Section 2: WebGoat - Revision history

Stephen Evans: OWASP ModSecurity Securing WebGoat Section 2 WebGoat moved to Section 2: WebGoat: To align with TOC on main page

2008-10-27T10:03:46Z

OWASP ModSecurity Securing WebGoat Section 2 WebGoat moved to Section 2: WebGoat: To align with TOC on main page

Stephen Evans: change to level 3 from subheading

2008-07-24T06:20:34Z

change to level 3 from subheading

Stephen Evans: /* Overview of lesson results */

2008-07-24T06:08:45Z

‎Overview of lesson results

Stephen Evans: /* Overview of lesson results */ add content

2008-07-24T06:07:14Z

‎Overview of lesson results: add content

Stephen Evans: /* Lesson Table Of Contents */

2008-07-24T05:58:33Z

‎Lesson Table Of Contents

Stephen Evans: /* Lesson Table Of Contents */

2008-07-24T05:48:51Z

‎Lesson Table Of Contents

Stephen Evans: /* Lesson Table Of Contents */ modify content

2008-07-24T05:45:16Z

‎Lesson Table Of Contents: modify content

Stephen Evans: /* Lesson Table Of Contents */ add content

2008-07-24T05:42:59Z

‎Lesson Table Of Contents: add content

Stephen Evans: /* How it works */

2008-07-24T05:09:22Z

‎How it works

Stephen Evans: /* How it works */

2008-07-24T05:08:21Z

‎How it works

@@ Line 1: / Line 1: @@
-== Overview ==
+=== Overview ===
 From the [http://www.owasp.org/index.php/OWASP_WebGoat_Project WebGoat home page] at OWASP:
@@ Line 8: / Line 8: @@
 Explaining WebGoat and the WebGoat lessons in detail is beyond the scope of this document. Each sublesson has a solution - available from the menu at the top of each lesson - that explains the purpose of the lesson. The motivation of the WebGoat solution (which is exploiting the vulnerability) is often accompanied by screenshots of WebGoat and WebScarab, the web proxy that is used in the solutions. If the reader does not wish to go through the WebGoat lessons themselves, the solutions are the "cheat sheets" for WebGoat, and because of that the solutions are provided in this project's documentation as is. If this is insufficient, installing and using WebGoat may be necessary to gain a complete understanding of the lessons.
-== How it works ==
+=== How it works ===
 WebGoat users are configured in the tomcat-users.xml configuration file.
@@ Line 43: / Line 43: @@
 [[Image:OWASP_ModSecurity_Securing_WebGoat_Section_2_SS6.jpg]]
-== Lesson Table Of Contents ==
+=== Lesson Table Of Contents ===
 The WebGoat lessons are structured as main lessons, which are broken up into sub-lessons, and a sublesson may have several stages. For the purpose of this project, a numbering system is introduced to reference them. The unit of measure will be a sublesson. Lessons are too general and the amount of content for each one varies greatly, while using a stage as the unit of measure is too low-level and would be confusing.
@@ Line 156: / Line 156: @@
 * 19.1  The CHALLENGE!
-== Overview of lesson results ==
+=== Overview of lesson results ===
 Following is an overview of the lesson results from May 21 to May 29 using WebGoat 5.2 beta 1.

@@ Line 162: / Line 162: @@
 The intended behavior of a successfully completed lesson is a green check mark next to the lesson; if absent, at the very least, a message in red appears in the web page with a "Successfully completed..." message. In several cases, it appeared the lesson was completed successfully but not recorded as such. Some lessons did not complete because of a bug or that it was not working according to the solution. One lesson was not implemented. A few lessons required developer versions - source code - in Labs so that the code could be altered; those are not applicable since that's our motive via ModSecurity. A few lessons were not lessons that demonstrated a feature or vulnerability; hence, they are not applicable.
-Note: It is duly noted that this version of WebGoat is beta 1; additionally, the inability of the project member to complete some of the WebGoat solutions is in no way a reflection on whether it actually can be completed or not.
+Note: It is duly noted that this version of WebGoat is beta 1; additionally, the inability of the project member to complete some of the WebGoat solutions is in no way a reflection on whether they actually can be completed or not.
 Summary by category:

