121 lines
4.3 KiB
Java
121 lines
4.3 KiB
Java
/*
|
|
* SPDX-FileCopyrightText: Copyright © 2019 WebGoat authors
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
package org.owasp.webgoat.integration;
|
|
|
|
import io.restassured.RestAssured;
|
|
import java.util.HashMap;
|
|
import java.util.Map;
|
|
import org.junit.jupiter.api.Test;
|
|
|
|
public class XSSIntegrationTest extends IntegrationTest {
|
|
|
|
@Test
|
|
public void crossSiteScriptingAssignments() {
|
|
startLesson("CrossSiteScripting");
|
|
|
|
Map<String, Object> params = new HashMap<>();
|
|
params.clear();
|
|
params.put("checkboxAttack1", "value");
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack1"), params, true);
|
|
|
|
params.clear();
|
|
params.put("QTY1", "1");
|
|
params.put("QTY2", "1");
|
|
params.put("QTY3", "1");
|
|
params.put("QTY4", "1");
|
|
params.put("field1", "<script>alert('XSS+Test')</script>");
|
|
params.put("field2", "111");
|
|
checkAssignmentWithGet(webGoatUrlConfig.url("CrossSiteScripting/attack5a"), params, true);
|
|
|
|
params.clear();
|
|
params.put("DOMTestRoute", "start.mvc#test");
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack6a"), params, true);
|
|
|
|
params.clear();
|
|
params.put("param1", "42");
|
|
params.put("param2", "24");
|
|
|
|
String result =
|
|
RestAssured.given()
|
|
.when()
|
|
.relaxedHTTPSValidation()
|
|
.cookie("JSESSIONID", getWebGoatCookie())
|
|
.header("webgoat-requested-by", "dom-xss-vuln")
|
|
.header("X-Requested-With", "XMLHttpRequest")
|
|
.formParams(params)
|
|
.post(webGoatUrlConfig.url("CrossSiteScripting/phone-home-xss"))
|
|
.then()
|
|
.statusCode(200)
|
|
.extract()
|
|
.path("output");
|
|
String secretNumber = result.substring("phoneHome Response is ".length());
|
|
|
|
params.clear();
|
|
params.put("successMessage", secretNumber);
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/dom-follow-up"), params, true);
|
|
|
|
params.clear();
|
|
params.put(
|
|
"question_0_solution",
|
|
"Solution 4: No because the browser trusts the website if it is acknowledged trusted, then"
|
|
+ " the browser does not know that the script is malicious.");
|
|
params.put(
|
|
"question_1_solution",
|
|
"Solution 3: The data is included in dynamic content that is sent to a web user without"
|
|
+ " being validated for malicious content.");
|
|
params.put(
|
|
"question_2_solution",
|
|
"Solution 1: The script is permanently stored on the server and the victim gets the"
|
|
+ " malicious script when requesting information from the server.");
|
|
params.put(
|
|
"question_3_solution",
|
|
"Solution 2: They reflect the injected script off the web server. That occurs when input"
|
|
+ " sent to the web server is part of the request.");
|
|
params.put(
|
|
"question_4_solution",
|
|
"Solution 4: No there are many other ways. Like HTML, Flash or any other type of code that"
|
|
+ " the browser executes.");
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/quiz"), params, true);
|
|
|
|
params.clear();
|
|
params.put(
|
|
"editor",
|
|
"<%@ taglib uri=\"https://www.owasp.org/index.php/OWASP_Java_Encoder_Project\" %>"
|
|
+ "<html>"
|
|
+ "<head>"
|
|
+ "<title>Using GET and POST Method to Read Form Data</title>"
|
|
+ "</head>"
|
|
+ "<body>"
|
|
+ "<h1>Using POST Method to Read Form Data</h1>"
|
|
+ "<table>"
|
|
+ "<tbody>"
|
|
+ "<tr>"
|
|
+ "<td><b>First Name:</b></td>"
|
|
+ "<td>${e:forHtml(param.first_name)}</td>"
|
|
+ "</tr>"
|
|
+ "<tr>"
|
|
+ "<td><b>Last Name:</b></td>"
|
|
+ "<td>${e:forHtml(param.last_name)}</td>"
|
|
+ "</tr>"
|
|
+ "</tbody>"
|
|
+ "</table>"
|
|
+ "</body>"
|
|
+ "</html>");
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack3"), params, true);
|
|
|
|
params.clear();
|
|
params.put(
|
|
"editor2",
|
|
"Policy.getInstance(\"antisamy-slashdot.xml\");"
|
|
+ "Sammy s = new AntiSamy();"
|
|
+ "s.scan(newComment,\"\");"
|
|
+ "CleanResults();"
|
|
+ "MyCommentDAO.addComment(threadID, userID).getCleanHTML());");
|
|
checkAssignment(webGoatUrlConfig.url("CrossSiteScripting/attack4"), params, true);
|
|
|
|
checkResults("CrossSiteScripting");
|
|
}
|
|
}
|