3340eb92dd
* feature/spring-boot: (92 commits) XXE checkin XXE checkin XXE first attempt HTTP-Basics mark lesson complete issue fixed cleaning up some fixing the scroll 'sliver' problem. Likely need to check back on this when menu grows again lesson pagination fixes mainly, some other fixes included & clean up Incremental style changes refactor to help accomodate multiple attacks and output in one 'page' Updated some of the credits double-feedback fix on single page commenting out to stop redundant callbacks few cleanup items, added least privilege Fixed test for password First wave is complete; some rendering issues Trying to wire up the DB connection and fill out first sql stub Fixing hide/show of next/prev buttons another stub First round of sql injection with stubs Give focus to username when loading the login page ... Signed-off-by: Doug Morato <dm@corp.io> # Conflicts: # .travis.yml # README.MD # pom.xml # webgoat-container/pom.xml # webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java # webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java # webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java # webgoat-container/src/main/java/org/owasp/webgoat/plugins/PluginsLoader.java # webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java # webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatContext.java # webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js # webgoat-container/src/main/resources/webgoat.properties # webgoat-container/src/main/webapp/META-INF/context.xml # webgoat-container/src/main/webapp/WEB-INF/context.xml # webgoat-container/src/main/webapp/js/goatApp/view/LessonContentView.js # webgoat-container/src/test/java/org/owasp/webgoat/plugins/WebGoatIT.java # webgoat-container/src/test/resources/log4j.properties # webgoat_developer_bootstrap.sh
240 lines
8.8 KiB
Markdown
240 lines
8.8 KiB
Markdown
# WebGoat: A deliberately insecure Web Application
|
|
|
|
[](https://travis-ci.org/WebGoat/WebGoat)
|
|
[](https://coveralls.io/github/WebGoat/WebGoat?branch=master)
|
|
[](https://www.codacy.com/app/dm/WebGoat)
|
|
[](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa)
|
|
[](https://www.owasp.org/index.php/OWASP_Project_Inventory#tab=Labs_Projects)
|
|
|
|
# Important Information
|
|
|
|
### The WebGoat Lesson Server, is currently **UNDER MAJOR DEVELOMENT**.
|
|
As of February 1st 2016, the version "7.0.1" is considered the first **STABLE** version of a major architecture and UI changes.
|
|
|
|
#### Older/Legacy version of WebGoat an be found at: [WebGoat-Legacy](https://github.com/WebGoat/WebGoat-Legacy)
|
|
|
|
WebGoat is a deliberately insecure web application maintained by [OWASP](http://www.owasp.org/) designed to teach web
|
|
application security lessons.
|
|
|
|
This program is a demonstration of common server-side application flaws. The
|
|
exercises are intended to be used by people to learn about application security and
|
|
penetration testing techniques.
|
|
|
|
* [Home Page](http://webgoat.github.io)
|
|
* [OWASP Project Home Page](http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project)
|
|
* [Source Code](https://github.com/WebGoat/WebGoat)
|
|
* [Easy-Run Download](https://s3.amazonaws.com/webgoat-war/webgoat-container-7.0.1-war-exec.jar)
|
|
* [Wiki](https://github.com/WebGoat/WebGoat/wiki)
|
|
* [FAQ (old info):](http://code.google.com/p/webgoat/wiki/FAQ)
|
|
* [Project Leader - Direct to Bruce Mayhew](mailto:webgoat@owasp.org)
|
|
* [Mailing List - WebGoat Community - For most questions](mailto:owasp-webgoat@lists.owasp.org)
|
|
* [Artifacts generated from Continuous Integration](http://webgoat-war.s3-website-us-east-1.amazonaws.com/)
|
|
* [Output from our Travis.CI Build server](https://travis-ci.org/WebGoat/WebGoat)
|
|
|
|
**WARNING 1:** *While running this program your machine will be extremely
|
|
vulnerable to attack. You should to disconnect from the Internet while using
|
|
this program.* WebGoat's default configuration binds to localhost to minimize
|
|
the exposure.
|
|
|
|
**WARNING 2:** *This program is for educational purposes only. If you attempt
|
|
these techniques without authorization, you are very likely to get caught. If
|
|
you are caught engaging in unauthorized hacking, most companies will fire you.
