5d930ec235
* Solutions added * Bugfixes * Introduction added (including how to start with webgoat and useful tools) * New lesson: Password strength * New lessons: Multi Level Login * Not yet working new lesson: Session fixation (inital release) git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@301 4033779f-a91e-0410-96ef-6bf7bf53c507
463 lines
12 KiB
Java
463 lines
12 KiB
Java
|
|
package org.owasp.webgoat.lessons;
|
|
|
|
import java.util.ArrayList;
|
|
import java.util.List;
|
|
import org.apache.ecs.Element;
|
|
import org.apache.ecs.ElementContainer;
|
|
import org.apache.ecs.html.B;
|
|
import org.apache.ecs.html.Input;
|
|
import org.apache.ecs.html.TD;
|
|
import org.apache.ecs.html.TR;
|
|
import org.apache.ecs.html.Table;
|
|
import org.apache.ecs.html.TextArea;
|
|
import org.owasp.webgoat.session.WebSession;
|
|
|
|
|
|
public class SessionFixation extends SequentialLessonAdapter
|
|
{
|
|
|
|
private String LoggedInUser = "";
|
|
|
|
private final String mailTo = "jane.plane@owasp.org";
|
|
private final String mailFrom = "admin@webgoatfinancial.com";
|
|
private final String mailTitel = "Check your account";
|
|
private final String MAILCONTENTNAME = "mailname";
|
|
|
|
private final static String USER = "user";
|
|
private final static String PASSWORD = "pass";
|
|
|
|
/**
|
|
* Creates Staged WebContent
|
|
*
|
|
* @param s
|
|
*/
|
|
protected Element createContent(WebSession s)
|
|
{
|
|
return super.createStagedContent(s);
|
|
}
|
|
|
|
/**
|
|
* Gets the category attribute of the RoleBasedAccessControl object
|
|
*
|
|
* @return The category value
|
|
*/
|
|
protected ElementContainer doStage1(WebSession s)
|
|
{
|
|
ElementContainer ec = new ElementContainer();
|
|
String mailContent = s.getParser().getStringParameter(MAILCONTENTNAME, "");
|
|
if (mailContent.contains("SSID"))
|
|
{
|
|
|
|
// ec.addElement(mailContent);
|
|
return ec;
|
|
}
|
|
|
|
ec.addElement(createStage1Content(s));
|
|
return ec;
|
|
|
|
}
|
|
|
|
private Element createStage1Content(WebSession s)
|
|
{
|
|
|
|
String link = getLink();
|
|
String mailText = "Dear MS. Plane <br><br>" + "During the last week we had a few problems with our servers. "
|
|
+ "A lot of people complained that there account details are wrong. "
|
|
+ "That is why we kindly ask you to use following link to verify your "
|
|
+ "data:<br><br><center><a href=" + link + "&XXXX=YYYYYYYY> WebGoat Financial</a></center><br><br>"
|
|
+ "We are sorry for the caused inconvenience and thank you for your colaboration.<br><br>"
|
|
+ "Your WebGoat Financial Team";
|
|
|
|
ElementContainer ec = new ElementContainer();
|
|
Table table = new Table();
|
|
TR tr1 = new TR();
|
|
TD td1 = new TD();
|
|
TD td2 = new TD();
|
|
|
|
TR tr2 = new TR();
|
|
TD td3 = new TD();
|
|
TD td4 = new TD();
|
|
|
|
TR tr3 = new TR();
|
|
TD td5 = new TD();
|
|
TD td6 = new TD();
|
|
|
|
TR tr4 = new TR();
|
|
TD td7 = new TD();
|
|
td7.addAttribute("colspan", 2);
|
|
|
|
TR tr5 = new TR();
|
|
TD td8 = new TD();
|
|
td8.addAttribute("colspan", 2);
|
|
td8.addAttribute("align", "center");
|
|
|
|
table.addElement(tr1);
|
|
table.addElement(tr2);
|
|
table.addElement(tr3);
|
|
table.addElement(tr4);
|
|
table.addElement(tr5);
|
|
|
|
tr1.addElement(td1);
|
|
tr1.addElement(td2);
|
|
tr2.addElement(td3);
|
|
tr2.addElement(td4);
|
|
tr3.addElement(td5);
|
|
tr3.addElement(td6);
|
|
tr4.addElement(td7);
|
|
tr5.addElement(td8);