← Older revision		Revision as of 06:07, 24 July 2008
Line 157:		Line 157:

	== Overview of lesson results ==		== Overview of lesson results ==
		+
		+	Following is an overview of the lesson results from May 21 to May 29 using WebGoat 5.2 beta 1.
		+
		+	The intended behavior of a successfully completed lesson is a green check mark next to the lesson; if absent, at the very least, a message in red appears in the web page with a "Successfully completed..." message. In several cases, it appeared the lesson was completed successfully but not recorded as such. Some lessons did not complete because of a bug or that it was not working according to the solution. One lesson was not implemented. A few lessons required developer versions - source code - in Labs so that the code could be altered; those are not applicable since that's our motive via ModSecurity. A few lessons were not lessons that demonstrated a feature or vulnerability; hence, they are not applicable.
		+
		+	Note: It is duly noted that this version of WebGoat is beta 1; additionally, the inability of the project member to complete some of the WebGoat solutions is in no way a reflection on whether it actually can be completed or not.
		+
		+	Summary by category:
		+
		+	* (a) Not done because not applicable: 2
		+
		+	18.1, 19.1
		+
		+	* (b) Not done because not implemented: 1
		+
		+	5.0
		+
		+	* (c) Not done because developer version required: 3
		+
		+	2.3, 8.2, 11.7
		+
		+	* (d) Not successful because of bug or not doing correctly with the given solution: 9
		+
		+	3.1, 8.3, 8.5, 11.1, 11.5, 11.8, 16.2, 16.3, 17.4
		+
		+	* (e) Successful but no red "successful" message and/or green check mark: 12
		+
		+	1.1, 1.2, 2.2, 3.7, 4.3, 7.1, 7.2, 9.1, 11.2, 12.1, 14.1, 17.1
		+
		+	* (f) Successful: red "successful" message and/or green check mark: 29
		+
		+	2.1, 2.4, 3.2, 3.3, 3.4, 3.5, 3.6, 3.8, 3.9, 4.1, 4.2, 4.4, 4.5, 6.1, 8.1, 8.4, 8.6, 8.7, 10.1, 11.3, 11.4, 11.6, 13.1, 15.1, 15.2, 15.3, 16.1, 17.2, 17.3
		+
		+	Conclusion:
		+
		+	Not counting (a) and (b), 53 lessons were attempted and 41 lessons were successfully completed (some guesswork was involved in arriving at these numbers)

