diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index 85cfca11b..000000000
--- a/.gitignore
+++ /dev/null
@@ -1,14 +0,0 @@
-# Project Files #
-#################
-*.userprefs
-*.pidb
-*swp
-bin
-obj
-WebGoat/App_Data/*.txt
-*.sqlite*
-WebGoat/Configuration/*.config
-
-# Trash Files #
-###############
-.DS_Store
diff --git a/README b/README
deleted file mode 100644
index a5ce616ca..000000000
--- a/README
+++ /dev/null
@@ -1,64 +0,0 @@
-***************************** Webgoat.NET **********************************
-* Source Code: https://github.com/jerryhoff/WebGoat.NET
-* Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master
-****************************************************************************
-
-This web application is a learning platform that attempts to teach about
-common web security flaws. It contains generic security flaws that apply to
-most web applications. It also contains lessons that specifically pertain to
-the .NET framework. The excercises in this app are intented to teach about
-web security attacks and how developers can overcome them.
-
-WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES
-WHICH WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY
-RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE
-RUNNING!
-
-Notes:
- - Google Chrome performs filtering for reflected XSS attacks. These attacks
- will not work unless chrome is run with the argument
- --disable-xss-auditor.
-- Some (but not all!) of the lessons require a working SQL database. Setup
- guidelines are shown below.
-
-How To Build And Run under Mac OS X and Linux:
- 1. Prerequisites
- a. Mono framework for your respective OS. It can be downloaded at
- http://www.go-mono.com/mono-downloads/download.html. Make sure
- that ALL components get installed, including GTK and xsp.
- b. A DB for some of the lessions. Sqlite3 is recommended as it's
- faster and easier to use for the purposes of these lessions.
- Binaries can be found here: http://www.sqlite.org/download.html
- 2. Install the mono framework and sqlite3 binaries.
- 3. IMPORTANT: Make sure that the the mono executable is in your PATH.
- 4. Grab WebGoat.NET and cd into the root dir.
- 5. Run 'xbuild'. There may be a few warnings but there should be no
- errors! If there are please let us know.
- 6. cd into the WebGoat project and run 'xsp4'. Then open your favorite
- browser and go to http://localhost:8080 (or whatever port your
- xsp4 is using if you're not using the default). Note: The first run
- may take take some time as it's compiling everything on the fly.
- 7. If you see the WebGoat.NET page that means you're almost there! Next
- step is to click on 'Set Up Database!'
- 8. You should see a form with a bunch of setup information for the
- database. For 'Data Provider' choose Sqlite. For 'Data File Path' put
- in 'db.sqlite3' and for 'Client Executable' put in the sqlite3
- executable of your OS (usually /usr/bin/sqlite3).
- 9. Click on 'Test Configuration', followed by 'Rebuild Database' and
- hopefully you should be good go! Enjoy your hackathon!
-
-How to build and run under Windows:
- 1. Prerequisites:
- a. Visual Studio 2010 and above.
- b. Mysql database that's up and running with at least one user
- aleady setup with full permissions.
- 2. Open WebGoat.sln file via Visual Studio, and click on debug.
- 3. You should see the WebGoat.NET page at which point click on
- 'Set Up Database'.
- 3. You should see a form with a bunch of setup information for the
- database. For 'Data Provider' choose MySql. You'll need to fill in
- the respective data entries for your mysql db. 'Client Executable'
- and 'Data File Path' are not necessary for MySql so you can leave
- them empty.
- 4. Click on 'Test Configuration', followed by 'Rebuild Database' and
- hopefully you should be good go! Enjoy your hackathon!
