Lesson Plans - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textgetvar.com

2009-05-27T18:28:39Z

Reverting to last version not containing links to www.textgetvar.com

Deleted user at 15:13, 22 May 2009

2009-05-22T15:13:36Z

Rknell: Linked keyword: HTTPOnly

2007-07-27T17:37:39Z

Linked keyword: HTTPOnly

Robert.sullivan at 08:09, 21 April 2007

2007-04-21T08:09:04Z

Koussa at 14:49, 28 December 2006

2006-12-28T14:49:55Z

Koussa at 14:34, 28 December 2006

2006-12-28T14:34:49Z

Koussa at 02:37, 24 December 2006

2006-12-24T02:37:48Z

Koussa at 02:06, 24 December 2006

2006-12-24T02:06:22Z

Koussa at 01:15, 23 December 2006

2006-12-23T01:15:49Z

Weilin Zhong at 19:25, 5 June 2006

2006-06-05T19:25:49Z

New page

[[WebGoat User Guide Table of Contents]]
__TOC__

The current lesson plans included in this release of WebGoatv4 include:
{| border=1
|| Http Basics
|-
|| How to Exploit Thread Safety Problems
|-
|| How to Discover Clues in the HTML
|-
|| How to Exploit Hidden Fields
|-
|| How to Exploit Unchecked Email
|-
|| How to Bypass Client Side JavaScript Validation
|-
|| How to Bypass a Role Based Access Control Scheme
|-
|| How to Bypass a Path Based Access Control Scheme
|-
|| How to Spoof an Authentication Cookie
|-
|| Basic Authentication
|-
|| How to Perform Cross Site Trace Attacks
|-
|| How to Perform Command Injection
|-
|| How to Perform Blind SQL Injection
|-
|| How to Bypass a Fail Open Authentication Scheme
|-
|| Web Service SQL Injection
|-
|| The Challenge
|-
|}

For each lesson within WebGoat, an overview and objectives are provided. These are accessed through the ''Show Lesson Plan'' button.

[[Image:WebGoat Show Lesson Plan.gif|Figure 3: Show Lesson Plan]]

These lesson plans describe the operation of each aspect of the target application, the areas of interest relating to the security assessment and the type of attack that should be attempted.

[[WebGoat User Guide Table of Contents]]
[[Category:OWASP WebGoat Project]]

← Older revision		Revision as of 18:28, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textgetvar.com~~
	[[WebGoat User Guide Table of Contents]]		[[WebGoat User Guide Table of Contents]]
	__TOC__		__TOC__

← Older revision		Revision as of 15:13, 22 May 2009
Line 1:		Line 1:
		+	http://www.textgetvar.com
	[[WebGoat User Guide Table of Contents]]		[[WebGoat User Guide Table of Contents]]
	__TOC__		__TOC__

@@ Line 45: / Line 45: @@
   || || How to Perform Reflected Cross Site Scripting (XSS)
 |-
-  || || HTTPOnly Test
+  || || [[HTTPOnly]] Test
 |-
   || || How to Perform Cross Site Tracing (XST) Attacks

