Welcome to a short introduction to WebGoat.
Here you will learn how to use WebGoat and additional tools for the lessons.
WebGoat uses the Apache Tomcat server. It is configured to run on localhost although this can be easily changed. This configuration is for single user, additional users can be added in the tomcat-users.xml file. If you want to use WebGoat in a laboratory or in class you might need to change this setup. Please refer to the Tomcat Configuration in the Introduction section.
1. These are Lesson Categories in WebGoat. Click on a Category to see all Lessons in it.
2. This will show technical hints to solve the lesson.
3. This will show the HTTP Request Parameters
4. This will show the HTTP Request Cookies
5. This will show goals and objectives of the lesson.
6. This will show the underlying Java source code.
7. This will show the complete solution of the selected lesson.
8. If you want to restart a lesson you can use this link.
Always start with the lessons plan. Then try to solve the lesson and if necessary, use the hints. The last hint is the solution text if applicable. If you cannot solve the lesson using the hints, you may view the solution for complete details.
To read and edit Parameters you need a local proxy to intercept the HTTP request. Here we use WebScarab. More information on WebScarab can be found in the "Useful Tools" Chapter.
Often it is not only necessary to change the value of the parameters but to change the value of cookies. WebScarab has functionality for this as well.