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="password_reg" id="password" tabindex="2"
|
||||
class="form-control" placeholder="Password"/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="confirm_password_reg" id="confirm-password"
|
||||
tabindex="2" class="form-control" placeholder="Confirm Password"/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-sm-6 col-sm-offset-3">
|
||||
<input type="submit" name="register-submit" id="register-submit"
|
||||
tabindex="4" class="form-control btn btn-primary"
|
||||
value="Register Now"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<p class="text-right">Welcome back, <b><span id="name"></span></b></p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h3>Vote for your favorite</h3>
|
||||
</div>
|
||||
<div id ="votesList" class="list-group">
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<br/>
|
||||
<form class="attack-form" method="POST" name="form" action="/WebGoat/challenge/flag">
|
||||
<div class="form-group">
|
||||
|
||||
@ -5,51 +5,67 @@
|
||||
|
||||
<div class="lesson-page-wrapper">
|
||||
<div class="adoc-content" th:replace="doc:Challenge_5.adoc"></div>
|
||||
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/challenge5.css}"/>
|
||||
<script th:src="@{/lesson_js/bootstrap.min.js}" language="JavaScript"></script>
|
||||
<script th:src="@{/lesson_js/challenge5.js}" language="JavaScript"></script>
|
||||
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/challenge6.css}"/>
|
||||
<div class="attack-container">
|
||||
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
||||
<div class="container-fluid">
|
||||
|
||||
<div class="row">
|
||||
|
||||
<div class="well">
|
||||
<div class="pull-right">
|
||||
<div class="dropdown">
|
||||
<button type="button" data-toggle="dropdown" class="btn btn-default dropdown-toggle">
|
||||
<i class="fa fa-user"></i> <span class="caret"></span>
|
||||
</button>
|
||||
<ul class="dropdown-menu dropdown-menu-left">
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Guest')"
|
||||
th:text="Guest">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Tom')"
|
||||
th:text="Tom">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Jerry')"
|
||||
th:text="Jerry">current</a></li>
|
||||
<li role="presentation"><a role="menuitem" tabindex="-1"
|
||||
onclick="javascript:login('Sylvester')"
|
||||
th:text="Sylvester">current</a></li>
|
||||
</ul>
|
||||
<div class="col-md-6">
|
||||
<div class="panel panel-login">
|
||||
<div class="panel-heading">
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<a href="#" class="active" id="login-form-link">Login</a>
|
||||
</div>
|
||||
</div>
|
||||
<hr/>
|
||||
</div>
|
||||
<div>
|
||||
<p class="text-right">Welcome back, <b><span id="name"></span></b></p>
|
||||
<div class="panel-body">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<form id="login-form" class="attack-form" accept-charset="UNKNOWN"
|
||||
method="POST" name="form"
|
||||
action="/WebGoat/challenge/5"
|
||||
enctype="application/json;charset=UTF-8" role="form">
|
||||
<div class="form-group">
|
||||
<input type="text" name="username_login" id="username4" tabindex="1"
|
||||
class="form-control" placeholder="Username" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="password_login" id="password4" tabindex="2"
|
||||
class="form-control" placeholder="Password"/>
|
||||
</div>
|
||||
<div class="form-group text-center">
|
||||
<input type="checkbox" tabindex="3" class="" name="remember" id="remember"/>
|
||||
<label for="remember"> Remember me</label>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-sm-6 col-sm-offset-3">
|
||||
<input type="submit" name="login-submit" id="login-submit"
|
||||
tabindex="4" class="form-control btn-primary"
|
||||
value="Log In"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<div class="text-center">
|
||||
<a href="#" tabindex="5" class="forgot-password">Forgot
|
||||
Password?</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h3>Vote for your favorite</h3>
|
||||
</div>
|
||||
<div id ="votesList" class="list-group">
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<br/>
|
||||
<form class="attack-form" method="POST" name="form" action="/WebGoat/challenge/flag">
|
||||
<div class="form-group">
|
||||
|
||||
@ -0,0 +1,125 @@
|
||||
<!DOCTYPE html>
|
||||
|
||||
<html xmlns:th="http://www.thymeleaf.org">
|
||||
|
||||
|
||||
<div class="lesson-page-wrapper">
|
||||
<div class="adoc-content" th:replace="doc:Challenge_6.adoc"></div>