@@ Line 64: / Line 64: @@
 .  AJAX Security
-.1  LAB: Client Side Filtering
+* 3.1  LAB: Client Side Filtering
-.2  LAB: DOM-Based cross-site scripting
+* 3.2  LAB: DOM-Based cross-site scripting
-.3  DOM Injection
+* 3.3  DOM Injection
-.4  Same Origin Policy Protection
+* 3.4  Same Origin Policy Protection
-.5  XML Injection
+* 3.5  XML Injection
-.6  JSON Injection
+* 3.6  JSON Injection
-.7  Silent Transactions Attacks
+* 3.7  Silent Transactions Attacks
-.8  Insecure Client Storage
+* 3.8  Insecure Client Storage
-	Stage 1:
+* 3.9  Dangerous Use of Eval
 .  Authentication Flaws
-.1  Password Strength
+* 4.1  Password Strength
-.2  Forgot Password
+* 4.2  Forgot Password
-.3  Basic Authentication
+* 4.3  Basic Authentication
-.4  Multi Level Login 1
+* 4.4  Multi Level Login 1
-.5  Multi Level Login 2
+* 4.5  Multi Level Login 2
 .  Buffer Overflows
 .  Code Quality
-.1  Discover Clues in the HTML
+* 6.1  Discover Clues in the HTML
 .  Concurrency
-.1  Thread Safety Problem
+* 7.1  Thread Safety Problem
-.2  Shopping Cart Concurrency Flaw
+* 7.2  Shopping Cart Concurrency Flaw
 .  Cross-Site Scripting (XSS)
-.1  Phishing with XSS
+* 8.1  Phishing with XSS
-.2  LAB: Cross Site Scripting
+* 8.2  LAB: Cross Site Scripting
-	Stage 1: Stored XSS
+** Stage 1: Stored XSS
-	Stage 2: Block Stored XSS using Input Validation
+** Stage 2: Block Stored XSS using Input Validation
-	Stage 3: Stored XSS Revisited
+** Stage 3: Stored XSS Revisited
-	Stage 4: Block Stored XSS using Output Encoding
+** Stage 4: Block Stored XSS using Output Encoding
-	Stage 5: Reflected XSS
+** Stage 5: Reflected XSS
-	Stage 6: Block Reflected XSS
+** Stage 6: Block Reflected XSS
-.3  Stored XSS Attacks
+* 8.3  Stored XSS Attacks
-.4  Reflected XSS Attacks
+* 8.4  Reflected XSS Attacks
-.5  Cross Site Request Forgery (CSRF)
+* 8.5  Cross Site Request Forgery (CSRF)
-.6  HTTPOnly Test
+* 8.6  HTTPOnly Test
-.7  Cross Site Tracing (XST) Attacks
+* 8.7  Cross Site Tracing (XST) Attacks
 .  Denial of Service
-.1  Denial of Service from Multiple Logins
+* 9.1  Denial of Service from Multiple Logins
 .  Improper Error Handling
-.1  Fail Open Authentication Scheme
+* 10.1  Fail Open Authentication Scheme
 .  Injection Flaws
-.1  Command Injection
+* 11.1  Command Injection
-.2  Blind SQL Injection
+* 11.2  Blind SQL Injection
-.3  Numeric SQL Injection
+* 11.3  Numeric SQL Injection
-.4  Log Spoofing
+* 11.4  Log Spoofing
-.5  XPATH Injection
+* 11.5  XPATH Injection
-.6  String SQL Injection
+* 11.6  String SQL Injection
-.7  LAB: SQL Injection
+* 11.7  LAB: SQL Injection
-	Stage 1: String SQL Injection
+** Stage 1: String SQL Injection
-	Stage 2: Parameterized Query #1
+** Stage 2: Parameterized Query #1
-	Stage 3: Numeric SQL Injection
+** Stage 3: Numeric SQL Injection
-	Stage 4: Parameterized Query #2
+** Stage 4: Parameterized Query #2
-.8  Database Backdoors
+* 11.8  Database Backdoors
 .  Insecure Communication
-.1  Insecure Login
+* 12.1  Insecure Login
 .  Insecure Configuration
-.1  Forced Browsing
+* 13.1  Forced Browsing
 .  Insecure Storage
-.1  Encoding Basics
+* 14.1  Encoding Basics
 .  Parameter Tampering
-.1  Exploit Hidden Fields
+* 15.1  Exploit Hidden Fields
-.2  Exploit Unchecked Email
+* 15.2  Exploit Unchecked Email
-.3  Bypass Client Side JavaScript Validation
+* 15.3  Bypass Client Side JavaScript Validation
 .  Session Management Flaws
-.1  Spoof an Authentication Cookie
+* 16.1  Spoof an Authentication Cookie
-.2  Hijack a Session
+* 16.2  Hijack a Session
-.3  Session Fixation
+* 16.3  Session Fixation
 .  Web Services
-.1  Create a SOAP Request
+* 17.1  Create a SOAP Request
-.2  WSDL Scanning
+* 17.2  WSDL Scanning
-.3  Web Service SAX Injection
+* 17.3  Web Service SAX Injection
-.4  Web Service SQL Injection
+* 17.4  Web Service SQL Injection
 .  Admin Functions
-.1  Report Card
+* 18.1  Report Card
 .  The Challenge
-.1  The CHALLENGE!
+* 19.1  The CHALLENGE!
 == Overview of lesson results ==

