dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,345 Commits 11 Branches 78 Tags
db66c1dd0291ce0f62368065a1b0a7b4027fbfc5
Commit Graph

568 Commits

Author SHA1 Message Date
Satoshi SAKAO
db66c1dd02 fix number of steps 2020-04-27 10:44:39 +02:00
Satoshi SAKAO
608728b135 fix asciidoc italic format 2020-04-27 10:44:39 +02:00
René Zubcevic
88eb4d7b26 ace editor added without all the nonsense around it 2020-04-26 16:45:56 +02:00
René Zubcevic
58bc94d1f6 fix green buttons 2020-04-22 16:37:00 +02:00
René Zubcevic
6f532683a1 lessonplan character updates so it also works on Windows Cp125 2020-04-20 12:54:18 +02:00
Nanne Baars
a5350060e1 Add dummy extra method with return type AttackResult because every assignment needs at least one such mapping (in the challenges case this is optional but since the challenges are an extra thing and this is the only assignment which has no such method adding a dummy method makes sense) 2020-04-19 15:42:50 +02:00
Nanne Baars
4f649234a9 Fix Java 11 issue where the order of methods returned in AssignmentEndpoint subclasses returned wrong method for determining the mapping of an assignment. Now we walk over all methods until we find one which has for example a @GetMapping with AttackResult or ResponseEntity<AttackResult as return type. If no such method is found an exception is thrown 2020-04-19 15:42:50 +02:00
Nanne Baars
96412da04e Remove unused imports and parameters 2020-04-19 15:42:50 +02:00
Nanne Baars
3b7481c2a7 Update method signature 2020-04-19 15:42:50 +02:00
Nanne Baars
407e19638f Add two more assignments for SQL injection where only filtering is applied. 2020-04-19 15:42:50 +02:00
Nanne Baars
122cc323f2 Changed the order of explanation of setting up ZAP/Burp a bit (feedback from workshop). This makes the necessary steps more explicit by moving all extra configuration for https etc to the back. So when you follow the lesson you will only setup the minimal and not get confused about things which are only necessary in certain cases 2020-04-19 15:42:50 +02:00
René Zubcevic
25e66ae412 use of script console in stead of browser address bar 2020-04-17 15:33:26 +02:00
René Zubcevic
089952e9ad quiz fix for CIA, SQL Injection Advanced and XSS + XSS description 
change in alert(document.cookie)
 2020-04-17 15:33:26 +02:00
René Zubcevic
efc5a870a0 Path traversal windows unittest fix (#780) 
* fixes to support windows and linux/unix/mac

* fix in matcher
 2020-04-14 16:13:43 +02:00
René Zubcevic
0638cae6e5 corrected hints and improved error handling base64 (#781) 2020-04-14 16:13:25 +02:00
René Zubcevic
e25f7a7560 clean up and update js 2020-04-08 12:05:01 +02:00
René Zubcevic
c4153ecbfb Maven owasp dep update (#776) 
* add pmd and owasp dependency check through -P owasp profile

* suppress full stack trace in log

* revert to spring 2.2.0 as 2.2.4 failed in travis

* added owasp dependency check maven configuration details to vulenerable
lesson page 7
 2020-04-06 16:01:09 +02:00
Nanne Baars
bb6d06713f Fix failing test 2020-03-10 08:03:48 +01:00
Nanne Baars
14022d88c9 Last assignment now filters out .. and / so encoding plays a role now 2020-03-10 08:03:48 +01:00
Nanne Baars
d4966b5e71 Fix test cases 2020-03-10 08:03:48 +01:00
Nanne Baars
b3840e60e3 Fix lessons 2020-03-10 08:03:48 +01:00
Nanne Baars
6c25cf8e43 Add path traversal lesson 2020-03-10 08:03:48 +01:00
Tiago Mussi
c4c28f544f Fixed CSRF broken links. 2020-03-06 17:15:10 +01:00
René Zubcevic
3b050a856a tested solution with unit test and verfied with lesson 5 on ie 2020-02-28 23:11:29 +01:00
René Zubcevic
71d9c4b61a first steps 2020-02-28 23:11:29 +01:00
René Zubcevic
5f3dff4921 added notes on salted hash (#758) 2020-02-27 07:20:58 +01:00
August Detlefsen
208aa42fdb relax detection regex (#757) 
Allow for content before and after the script; Allow optional semicolon
 2020-02-20 20:00:07 +01:00
Jonathan Thompson
cd3fb8040f Typo and grammar corrections for the crypto lessons (#756) 
* Correct typos and grammar errors.