|
||||
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/challenge6.css}"/>
|
||||
<script th:src="@{/lesson_js/challenge6.js}" language="JavaScript"></script>
|
||||
<div class="attack-container">
|
||||
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
||||
<div class="container-fluid">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<div class="panel panel-login">
|
||||
<div class="panel-heading">
|
||||
<div class="row">
|
||||
<div class="col-xs-6">
|
||||
<a href="#" class="active" id="login-form-link">Login</a>
|
||||
</div>
|
||||
<div class="col-xs-6">
|
||||
<a href="#" id="register-form-link">Register</a>
|
||||
</div>
|
||||
</div>
|
||||
<hr/>
|
||||
</div>
|
||||
<div class="panel-body">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<form id="login-form" class="attack-form" accept-charset="UNKNOWN"
|
||||
method="POST" name="form"
|
||||
action="/WebGoat/challenge/6"
|
||||
enctype="application/json;charset=UTF-8" role="form">
|
||||
<div class="form-group">
|
||||
<input type="text" name="username_login" id="username4" tabindex="1"
|
||||
class="form-control" placeholder="Username" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="password_login" id="password4" tabindex="2"
|
||||
class="form-control" placeholder="Password"/>
|
||||
</div>
|
||||
<div class="form-group text-center">
|
||||
<input type="checkbox" tabindex="3" class="" name="remember" id="remember"/>
|
||||
<label for="remember"> Remember me</label>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-sm-6 col-sm-offset-3">
|
||||
<input type="submit" name="login-submit" id="login-submit"
|
||||
tabindex="4" class="form-control btn-primary"
|
||||
value="Log In"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-lg-12">
|
||||
<div class="text-center">
|
||||
<a href="#" tabindex="5" class="forgot-password">Forgot
|
||||
Password?</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
<form id="register-form" class="attack-form" accept-charset="UNKNOWN"
|
||||
method="PUT" name="form"
|
||||
action="/WebGoat/challenge/6"
|
||||
enctype="application/json;charset=UTF-8" style="display: none;" role="form">
|
||||
<div class="form-group">
|
||||
<input type="text" name="username_reg" id="username" tabindex="1"
|
||||
class="form-control" placeholder="Username" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="email" name="email_reg" id="email" tabindex="1"
|
||||
class="form-control" placeholder="Email Address" value=""/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="password_reg" id="password" tabindex="2"
|
||||
class="form-control" placeholder="Password"/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<input type="password" name="confirm_password_reg" id="confirm-password"
|
||||
tabindex="2" class="form-control" placeholder="Confirm Password"/>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<div class="row">
|
||||
<div class="col-sm-6 col-sm-offset-3">
|
||||
<input type="submit" name="register-submit" id="register-submit"
|
||||
tabindex="4" class="form-control btn btn-primary"
|
||||
value="Register Now"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<br/>
|
||||
<form class="attack-form" method="POST" name="form" action="/WebGoat/challenge/flag">
|
||||
<div class="form-group">
|
||||
<div class="input-group">
|
||||
<div class="input-group-addon"><i class="fa fa-flag-checkered" aria-hidden="true"
|
||||
style="font-size:20px"></i></div>
|
||||
<input type="text" class="form-control" id="flag" name="flag"
|
||||
placeholder="a7179f89-906b-4fec-9d99-f15b796e7208"/>
|
||||
</div>
|
||||
<div class="input-group" style="margin-top: 10px">
|
||||
<button type="submit" class="btn btn-primary">Submit flag</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</form>
|
||||
|
||||
<br/>
|
||||
<div class="attack-feedback"></div>
|
||||
<div class="attack-output"></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</html>
|
||||
@ -2,8 +2,9 @@ challenge0.title=WebGoat Challenge
|
||||
challenge1.title=Admin lost password
|
||||
challenge2.title=Get it for free
|
||||
challenge3.title=Photo comments
|
||||
challenge4.title=Creating a new account
|
||||
challenge5.title=Voting
|
||||
challenge4.title=Voting
|
||||
challenge5.title=Without password
|
||||
challenge6.title=Creating a new account
|
||||
challenge.solved=Congratulations, you solved the challenge. Here is your flag: {0}
|
||||
challenge.close=This is not the correct password for tom, please try again.
