Commit Graph

3025 Commits

Author SHA1 Message Date
e07a2aff48 Fix mistake the SQL exception should be throws otherwise users cannot see the table name (servers) makes it impossible to
solve the assignment. Add explicit test for this to guard against future mistakes
2019-11-11 21:17:51 +01:00
7d48427d4f Integrate ZAP 2.8.0 (no HUB) as the setup is different also update the filtering as usual ZAP exclusion is again broken 2019-11-11 21:17:51 +01:00
d8844216cc Add solution for Firefox no longer proxying localhost at all 2019-11-11 10:38:25 +01:00
ab3cd118c9 Explicitly set Maven repo to https 2019-11-11 10:38:05 +01:00
8da4342430 Improve readability of query (#685)
thanks! and do not forget to clean your .webgoat... local db related files
2019-11-04 13:28:35 +01:00
ddf6ac9bdb Improve handling of missing parameters, now returns HTTP/401 (#698) 2019-11-03 18:27:03 +01:00
f7b794bf68 Race condition in counting number of attempts #567 (#697)
Add version to Hibernate mapping so we get optimistic locking this solves
number of parallel calls trying to update/guess and mess with the lesson
counter
2019-11-03 18:14:15 +01:00
1a83e2825e Code style (#696)
* Remove Guava dependency from WebGoat

* Add Checkstyle to the project with very basic standards so we have a
style across lessons. It does not interfere with basic Intellij formatting
2019-11-03 18:11:09 +01:00
66bd1d8c1a Remove obsolete methods
As there were removed also in e8d086ac9b (diff-98a46e7f04c7a2dd03d59046076aac5bL40)
2019-10-30 08:28:42 +01:00
531db87876 Fix CommandInjection java files
Avoid these compilation errors:

```
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjectionExecute.java:[47,8] class HttpBasicsInterceptRequest is public, should be declared in a file named HttpBasicsInterceptRequest.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,8] class HttpProxies is public, should be declared in a file named HttpProxies.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[5,33] cannot find symbol
  symbol:   class AbstractLesson
  location: package org.owasp.webgoat.lessons
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,34] cannot find symbol
  symbol: class AbstractLesson
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[39,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[44,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[49,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[54,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[59,5] method does not override or implement a method from a supertype
[INFO] 9 errors
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  4.356 s
[INFO] Finished at: 2019-10-19T21:13:03Z
[INFO] ------------------------------------------------------------------------
```
2019-10-30 08:28:42 +01:00
cac5985873 Fix command-injection pom.xml 2019-10-30 08:28:42 +01:00
c03b8e22bf Fix webgoat-lesson-template parent artifact ref
WebGoat 8 latest ([develop](9fdbbf69d6)) has the following compilation error:

```
Building Maven project at /builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template.
[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version] (/builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template/pom.xml) has 1 error
[ERROR]     Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13 -> [Help 2]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException
Error: Project couldn't be built: exit status 1
```

This is due to an invalid (obsolete) ref in the parent artifact.

Full logs: https://gitlab.com/gitlab-org/security-products/tests/webgoat/-/jobs/322887707
2019-10-30 08:28:42 +01:00
710adfae20 Upgrade to latest Spring Boot version 2019-10-30 08:28:14 +01:00
9b87fd602c Explicitly set session persistence to false (result in non serializable exception) 2019-10-30 08:28:14 +01:00
28299f3ced Bind HSQLDB to same address as WebGoat 2019-10-30 08:28:14 +01:00
689e3de7a4 Final changes for splitting SQL WebGoat and lessons 2019-10-30 08:28:14 +01:00
25dae3a4a8 Fix merge request 2019-10-30 08:28:14 +01:00
d73875e8e8 Remove empty line 2019-10-30 08:28:14 +01:00
e783c0c1f1 SQL: Cannot use apostrophe/quotes on string literals #662 2019-10-30 08:28:14 +01:00
2a6b3d189e Disable csrf through property no longer works and we already have it in WebSecurityConfig. Thymeleaf templates caching is set on the resolvers themselves 2019-10-30 08:28:14 +01:00
96d11697d4 SQL Injection lesson 6 minor mistakes in examples #663 2019-10-30 08:28:14 +01:00
a0933d83d5 Reworked all the SQL statements to be uppercase 2019-10-30 08:28:14 +01:00
9fdbbf69d6 Proposition for fixing broken/improving links (#686)
* As stated on enzoic.com: "PasswordPing is now Enzoic!"

