This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Lesson Plans"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to www.textgetvar.com)
 
(4 intermediate revisions by 4 users not shown)
Line 2: Line 2:
 
__TOC__
 
__TOC__
  
−
The current lesson plans included in this release of WebGoatv5 include:
+
The lesson plans included WebGoat 5.0 (1/31/07) include:
 
{| border=1
 
{| border=1
 
|-
 
|-
−
  || HTTP Basics
+
  || General || HTTP Basics
 
|-
 
|-
−
  || HTTP Splitting and Cache Poisining
+
  || || HTTP Splitting and Cache Poisining
 
|-
 
|-
−
  || How to Exploit Thread Safety Problems
+
  || || How to Exploit Thread Safety Problems
 
|-
 
|-
−
  || How to Discover Clues in the HTML
+
  || || How to add a new WebGoat lesson
 
|-
 
|-
−
  || How to Exploit Hidden Fields
+
  || Code Quality || How to Discover Clues in the HTML
 
|-
 
|-
−
  || How to Exploit Unchecked Email
+
  || Unvalidated Parameters || How to Exploit Hidden Fields
 
|-
 
|-
−
  || How to Bypass Client Side JavaScript Validation
+
  || || How to Exploit Unchecked Email
 
|-
 
|-
−
  || How to Force Browser Web Resources
+
  || || How to Bypass Client Side JavaScript Validation
 
|-
 
|-
−
  || How to Bypass a Role Based Access Control Scheme
+
  || Broken Access Control || Using an Access Control Matrix
 
|-
 
|-
−
  || How to Bypass a Path Based Access Control Scheme
+
  || || How to Bypass a Path Based Access Control Scheme
 
|-
 
|-
−
  || LAB: Role based Access Control
+
  || || How to Perform Cross Site Request Forgery (CSRF)
 
|-
 
|-
−
  || Using an Access Control Matrix
+
  || || LAB: Role based Access Control
 
|-
 
|-
−
  || How to Exploit the Forgot Password Page
+
  || || Remote Admin Access
 
|-
 
|-
−
  || How to Spoof an Authentication Cookie
+
  || Broken Authentication || Forgot Password
 
|-
 
|-
−
  || How to Hijack a Session
+
  || || How to Spoof an Authentication Cookie
 
|-
 
|-
−
  || Basic Authentication
+
  || || How to Hijack a Session
 
|-
 
|-
−
  || LAB: Cross Site Scripting
+
  || || Basic Authentication
 
|-
 
|-
−
  || How to Perform Stored Cross Site Scripting (XSS)
+
  || Cross Site Scripting (Xss) || LAB: Cross Site Scripting
 
|-
 
|-
−
  || How to Perform Reflected Cross Site Scripting (XSS)
+
  || || How to Perform Stored Cross Site Scripting (XSS)
 
|-
 
|-
−
  || How to Perform Cross Site Trace Attacks (XSS)
+
  || || How to Perform Reflected Cross Site Scripting (XSS)
 
|-
 
|-
−
  || Buffer Overflow (TBD)
+
  || || [[HTTPOnly]] Test
 
|-
 
|-
−
  || HttpOnly Test
+
  || || How to Perform Cross Site Tracing (XST) Attacks
 
|-
 
|-
−
  || How to Perform Command Injection
+
  || Buffer Overflows || Buffer Overflow
 
|-
 
|-
−
  || How to Perform Parameter Injection
+
  || Injection Flaws || How to Perform Command Injection
 
|-
 
|-
−
  || How to Perform Blind SQL Injection
+
  || || How to Perform Blind SQL Injection
 
|-
 
|-
−
  || How to Perform Numeric SQL Injection  
+
  || || How to Perform Numeric SQL Injection  
 
|-
 
|-
−
  || How to Perform String SQL Injection
+
  || || How to Perform Log Spoofing
 
|-
 
|-
−
  || How to Perform Log Spoofing
+
  || || How to Perform XPATH Injection
 
|-
 
|-
−
  || How to Perform XPATH Injection Attacks
+
  || || How to Perform String SQL Injection  
 