* Revert one grammar change
 2020-02-09 08:00:08 +01:00
Dan Muller
9d5fa6f4ef Correct typos and clarify language in signing.adoc (#754) 
Some of the changes correct simple misspellings. Some are intended to clarify or simplify the language.
 2020-01-30 14:01:42 +01:00
René Zubcevic
4e371b63d0 suppressing some useless log messages and banners in unit tests (#752) 
* suppressing some useless log messages and banners in unit tests

* some more log suppressed
 2020-01-25 12:11:45 +01:00
Nanne Baars
5de82c0a06 Fix link to XStream blog which no longer exists (#740) 2020-01-05 19:48:40 +01:00
Nanne Baars
71f2d2968f Fix NPE when request does not contain parameter (#739) 2020-01-05 15:14:53 +01:00
Nanne Baars
8088465652 Move and remove unneccessary pom dependencies (#736) 2019-12-24 16:14:36 +01:00
Nanne Baars
035c8662d4 Revert "Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons" 
This reverts commit a831d949b2.
 2019-12-23 17:14:20 +01:00
dependabot[bot]
a831d949b2 Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons 
Bumps xstream from 1.4.5 to 1.4.6.

Signed-off-by: dependabot[bot] <support@github.com>
 2019-12-23 17:12:31 +01:00
torleif
4c45a1e68c This lesson is intended to show the dangers of outdated software. However in version 1.4.7 the vulnerability is fixed! In 1.4.5 it is still present, so I suggest this downgrade. It is tested and works as intended, just as 1.4.7 does not. 2019-12-23 17:09:46 +01:00
René Zubcevic
f79ad452d2 password reset support for using www.webwolf.local 2019-12-23 17:08:33 +01:00
René Zubcevic
b6aa677594 Zap 8 update for proxy lesson (#718) 
* additional steps in proxy setup added

* lessons checked

* added page on https proxy and burp proxy
 2019-12-10 12:14:21 +01:00
thegoodcrumpets
681a20a7c3 In the migration to Spring 2, this method lost its get mapping to the IDOR/profile url,breaking the javascript call to that address. (#720) 
thanks!
 2019-12-04 12:21:19 +01:00
René Zubcevic
c5ec2d40a1 updates docker image name (#717) 2019-11-26 18:12:06 +01:00
René Zubcevic
b5e5dd1d13 Crypto lesson (#712) 
* crypto lesson added

* signing assignment

* integration test added for signing assignment

* added more hints

* corrections after rebase

* added some explanation

* added security defaults assignment
 2019-11-23 21:52:14 +01:00
Nanne Baars
5dd6b31905 Adjust lesson template (#704) 
* Remove method `getId()` from all lessons as it defaults to the class name

* remove clean up endpoint

* remove unused class `RequestParameter`

* remove unused class `PluginLoadingFailure`

* Move `CourseConfiguration` to lesson package

* Add more content around the lesson template lesson and make it visible as a lesson in WebGoat

* Remove explicit invocation `trackProgress()` inside WebGoat framework so assignments only need to return an `AttackResult`

* Put original solution back as well for SQL string injection

* review comments

* Add
 2019-11-17 13:39:56 +01:00
Nanne Baars
f40b6ffd31 Moving back to snapshot 2019-11-13 12:27:26 +01:00
Nanne Baars
fe2ac1b8d4 New release, updating pom.xml 2019-11-12 09:22:45 +01:00
Nanne Baars
ba74898441 Add JavaScript to assignment otherwise you will not be able to see the flow of the endpoint 2019-11-12 09:12:37 +01:00
Nanne Baars
1d477bd0e8 Rename endpoint in JavaScript as backend call uses different endpoint 2019-11-12 09:12:37 +01:00
Nanne Baars
48b604d6d9 Enable salaries again as rest controller 2019-11-12 09:12:37 +01:00
Nanne Baars
e07a2aff48 Fix mistake the SQL exception should be throws otherwise users cannot see the table name (servers) makes it impossible to 
solve the assignment. Add explicit test for this to guard against future mistakes
 2019-11-11 21:17:51 +01:00
Nanne Baars
7d48427d4f Integrate ZAP 2.8.0 (no HUB) as the setup is different also update the filtering as usual ZAP exclusion is again broken 2019-11-11 21:17:51 +01:00
Nanne Baars
d8844216cc Add solution for Firefox no longer proxying localhost at all 2019-11-11 10:38:25 +01:00