diff --git a/WebGoat.NET.sln b/WebGoat.NET.sln
deleted file mode 100644
index 89f8133cd..000000000
--- a/WebGoat.NET.sln
+++ /dev/null
@@ -1,212 +0,0 @@
-
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WebGoat.NET", "WebGoat\WebGoat.NET.csproj", "{83B04441-0F79-4424-AAD0-46E0C3CDDAA1}"
-EndProject
-Global
- GlobalSection(SolutionConfigurationPlatforms) = preSolution
- Debug|Any CPU = Debug|Any CPU
- Release|Any CPU = Release|Any CPU
- EndGlobalSection
- GlobalSection(ProjectConfigurationPlatforms) = postSolution
- {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
- {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Debug|Any CPU.Build.0 = Debug|Any CPU
- {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Release|Any CPU.ActiveCfg = Release|Any CPU
- {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Release|Any CPU.Build.0 = Release|Any CPU
- EndGlobalSection
- GlobalSection(MonoDevelopProperties) = preSolution
- StartupItem = WebGoat\WebGoat.NET.csproj
- Policies = $0
- $0.DotNetNamingPolicy = $1
- $1.DirectoryNamespaceAssociation = PrefixedFlat
- $1.ResourceNamePolicy = FileFormatDefault
- $0.StandardHeader = $2
- $2.Text =
- $2.IncludeInNewFiles = True
- $0.TextStylePolicy = $3
- $3.inheritsSet = null
- $3.scope = text/x-csharp
- $0.CSharpFormattingPolicy = $4
- $4.IndentSwitchBody = True
- $4.AnonymousMethodBraceStyle = NextLine
- $4.PropertyBraceStyle = DoNotChange
- $4.PropertyGetBraceStyle = DoNotChange
- $4.PropertySetBraceStyle = DoNotChange
- $4.EventAddBraceStyle = NextLine
- $4.EventRemoveBraceStyle = NextLine
- $4.StatementBraceStyle = NextLine
- $4.ElseNewLinePlacement = NewLine
- $4.CatchNewLinePlacement = NewLine
- $4.FinallyNewLinePlacement = NewLine
- $4.BeforeMethodDeclarationParentheses = False
- $4.BeforeMethodCallParentheses = False
- $4.BeforeConstructorDeclarationParentheses = False
- $4.NewParentheses = False
- $4.SpacesBeforeBrackets = False
- $4.inheritsSet = Mono
- $4.inheritsScope = text/x-csharp
- $4.scope = text/x-csharp
- $0.TextStylePolicy = $5
- $5.FileWidth = 120
- $5.inheritsSet = VisualStudio
- $5.inheritsScope = text/plain
- $5.scope = text/plain
- $0.NameConventionPolicy = $6
- $6.Rules = $7
- $7.NamingRule = $8
- $8.Name = Namespaces
- $8.AffectedEntity = Namespace
- $8.VisibilityMask = VisibilityMask
- $8.NamingStyle = PascalCase
- $8.IncludeInstanceMembers = True
- $8.IncludeStaticEntities = True
- $7.NamingRule = $9
- $9.Name = Types
- $9.AffectedEntity = Class, Struct, Enum, Delegate
- $9.VisibilityMask = VisibilityMask
- $9.NamingStyle = PascalCase
- $9.IncludeInstanceMembers = True
- $9.IncludeStaticEntities = True
- $7.NamingRule = $10
- $10.Name = Interfaces
- $10.RequiredPrefixes = $11
- $11.String = I
- $10.AffectedEntity = Interface
- $10.VisibilityMask = VisibilityMask
- $10.NamingStyle = PascalCase
- $10.IncludeInstanceMembers = True
- $10.IncludeStaticEntities = True
- $7.NamingRule = $12
- $12.Name = Attributes
- $12.RequiredSuffixes = $13
- $13.String = Attribute
- $12.AffectedEntity = CustomAttributes
- $12.VisibilityMask = VisibilityMask
- $12.NamingStyle = PascalCase
- $12.IncludeInstanceMembers = True
- $12.IncludeStaticEntities = True
- $7.NamingRule = $14
- $14.Name = Event Arguments
- $14.RequiredSuffixes = $15
- $15.String = EventArgs
- $14.AffectedEntity = CustomEventArgs
- $14.VisibilityMask = VisibilityMask
- $14.NamingStyle = PascalCase
- $14.IncludeInstanceMembers = True
- $14.IncludeStaticEntities = True
- $7.NamingRule = $16
- $16.Name = Exceptions
- $16.RequiredSuffixes = $17
- $17.String = Exception
- $16.AffectedEntity = CustomExceptions
- $16.VisibilityMask = VisibilityMask
- $16.NamingStyle = PascalCase
- $16.IncludeInstanceMembers = True
- $16.IncludeStaticEntities = True
- $7.NamingRule = $18
- $18.Name = Methods
- $18.AffectedEntity = Methods
- $18.VisibilityMask = VisibilityMask
- $18.NamingStyle = PascalCase
- $18.IncludeInstanceMembers = True
- $18.IncludeStaticEntities = True
- $7.NamingRule = $19
- $19.Name = Static Readonly Fields
- $19.AffectedEntity = ReadonlyField
- $19.VisibilityMask = Internal, Protected, Public
- $19.NamingStyle = PascalCase
- $19.IncludeInstanceMembers = False
