WebGoat/main/project/JavaSource/org/owasp/webgoat/lessons/BasicAuthentication.java

package org.owasp.webgoat.lessons;

import java.util.ArrayList;
import java.util.List;
import org.apache.ecs.Element;
import org.apache.ecs.ElementContainer;
import org.apache.ecs.StringElement;
import org.apache.ecs.html.Input;
import org.apache.ecs.html.P;
import org.apache.ecs.html.TD;
import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.ECSFactory;
import org.owasp.webgoat.session.WebSession;


/***************************************************************************************************
 * 
 * 
 * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
 * please see http://www.owasp.org/
 * 
 * Copyright (c) 2002 - 2007 Bruce Mayhew
 * 
 * This program is free software; you can redistribute it and/or modify it under the terms of the
 * GNU General Public License as published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License along with this program; if
 * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
 * 02111-1307, USA.
 * 
 * Getting Source ==============
 * 
 * Source for this application is maintained at code.google.com, a repository for free software
 * projects.
 * 
 * For details, please see http://code.google.com/p/webgoat/
 * 
 * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
 * @created October 28, 2003
 */
public class BasicAuthentication extends SequentialLessonAdapter
{
	private static final String EMPTY_STRING = "";

	private static final String WEBGOAT_BASIC = "webgoat_basic";

	private static final String AUTHORIZATION = "Authorization";

	private static final String ORIGINAL_AUTH = "Original_Auth";

	private static final String ORIGINAL_USER = "Original.user";

	private static final String BASIC = "basic";

	private static final String JSESSIONID = "JSESSIONID";

	private final static String HEADER_NAME = "header";

	private final static String HEADER_VALUE = "value";

	/**
	 * Description of the Method
	 * 
	 * @param s
	 *            Description of the Parameter
	 * @return Description of the Return Value
	 */
	protected Element createContent(WebSession s)
	{
		return super.createStagedContent(s);
	}

	protected Element doStage1(WebSession s) throws Exception
	{
		ElementContainer ec = new ElementContainer();

		String headerName = null;
		String headerValue = null;
		try
		{
			headerName = new String(s.getParser().getStringParameter(HEADER_NAME, EMPTY_STRING));
			headerValue = new String(s.getParser().getStringParameter(HEADER_VALUE, EMPTY_STRING));

			// <START_OMIT_SOURCE>
			// FIXME: This won;t work for CBT, we need to use the UserTracker
			// Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
			if (headerName.equalsIgnoreCase(AUTHORIZATION)
					&& (headerValue.equals("guest:guest") || headerValue.equals("webgoat:webgoat")))
			{
				getLessonTracker(s).setStage(2);
				return doStage2(s);
			}
			else
			{
				if (headerName.length() > 0 && !headerName.equalsIgnoreCase(AUTHORIZATION))
				{
					s.setMessage("Basic Authentication header name is incorrect.");
				}
				if (headerValue.length() > 0
						&& !(headerValue.equals("guest:guest") || headerValue.equals("webgoat:webgoat")))
				{
					s.setMessage("Basic Authentication header value is incorrect.");

				}
			}
			// <END_OMIT_SOURCE>

			Table t = new Table(0).setCellSpacing(0).setCellPadding(0).setBorder(0);
			if (s.isColor())
			{
				t.setBorder(1);
			}

			TR row1 = new TR();
			TR row2 = new TR();
			row1.addElement(new TD(new StringElement("What is the name of the authentication header: ")));
			row2.addElement(new TD(new StringElement("What is the decoded value of the authentication header: ")));

			row1.addElement(new TD(new Input(Input.TEXT, HEADER_NAME, headerName.toString())));
			row2.addElement(new TD(new Input(Input.TEXT, HEADER_VALUE, headerValue.toString())));

			t.addElement(row1);
			t.addElement(row2);

			ec.addElement(t);
			ec.addElement(new P());

			Element b = ECSFactory.makeButton("Submit");
			ec.addElement(b);

		} catch (Exception e)
		{
			s.setMessage("Error generating " + this.getClass().getName());
			e.printStackTrace();
		}

		return (ec);
	}

	protected Element doStage2(WebSession s) throws Exception
	{
		ElementContainer ec = new ElementContainer();

		try
		{
			if (s.getRequest().isUserInRole(WEBGOAT_BASIC))
			{
				String originalUser = getLessonTracker(s).getLessonProperties()
						.getProperty(ORIGINAL_USER, EMPTY_STRING);
				getLessonTracker(s, originalUser).setCompleted(true);
				getLessonTracker(s, originalUser).setStage(1);
				getLessonTracker(s, originalUser).store(s, this);
				makeSuccess(s);
				s.setMessage("Close your browser and login as " + originalUser + " to get your green stars back.");
				return ec;
			}
			else
			{
				// If we are still in the ORIGINAL_USER role see if the Basic Auth header has been
				// manipulated
				String originalAuth = getLessonTracker(s).getLessonProperties()
						.getProperty(ORIGINAL_AUTH, EMPTY_STRING);
				String originalSessionId = getLessonTracker(s).getLessonProperties()
						.getProperty(JSESSIONID, s.getCookie(JSESSIONID));

