dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,985 Commits 11 Branches 78 Tags
Commit Graph

373 Commits

Author SHA1 Message Date
François Capon
3134f18066
fix: Success if only Smith earn most salary (#1744) 
* Update labels

* Update Java

* Update Test

---------

Co-authored-by: René Zubcevic <rene@zubcevic.com>
 2024-06-01 10:50:38 +02:00
Vandeputte Brice
e219887f14
docs: Update HttpBasics_plan.adoc - fix broken link to https://www.zaproxy.org/ (#1803) 
fix broken link OWASP ZAP -  https://www.zaproxy.org/

Co-authored-by: René Zubcevic <rene@zubcevic.com>
 2024-06-01 10:45:12 +02:00
Nanne Baars
4ab820e1d1
feat: move CSRF to A3 (#1776) 
CSRF is part of security misconfiguration in the OWASP Top 10.
 2024-03-21 20:50:37 +01:00
Nanne Baars
62931a1836
feature: enable CORS configuration (#1771) 2024-03-17 10:55:27 +01:00
François Capon
57d5b313b9 Fix typo in SQLi blind case 2024-02-10 16:02:35 +01:00
cap-dev0x
dd0f135088
fix(quiz): use $ instead of jQuery which is undefined (#1736) 
Fixes: #1703

Signed-off-by: cap-dev0x <158111888+cap-dev0x@users.noreply.github.com>
 2024-02-05 14:30:01 +01:00
Peter Potrowl
4ebb869f5d
Fix hidden links in MissingFunctionAC.html. (#1710) 2023-12-29 15:01:35 +01:00
Peter Potrowl
6bb7a182dc Fix typos in texts. 2023-12-14 23:00:59 +01:00
Peter Potrowl
cb2c99d38d Improve texts to avoid confusion. 2023-12-14 22:54:20 +01:00
Nanne Baars
17acef57b4 chore: add pre-commit hooks 
chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks
 2023-12-06 17:16:24 +01:00
Nanne Baars
d913967ec5 refactor: remove usage of RequestMapping 2023-12-06 17:16:24 +01:00
Nanne Baars
87edc7d1db refactor: use AssertJ for testing 
Majority of our test cases use AssertJ
 2023-12-06 17:16:24 +01:00
Nanne Baars
ae261f201a feat: show directly requested file in requests overview 
When a call directly hits a file it is now show up in the requests overview. This helps the user whether an attack from WebGoat actually requested the uploaded file.

Closes: gh-1551
 2023-12-04 21:34:16 +01:00
Nanne Baars
3d651526be feat: show creating time in file upload overview 
Closes: gh-1551
 2023-12-04 21:32:02 +01:00
Nanne Baars
c7c2a61f65
chore: fix startup message (#1687) 
Since we use two application context, the event listener would print out the last one with the WebWolf context. As WebWolf is part of WebGoat we should not refer to it anymore during startup as users should always go to WebGoat first.
 2023-12-04 07:59:29 +01:00
Nanne Baars
b7f657ad2c
chore: fix WebWolf UI (#1686) 
Fix-ups after the Bootstrap 5 upgrade for WebWolf.
 2023-12-02 12:59:56 +01:00
René Zubcevic
7fea42afe9
Fix/state of software supply chain links (#1683) 
* fix:update state of software supply chain links

* fix:fix second link

* fix:links formatting

---------

Co-authored-by: maurycupitt <maury@cupitt.com>
 2023-11-27 15:33:14 +01:00
René Zubcevic
826887cc83
Consistent environment values and url references (#1677) 
* organizing environment variables

* Update application-webgoat.properties

* Update pom.xml

* test without ssl

* fix docker base image and default env entries

* seperate server.address from webgoat.host and webwolf.host

* change base image and enable endpoint logging for docker as well

* change README

* change README

* make integration test able to verify against alternative host names

* use dynamic ports and remove system println
 2023-11-27 14:35:49 +01:00
René Zubcevic
88a321c268
search box moved and jwt encode/decode with little delay (#1664) 2023-11-16 14:42:10 +01:00
René Zubcevic
8450c5a5be
skip validation for JWT (#1663) 
* skip validation for JWT

* skip validation for JWT

* skip validation for JWT
 2023-11-15 18:30:14 +01:00
René Zubcevic
ba75e10efd
fixed issue in JWT test tool and added robot test (#1658) 2023-11-14 18:14:48 +01:00
René Zubcevic
d1e44bbc98
Password reset link test condition more strict and move all WebWolf links to /WebWolf (#1645) 
* better check on host and port for password reset and make context roots more flexible

* spotless applied

* removed hardcoded /WebGoat from js

* removed hardcoded /WebGoat from js

* fix spotless

* fix scoreboard

* upgrade WebWolf bootstrap version and icons and templates - part 1

* fixed more bootstrap 5 style issues and context path issues

* organized WebSecurityConfig based on latest conventions and added basic support for oauth (more work needed)