|
|
Claiming that you were doing security research will not work as that is the
|
|
first thing that all hackers claim.*
|
|
|
|
# Easy Run ( For non-developers )
|
|
|
|
Every successful build of the WebGoat Lessons Container and the WebGoat Lessons in our Continuous Integration Server
|
|
creates an "Easy Run" Executable WAR file, which contains the WebGoat Lessons Server, the lessons and a embedded Tomcat server.
|
|
|
|
You can check for the "Last Modified" date of our "Easy Run" war file [HERE](http://webgoat-war.s3-website-us-east-1.amazonaws.com/)
|
|
|
|
The "Easy Run" JAR file offers a no hassle approach to testing and running WebGoat. Follow these instructions if you
|
|
wish to simply try/test/run the current development version of WebGoat
|
|
|
|
### Prerequisites:
|
|
* Java VM 1.8 or Docker installed
|
|
|
|
## Easy Run Instructions:
|
|
|
|
#### 1. Docker image
|
|
|
|
The latest version of WebGoat is available at DockerHub, see [https://hub.docker.com/r/webgoat/webgoat-container/](https://hub.docker.com/r/webgoat/webgoat-container/).
|
|
First install Docker, then open a command shell/window and type:
|
|
|
|
```Shell
|
|
docker pull webgoat/webgoat-container
|
|
docker run -p 8080:8080 webgoat/webgoat-container
|
|
```
|
|
|
|
Wait for the Docker container to start and go to step 3.
|
|
|
|
#### 2. Download the easy run executable jar file which contains all the lessons and a embedded Tomcat server:
|
|
|
|
https://s3.amazonaws.com/webgoat-war/webgoat-standalone-7.1-SNAPSHOT-exec.jar
|
|
|
|
#### 3. Run it using java:
|
|
|
|
Open a command shell/window, browse to where you downloaded the easy run jar and type:
|
|
|
|
```Shell
|
|
java -jar webgoat-standalone-7.0.1-exec.jar [-p | --p <port>] [-a | --address <address>]
|
|
```
|
|
|
|
Using the `--help` option will show the allowed command line arguments.
|
|
|
|
#### 3. Browse to the url shown in the console and happy hacking !
|
|
|
|
## Vagrant
|
|
|
|
To run WebGoat with Vagrant you must first have Vagrant and Virtualbox installed.
|
|
|
|
```shell
|
|
$ cd WebGoat/webgoat-images/vagrant-users
|
|
$ vagrant up
|
|
```
|
|
|
|
Once you see the message 'Browse to http://localhost:9999/WebGoat and happy hacking! you can open a
|
|
browser.
|
|
|
|
|
|
# For Developers
|
|
|
|
## Vagrant
|
|
|
|
For an easy development experience you can use Vagrant. Note you should have Vagrant and Virtualbox installed on your system.
|
|
|
|
```shell
|
|
$ cd WebGoat/webgoat-images/vagrant-developers
|
|
$ vagrant up
|
|
```
|
|
|
|
Once the provisioning is complete login to the Virtualbox with username vagrant and password vagrant.
|
|
The source code will be available in the home directory.
|
|
|
|
## Set up manual
|
|
|
|
Follow these instructions if you wish to run Webgoat and modify the source code as well.
|
|
|
|
### Prerequisites:
|
|
|
|
* Java 8
|
|
* Maven > 3.2.1
|
|
* Your favorite IDE, with Maven awareness: Netbeans/IntelliJ/Eclipse with m2e installed.