|-
 
|-
−
  || LAB: SQL Injection
+
  || || LAB: SQL Injection
 
|-
 
|-
−
  || How to Bypass a Fail Open Authentication Scheme
+
  || || How to Use Database Backdoors
 
|-
 
|-
−
  || How to Peform Basic Encoding
+
  || Improper Error Handling || How to Bypass a Fail Open Authentication Scheme
 
|-
 
|-
−
  || Denial of Service from Multiple Logins
+
  || Insecure Storage || Encoding Basics
 
|-
 
|-
−
  || How to Create a SOAP Request
+
  || Denial of Service || Denial of Service From Multiple Logins
 
|-
 
|-
−
  || How to Perform WSDL Scanning
+
  || Insecure Configuration Management || Forced Browsing
 
|-
 
|-
−
|| How to Perform Web Service SAX Injection
+
|| Web Services || How to Create a SOAP Request
 
|-
 
|-
−
  || How to Perform Web Service SQL Injection
+
  || || WSDL Scanning
 
|-
 
|-
−
  || How to Perform DOM Injection Attack
+
  || || Web Service SAX Injection
 
|-
 
|-
−
  || How to Perform XML Injection Attacks
+
  || || Web Service SQL Injection
 
|-
 
|-
−
  || How to Add a New Lesson
+
  || AJAX Security || DOM Injection
 
|-
 
|-
−
  || The Challenge  
+
|| || XML Injection
 +
|-
 +
  || || JSON Injection
 +
|-
 +
|| || Silent Transactions Attacks
 +
|-
 +
|| Challenge || The Challenge  
 
|-
 
|-
  

Latest revision as of 18:28, 27 May 2009

WebGoat User Guide Table of Contents


The lesson plans included WebGoat 5.0 (1/31/07) include:

General HTTP Basics
HTTP Splitting and Cache Poisining
How to Exploit Thread Safety Problems
How to add a new WebGoat lesson
Code Quality How to Discover Clues in the HTML
Unvalidated Parameters How to Exploit Hidden Fields
How to Exploit Unchecked Email
How to Bypass Client Side JavaScript Validation
Broken Access Control Using an Access Control Matrix
How to Bypass a Path Based Access Control Scheme
How to Perform Cross Site Request Forgery (CSRF)
LAB: Role based Access Control
Remote Admin Access
Broken Authentication Forgot Password
How to Spoof an Authentication Cookie
How to Hijack a Session
Basic Authentication
Cross Site Scripting (Xss) LAB: Cross Site Scripting
How to Perform Stored Cross Site Scripting (XSS)
How to Perform Reflected Cross Site Scripting (XSS)
HTTPOnly Test
How to Perform Cross Site Tracing (XST) Attacks
Buffer Overflows Buffer Overflow
Injection Flaws How to Perform Command Injection
How to Perform Blind SQL Injection
How to Perform Numeric SQL Injection
How to Perform Log Spoofing
How to Perform XPATH Injection
How to Perform String SQL Injection
LAB: SQL Injection
How to Use Database Backdoors
Improper Error Handling How to Bypass a Fail Open Authentication Scheme
Insecure Storage Encoding Basics
Denial of Service Denial of Service From Multiple Logins
Insecure Configuration Management Forced Browsing
Web Services How to Create a SOAP Request
WSDL Scanning
Web Service SAX Injection
Web Service SQL Injection
AJAX Security DOM Injection
XML Injection
JSON Injection
Silent Transactions Attacks
Challenge The Challenge

For each lesson within WebGoat, an overview and objectives are provided. These are accessed through the Show Lesson Plan button.


Figure 3: Show Lesson Plan

These lesson plans describe the operation of each aspect of the target application, the areas of interest relating to the security assessment and the type of attack that should be attempted.


WebGoat User Guide Table of Contents

Retrieved from "https://wiki.owasp.org/index.php?title=Lesson_Plans&oldid=62600"