OWASP - User contributions [en]

WebGoat Installation

2006-10-21T11:45:30Z

Josef Meixner: /* Installing to Linux */ Formatting of start and stop command was off

[[WebGoat User Guide Table of Contents]]
__TOC__

WebGoat is a platform independent environment.
It utilizes Apache Tomcat and the JAVA development environment.
Installers are provided for Microsoft Windows and UN*X environments, together with notes for installation on other platforms.

==Installing Java and Tomcat ==
# <This section may not be needed, update for v4>

==Installing to Windows ==
# Unzip the Windows_WebGoat-x.x.zip to your working environment
# To start Tomcat, browse to the WebGoat directory unzipped above and double click "webgoat.bat"
# Start your browser and browse to: http://localhost/WebGoat/attack This link is case-sensitive. Make sure to use a large ‘W’ and ‘G’.

==Installing to Linux ==
* 1. Download and install Java JDK 1.5 from Sun (http://java.sun.com)
* 2. Unzip the Unix_WebGoat-x.x.zip to your working directory
* 3. Edit the following line in webgoat.sh, set JAVA_HOME to your JDK1.5 path.
JAVA_HOME="SET ME TO YOUR JAVA 1.5 JDK PATH"
* 4. Since the latest version runs on a privileged port, you will need to start/stop WebGoat as root.

sudo sh webgoat.sh start
sudo sh webgoat.sh stop

==Installing to OS X (Tiger 10.4+) ==
# Unzip the Unix_WebGoat-x.x.zip to your working directory
# Since the latest version runs on a privileged port, you will need to start/stop WebGoat as root.

sudo sh webgoat.sh start
sudo sh webgoat.sh stop

==Running ==
# Start your browser and browse to: http://localhost/WebGoat/attack. Notice the capital 'W' and 'G'
# Login in as: user = guest, password = guest

==Building ==
Skip these steps if you just want to run WebGoat
<this section is incomplete>

[[WebGoat User Guide Table of Contents]]
[[Category:OWASP WebGoat Project]]
{{Template:Stub}}

Tools required

2006-10-21T11:19:49Z

Josef Meixner: Missed second link at last edit

[[WebGoat User Guide Table of Contents]]
__TOC__

There are a number of tools to aid the wily application security assessor. By far the most relevant to this type of security assessment are local proxies and web/application spiders. To complete the full set of WebGoat lessons a web-proxy will be required.

==Application Assessment Proxy ==
A normal web-proxy typically receives, processes and forwards HTTP and HTTPS traffic between the client and server. This is normally to provide a single point through which all web traffic passes – for example to monitor usage, improve performance through caching or apply security policies.

An application proxy tool is designed to intercept all HTTP and HTTPS communication between the local client browser and the server-side. It acts as a man-in-the-middle where all interaction may be monitored, reviewed and (importantly) modified.

Through such a tool, the assessor can determine exactly what data is passed between the Client and Server. Furthermore, they may analyze and modify the data in order to test the impact of the application.

It is essential for many of the lessons within WebGoat that an application assessment proxy, or software with equivalent functionality be used.

The following is recommended:
WebScarab: [[:Category:OWASP_WebScarab_Project|WebScarab Project]]

==Application Spider ==
Spidering or crawling a site should identify and follow all of the intended pages and links within a web site & application, and optionally store a local copy.

The results can then be analyzed to define a comprehensive list of target scripts, forms, pages and fields within the application for use in later testing.

Mirrored content can also be analyzed for relevant information far more quickly than through a manual or ‘on the wire’ analysis.

The following are recommended:
* HHTrack – http://www.httrack.com
* Form Scalpel – http://www.ugc-labs.co.uk/tools/formscalpel/
* WebScarab – [[:Category:OWASP_WebScarab_Project|WebScarab Project]]

[[WebGoat User Guide Table of Contents]]
[[Category:OWASP WebGoat Project]]

Tools required

2006-10-21T11:19:03Z

Josef Meixner: http://www.owasp.org/webscarab does no longer work, so substituted with category page

[[WebGoat User Guide Table of Contents]]
__TOC__

There are a number of tools to aid the wily application security assessor. By far the most relevant to this type of security assessment are local proxies and web/application spiders. To complete the full set of WebGoat lessons a web-proxy will be required.

==Application Assessment Proxy ==
A normal web-proxy typically receives, processes and forwards HTTP and HTTPS traffic between the client and server. This is normally to provide a single point through which all web traffic passes – for example to monitor usage, improve performance through caching or apply security policies.

An application proxy tool is designed to intercept all HTTP and HTTPS communication between the local client browser and the server-side. It acts as a man-in-the-middle where all interaction may be monitored, reviewed and (importantly) modified.

Through such a tool, the assessor can determine exactly what data is passed between the Client and Server. Furthermore, they may analyze and modify the data in order to test the impact of the application.

It is essential for many of the lessons within WebGoat that an application assessment proxy, or software with equivalent functionality be used.

The following is recommended:
WebScarab: [[:Category:OWASP_WebScarab_Project|WebScarab Project]]

==Application Spider ==
Spidering or crawling a site should identify and follow all of the intended pages and links within a web site & application, and optionally store a local copy.

The results can then be analyzed to define a comprehensive list of target scripts, forms, pages and fields within the application for use in later testing.

Mirrored content can also be analyzed for relevant information far more quickly than through a manual or ‘on the wire’ analysis.

The following are recommended:
* HHTrack – http://www.httrack.com
* Form Scalpel – http://www.ugc-labs.co.uk/tools/formscalpel/
* WebScarab – http://www.owasp.org/webscarab

[[WebGoat User Guide Table of Contents]]
[[Category:OWASP WebGoat Project]]