				// store the original user info in the BASIC properties files
				if (originalSessionId.equals(s.getCookie(JSESSIONID)))
				{
					// Store the original user name in the "basic" user properties file. We need to
					// use
					// the original user to access the correct properties file to update status.
					// store the initial auth header
					getLessonTracker(s).getLessonProperties().setProperty(JSESSIONID, originalSessionId);
					getLessonTracker(s).getLessonProperties().setProperty(ORIGINAL_AUTH, s.getHeader(AUTHORIZATION));
					getLessonTracker(s, BASIC).getLessonProperties().setProperty(ORIGINAL_USER, s.getUserName());
					getLessonTracker(s, BASIC).setStage(2);
					getLessonTracker(s, BASIC).store(s, this, BASIC);
				}

				s.setMessage("Congratulations, you have figured out the mechanics of basic authentication.");
				s.setMessage("&nbsp;&nbsp;- Now you must try to make WebGoat reauthenticate you as:  ");
				s.setMessage("&nbsp;&nbsp;&nbsp;&nbsp;- username:  basic");
				s.setMessage("&nbsp;&nbsp;&nbsp;&nbsp;- password:  basic");
				s.setMessage("Use the Basic Authentication Menu to start at login page.");

				// If the auth header is different but still the original user - tell the user
				// that the original cookie was posted bak and basic auth uses the cookie before the
				// authorization token
				if (!originalAuth.equals("") && !originalAuth.equals(s.getHeader(AUTHORIZATION)))
				{
					ec
							.addElement("You're almost there!  You've modified the "
									+ AUTHORIZATION
									+ " header but you are "
									+ "still logged in as "
									+ s.getUserName()
									+ ".  Look at the request after you typed in the 'basic' "
									+ "user credentials and submitted the request.  Remember the order of events that occur during Basic Authentication.");
				}
				else if (!originalSessionId.equals(s.getCookie(JSESSIONID)))
				{
					ec
							.addElement("You're really close!  Changing the session cookie caused the server to create a new session for you.  This did not cause the server to reauthenticate you.  "
									+ "When you figure out how to force the server to perform an authentication request, you have to authenticate as:<br><br>"
									+ "&nbsp;&nbsp;&nbsp;&nbsp;user name: basic<br> "
									+ "&nbsp;&nbsp;&nbsp;&nbsp;password: basic<br>");
				}
				else
				{
					ec.addElement("Use the hints!  One at a time...");
				}

			}

		} catch (Exception e)
		{
			s.setMessage("Error generating " + this.getClass().getName());
			e.printStackTrace();
		}

		return (ec);
	}

	/**
	 * Gets the category attribute of the ForgotPassword object
	 * 
	 * @return The category value
	 */
	protected Category getDefaultCategory()
	{

		return Category.AUTHENTICATION;
	}

	/**
	 * Gets the hints attribute of the HelloScreen object
	 * 
	 * @return The hints value
	 */
	public List<String> getHints(WebSession s)
	{
		List<String> hints = new ArrayList<String>();
		// int stage = getLessonTracker(session, BASIC).getStage();

		// switch ( stage )
		// {
		// case 1:
		hints.add("Basic authentication uses a cookie to pass the credentials. "
				+ "Use a proxy to intercept the request.  Look at the cookies.");
		hints.add("Basic authentication uses Base64 encoding to 'scramble' the " + "user's login credentials.");
		hints.add("Basic authentication uses 'Authorization' as the cookie name to " + "store the user's credentials.");
		hints.add("Use WebScarab -> Tools -> Transcoder to Base64 decode the "
				+ "the value in the Authorization cookie.");
		// break;
		// case 2:
		hints.add("Basic authentication uses a cookie to pass the credentials. "
				+ "Use a proxy to intercept the request.  Look at the cookies.");
		hints.add("Before the WebServer requests credentials from the client, the current "
				+ "session is checked for validitity.");
		hints.add("If the session is invalid the webserver will use the basic authentication credentials");
		hints.add("If the session is invalid and the basic authentication credentials are invalid, "
				+ "new credentials will be requested from the client.");
		hints.add("Intercept the request and corrupt the JSESSIONID and the Authorization header.");
		// break;
		// }

		return hints;
	}

	private final static Integer DEFAULT_RANKING = new Integer(100);

	protected Integer getDefaultRanking()
	{
		return DEFAULT_RANKING;
	}

	/**
	 * Gets the title attribute of the HelloScreen object
	 * 
	 * @return The title value
	 */
	public String getTitle()
	{
		return ("Basic Authentication");
	}

}