@@ Line 48: / Line 48: @@
 The Table of Contents for WebGoat 5.2 beta 1 with the numbering system used for this project is:
-{{{
 . General
-.1  Http Basics
+* 1.1  Http Basics
-.2  HTTP Splitting
+* 1.2  HTTP Splitting
 .  Access Control Flaws
-.1  Using an Access Control Matrix
+* 2.1  Using an Access Control Matrix
-.2  Bypass a Path Based Access Control Scheme
+* 2.2  Bypass a Path Based Access Control Scheme
-.3  LAB: Role Based Access Control
+* 2.3  LAB: Role Based Access Control
-	Stage 1: Bypass Business Layer Access Control
+** Stage 1: Bypass Business Layer Access Control
-	Stage 2: Add Business Layer Access Control
+** Stage 2: Add Business Layer Access Control
-	Stage 3: Bypass Data Layer Access Control
+** Stage 3: Bypass Data Layer Access Control
-	Stage 4: Add Data Layer Access Control
+** Stage 4: Add Data Layer Access Control
-.4  Remote Admin Access
+* 2.4  Remote Admin Access
 .  AJAX Security

← Older revision	Revision as of 10:03, 27 October 2008
(No difference)

← Older revision		Revision as of 05:42, 24 July 2008
Line 44:		Line 44:

	== Lesson Table Of Contents ==		== Lesson Table Of Contents ==
		+
		+	The WebGoat lessons are structured as main lessons, which are broken up into sub-lessons, and a sublesson may have several stages. For the purpose of this project, a numbering system is introduced to reference them. The unit of measure will be a sublesson. Lessons are too general and the amount of content for each one varies greatly, while using a stage as the unit of measure is too low-level and would be confusing.
		+
		+	The Table of Contents for WebGoat 5.2 beta 1 with the numbering system used for this project is:
		+
		+	1. General
		+	1.1 Http Basics
		+	1.2 HTTP Splitting
		+
		+	2. Access Control Flaws
		+	2.1 Using an Access Control Matrix
		+	2.2 Bypass a Path Based Access Control Scheme
		+	2.3 LAB: Role Based Access Control
		+	Stage 1: Bypass Business Layer Access Control
		+	Stage 2: Add Business Layer Access Control
		+	Stage 3: Bypass Data Layer Access Control
		+	Stage 4: Add Data Layer Access Control
		+	2.4 Remote Admin Access
		+
		+	3. AJAX Security
		+	3.1 LAB: Client Side Filtering
		+	3.2 LAB: DOM-Based cross-site scripting
		+	3.3 DOM Injection
		+	3.4 Same Origin Policy Protection
		+	3.5 XML Injection
		+	3.6 JSON Injection
		+	3.7 Silent Transactions Attacks
		+	3.8 Insecure Client Storage
		+	Stage 1:
		+	Stage 2:
		+	3.9 Dangerous Use of Eval
		+
		+	4. Authentication Flaws
		+	4.1 Password Strength
		+	4.2 Forgot Password
		+	4.3 Basic Authentication
		+	4.4 Multi Level Login 1
		+	4.5 Multi Level Login 2
		+
		+	5. Buffer Overflows
		+
		+	6. Code Quality
		+	6.1 Discover Clues in the HTML
		+
		+	7. Concurrency
		+	7.1 Thread Safety Problem
		+	7.2 Shopping Cart Concurrency Flaw
		+
		+	8. Cross-Site Scripting (XSS)
		+	8.1 Phishing with XSS
		+	8.2 LAB: Cross Site Scripting
		+	Stage 1: Stored XSS
		+	Stage 2: Block Stored XSS using Input Validation
		+	Stage 3: Stored XSS Revisited
		+	Stage 4: Block Stored XSS using Output Encoding
		+	Stage 5: Reflected XSS
		+	Stage 6: Block Reflected XSS
		+	8.3 Stored XSS Attacks
		+	8.4 Reflected XSS Attacks
		+	8.5 Cross Site Request Forgery (CSRF)
		+	8.6 HTTPOnly Test
		+	8.7 Cross Site Tracing (XST) Attacks
		+
		+	9. Denial of Service
		+	9.1 Denial of Service from Multiple Logins
		+
		+	10. Improper Error Handling
		+	10.1 Fail Open Authentication Scheme
		+
		+	11. Injection Flaws
		+	11.1 Command Injection
		+	11.2 Blind SQL Injection
		+	11.3 Numeric SQL Injection
		+	11.4 Log Spoofing
		+	11.5 XPATH Injection
		+	11.6 String SQL Injection
		+	11.7 LAB: SQL Injection
		+	Stage 1: String SQL Injection
		+	Stage 2: Parameterized Query #1
		+	Stage 3: Numeric SQL Injection
		+	Stage 4: Parameterized Query #2
		+	11.8 Database Backdoors
		+
		+	12. Insecure Communication
		+	12.1 Insecure Login
		+
		+	13. Insecure Configuration
		+	13.1 Forced Browsing
		+
		+	14. Insecure Storage
		+	14.1 Encoding Basics
		+
		+	15. Parameter Tampering
		+	15.1 Exploit Hidden Fields
		+	15.2 Exploit Unchecked Email
		+	15.3 Bypass Client Side JavaScript Validation
		+
		+	16. Session Management Flaws
		+	16.1 Spoof an Authentication Cookie
		+	16.2 Hijack a Session
		+	16.3 Session Fixation
		+
		+	17. Web Services
		+	17.1 Create a SOAP Request
		+	17.2 WSDL Scanning
		+	17.3 Web Service SAX Injection
		+	17.4 Web Service SQL Injection
		+
		+	18. Admin Functions
		+	18.1 Report Card
		+
		+	19. The Challenge
		+	19.1 The CHALLENGE!