|
||||
|
||||
|
||||
@ -1,18 +1,84 @@
|
||||
$(function() {
|
||||
$(document).ready(function () {
|
||||
login('Guest');
|
||||
})
|
||||
|
||||
$('#login-form-link').click(function(e) {
|
||||
$("#login-form").delay(100).fadeIn(100);
|
||||
$("#register-form").fadeOut(100);
|
||||
$('#register-form-link').removeClass('active');
|
||||
$(this).addClass('active');
|
||||
e.preventDefault();
|
||||
});
|
||||
$('#register-form-link').click(function(e) {
|
||||
$("#register-form").delay(100).fadeIn(100);
|
||||
$("#login-form").fadeOut(100);
|
||||
$('#login-form-link').removeClass('active');
|
||||
$(this).addClass('active');
|
||||
e.preventDefault();
|
||||
function login(user) {
|
||||
$("#name").text(user);
|
||||
$.ajax({
|
||||
url: "votings/login?user=" + user,
|
||||
complete: function (result, status) {
|
||||
getVotings();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
var html = '<a href="#" class="list-group-item ACTIVE">' +
|
||||
'<div class="media col-md-3">' +
|
||||
'<figure> ' +
|
||||
'<img class="media-object img-rounded" src="images/IMAGE_SMALL" alt="placehold.it/350x250"/>' +
|
||||
'</figure>' +
|
||||
'</div> ' +
|
||||
'<div class="col-md-6">' +
|
||||
'<h4 class="list-group-item-heading">TITLE</h4>' +
|
||||
'<p class="list-group-item-text">INFORMATION</p>' +
|
||||
'</div>' +
|
||||
'<div class="col-md-3 text-center">' +
|
||||
'<h2 HIDDEN_VIEW_VOTES>NO_VOTES' +
|
||||
'<small HIDDEN_VIEW_VOTES> votes</small>' +
|
||||
'</h2>' +
|
||||
'<button type="button" id="TITLE" class="btn BUTTON btn-lg btn-block" onclick="vote(this.id)">Vote Now!</button>' +
|
||||
'<div style="visibility:HIDDEN_VIEW_RATING;" class="stars"> ' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star-empty"></span>' +
|
||||
'</div>' +
|
||||
'<p HIDDEN_VIEW_RATING>Average AVERAGE<small> /</small>4</p>' +
|
||||
'</div>' +
|
||||
'<div class="clearfix"></div>' +
|
||||
'</a>';
|
||||
|
||||
function getVotings() {
|
||||
$("#votesList").empty();
|
||||
$.get("votings/", function (result, status) {
|
||||
for (var i = 0; i < result.length; i++) {
|
||||
var voteTemplate = html.replace('IMAGE_SMALL', result[i].imageSmall);
|
||||
if (i === 0) {
|
||||
voteTemplate = voteTemplate.replace('ACTIVE', 'active');
|
||||
voteTemplate = voteTemplate.replace('BUTTON', 'btn-default');
|
||||
} else {
|
||||
voteTemplate = voteTemplate.replace('ACTIVE', '');
|
||||
voteTemplate = voteTemplate.replace('BUTTON', 'btn-primary');
|
||||
}
|
||||
voteTemplate = voteTemplate.replace(/TITLE/g, result[i].title);
|
||||
voteTemplate = voteTemplate.replace('INFORMATION', result[i].information || '');
|
||||
voteTemplate = voteTemplate.replace('NO_VOTES', result[i].numberOfVotes || '');
|
||||
voteTemplate = voteTemplate.replace('AVERAGE', result[i].average || '');
|
||||
|
||||
var hidden = (result[i].numberOfVotes === undefined ? 'hidden' : '');
|
||||
voteTemplate = voteTemplate.replace(/HIDDEN_VIEW_VOTES/g, hidden);
|
||||
hidden = (result[i].average === undefined ? 'hidden' : '');
|
||||
voteTemplate = voteTemplate.replace(/HIDDEN_VIEW_RATING/g, hidden);
|
||||
|
||||
$("#votesList").append(voteTemplate);
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
function vote(title) {
|
||||
var user = $("#name").text();
|
||||
if (user === 'Guest') {
|
||||
alert("As a guest you are not allowed to vote, please login first.")
