203 lines
8.3 KiB
HTML
203 lines
8.3 KiB
HTML
<html xmlns:th="http://www.thymeleaf.org">
|
|
|
|
<script th:src="@{/lesson_js/xxe.js}" language="JavaScript"></script>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
|
|
<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
|
|
which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
|
|
<div class="adoc-content" th:replace="doc:XXE_plan.adoc"></div>
|
|
</div>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
|
|
<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
|
|
which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
|
|
<div class="adoc-content" th:replace="doc:XXE_intro.adoc"></div>
|
|
</div>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_simple.adoc"></div>
|
|
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/xxe.css}"/>
|
|
<div class="attack-container">
|
|
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
|
|
|
<form class="attack-form" accept-charset="UNKNOWN"
|
|
method="POST" name="form"
|
|
prepareData="simpleXXE"
|
|
successCallback="simpleXXECallback"
|
|
contentType="application/xml"
|
|
action="/WebGoat/xxe/simple">
|
|
<div class="container-fluid">
|
|
<div class="panel post">
|
|
<div class="post-heading">
|
|
<div class="pull-left image">
|
|
<img th:src="@{/images/avatar1.png}"
|
|
class="img-circle avatar" alt="user profile image"/>
|
|
</div>
|
|
<div class="pull-left meta">
|
|
<div class="title h5">
|
|
<a href="#"><b>John Doe</b></a>
|
|
uploaded a photo.
|
|
</div>
|
|
<h6 class="text-muted time">24 days ago</h6>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="post-image">
|
|
<img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
|
|
</div>
|
|
|
|
<div class="post-description">
|
|
|
|
</div>
|
|
<div class="post-footer">
|
|
<div class="input-group">
|
|
<input class="form-control input-lg" id="commentInputSimple" placeholder="Add a comment"
|
|
type="text"/>
|
|
<span class="input-group-addon">
|
|
<button id="postCommentSimple" class="btn btn-primary">Submit</button>
|
|
</span>
|
|
</div>
|
|
<ul class="comments-list">
|
|
<div id="commentsListSimple">
|
|
</div>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
|
|
<br/>
|
|
<div class="attack-feedback"></div>
|
|
<div class="attack-output"></div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_changing_content_type.adoc"></div>
|
|
<div class="attack-container">
|
|
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
|
<form class="attack-form" accept-charset="UNKNOWN"
|
|
method="POST" name="form"
|
|
prepareData="contentTypeXXE"
|
|
successCallback="contentTypeXXECallback"
|
|
action="xxe/content-type"
|
|
contentType="application/json">
|
|
<div class="container-fluid">
|
|
<div class="panel post">
|
|
<div class="post-heading">
|
|
<div class="pull-left image">
|
|
<img th:src="@{/images/avatar1.png}"
|
|
class="img-circle avatar" alt="user profile image"/>
|
|
</div>
|
|
<div class="pull-left meta">
|
|
<div class="title h5">
|
|
<a href="#"><b>John Doe</b></a>
|
|
uploaded a photo.
|
|
</div>
|
|
<h6 class="text-muted time">24 days ago</h6>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="post-image">
|
|
<img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
|
|
</div>
|
|
|
|
<div class="post-description">
|
|
|
|
</div>
|
|
<div class="post-footer">
|
|
<div class="input-group">
|
|
<input class="form-control input-lg" id="commentInputContentType" placeholder="Add a comment"
|
|
type="text"/>
|
|
<span class="input-group-addon">
|
|
<button id="postCommentContentType" class="btn btn-primary">Submit</button>
|
|
</span>
|
|
</div>
|
|
<ul class="comments-list">
|
|
<div id="commentsListContentType">
|
|
</div>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
|
|
<br/>
|
|
<div class="attack-feedback"></div>
|
|
<div class="attack-output"></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_overflow.adoc"></div>
|
|
</div>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_blind.adoc"></div>
|
|
</div>
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_blind_assignment.adoc"></div>
|
|
<div class="attack-container">
|
|
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
|
<form class="attack-form" accept-charset="UNKNOWN"
|
|
method="POST" name="form"
|
|
prepareData="blindXXE"
|
|
successCallback="blindXXECallback"
|
|
action="/WebGoat/xxe/blind"
|
|
contentType="application/xml">
|
|
<div class="container-fluid">
|
|
<div class="panel post">
|
|
<div class="post-heading">
|
|
<div class="pull-left image">
|
|
<img th:src="@{/images/avatar1.png}"
|
|
class="img-circle avatar" alt="user profile image"/>
|
|
</div>
|
|
<div class="pull-left meta">
|
|
<div class="title h5">
|
|
<a href="#"><b>John Doe</b></a>
|
|
uploaded a photo.
|
|
</div>
|
|
<h6 class="text-muted time">24 days ago</h6>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="post-image">
|
|
<img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
|
|
</div>
|
|
|
|
<div class="post-description">
|
|
|
|
</div>
|
|
<div class="post-footer">
|
|
<div class="input-group">
|
|
<input class="form-control input-lg" id="commentInputBlind" placeholder="Add a comment" type="text"/>
|
|
<span class="input-group-addon">
|
|
<button id="postCommentBlind" class="btn btn-primary">Submit</button>
|
|
</span>
|
|
</div>
|
|
<ul class="comments-list">
|
|
<div id="commentsListBlind">
|
|
</div>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
|
|
<br/>
|
|
<div class="attack-feedback"></div>
|
|
<div class="attack-output"></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="lesson-page-wrapper">
|
|
<div class="adoc-content" th:replace="doc:XXE_mitigation.adoc"></div>
|
|
</div>
|
|
|
|
|
|
</html> |