704 Commits

Author SHA1 Message Date
René Zubcevic
0638cae6e5
corrected hints and improved error handling base64 (#781) 2020-04-14 16:13:25 +02:00
René Zubcevic
e25f7a7560 clean up and update js 2020-04-08 12:05:01 +02:00
René Zubcevic
c4153ecbfb
Maven owasp dep update (#776)
* add pmd and owasp dependency check through -P owasp profile

* suppress full stack trace in log

* revert to spring 2.2.0 as 2.2.4 failed in travis

* added owasp dependency check maven configuration details to vulenerable
lesson page 7
2020-04-06 16:01:09 +02:00
Nanne Baars
bb6d06713f Fix failing test 2020-03-10 08:03:48 +01:00
Nanne Baars
14022d88c9 Last assignment now filters out .. and / so encoding plays a role now 2020-03-10 08:03:48 +01:00
Nanne Baars
d4966b5e71 Fix test cases 2020-03-10 08:03:48 +01:00
Nanne Baars
b3840e60e3 Fix lessons 2020-03-10 08:03:48 +01:00
Nanne Baars
6c25cf8e43 Add path traversal lesson 2020-03-10 08:03:48 +01:00
Tiago Mussi
c4c28f544f Fixed CSRF broken links. 2020-03-06 17:15:10 +01:00
René Zubcevic
3b050a856a tested solution with unit test and verfied with lesson 5 on ie 2020-02-28 23:11:29 +01:00
René Zubcevic
71d9c4b61a first steps 2020-02-28 23:11:29 +01:00
René Zubcevic
5f3dff4921
added notes on salted hash (#758) 2020-02-27 07:20:58 +01:00
August Detlefsen
208aa42fdb
relax detection regex (#757)
Allow for content before and after the script; Allow optional semicolon
2020-02-20 20:00:07 +01:00
Jonathan Thompson
cd3fb8040f
Typo and grammar corrections for the crypto lessons (#756)
* Correct typos and grammar errors.

* Revert one grammar change
2020-02-09 08:00:08 +01:00
Dan Muller
9d5fa6f4ef
Correct typos and clarify language in signing.adoc (#754)
Some of the changes correct simple misspellings. Some are intended to clarify or simplify the language.
2020-01-30 14:01:42 +01:00
René Zubcevic
4e371b63d0
suppressing some useless log messages and banners in unit tests (#752)
* suppressing some useless log messages and banners in unit tests

* some more log suppressed
2020-01-25 12:11:45 +01:00
Nanne Baars
5de82c0a06 Fix link to XStream blog which no longer exists (#740) 2020-01-05 19:48:40 +01:00
Nanne Baars
71f2d2968f Fix NPE when request does not contain parameter (#739) 2020-01-05 15:14:53 +01:00
Nanne Baars
8088465652 Move and remove unneccessary pom dependencies (#736) 2019-12-24 16:14:36 +01:00
Nanne Baars
035c8662d4 Revert "Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons"
This reverts commit a831d949b25b0da599a8e71518f52b7889fc982a.
2019-12-23 17:14:20 +01:00
dependabot[bot]
a831d949b2 Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons
Bumps xstream from 1.4.5 to 1.4.6.

Signed-off-by: dependabot[bot] <support@github.com>
2019-12-23 17:12:31 +01:00
torleif
4c45a1e68c This lesson is intended to show the dangers of outdated software. However in version 1.4.7 the vulnerability is fixed! In 1.4.5 it is still present, so I suggest this downgrade. It is tested and works as intended, just as 1.4.7 does not. 2019-12-23 17:09:46 +01:00
René Zubcevic
f79ad452d2 password reset support for using www.webwolf.local 2019-12-23 17:08:33 +01:00
René Zubcevic
b6aa677594
Zap 8 update for proxy lesson (#718)
* additional steps in proxy setup added

* lessons checked

* added page on https proxy and burp proxy
2019-12-10 12:14:21 +01:00
thegoodcrumpets
681a20a7c3 In the migration to Spring 2, this method lost its get mapping to the IDOR/profile url,breaking the javascript call to that address. (#720)
thanks!
2019-12-04 12:21:19 +01:00
René Zubcevic
c5ec2d40a1
updates docker image name (#717) 2019-11-26 18:12:06 +01:00
René Zubcevic
b5e5dd1d13
Crypto lesson (#712)
* crypto lesson added

* signing assignment

* integration test added for signing assignment

* added more hints

* corrections after rebase

* added some explanation

* added security defaults assignment
2019-11-23 21:52:14 +01:00
Nanne Baars
5dd6b31905 Adjust lesson template (#704)
* Remove method `getId()` from all lessons as it defaults to the class name

* remove clean up endpoint

* remove unused class `RequestParameter`

* remove unused class `PluginLoadingFailure`

* Move `CourseConfiguration` to lesson package

* Add more content around the lesson template lesson and make it visible as a lesson in WebGoat