- $19.IncludeStaticEntities = True
- $7.NamingRule = $20
- $20.Name = Fields (Non Private)
- $20.AffectedEntity = Field
- $20.VisibilityMask = Internal, Protected, Public
- $20.NamingStyle = PascalCase
- $20.IncludeInstanceMembers = True
- $20.IncludeStaticEntities = True
- $7.NamingRule = $21
- $21.Name = ReadOnly Fields (Non Private)
- $21.AffectedEntity = ReadonlyField
- $21.VisibilityMask = Internal, Protected, Public
- $21.NamingStyle = PascalCase
- $21.IncludeInstanceMembers = True
- $21.IncludeStaticEntities = False
- $7.NamingRule = $22
- $22.Name = Fields (Private)
- $22.AllowedPrefixes = $23
- $23.String = _
- $23.String = m_
- $22.AffectedEntity = Field, ReadonlyField
- $22.VisibilityMask = Private
- $22.NamingStyle = CamelCase
- $22.IncludeInstanceMembers = True
- $22.IncludeStaticEntities = False
- $7.NamingRule = $24
- $24.Name = Static Fields (Private)
- $24.AffectedEntity = Field
- $24.VisibilityMask = Private
- $24.NamingStyle = CamelCase
- $24.IncludeInstanceMembers = False
- $24.IncludeStaticEntities = True
- $7.NamingRule = $25
- $25.Name = ReadOnly Fields (Private)
- $25.AllowedPrefixes = $26
- $26.String = _
- $26.String = m_
- $25.AffectedEntity = ReadonlyField
- $25.VisibilityMask = Private
- $25.NamingStyle = CamelCase
- $25.IncludeInstanceMembers = True
- $25.IncludeStaticEntities = False
- $7.NamingRule = $27
- $27.Name = Constant Fields
- $27.AffectedEntity = ConstantField
- $27.VisibilityMask = VisibilityMask
- $27.NamingStyle = PascalCase
- $27.IncludeInstanceMembers = True
- $27.IncludeStaticEntities = True
- $7.NamingRule = $28
- $28.Name = Properties
- $28.AffectedEntity = Property
- $28.VisibilityMask = VisibilityMask
- $28.NamingStyle = PascalCase
- $28.IncludeInstanceMembers = True
- $28.IncludeStaticEntities = True
- $7.NamingRule = $29
- $29.Name = Events
- $29.AffectedEntity = Event
- $29.VisibilityMask = VisibilityMask
- $29.NamingStyle = PascalCase
- $29.IncludeInstanceMembers = True
- $29.IncludeStaticEntities = True
- $7.NamingRule = $30
- $30.Name = Enum Members
- $30.AffectedEntity = EnumMember
- $30.VisibilityMask = VisibilityMask
- $30.NamingStyle = PascalCase
- $30.IncludeInstanceMembers = True
- $30.IncludeStaticEntities = True
- $7.NamingRule = $31
- $31.Name = Parameters
- $31.AffectedEntity = Parameter
- $31.VisibilityMask = VisibilityMask
- $31.NamingStyle = CamelCase
- $31.IncludeInstanceMembers = True
- $31.IncludeStaticEntities = True
- $7.NamingRule = $32
- $32.Name = Type Parameters
- $32.RequiredPrefixes = $33
- $33.String = T
- $32.AffectedEntity = TypeParameter
- $32.VisibilityMask = VisibilityMask
- $32.NamingStyle = PascalCase
- $32.IncludeInstanceMembers = True
- $32.IncludeStaticEntities = True
- $0.TextStylePolicy = $34
- $34.inheritsSet = null
- $34.scope = application/x-ashx
- EndGlobalSection
- GlobalSection(SolutionProperties) = preSolution
- HideSolutionNode = FALSE
- EndGlobalSection
-EndGlobal
diff --git a/WebGoat.NET.suo b/WebGoat.NET.suo
deleted file mode 100644
index aa1b304db..000000000
Binary files a/WebGoat.NET.suo and /dev/null differ
diff --git a/WebGoat/AddNewUser.aspx b/WebGoat/AddNewUser.aspx
deleted file mode 100644
index 66c8d26cc..000000000
--- a/WebGoat/AddNewUser.aspx
+++ /dev/null
@@ -1,58 +0,0 @@
-<%@ Page Title="" Language="C#" MasterPageFile="~/Resources/Master-Pages/Site.Master" AutoEventWireup="true" CodeBehind="AddNewUser.aspx.cs" Inherits="OWASP.WebGoat.NET.AddNewUser" %>
-
-
-
- Add New User
- <%--
-
-
-
-
-
- Enter a username:
-
-
-
-
- Choose a password:
-
-
-
- Enter your email address:
-
-
-
-
-
-
-
-Errors that happen on the server side should not be exposed to the client. All debugging - info should also be hidden.
- -| Click here to throw a server exception and show debugging info: | -
- |
-
-
-
-
-
-
-
-
-
Try to construct a message that has the same digest as:
Result:
An insecure message digest can compromise a system when an attacker can:
- -This lesson will demonstrate how weak message digests can be exploited.
-A weak number generator can be the source of a system break-in, as it is used in many important situations - such as password salts, SSL handshakes etc.