|
|
|
|
ec.addElement(table);
|
|
|
|
B b = new B();
|
|
b.addElement("MailTo: ");
|
|
td1.addElement(b);
|
|
td2.addElement(mailTo);
|
|
|
|
b = new B();
|
|
b.addElement("MailFrom: ");
|
|
td3.addElement(b);
|
|
td4.addElement(mailFrom);
|
|
|
|
b = new B();
|
|
b.addElement("Title: ");
|
|
td5.addElement(b);
|
|
Input titleField = new Input();
|
|
titleField.setValue(mailTitel);
|
|
titleField.addAttribute("size", 30);
|
|
td6.addElement(titleField);
|
|
|
|
TextArea mailContent = new TextArea();
|
|
mailContent.addAttribute("cols", 50);
|
|
mailContent.addAttribute("rows", 10);
|
|
mailContent.addElement(mailText);
|
|
mailContent.setName(MAILCONTENTNAME);
|
|
td7.addElement(mailContent);
|
|
|
|
td8.addElement(new Input(Input.SUBMIT, "SendMail", "Send Mail"));
|
|
|
|
return ec;
|
|
}
|
|
|
|
/**
|
|
* Creation of the main content
|
|
*
|
|
* @param s
|
|
* @return Element
|
|
*/
|
|
protected Element createMainContent(WebSession s)
|
|
{
|
|
ElementContainer ec = new ElementContainer();
|
|
|
|
// try
|
|
// {
|
|
//
|
|
//
|
|
// style sty = new style();
|
|
//
|
|
// sty.addElement("#lesson_wrapper {height: 435px;width: 500px;}#lesson_header
|
|
// {background-image: url(lessons/DBSQLInjection/images/lesson1_header.jpg);width:
|
|
// 490px;padding-right: 10px;padding-top: 60px;background-repeat:
|
|
// no-repeat;}.lesson_workspace {background-image:
|
|
// url(lessons/DBSQLInjection/images/lesson1_workspace.jpg);width: 489px;height:
|
|
// 325px;padding-left: 10px;padding-top: 10px;background-repeat: no-repeat;} .lesson_text
|
|
// {height: 240px;width: 460px;padding-top: 5px;} #lesson_buttons_bottom {height:
|
|
// 20px;width: 460px;} #lesson_b_b_left {width: 300px;float: left;} #lesson_b_b_right input
|
|
// {width: 100px;float: right;} .lesson_title_box {height: 20px;width: 420px;padding-left:
|
|
// 30px;} .lesson_workspace { } .lesson_txt_10 {font-family: Arial, Helvetica,
|
|
// sans-serif;font-size: 10px;} .lesson_text_db {color: #0066FF} #lesson_login
|
|
// {background-image: url(lessons/DBSQLInjection/images/lesson1_loginWindow.jpg);height:
|
|
// 124px;width: 311px;background-repeat: no-repeat;padding-top: 30px;margin-left:
|
|
// 80px;margin-top: 50px;text-align: center;} #lesson_login_txt {font-family: Arial,
|
|
// Helvetica, sans-serif;font-size: 12px;text-align: center;} #lesson_search
|
|
// {background-image: url(lessons/DBSQLInjection/images/lesson1_SearchWindow.jpg);height:
|
|
// 124px;width: 311px;background-repeat: no-repeat;padding-top: 30px;margin-left:
|
|
// 80px;margin-top: 50px;text-align: center;}");
|
|
// ec.addElement(sty);
|
|
//
|
|
// Div wrapperDiv = new Div();
|
|
// wrapperDiv.setID("lesson_wrapper");
|
|
//
|
|
// Div headerDiv = new Div();
|
|
// headerDiv.setID("lesson_header");
|
|
//
|
|
// Div workspaceDiv = new Div();
|
|
// workspaceDiv.setClass("lesson_workspace");
|
|
//
|
|
// wrapperDiv.addElement(headerDiv);
|
|
// wrapperDiv.addElement(workspaceDiv);
|
|
//
|
|
// ec.addElement(wrapperDiv);
|
|
//
|
|
// workspaceDiv.addElement(createWorkspaceContent(s));
|
|
//
|
|
// } catch (Exception e)
|
|
// {
|
|
// s.setMessage("Error generating " + this.getClass().getName());
|
|
// e.printStackTrace();
|
|
// }
|
|
|
|
return (ec);
|
|
}
|
|
|
|
// /**
|
|
// * Creation of the content of the workspace
|
|
// * @param s
|
|
// * @return Element
|
|
// */
|
|
// private Element createWorkspaceContent(WebSession s)