* spotless applied

* added mock bean

* requires updates to properties - commented for now

* requires updates to properties - commented for now

* oauth secrets through env values

* user creation after oauth login

* integration test against non default context paths

* adjusted StartupMessage

* add global model element username

* conditionally show login oauth links

* fixed WebWolf login

---------

Co-authored-by: René Zubcevic <rene@Mac-mini-van-Rene.local>
 2023-11-14 10:01:59 +01:00
François Capon
45c26d8aaf
Fix servers id (#1619) 2023-10-22 15:25:52 +02:00
Àngel Ollé Blázquez
be30551850 fix: potential NPE in the stored XSS assignment 2023-08-27 14:31:35 +02:00
Àngel Ollé Blázquez
49862f6b90 fix: fixes the default change in trailing slash matching and address the affected assignments 2023-08-27 14:14:27 +02:00
Àngel Ollé Blázquez
4009785bb8 fix: crypto basics broken links 2023-08-27 13:16:08 +02:00
Àngel Ollé Blázquez
d8341c86a1 bug: fix hint that was breaking the template, causing hints from different assignments to mix (#1424) 2023-08-27 02:08:52 +02:00
Àngel Ollé Blázquez
055578893d feat: improve MFAC lesson hint texts for a better user experience (#1424) 2023-08-27 02:08:52 +02:00
Àngel Ollé Blázquez
7b81247dd1 fix: HijackSession lesson template deprecated Tymeleaf attribute 2023-08-26 02:57:50 +02:00
Àngel Ollé Blázquez
3bc2e57c9c Fix NPE in IDOR lesson 2023-08-26 02:22:33 +02:00
Àngel Ollé Blázquez
c3ec168d59 Add new assignment IT tests 2023-08-26 01:30:17 +02:00
Àngel Ollé Blázquez
a67fbf5a5a fix: XSS mitigation 2023-08-26 01:30:17 +02:00
Àngel Ollé Blázquez
3365c8d447 Remove wrong files 2023-08-25 22:50:40 +02:00
Àngel Ollé Blázquez
368c046779 fix: Stored Cross-Site Scripting Lesson 2023-08-25 20:55:26 +02:00
Àngel Ollé Blázquez
786cabd251 Make webjar dependencies version agnostic 2023-08-24 16:43:28 +02:00
Àngel Ollé Blázquez
4ba818533c fix: WebWolf JWT jquery webjar 2023-08-09 01:32:03 +02:00
Nanne Baars
a9b1fd66b8
feat: implement JWT jku example (#1552) 
Closes #1539
 2023-08-08 17:18:22 +02:00
dependabot[bot]
61de52840f
chore: bump com.diffplug.spotless:spotless-maven-plugin from 2.33.0 to 2.38.0 (#1535) 
* chore: bump com.diffplug.spotless:spotless-maven-plugin

Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.33.0 to 2.38.0.
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/2.33.0...lib/2.38.0)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: format code

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nanne Baars <nanne.baars@owasp.org>
 2023-07-30 15:10:31 +02:00
Àngel Ollé Blázquez
ad00119b0d Add Assignment7 Tests 2023-07-18 00:38:23 +02:00
Àngel Ollé Blázquez
25f49537e7 bug: Fix IDOR lesson 2023-07-16 17:14:27 +02:00
Àngel Ollé Blázquez
8ec718c1ef format 2023-06-15 19:26:33 +02:00
Àngel Ollé Blázquez
1df7ca61a3 Text content improvement 2023-06-15 19:26:33 +02:00
Àngel Ollé Blázquez
75398feca0 Add hints 2023-06-15 19:26:33 +02:00
Nanne Baars
ca886b4818
feat: upgrade to Spring Boot version 3 (#1477) 2023-06-04 11:19:47 +02:00
caputdraconis
ac6de9d788 Fix typo of HijackSession_content0.adoc 2023-04-17 09:04:15 +02:00
Loris Sierra
cbf2e153d9 Restrict SSRF Regexes 2023-03-08 23:22:38 +01:00
Nanne Baars
e50986a098
fix: challenge 7 (#1433) 2023-02-22 22:55:48 +01:00
Nanne Baars
5dbe2eaf19 refactor: update challenge code 
- Flags are now wired through a Spring config
- Introduced Flag class
- Removed Flags from the FlagController
 2023-02-22 11:01:34 +01:00
Nanne Baars
ecfc321f14 feature: Add extra feedback once someone solves JWT refresh lesson differently 
One can solve this lesson by using `alg:none` instead of using the refresh token flow. Instead of adding a check to force using the refresh token we opt for giving the user extra feedback.
 2023-02-16 20:32:27 +00:00
Nanne Baars
73b8c431fc chore: use constructor instead of field dependency injection 2023-02-16 20:32:27 +00:00