* Add references to other OWASP resources
2019-10-16 17:29:27 +02:00
1f00d461a8 cleaned logs and changed username length for csrf-uuid 2019-10-15 13:59:18 +02:00
6dc679e7b8 final tests and fixed the issue of getting the name of the loggedinuser 2019-10-15 13:59:18 +02:00
00873cfe3f csrf7 test cases added 2019-10-15 13:59:18 +02:00
e932253f06 initial test cases added 2019-10-15 13:59:18 +02:00
8d7142e6d3 upgrade ascii doc with support for link in new tab 2019-10-15 13:55:34 +02:00
e0ac4a1083 lessons in correct order and scoreboard visible again (#680) 2019-10-10 09:45:43 +02:00
f140875156 fixed views for password reset (#679) 2019-10-10 07:50:47 +02:00
18d43f16d3 working version with fixed link and GET for tracing purposes (#677)
* working version with fixed link and GET for tracing purposes

* added integration test

* filter on request log
2019-10-09 09:58:35 +02:00
aee4b74202 Update Receiving_mail.adoc (#676) 2019-10-03 18:22:54 +02:00
b481ed70e8 Fix typo in SQL Injection(Introduction) (#675)
Fix typo `date` to `data` which seems more appropriate in context.
2019-10-03 10:01:35 +02:00
fd7fb4cfbc seems that we forgot about this one in the spring-boot-2 upgrade (#674) 2019-10-02 14:52:21 +02:00
663224d06a xxe path info (#670)
* xxe path info aid added

* xxe path info aid added

*  changes to template file and hints

* added ssl test support for XXE

* added ssl test support for XXE

* restconfig replaced by httpsrelaxed

* processed review comments on hints and example
2019-10-02 09:59:32 +02:00
7536770769 deserialization made solvable again (#673)
* first objects and unit tests for making a fix for the lesson

* example added

* unit test for windows and linux

* added unit tests hints and feedbacks and updated lesson pages

* small typo correction
2019-10-02 08:26:48 +02:00
6c14f4987c Update IntroductionWebWolf.adoc
use aangepast in gebruiker
2019-10-02 07:55:57 +02:00
3d38ed7680 some text change 2019-10-02 07:55:57 +02:00
1a11702979 NL intro 2019-10-02 07:55:57 +02:00
0319c477b1 XSS lesson completion fixes (#669)
* XSS lesson completion fixes

* removed log all

* lesson progress capable of deprecated assignments in the database

* fixed unit test for lesson progress
2019-09-29 14:46:18 +02:00
45c7949118 Merge pull request #668 from afcidk/fix-typo
thanks for the fix
2019-09-27 15:05:59 +02:00
9b906a2a29 Fix typo in XXE lesson 2019-09-25 00:37:36 +08:00
686d8b0c85 Merge pull request #667 from WebGoat/spring-boot-2
Spring boot 2
2019-09-24 17:09:09 +02:00
d080b3ef06 Review comment 2019-09-24 07:36:49 +02:00
dad9c75ee0 Fix tests after updating from develop, changes applied for migrating to Spring Boot 2 2019-09-23 17:35:04 +02:00
35c1305ce9 Merge conflicts resolved 2019-09-23 07:34:27 +02:00
261f947777 Fix 2019-09-20 17:45:33 +02:00
c8ef848657 Fix 2019-09-20 17:36:15 +02:00
f29b923eef FIx? 2019-09-20 17:10:58 +02:00
6fe5831f11 FIx? 2019-09-20 16:46:26 +02:00