@@ Line 2: / Line 2: @@
 __TOC__
-The current lesson plans included in this release of WebGoatv5 include:
+The lesson plans included WebGoat 5.0 (1/31/07) include:
 {| border=1
 |-
-  || HTTP Basics
+  || General || HTTP Basics
 |-
-  || HTTP Splitting and Cache Poisining
+  || || HTTP Splitting and Cache Poisining
 |-
-  || How to Exploit Thread Safety Problems
+  || || How to Exploit Thread Safety Problems
 |-
-  || How to Discover Clues in the HTML
+  || || How to add a new WebGoat lesson
 |-
-  || How to Exploit Hidden Fields
+  || Code Quality || How to Discover Clues in the HTML
 |-
-  || How to Exploit Unchecked Email
+  || Unvalidated Parameters || How to Exploit Hidden Fields
 |-
-  || How to Bypass Client Side JavaScript Validation
+  || || How to Exploit Unchecked Email
 |-
-  || How to Force Browser Web Resources
+  || || How to Bypass Client Side JavaScript Validation
 |-
-  || How to Bypass a Role Based Access Control Scheme
+  || Broken Access Control || Using an Access Control Matrix
 |-
-  || How to Bypass a Path Based Access Control Scheme
+  || || How to Bypass a Path Based Access Control Scheme
 |-
-  || LAB: Role based Access Control
+  || || How to Perform Cross Site Request Forgery (CSRF)
 |-
-  || Using an Access Control Matrix
+  || || LAB: Role based Access Control
 |-
-  || How to Exploit the Forgot Password Page
+  || || Remote Admin Access
 |-
-  || How to Spoof an Authentication Cookie
+  || Broken Authentication || Forgot Password
 |-
-  || How to Hijack a Session
+  || || How to Spoof an Authentication Cookie
 |-
-  || Basic Authentication
+  || || How to Hijack a Session
 |-
-  || LAB: Cross Site Scripting
+  || || Basic Authentication
 |-
-  || How to Perform Stored Cross Site Scripting (XSS)
+  || Cross Site Scripting (Xss) || LAB: Cross Site Scripting
 |-
-  || How to Perform Reflected Cross Site Scripting (XSS)
+  || || How to Perform Stored Cross Site Scripting (XSS)
 |-
-  || How to Perform Cross Site Trace Attacks (XSS)
+  || || How to Perform Reflected Cross Site Scripting (XSS)
 |-
-  || Buffer Overflow (TBD)
+  || || HTTPOnly Test
 |-
-  || HttpOnly Test
+  || || How to Perform Cross Site Tracing (XST) Attacks
 |-
-  || How to Perform Command Injection
+  || Buffer Overflows || Buffer Overflow
 |-
-  || How to Perform Parameter Injection
+  || Injection Flaws || How to Perform Command Injection
 |-
-  || How to Perform Blind SQL Injection
+  || || How to Perform Blind SQL Injection
 |-
-  || How to Perform Numeric SQL Injection
+  || || How to Perform Numeric SQL Injection
 |-
-  || How to Perform String SQL Injection
+  || || How to Perform Log Spoofing
 |-
-  || How to Perform Log Spoofing
+  || || How to Perform XPATH Injection
 |-
-  || How to Perform XPATH Injection Attacks
+  || || How to Perform String SQL Injection
 |-
-  || LAB: SQL Injection
+  || || LAB: SQL Injection
 |-
-  || How to Bypass a Fail Open Authentication Scheme
+  || || How to Use Database Backdoors
 |-
-  || How to Peform Basic Encoding
+  || Improper Error Handling || How to Bypass a Fail Open Authentication Scheme
 |-
-  || Denial of Service from Multiple Logins
+  || Insecure Storage || Encoding Basics
 |-
-  || How to Create a SOAP Request
+  || Denial of Service || Denial of Service From Multiple Logins
 |-
-  || How to Perform WSDL Scanning
+  || Insecure Configuration Management || Forced Browsing
 |-
- || How to Perform Web Service SAX Injection
+|| Web Services || How to Create a SOAP Request
 |-
-  || How to Perform Web Service SQL Injection
+  || || WSDL Scanning
 |-
-  || How to Perform DOM Injection Attack
+  || || Web Service SAX Injection
 |-
-  || How to Perform XML Injection Attacks
+  || || Web Service SQL Injection
 |-
-  || How to Perform JSON Injection Attack
+  || AJAX Security || DOM Injection
 |-
- || How to Perform Silent Transactions Attacks
+|| || XML Injection
 |-
-  || How to Add a New Lesson
+  || || JSON Injection
 |-
-  || The Challenge
+  || || Silent Transactions Attacks
 |-

@@ Line 82: / Line 82: @@
 |-
   || How to Perform XML Injection Attacks
 |-
   || How to Add a New Lesson