|
|
// {
|
|
//
|
|
//
|
|
// ElementContainer ec = new ElementContainer();
|
|
//
|
|
// return ec;
|
|
// }
|
|
|
|
// /**
|
|
// * Create content for logging in
|
|
// * @param ec
|
|
// */
|
|
// private void createLogInContent(ElementContainer ec, String errorMessage) {
|
|
// Div loginDiv = new Div();
|
|
// loginDiv.setID("lesson_login");
|
|
//
|
|
// Table table = new Table();
|
|
// //table.setStyle(tableStyle);
|
|
// table.addAttribute("align='center'", 0);
|
|
// TR tr1 = new TR();
|
|
// TD td1 = new TD();
|
|
// TD td2 = new TD();
|
|
// td1.addElement(new StringElement("Enter your name: "));
|
|
// td2.addElement(new Input(Input.TEXT, USER));
|
|
// tr1.addElement(td1);
|
|
// tr1.addElement(td2);
|
|
//
|
|
// TR tr2 = new TR();
|
|
// TD td3 = new TD();
|
|
// TD td4 = new TD();
|
|
// td3.addElement(new StringElement("Enter your password: "));
|
|
// td4.addElement(new Input(Input.PASSWORD, PASSWORD));
|
|
// tr2.addElement(td3);
|
|
// tr2.addElement(td4);
|
|
//
|
|
//
|
|
// TR tr3 = new TR();
|
|
// TD td5 = new TD();
|
|
// td5.setColSpan(2);
|
|
// td5.setAlign("center");
|
|
//
|
|
// td5.addElement(new Input(Input.SUBMIT, "Submit", "Submit"));
|
|
// tr3.addElement(td5);
|
|
//
|
|
// table.addElement(tr1);
|
|
// table.addElement(tr2);
|
|
// table.addElement(tr3);
|
|
// loginDiv.addElement(table);
|
|
// ec.addElement(loginDiv);
|
|
//
|
|
// H2 errorTag = new H2(errorMessage);
|
|
// errorTag.addAttribute("align", "center");
|
|
// errorTag.addAttribute("class", "info");
|
|
// ec.addElement(errorTag);
|
|
//
|
|
//
|
|
// }
|
|
|
|
// /**
|
|
// * Create content after a successful login
|
|
// * @param s
|
|
// * @param ec
|
|
// */
|
|
// private void createSuccessfulLoginContent(WebSession s,
|
|
// ElementContainer ec) {
|
|
//
|
|
// String userDataStyle = "margin-top:50px;";
|
|
//
|
|
// Div userDataDiv = new Div();
|
|
// userDataDiv.setStyle(userDataStyle);
|
|
// userDataDiv.addAttribute("align", "center");
|
|
// Table table = new Table();
|
|
// table.addAttribute("cellspacing", 10);
|
|
// table.addAttribute("cellpadding", 5);
|
|
//
|
|
// table.addAttribute("align", "center");
|
|
// TR tr1 =new TR();
|
|
// TR tr2 = new TR();
|
|
// TR tr3 = new TR();
|
|
// TR tr4 = new TR();
|
|
// tr1.addElement(new TD("<b>Firstname:</b>"));
|
|
// tr1.addElement(new TD(LoggedInUser));
|
|
//
|
|
// try
|
|
// {
|
|
// ResultSet results = getUser(LoggedInUser, s);
|
|
// results.first();
|
|
//
|
|
// tr2.addElement(new TD("<b>Lastname:</b>"));
|
|
// tr2.addElement(new TD(results.getString("last_name")));
|
|
//
|
|
// tr3.addElement(new TD("<b>Credit Card Type:</b>"));
|
|
// tr3.addElement(new TD(results.getString("cc_type")));
|
|
//
|
|
// tr4.addElement(new TD("<b>Credit Card Number:</b>"));
|
|
// tr4.addElement(new TD(results.getString("cc_number")));
|
|
//
|
|
//
|
|
// }
|
|
//
|
|
// catch (Exception e)
|
|
// {
|
|
// e.printStackTrace();
|
|
// }
|
|
// table.addElement(tr1);
|
|
// table.addElement(tr2);
|
|
// table.addElement(tr3);
|
|
// table.addElement(tr4);
|
|
//
|
|
// userDataDiv.addElement(table);
|
|
// ec.addElement(userDataDiv);
|
|
// ec.addElement(createLogoutLink());
|
|
// }
|
|
|
|
// /**
|
|
// * Create a link for logging out
|
|
// * @return Element
|
|
// */
|
|
// private Element createLogoutLink()
|
|
// {
|
|
// A logoutLink = new A();
|
|
// logoutLink.addAttribute("href", getLink() + "&logout=true");