	== Overview of lesson results ==		== Overview of lesson results ==

← Older revision		Revision as of 05:09, 24 July 2008
Line 17:		Line 17:


−	Next is the entrance/start page; a JSESSIONID cookie is set for the session variable:	+	Next is the entrance/start page; a JSESSIONID cookie is set for the session variable:

	[[Image:OWASP_ModSecurity_Securing_WebGoat_Section_2_SS2.jpg]]		[[Image:OWASP_ModSecurity_Securing_WebGoat_Section_2_SS2.jpg]]

← Older revision		Revision as of 05:08, 24 July 2008
Line 27:		Line 27:


−	Each WebGoat lesson is designated by the 'menu' parameter in the query string. In the screen shot below, the 'screen' parameter will vary but the 'menu' ~~paramater~~ will always be 900 for this lesson. There is no similar way of easily identifying sublessons within a lesson or stages within a sublesson; ths sublesson 'Stored XSS Attacks' will also have 'menu' value of 900, and each of the stages in the 'LAB: Cross-Site Scripting' sublesson will ~~also~~ have 'menu' value of 900:	+	Each WebGoat lesson is designated by the 'menu' parameter in the query string. In the screen shot below, the 'screen' parameter will vary but the 'menu' parameter will always be 900 for this lesson. There is no similar way of easily identifying sublessons within a lesson or stages within a sublesson; ths sublesson 'Stored XSS Attacks' will also have 'menu' value of 900, and each of the stages in the 'LAB: Cross-Site Scripting' sublesson will always have 'menu' value of 900:

	[[Image:OWASP_ModSecurity_Securing_WebGoat_Section_2_SS4.jpg]]		[[Image:OWASP_ModSecurity_Securing_WebGoat_Section_2_SS4.jpg]]