|
||||
} else {
|
||||
$.ajax({
|
||||
type: 'POST',
|
||||
url: 'votings/' + title
|
||||
}).then(
|
||||
function () {
|
||||
getVotings();
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
});
|
||||
@ -1,84 +0,0 @@
|
||||
$(document).ready(function () {
|
||||
login('Guest');
|
||||
})
|
||||
|
||||
function login(user) {
|
||||
$("#name").text(user);
|
||||
$.ajax({
|
||||
url: "votings/login?user=" + user,
|
||||
complete: function (result, status) {
|
||||
getVotings();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
var html = '<a href="#" class="list-group-item ACTIVE">' +
|
||||
'<div class="media col-md-3">' +
|
||||
'<figure> ' +
|
||||
'<img class="media-object img-rounded" src="images/IMAGE_SMALL" alt="placehold.it/350x250"/>' +
|
||||
'</figure>' +
|
||||
'</div> ' +
|
||||
'<div class="col-md-6">' +
|
||||
'<h4 class="list-group-item-heading">TITLE</h4>' +
|
||||
'<p class="list-group-item-text">INFORMATION</p>' +
|
||||
'</div>' +
|
||||
'<div class="col-md-3 text-center">' +
|
||||
'<h2 HIDDEN_VIEW_VOTES>NO_VOTES' +
|
||||
'<small HIDDEN_VIEW_VOTES> votes</small>' +
|
||||
'</h2>' +
|
||||
'<button type="button" id="TITLE" class="btn BUTTON btn-lg btn-block" onclick="vote(this.id)">Vote Now!</button>' +
|
||||
'<div style="visibility:HIDDEN_VIEW_RATING;" class="stars"> ' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star"></span>' +
|
||||
'<span class="glyphicon glyphicon-star-empty"></span>' +
|
||||
'</div>' +
|
||||
'<p HIDDEN_VIEW_RATING>Average AVERAGE<small> /</small>4</p>' +
|
||||
'</div>' +
|
||||
'<div class="clearfix"></div>' +
|
||||
'</a>';
|
||||
|
||||
function getVotings() {
|
||||
$("#votesList").empty();
|
||||
$.get("votings/", function (result, status) {
|
||||
for (var i = 0; i < result.length; i++) {
|
||||
var voteTemplate = html.replace('IMAGE_SMALL', result[i].imageSmall);
|
||||
if (i === 0) {
|
||||
voteTemplate = voteTemplate.replace('ACTIVE', 'active');
|
||||
voteTemplate = voteTemplate.replace('BUTTON', 'btn-default');
|
||||
} else {
|
||||
voteTemplate = voteTemplate.replace('ACTIVE', '');
|
||||
voteTemplate = voteTemplate.replace('BUTTON', 'btn-primary');
|
||||
}
|
||||
voteTemplate = voteTemplate.replace(/TITLE/g, result[i].title);
|
||||
voteTemplate = voteTemplate.replace('INFORMATION', result[i].information || '');
|
||||
voteTemplate = voteTemplate.replace('NO_VOTES', result[i].numberOfVotes || '');
|
||||
voteTemplate = voteTemplate.replace('AVERAGE', result[i].average || '');
|
||||
|
||||
var hidden = (result[i].numberOfVotes === undefined ? 'hidden' : '');
|
||||
voteTemplate = voteTemplate.replace(/HIDDEN_VIEW_VOTES/g, hidden);
|
||||
hidden = (result[i].average === undefined ? 'hidden' : '');
|
||||
voteTemplate = voteTemplate.replace(/HIDDEN_VIEW_RATING/g, hidden);
|
||||
|
||||
$("#votesList").append(voteTemplate);
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
function vote(title) {
|
||||
var user = $("#name").text();
|
||||
if (user === 'Guest') {
|
||||
alert("As a guest you are not allowed to vote, please login first.")
|
||||
} else {
|
||||
$.ajax({
|
||||
type: 'POST',
|
||||
url: 'votings/' + title
|
||||
}).then(
|
||||
function () {
|
||||
getVotings();
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
$(function() {
|
||||
|
||||
$('#login-form-link').click(function(e) {
|
||||
$("#login-form").delay(100).fadeIn(100);
|
||||
$("#register-form").fadeOut(100);
|
||||
$('#register-form-link').removeClass('active');
|
||||
$(this).addClass('active');
|
||||
e.preventDefault();
|
||||
});
|
||||
$('#register-form-link').click(function(e) {
|
||||
$("#register-form").delay(100).fadeIn(100);
|
||||
$("#login-form").fadeOut(100);
|
||||
$('#login-form-link').removeClass('active');
|
||||
$(this).addClass('active');
|
||||
e.preventDefault();
|
||||
});
|
||||
|
||||
});
|
||||
@ -1 +1 @@
|
||||
Can you login as Tom?
|
||||
Try to change to a different user, maybe you can find the flag?
|
||||
@ -1 +1 @@
|
||||
Try to change to a different user, maybe you can find the flag?
|
||||
Can you login as Larry?
|
||||
@ -0,0 +1 @@
|
||||
Can you login as Tom?
|
||||
Reference in New Issue
Block a user