|
|
// logoutLink.addElement("Logout");
|
|
//
|
|
// String logoutStyle = "margin-right:50px; mrgin-top:30px";
|
|
// Div logoutDiv = new Div();
|
|
// logoutDiv.addAttribute("align", "right");
|
|
// logoutDiv.addElement(logoutLink);
|
|
// logoutDiv.setStyle(logoutStyle);
|
|
//
|
|
// return logoutDiv;
|
|
// }
|
|
|
|
// /**
|
|
// * Get a user by its name
|
|
// * @param user
|
|
// * @param s
|
|
// * @return ResultSet containing the user
|
|
// */
|
|
// private ResultSet getUser(String user, WebSession s)
|
|
// {
|
|
// try {
|
|
// Connection connection = DatabaseUtilities.getConnection(s);
|
|
// String query = "SELECT * FROM user_data_tan WHERE first_name = ? ";
|
|
// PreparedStatement prepStatement =connection.prepareStatement(query,
|
|
// ResultSet.TYPE_SCROLL_INSENSITIVE,
|
|
// ResultSet.CONCUR_READ_ONLY);
|
|
// prepStatement.setString(1, user);
|
|
//
|
|
//
|
|
// ResultSet results = prepStatement.executeQuery();
|
|
//
|
|
// return results;
|
|
//
|
|
// } catch (Exception e) {
|
|
// e.printStackTrace();
|
|
// }
|
|
// return null;
|
|
//
|
|
// }
|
|
|
|
// /**
|
|
// * See if the password and corresponding user is valid
|
|
// * @param userName
|
|
// * @param password
|
|
// * @param s
|
|
// * @return true if the password was correct
|
|
// */
|
|
// private boolean correctLogin(String userName, String password, WebSession s)
|
|
// {
|
|
// try {
|
|
// Connection connection = DatabaseUtilities.getConnection(s);
|
|
// String query = "SELECT * FROM user_data_tan WHERE first_name = ? AND password = ?";
|
|
// PreparedStatement prepStatement =connection.prepareStatement(query,
|
|
// ResultSet.TYPE_SCROLL_INSENSITIVE,
|
|
// ResultSet.CONCUR_READ_ONLY);
|
|
// prepStatement.setString(1, userName);
|
|
// prepStatement.setString(2, password);
|
|
//
|
|
// ResultSet results = prepStatement.executeQuery();
|
|
//
|
|
// if ((results != null) && (results.first() == true))
|
|
// {
|
|
//
|
|
// return true;
|
|
//
|
|
// }
|
|
//
|
|
// } catch (Exception e) {
|
|
// e.printStackTrace();
|
|
// }
|
|
//
|
|
// return false;
|
|
//
|
|
// }
|
|
|
|
/**
|
|
* Get the category
|
|
*
|
|
* @return the category
|
|
*/
|
|
protected Category getDefaultCategory()
|
|
{
|
|
return Category.SESSION_MANAGEMENT;
|
|
}
|
|
|
|
/**
|
|
* Gets the hints attribute of the RoleBasedAccessControl object
|
|
*
|
|
* @return The hints value
|
|
*/
|
|
public List<String> getHints(WebSession s)
|
|
{
|
|
List<String> hints = new ArrayList<String>();
|
|
|
|
hints.add("Stage 1: Just do a regular login");
|
|
hints.add("Stage 2: How does the server know which TAN has to be used");
|
|
hints.add("Stage 2: Maybe taking a look at the source code helps");
|
|
hints.add("Stage 2: Watch out for hidden fields");
|
|
hints.add("Stage 2: Manipulate the hidden field 'hidden_tan'");
|
|
|
|
return hints;
|
|
|
|
}
|
|
|
|
/**
|
|
* Get the instructions for the user
|
|
*/
|
|
public String getInstructions(WebSession s)
|
|
{
|
|
String instructions = "Stub";
|
|
|
|
return (instructions);
|
|
}
|
|
|
|
private final static Integer DEFAULT_RANKING = new Integer(222);
|
|
|
|
/**
|
|
* Get the ranking for the hirarchy of lessons
|
|
*/
|
|
protected Integer getDefaultRanking()
|
|
{
|
|
return DEFAULT_RANKING;
|
|
}
|
|
|
|
/**
|
|
* Get the title of the Lesson
|
|
*/
|
|
public String getTitle()
|
|
{
|
|
return ("Session Fixation");
|
|
}
|
|
|
|
}
|