Welcome to a short introduction of WebGoat.
Here you will learn how to use WebGoat and additional tools for the lessons.
WebGoat uses Apache Tomcat as server. It is setup to run on localhost. This configuration is for single user. If you want to use WebGoat in a laboratory or in class you might need to change the setup. Please refer to the Tomcat Configuration in the Introduction section.
1. Here you see all Categories of Lessons in WebGoat. Click on the Categories to see all Lessons in it.
2. This link will give you the technical background to solve the lesson.
3. Do you need some help to find the solution? Here you will find useful hints.
4. Here you will find a complete solution of the selected lesson.
5. If you want to restart a lesson you can use this link.
Always read first the lessons plan. Then try to solve the lesson and if necessary, use the hints. If you cannot solve the lesson using the hints, you may watch the solution. Here every step is explained.
To read and edit Parameters you need a proxy to intercept the HTTP request.
Here we use WebScarab. More informations to WebScarab you will get in the
Chapter "Useful Tools".
After installing WebScarab and making a proxy on localhost we can start.
We have to select "intercept request" in the tab "Intercept". If we send a new HTTP request now, we get a new WebScarab window.
Here we can read and edit the sent parameter. After "Accept changes" the request will be sent to the server.
Often it is not only necessary to change the value of parameters but to change the value of cookies. We use again WebScarab and intercept the request as explained in the last topic.
We again get the new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit the values of them.