826887cc83
* organizing environment variables * Update application-webgoat.properties * Update pom.xml * test without ssl * fix docker base image and default env entries * seperate server.address from webgoat.host and webwolf.host * change base image and enable endpoint logging for docker as well * change README * change README * make integration test able to verify against alternative host names * use dynamic ports and remove system println
156 lines
5.5 KiB
Markdown
156 lines
5.5 KiB
Markdown
# WebGoat: A deliberately insecure Web Application
|
|
|
|
[](https://github.com/WebGoat/WebGoat/actions/workflows/build.yml)
|
|
[](https://jdk.java.net/)
|
|
[](https://owasp.org/projects/)
|
|
[](https://github.com/WebGoat/WebGoat/releases/latest)
|
|
[](https://gitter.im/OWASPWebGoat/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
|
|
[](https://github.com/WebGoat/WebGoat/discussions)
|
|
[](https://conventionalcommits.org)
|
|
|
|
# Introduction
|
|
|
|
WebGoat is a deliberately insecure web application maintained by [OWASP](http://www.owasp.org/) designed to teach web
|
|
application security lessons.
|
|
|
|
This program is a demonstration of common server-side application flaws. The
|
|
exercises are intended to be used by people to learn about application security and
|
|
penetration testing techniques.
|
|
|
|
**WARNING 1:** *While running this program your machine will be extremely
|
|
vulnerable to attack. You should disconnect from the Internet while using
|
|
this program.* WebGoat's default configuration binds to localhost to minimize
|
|
the exposure.
|
|
|
|
**WARNING 2:** *This program is for educational purposes only. If you attempt
|
|
these techniques without authorization, you are very likely to get caught. If
|
|
you are caught engaging in unauthorized hacking, most companies will fire you.
|
|
Claiming that you were doing security research will not work as that is the
|
|
first thing that all hackers claim.*
|
|
|
|
|
|
|
|
# Installation instructions:
|
|
|
|
For more details check [the Contribution guide](/CONTRIBUTING.md)
|
|
|
|
## 1. Run using Docker
|
|
|
|
Already have a browser and ZAP and/or Burp installed on your machine in this case you can run the WebGoat image directly using Docker.
|
|
|
|
Every release is also published on [DockerHub](https://hub.docker.com/r/webgoat/webgoat).
|
|
|
|
```shell
|
|
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat
|
|
```
|
|
|
|
For some lessons you need the container run in the same timezone. For this you can set the TZ environment variable.
|
|
E.g.
|
|
|
|
```shell
|
|
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=America/Boise webgoat/webgoat
|
|
```
|
|
|
|
If you want to use OWASP ZAP or another proxy, you can no longer use 127.0.0.1 or localhost. but
|
|
you can use custom host entries. For example:
|
|
|
|
```shell
|
|
127.0.0.1 www.webgoat.local www.webwolf.local
|
|
```
|
|
|
|
Then you can run the container with:
|
|
|
|
```shell
|
|
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e WEBGOAT_HOST=www.webgoat.local -e WEBWOLF_HOST=www.webwolf.local -e TZ=America/Boise webgoat/webgoat
|
|
```
|
|
|
|
Then visit http://www.webgoat.local:8080/WebGoat/ and http://www.webwolf.local:9090/WebWolf/
|
|
|
|
## 2. Run using Docker with complete Linux Desktop
|
|
|
|
Instead of installing tools locally we have a complete Docker image based on running a desktop in your browser. This way you only have to run a Docker image which will give you the best user experience.
|
|
|
|
```shell
|
|
docker run -p 127.0.0.1:3000:3000 webgoat/webgoat-desktop
|
|
```
|
|
|
|
## 3. Standalone
|
|
|
|
Download the latest WebGoat release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases)
|
|
|
|
```shell
|
|
export TZ=Europe/Amsterdam # or your timezone
|
|
java -Dfile.encoding=UTF-8 -jar webgoat-2023.5.jar
|
|
```
|
|
|
|
Click the link in the log to start WebGoat.
|
|
|
|
## 4. Run from the sources
|
|
|
|
### Prerequisites:
|
|
|
|
* Java 17 or 21
|
|
* Your favorite IDE
|
|
* Git, or Git support in your IDE
|
|
|
|
Open a command shell/window:
|
|
|
|
```Shell
|
|
git clone git@github.com:WebGoat/WebGoat.git
|
|
```
|
|
|
|
Now let's start by compiling the project.
|
|
|
|
```Shell
|
|
cd WebGoat
|
|
git checkout <<branch_name>>
|
|
# On Linux/Mac:
|
|
./mvnw clean install
|
|
|
|
# On Windows:
|
|
./mvnw.cmd clean install
|
|
|
|
# Using docker or podman, you can than build the container locally
|
|
docker build -f Dockerfile . -t webgoat/webgoat
|
|
```
|
|
|
|
Now we are ready to run the project. WebGoat is using Spring Boot.
|
|
|
|
```Shell
|
|
# On Linux/Mac:
|
|
./mvnw spring-boot:run
|
|
# On Windows:
|
|
./mvnw.cmd spring-boot:run
|
|
|
|
```
|
|
|
|
... you should be running WebGoat on http://localhost:8080/WebGoat momentarily.
|
|
|
|
Note: The above link will redirect you to login page if you are not logged in. LogIn/Create account to proceed.
|
|
|
|
To change the IP address add the following variable to the `WebGoat/webgoat-container/src/main/resources/application.properties` file:
|
|
|
|
```
|
|
server.address=x.x.x.x
|
|
```
|
|
|
|
## 4. Run with custom menu
|
|
|
|
For specialist only. There is a way to set up WebGoat with a personalized menu. You can leave out some menu categories or individual lessons by setting certain environment variables.
|
|
|
|
For instance running as a jar on a Linux/macOS it will look like this:
|
|
|
|
```Shell
|
|
export TZ=Europe/Amsterdam # or your timezone
|
|
export EXCLUDE_CATEGORIES="CLIENT_SIDE,GENERAL,CHALLENGE"
|
|
export EXCLUDE_LESSONS="SqlInjectionAdvanced,SqlInjectionMitigations"
|
|
java -jar target/webgoat-2023.6-SNAPSHOT.jar
|
|
```
|
|
|
|
Or in a docker run it would (once this version is pushed into docker hub) look like this:
|
|
|
|
```Shell
|
|
docker run -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e EXCLUDE_CATEGORIES="CLIENT_SIDE,GENERAL,CHALLENGE" -e EXCLUDE_LESSONS="SqlInjectionAdvanced,SqlInjectionMitigations" webgoat/webgoat
|
|
```
|
|
|