|
|
* Git, or Git support in your IDE
|
|
|
|
## The Easy Way: Developer Edition run using Linux or Mac
|
|
The __webgoat_developer_bootstrap.sh__ script will clone the necessary repositories, call the maven goals in order
|
|
launch Tomcat listening on localhost:8080
|
|
|
|
```Shell
|
|
mkdir WebGoat-Workspace
|
|
cd WebGoat-Workspace
|
|
curl -o webgoat_developer_bootstrap.sh https://raw.githubusercontent.com/WebGoat/WebGoat/master/webgoat_developer_bootstrap.sh
|
|
./webgoat_developer_bootstrap.sh
|
|
```
|
|
|
|
## The Manual Way: Developer Edition!
|
|
|
|
#### Cloning the Lesson Server and the Lessons project:
|
|
|
|
Open a command shell/window, navigate to where you wish to download the source and type:
|
|
|
|
```Shell
|
|
git clone https://github.com/WebGoat/WebGoat.git
|
|
git clone https://github.com/WebGoat/WebGoat-Lessons.git
|
|
```
|
|
|
|
#### Now let's start by compiling the WebGoat Lessons server.
|
|
|
|
```Shell
|
|
cd WebGoat
|
|
git checkout develop
|
|
mvn clean compile install
|
|
cd ..
|
|
```
|
|
|
|
#### Before you can run the project, we need to compile the lessons and copy them over:
|
|
**If you don't run this step, you will not have any Lessons to work with!**
|
|
|
|
```Shell
|
|
cd WebGoat-Lessons
|
|
git checkout develop
|
|
mvn package
|
|
(linux) cp target/plugins/*.jar ../WebGoat/webgoat-container/src/main/webapp/plugin_lessons/
|
|
(windows) xcopy "target\plugins\*.jar" "..\WebGoat\webgoat-container\src\main\webapp\plugin_lessons\"
|
|
cd ..
|
|
```
|
|
|
|
#### Now we are ready to run the project. There are 3 options you can choose from to run the project:
|
|
|
|
Then you can run the project with one of the steps below (From the WebGoat folder not WebGoat-Lessons):
|
|
|
|
#### Option #1: Using the Maven-Tomcat Plugin
|
|
The __maven tomcat7:run-war__ goal runs the project in an embedded tomcat:
|
|
|
|
```Shell
|
|
cd WebGoat
|
|
mvn -pl webgoat-container spring-boot:run
|
|
```
|
|
|
|
Browse to [http://localhost:8080/WebGoat](http://localhost:8080/WebGoat) and happy hacking !
|
|
|
|
#### Option #2: Java executable JAR
|
|
The __maven package__ goal generates an executable .jar file:
|
|
|
|
```Shell
|
|
cd WebGoat
|
|
mvn package
|
|
cd webgoat-standalone/target
|
|
java -jar webgoat-standalone-7.1-SNAPSHOT-exec.jar [-p | --p <port>] [-a | --address <address>]
|
|
```
|
|
|
|
Browse to url shown in the console and happy hacking !
|
|
|
|
#### Option #3: Deploy the WebGoat WAR file in your local Tomcat or other Application Server:
|
|
The __maven package__ goal generates a .war file that can deployed into an Application Server, such as Tomcat
|
|
|
|
```Shell
|
|
cd WebGoat
|
|
mvn package
|
|
cp webgoat-container/target/webgoat-container-7.1-SNAPSHOT.war <your_tomcat_directory>/webapps/
|
|
```
|
|
|
|
Browse to [http://localhost:8080/WebGoat](http://localhost:8080/WebGoat) and happy hacking !
|
|
|
|
# Debugging and Troubleshooting
|
|
|
|
## Reloading plugins and lessons
|
|
|
|
If you want to __reload all the plugin and lessons__, open up the developer tools available from the info menu. This will
|
|
show an extra set of links below the cookie overview.
|
|
|
|
## Debugging label properties
|
|
|
|
To be able to see which labels are loaded through a property file, open up the developer tools avalailable from the info menu
|
|
After the reload is complete, all labels which are loaded from a property file will be __marked green__.
|
|
|
|
|
|
## Building a new Docker image
|
|
|
|
WebGoat now has Docker support you can build a container with the following commands:
|
|
|
|
```Shell
|
|
cd WebGoat/
|
|
mvn package
|
|
cd webgoat-container
|
|
mvn docker:build
|
|
docker login
|
|
docker push webgoat/webgoat-container
|
|
```
|
|
|
|
With the following command you are able to run the Docker container on your local machine:
|
|
|
|
```Shell
|
|
docker run -p 8080:8080 -t webgoat/webgoat-container
|
|
docker ps
|
|
```
|
|
|
|
With the last command you are able to determine ip address to connect to.
|