diff --git a/.gitignore b/.gitignore old mode 100644 new mode 100755 index 85cfca11b..bf001a5dd --- a/.gitignore +++ b/.gitignore @@ -2,11 +2,10 @@ ################# *.userprefs *.pidb -*swp bin obj WebGoat/App_Data/*.txt -*.sqlite* +*.sqlite WebGoat/Configuration/*.config # Trash Files # diff --git a/README b/README deleted file mode 100644 index a5ce616ca..000000000 --- a/README +++ /dev/null @@ -1,64 +0,0 @@ -***************************** Webgoat.NET ********************************** -* Source Code: https://github.com/jerryhoff/WebGoat.NET -* Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master -**************************************************************************** - -This web application is a learning platform that attempts to teach about -common web security flaws. It contains generic security flaws that apply to -most web applications. It also contains lessons that specifically pertain to -the .NET framework. The excercises in this app are intented to teach about -web security attacks and how developers can overcome them. - -WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES -WHICH WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY -RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE -RUNNING! - -Notes: - - Google Chrome performs filtering for reflected XSS attacks. These attacks - will not work unless chrome is run with the argument - --disable-xss-auditor. -- Some (but not all!) of the lessons require a working SQL database. Setup - guidelines are shown below. - -How To Build And Run under Mac OS X and Linux: - 1. Prerequisites - a. Mono framework for your respective OS. It can be downloaded at - http://www.go-mono.com/mono-downloads/download.html. Make sure - that ALL components get installed, including GTK and xsp. - b. A DB for some of the lessions. Sqlite3 is recommended as it's - faster and easier to use for the purposes of these lessions. - Binaries can be found here: http://www.sqlite.org/download.html - 2. Install the mono framework and sqlite3 binaries. - 3. IMPORTANT: Make sure that the the mono executable is in your PATH. - 4. Grab WebGoat.NET and cd into the root dir. - 5. Run 'xbuild'. There may be a few warnings but there should be no - errors! If there are please let us know. - 6. cd into the WebGoat project and run 'xsp4'. Then open your favorite - browser and go to http://localhost:8080 (or whatever port your - xsp4 is using if you're not using the default). Note: The first run - may take take some time as it's compiling everything on the fly. - 7. If you see the WebGoat.NET page that means you're almost there! Next - step is to click on 'Set Up Database!' - 8. You should see a form with a bunch of setup information for the - database. For 'Data Provider' choose Sqlite. For 'Data File Path' put - in 'db.sqlite3' and for 'Client Executable' put in the sqlite3 - executable of your OS (usually /usr/bin/sqlite3). - 9. Click on 'Test Configuration', followed by 'Rebuild Database' and - hopefully you should be good go! Enjoy your hackathon! - -How to build and run under Windows: - 1. Prerequisites: - a. Visual Studio 2010 and above. - b. Mysql database that's up and running with at least one user - aleady setup with full permissions. - 2. Open WebGoat.sln file via Visual Studio, and click on debug. - 3. You should see the WebGoat.NET page at which point click on - 'Set Up Database'. - 3. You should see a form with a bunch of setup information for the - database. For 'Data Provider' choose MySql. You'll need to fill in - the respective data entries for your mysql db. 'Client Executable' - and 'Data File Path' are not necessary for MySql so you can leave - them empty. - 4. Click on 'Test Configuration', followed by 'Rebuild Database' and - hopefully you should be good go! Enjoy your hackathon! diff --git a/WebGoat.NET.sln b/WebGoat.NET.sln old mode 100644 new mode 100755 diff --git a/WebGoat.NET.suo b/WebGoat.NET.suo deleted file mode 100644 index aa1b304db..000000000 Binary files a/WebGoat.NET.suo and /dev/null differ diff --git a/WebGoat/AddNewUser.aspx b/WebGoat/AddNewUser.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/AddNewUser.aspx.cs b/WebGoat/AddNewUser.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/AddNewUser.aspx.designer.cs b/WebGoat/AddNewUser.aspx.designer.cs old mode 100644 new mode 100755 index 959cf3856..2ddec37d3 --- a/WebGoat/AddNewUser.aspx.designer.cs +++ b/WebGoat/AddNewUser.aspx.designer.cs @@ -26,7 +26,6 @@ public partial class AddNewUser { protected System.Web.UI.WebControls.TextBox Password; protected System.Web.UI.WebControls.TextBox Email; - protected System.Web.UI.WebControls.Label SecurityQuestion; protected System.Web.UI.WebControls.TextBox SecurityAnswer; diff --git a/WebGoat/App_Code/ConfigFile.cs b/WebGoat/App_Code/ConfigFile.