* Remove explicit invocation `trackProgress()` inside WebGoat framework so assignments only need to return an `AttackResult`

* Put original solution back as well for SQL string injection

* review comments

* Add
2019-11-17 13:39:56 +01:00
Nanne Baars
f40b6ffd31 Moving back to snapshot 2019-11-13 12:27:26 +01:00
Nanne Baars
fe2ac1b8d4 New release, updating pom.xml 2019-11-12 09:22:45 +01:00
Nanne Baars
ba74898441 Add JavaScript to assignment otherwise you will not be able to see the flow of the endpoint 2019-11-12 09:12:37 +01:00
Nanne Baars
1d477bd0e8 Rename endpoint in JavaScript as backend call uses different endpoint 2019-11-12 09:12:37 +01:00
Nanne Baars
48b604d6d9 Enable salaries again as rest controller 2019-11-12 09:12:37 +01:00
Nanne Baars
e07a2aff48 Fix mistake the SQL exception should be throws otherwise users cannot see the table name (servers) makes it impossible to
solve the assignment. Add explicit test for this to guard against future mistakes
2019-11-11 21:17:51 +01:00
Nanne Baars
7d48427d4f Integrate ZAP 2.8.0 (no HUB) as the setup is different also update the filtering as usual ZAP exclusion is again broken 2019-11-11 21:17:51 +01:00
Nanne Baars
d8844216cc Add solution for Firefox no longer proxying localhost at all 2019-11-11 10:38:25 +01:00
Cotonne
8da4342430 Improve readability of query (#685)
thanks! and do not forget to clean your .webgoat... local db related files
2019-11-04 13:28:35 +01:00
Nanne Baars
ddf6ac9bdb Improve handling of missing parameters, now returns HTTP/401 (#698) 2019-11-03 18:27:03 +01:00
Nanne Baars
1a83e2825e Code style (#696)
* Remove Guava dependency from WebGoat

* Add Checkstyle to the project with very basic standards so we have a
style across lessons. It does not interfere with basic Intellij formatting
2019-11-03 18:11:09 +01:00
Philippe Lafoucrière
66bd1d8c1a Remove obsolete methods
As there were removed also in e8d086ac9b (diff-98a46e7f04c7a2dd03d59046076aac5bL40)
2019-10-30 08:28:42 +01:00
Philippe Lafoucrière
531db87876 Fix CommandInjection java files
Avoid these compilation errors:

```
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjectionExecute.java:[47,8] class HttpBasicsInterceptRequest is public, should be declared in a file named HttpBasicsInterceptRequest.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,8] class HttpProxies is public, should be declared in a file named HttpProxies.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[5,33] cannot find symbol
  symbol:   class AbstractLesson
  location: package org.owasp.webgoat.lessons
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,34] cannot find symbol
  symbol: class AbstractLesson
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[39,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[44,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[49,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[54,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[59,5] method does not override or implement a method from a supertype
[INFO] 9 errors
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  4.356 s
[INFO] Finished at: 2019-10-19T21:13:03Z
[INFO] ------------------------------------------------------------------------
```
2019-10-30 08:28:42 +01:00
Philippe Lafoucrière
cac5985873 Fix command-injection pom.xml 2019-10-30 08:28:42 +01:00
Philippe Lafoucrière
c03b8e22bf Fix webgoat-lesson-template parent artifact ref
WebGoat 8 latest ([develop](9fdbbf69d6)) has the following compilation error:

```
Building Maven project at /builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template.
[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version] (/builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template/pom.xml) has 1 error
[ERROR]     Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13 -> [Help 2]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException
Error: Project couldn't be built: exit status 1
```

This is due to an invalid (obsolete) ref in the parent artifact.

Full logs: https://gitlab.com/gitlab-org/security-products/tests/webgoat/-/jobs/322887707
2019-10-30 08:28:42 +01:00
Nanne Baars
25dae3a4a8 Fix merge request 2019-10-30 08:28:14 +01:00
Nanne Baars
d73875e8e8 Remove empty line 2019-10-30 08:28:14 +01:00
Nanne Baars
e783c0c1f1 SQL: Cannot use apostrophe/quotes on string literals #662 2019-10-30 08:28:14 +01:00
Nanne Baars
96d11697d4 SQL Injection lesson 6 minor mistakes in examples #663 2019-10-30 08:28:14 +01:00
Nanne Baars
a0933d83d5 Reworked all the SQL statements to be uppercase 2019-10-30 08:28:14 +01:00
Cotonne
9fdbbf69d6 Proposition for fixing broken/improving links (#686)
* As stated on enzoic.com: "PasswordPing is now Enzoic!"

* Add references to other OWASP resources
2019-10-16 17:29:27 +02:00
Rene Zubcevic
6dc679e7b8 final tests and fixed the issue of getting the name of the loggedinuser 2019-10-15 13:59:18 +02:00