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/CookieManager.cs b/WebGoat/App_Code/CookieManager.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/CustomerLoginData.cs b/WebGoat/App_Code/CustomerLoginData.cs old mode 100644 new mode 100755 index fa431889b..9d4a5e136 --- a/WebGoat/App_Code/CustomerLoginData.cs +++ b/WebGoat/App_Code/CustomerLoginData.cs @@ -1,5 +1,6 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Web; namespace OWASP.WebGoat.NET @@ -30,4 +31,4 @@ public String Message } } -} +} \ No newline at end of file diff --git a/WebGoat/App_Code/DB/DbConstants.cs b/WebGoat/App_Code/DB/DbConstants.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/DB/DbProviderFactory.cs b/WebGoat/App_Code/DB/DbProviderFactory.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/DB/DummyDbProvider.cs b/WebGoat/App_Code/DB/DummyDbProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/DB/IDbProvider.cs b/WebGoat/App_Code/DB/IDbProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/DB/MySqlDbProvider.cs b/WebGoat/App_Code/DB/MySqlDbProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/DB/SqliteDbProvider.cs b/WebGoat/App_Code/DB/SqliteDbProvider.cs old mode 100644 new mode 100755 index 0e88a6d86..56ecb3484 --- a/WebGoat/App_Code/DB/SqliteDbProvider.cs +++ b/WebGoat/App_Code/DB/SqliteDbProvider.cs @@ -59,8 +59,6 @@ public DataSet GetCatalogData() { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter("select * from Products", connection); DataSet ds = new DataSet(); @@ -81,8 +79,6 @@ public bool IsValidCustomerLogin(string email, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); //TODO: User reader instead (for all calls) @@ -136,8 +132,6 @@ public string CustomCustomerLogin(string email, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -185,8 +179,6 @@ public string GetCustomerEmail(string customerNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select email from CustomerLogin where customerNumber = " + customerNumber; SqliteCommand command = new SqliteCommand(sql, connection); output = command.ExecuteScalar().ToString(); @@ -212,8 +204,6 @@ public DataSet GetCustomerDetails(string customerNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.Fill(ds); } @@ -234,8 +224,6 @@ public DataSet GetOffice(string city) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select * from Offices where city = @city"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.SelectCommand.Parameters.AddWithValue("@city", city); @@ -249,8 +237,6 @@ public DataSet GetComments(string productCode) { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select * from Comments where productCode = @productCode"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.SelectCommand.Parameters.AddWithValue("@productCode", productCode); @@ -293,8 +279,6 @@ public string UpdateCustomerPassword(int customerNumber, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteCommand command = new SqliteCommand(sql, connection); int rows_added = command.ExecuteNonQuery(); @@ -320,8 +304,6 @@ public string[] GetSecurityQuestionAndAnswer(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -346,8 +328,6 @@ public string GetPasswordByEmail(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - //get data string sql = "select * from CustomerLogin where email = '" + email + "';"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); @@ -376,8 +356,6 @@ public DataSet GetUsers() { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select * from CustomerLogin;"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -391,8 +369,6 @@ public DataSet GetOrders(int customerID) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select * from Orders where customerNumber = " + customerID; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -414,8 +390,6 @@ public DataSet GetProductDetails(string productCode) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - sql = "select * from Products where productCode = '" + productCode + "'"; da = new SqliteDataAdapter(sql, connection); da.Fill(ds, "products"); @@ -448,8 +422,6 @@ public DataSet GetOrderDetails(int orderNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -465,8 +437,6 @@ public DataSet GetPayments(int customerNumber) { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select * from Payments where customerNumber = " + customerNumber; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -499,7 +469,6 @@ public DataSet GetProductsAndCategories(int catNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); sql = "select * from Categories" + catClause; da = new SqliteDataAdapter(sql, connection); @@ -528,8 +497,6 @@ public DataSet GetEmailByName(string name) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -549,8 +516,6 @@ public string GetEmailByCustomerNumber(string num) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - string sql = "select email from CustomerLogin where customerNumber = " + num; SqliteCommand cmd = new SqliteCommand(sql, connection); output = (string)cmd.ExecuteScalar(); @@ -573,8 +538,6 @@ public DataSet GetCustomerEmails(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { - connection.Open(); - SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); diff --git a/WebGoat/App_Code/Encoder.cs b/WebGoat/App_Code/Encoder.cs old mode 100644 new mode 100755 index 99bb022e3..5d792c51e --- a/WebGoat/App_Code/Encoder.cs +++ b/WebGoat/App_Code/Encoder.cs @@ -1,5 +1,6 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Web; using System.IO; using System.Text; @@ -241,4 +242,4 @@ public string EncodeTicket(string token) } } -} +} \ No newline at end of file diff --git a/WebGoat/App_Code/Settings.cs b/WebGoat/App_Code/Settings.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/Util.cs b/WebGoat/App_Code/Util.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/VeryWeakRandom.cs b/WebGoat/App_Code/VeryWeakRandom.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/WeakMessageDigest.cs b/WebGoat/App_Code/WeakMessageDigest.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Code/WeakRandom.cs b/WebGoat/App_Code/WeakRandom.cs old mode 100644 new mode 100755 diff --git a/WebGoat/App_Data/XmlInjectionUsers.xml b/WebGoat/App_Data/XmlInjectionUsers.xml old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/00.reset.css b/WebGoat/App_Themes/Default/00.reset.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/01.960_24_col.css b/WebGoat/App_Themes/Default/01.960_24_col.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/02.text.css b/WebGoat/App_Themes/Default/02.text.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/03.layout.css b/WebGoat/App_Themes/Default/03.layout.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/BreadCrumb.css b/WebGoat/App_Themes/Default/BreadCrumb.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/Forms.css b/WebGoat/App_Themes/Default/Forms.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/WebGoat.skin b/WebGoat/App_Themes/Default/WebGoat.skin old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/buttons.css b/WebGoat/App_Themes/Default/buttons.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/grids.css b/WebGoat/App_Themes/Default/grids.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/Chevron.gif b/WebGoat/App_Themes/Default/images/Chevron.gif old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/ChevronOverlay.png b/WebGoat/App_Themes/Default/images/ChevronOverlay.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/IconHome.gif b/WebGoat/App_Themes/Default/images/IconHome.gif old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/blank.gif b/WebGoat/App_Themes/Default/images/blank.gif old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/calendar.png b/WebGoat/App_Themes/Default/images/calendar.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/eisk-logo.png b/WebGoat/App_Themes/Default/images/eisk-logo.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/extras/ico-delete.png b/WebGoat/App_Themes/Default/images/extras/ico-delete.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/extras/loader-modal.gif b/WebGoat/App_Themes/Default/images/extras/loader-modal.gif old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/header-grad.png b/WebGoat/App_Themes/Default/images/header-grad.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/listing/asc.png b/WebGoat/App_Themes/Default/images/listing/asc.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/listing/desc.png b/WebGoat/App_Themes/Default/images/listing/desc.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/listing/ico-edit.png b/WebGoat/App_Themes/Default/images/listing/ico-edit.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/listing/ico-view.png b/WebGoat/App_Themes/Default/images/listing/ico-view.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/listing/sort-regular.png b/WebGoat/App_Themes/Default/images/listing/sort-regular.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/logo.png b/WebGoat/App_Themes/Default/images/logo.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/images/logo2.png b/WebGoat/App_Themes/Default/images/logo2.png old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/left-menu.css b/WebGoat/App_Themes/Default/left-menu.css old mode 100644 new mode 100755 diff --git a/WebGoat/App_Themes/Default/styles.css b/WebGoat/App_Themes/Default/styles.css old mode 100644 new mode 100755 diff --git a/WebGoat/ChangePassword.aspx b/WebGoat/ChangePassword.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/ChangePassword.aspx.cs b/WebGoat/ChangePassword.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/ChangePassword.aspx.designer.cs b/WebGoat/ChangePassword.aspx.designer.cs index 1181a2e30..6f81f8832 100644 --- a/WebGoat/ChangePassword.aspx.designer.cs +++ b/WebGoat/ChangePassword.aspx.designer.cs @@ -16,23 +16,5 @@ public partial class ChangePassword { protected System.Web.UI.WebControls.Content Content1; protected System.Web.UI.HtmlControls.HtmlGenericControl lblHeader; - - protected System.Web.UI.WebControls.Content Content2; - - protected System.Web.UI.WebControls.ChangePassword ChangePwdCtrl; - - protected System.Web.UI.WebControls.TextBox CurrentPassword; - - protected System.Web.UI.WebControls.TextBox NewPassword; - - protected System.Web.UI.WebControls.TextBox ConfirmNewPassword; - - protected System.Web.UI.WebControls.Button ChangePasswordPushButton; - - protected System.Web.UI.WebControls.Button CancelPushButton; - - protected System.Web.UI.WebControls.Literal FailureText; - - protected System.Web.UI.WebControls.Button ContinuePushButton; } } diff --git a/WebGoat/Code/DatabaseUtilities.cs b/WebGoat/Code/DatabaseUtilities.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Code/IOHelper.cs b/WebGoat/Code/IOHelper.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Code/SQLiteMembershipProvider.cs b/WebGoat/Code/SQLiteMembershipProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Code/SQLiteProfileProvider.cs b/WebGoat/Code/SQLiteProfileProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Code/SQLiteRoleProvider.cs b/WebGoat/Code/SQLiteRoleProvider.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Configuration/Default.config b/WebGoat/Configuration/Default.config deleted file mode 100644 index 3ed7cdc33..000000000 --- a/WebGoat/Configuration/Default.config +++ /dev/null @@ -1 +0,0 @@ -dbtype=MySql \ No newline at end of file diff --git a/WebGoat/Content/About.aspx b/WebGoat/Content/About.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/About.aspx.cs b/WebGoat/Content/About.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/About.aspx.designer.cs b/WebGoat/Content/About.aspx.designer.cs index 3fd0430b8..07ad3f5ee 100644 --- a/WebGoat/Content/About.aspx.designer.cs +++ b/WebGoat/Content/About.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class About { protected System.Web.UI.WebControls.Content Content3; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/BasicAuth.aspx b/WebGoat/Content/BasicAuth.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/BasicAuth.aspx.cs b/WebGoat/Content/BasicAuth.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/BasicAuth.aspx.designer.cs b/WebGoat/Content/BasicAuth.aspx.designer.cs index d0a4cca44..9a67e96c6 100644 --- a/WebGoat/Content/BasicAuth.aspx.designer.cs +++ b/WebGoat/Content/BasicAuth.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class BasicAuth { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/CSRFDemo.aspx b/WebGoat/Content/CSRFDemo.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/CSRFDemo.aspx.cs b/WebGoat/Content/CSRFDemo.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/CSRFDemo.aspx.designer.cs b/WebGoat/Content/CSRFDemo.aspx.designer.cs index b18134302..a822f61c3 100644 --- a/WebGoat/Content/CSRFDemo.aspx.designer.cs +++ b/WebGoat/Content/CSRFDemo.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class CSRFDemo { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/Challenge1.aspx b/WebGoat/Content/Challenge1.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge1.aspx.cs b/WebGoat/Content/Challenge1.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge1.aspx.designer.cs b/WebGoat/Content/Challenge1.aspx.designer.cs index cb9edf8e6..33c3505a8 100644 --- a/WebGoat/Content/Challenge1.aspx.designer.cs +++ b/WebGoat/Content/Challenge1.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class Challenge1 { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/Challenge2.aspx b/WebGoat/Content/Challenge2.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge2.aspx.cs b/WebGoat/Content/Challenge2.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge2.aspx.designer.cs b/WebGoat/Content/Challenge2.aspx.designer.cs index ae5ef7db8..e86eaf41a 100644 --- a/WebGoat/Content/Challenge2.aspx.designer.cs +++ b/WebGoat/Content/Challenge2.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class Challenge2 { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/Challenge3.aspx b/WebGoat/Content/Challenge3.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge3.aspx.cs b/WebGoat/Content/Challenge3.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/Challenge3.aspx.designer.cs b/WebGoat/Content/Challenge3.aspx.designer.cs index 13a1409d6..1940f843f 100644 --- a/WebGoat/Content/Challenge3.aspx.designer.cs +++ b/WebGoat/Content/Challenge3.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class Challenge3 { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/ChangePwd.aspx b/WebGoat/Content/ChangePwd.aspx old mode 100644 new mode 100755 diff --git a/WebGoat/Content/ChangePwd.aspx.cs b/WebGoat/Content/ChangePwd.aspx.cs old mode 100644 new mode 100755 diff --git a/WebGoat/Content/ChangePwd.aspx.designer.cs b/WebGoat/Content/ChangePwd.aspx.designer.cs index d861547aa..68187e388 100644 --- a/WebGoat/Content/ChangePwd.aspx.designer.cs +++ b/WebGoat/Content/ChangePwd.aspx.designer.cs @@ -14,7 +14,5 @@ namespace OWASP.WebGoat.NET { public partial class ChangePwd { protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; } } diff --git a/WebGoat/Content/Clickjacking.aspx b/WebGoat/Content/Clickjacking.aspx new file mode 100755 index 000000000..06d7d0a84 --- /dev/null +++ b/WebGoat/Content/Clickjacking.aspx @@ -0,0 +1,29 @@ +<%@ Page Title="" Language="C#" MasterPageFile="~/Resources/Master-Pages/Site.Master" AutoEventWireup="true" CodeBehind="Clickjacking.aspx.cs" Inherits="OWASP.WebGoat.NET.Clickjacking" %> + + + + + + No recent orders + + + + + + + + +
+ +
+
+
+
+ + Reset Order History +
+ + + + \ No newline at end of file diff --git a/WebGoat/Content/Clickjacking.aspx.cs b/WebGoat/Content/Clickjacking.aspx.cs new file mode 100755 index 000000000..f61ce2319 --- /dev/null +++ b/WebGoat/Content/Clickjacking.aspx.cs @@ -0,0 +1,59 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Web; +using System.Web.UI; +using System.Web.UI.WebControls; +using System.Text.RegularExpressions; + +namespace OWASP.WebGoat.NET +{ + public partial class Clickjacking : System.Web.UI.Page + { + protected void Page_Load(object sender, EventArgs e) + { + //Match match = Regex.Match(user_input, "^[\\p{L} .'-]+$", RegexOptions.IgnoreCase); + //return match.Success; + } + + protected void btnGo_Click(object sender, EventArgs e) + { + string time = DateTime.Now.ToShortTimeString() + " " + DateTime.Now.ToShortDateString(); + HttpCookie myCookie = new HttpCookie("ClickJackingTest"); + myCookie["LastOrder"] = time; + myCookie.Expires = DateTime.Now.AddDays(1d); + Response.Cookies.Add(myCookie); + labelMessage.Text = "Order Placed at " + time; + } + + protected void lnkReset_Click1(object sender, EventArgs e) + { + HttpCookie myCookie = new HttpCookie("ClickJackingTest"); + myCookie["LastOrder"] = "Never"; + myCookie.Expires = DateTime.Now.AddDays(1d); + Response.Cookies.Add(myCookie); + labelMessage.Text = "Order History Erased"; + } + + protected void labelMessage_Load(object sender, EventArgs e) + { + UpdateLabel(); + } + + protected void UpdateLabel() + { + if (Request.Cookies["ClickJackingTest"] != null) + { + string lastorder; + if (Request.Cookies["ClickJackingTest"]["LastOrder"] != null) + { + lastorder = Request.Cookies["ClickJackingTest"]["LastOrder"]; + //labelMessage.Text = "Last Order Date on File: " + lastorder; + } + //else + //labelMessage.Text = "No Recent Orders on File"; + } + + } + } +} \ No newline at end of file diff --git a/WebGoat/Content/Clickjacking.aspx.designer.cs b/WebGoat/Content/Clickjacking.aspx.designer.cs new file mode 100755 index 000000000..beca1a2b2 --- /dev/null +++ b/WebGoat/Content/Clickjacking.aspx.designer.cs @@ -0,0 +1,41 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace OWASP.WebGoat.NET { + + + public partial class Clickjacking { + /// + /// labelMessage control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.Label labelMessage; + + /// + /// btnOrder control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.Button btnOrder; + + /// + /// lnkReset control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.LinkButton lnkReset; + } +} diff --git a/WebGoat/Content/ClickjackingExploit.aspx b/WebGoat/Content/ClickjackingExploit.aspx new file mode 100755 index 000000000..735a85632 --- /dev/null +++ b/WebGoat/Content/ClickjackingExploit.aspx @@ -0,0 +1,83 @@ +<%@ Page Title="" Language="C#" MasterPageFile="~/Resources/Master-Pages/Site.Master" AutoEventWireup="true" CodeBehind="ClickjackingExploit.aspx.cs" Inherits="OWASP.WebGoat.NET.ClickjackingExploit" %> + + + + + + + + + + + + + + + +
+ +
+ +
+