- -In the following example, try to predict the next number in the sequence:
- -The next number is:
-
| Name: |
-
-
-
-
-
- - - - -
-
In this lesson we'll take a look at .NET's unsafe block and how it can be exploited through user input. - When typing a string in the textbox below, the server will read it and compute its reverse. Try to exploit the - server by typing in a 'bad' input.
- -Result:
-
-
-
-
-
-
-
-
-
| - Data Provider: | -
- |
-
| - Data File Path: | -
- |
-
| - Client Executable: | -
- |
-
| - Server: | -
- |
-
| - Port: | -
- |
-
| - Database: | -
- |
-
| - User Name: | -
- |
-
| - Password: | -
- |
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Are you sure you want to log out? -
- -- <% - lblTest.Text = "Hello, world!"; - %> - - <html xmlns="http://www.w3.org/1999/xhtml" > - <head runat="server"> - </head> - <body> - <form id="form1" runat="server"> - <asp:Label runat="server" id="lblTest"> - </asp:Label> - </form> - </body> - </html> -- - -
-
-
-
- CREATE TABLE [dbo].[Log] (
- [ID] [int] IDENTITY (1, 1) NOT NULL ,
- [Date] [datetime] NOT NULL ,
- [Thread] [varchar] (255) NOT NULL ,
- [Level] [varchar] (20) NOT NULL ,
- [Logger] [varchar] (255) NOT NULL ,
- [Message] [varchar] (4000) NOT NULL
- ) ON [PRIMARY]
- "DSN=MS Access Database;UID=admin;PWD=;SystemDB=C:\data\System.mdw;SafeTransactions = 0;FIL=MS Access;DriverID = 25;DBQ=C:\data\train33.mdb""Driver={Microsoft Access Driver (*.mdb)};DBQ=C:\Work\cvs_root\log4net-1.2\access.mdb;UID=;PWD=;""Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Work\cvs_root\log4net-1.2\access.mdb;User Id=;Password=;"System.Data.OleDb.OleDbConnection, System.Data, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089System.Data.SqlClient.SqlConnection, System.Data, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089Microsoft.Data.Odbc.OdbcConnection,Microsoft.Data.Odbc,version=1.0.3300.0,publicKeyToken=b77a5c561934e089,culture=neutral
- This is an optional package that you can download from
- http://msdn.microsoft.com/downloads
- search for ODBC .NET Data Provider.
- System.Data.OracleClient.OracleConnection, System.Data.OracleClient, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
- This is an optional package that you can download from
- http://msdn.microsoft.com/downloads
- search for .NET Managed Provider for Oracle.
-
-
-
-
-
-
-
-
-
-
-
-
-
- <mapping>
- <level value="ERROR" />
- <eventLogEntryType value="Error" />
- </mapping>
- <mapping>
- <level value="DEBUG" />
- <eventLogEntryType value="Information" />
- </mapping>
-
-
- IPEndPoint remoteEndPoint = new IPEndPoint(IPAddress.Any, 0);
- UdpClient udpClient;
- byte[] buffer;
- string loggingEvent;
- try
- {
- udpClient = new UdpClient(8080);
- while(true)
- {
- buffer = udpClient.Receive(ref remoteEndPoint);
- loggingEvent = System.Text.Encoding.Unicode.GetString(buffer);
- Console.WriteLine(loggingEvent);
- }
- }
- catch(Exception e)
- {
- Console.WriteLine(e.ToString());
- }
-
- Dim remoteEndPoint as IPEndPoint
- Dim udpClient as UdpClient
- Dim buffer as Byte()
- Dim loggingEvent as String
- Try
- remoteEndPoint = new IPEndPoint(IPAddress.Any, 0)
- udpClient = new UdpClient(8080)
- While True
- buffer = udpClient.Receive(ByRef remoteEndPoint)
- loggingEvent = System.Text.Encoding.Unicode.GetString(buffer)
- Console.WriteLine(loggingEvent)
- Wend
- Catch e As Exception
- Console.WriteLine(e.ToString())
- End Try
-
- using log4net.Config;
- using System.IO;
- using System.Configuration;
- ...
- DOMConfigurator.Configure(new FileInfo(ConfigurationSettings.AppSettings["log4net-config-file"]));
-
-
-
-
-
-
-
-
-
- using log4net.Config;
- using System.IO;
- using System.Configuration;
- ...
- DOMConfigurator.Configure(new FileInfo(ConfigurationSettings.AppSettings["log4net-config-file"]));
-
-
-
-
-
-
-
-
-
- log4net configuration XML goes here
-
- using log4net.Config;
- using System.IO;
- using System.Configuration;
- ...
- XmlConfigurator.Configure(new FileInfo(ConfigurationSettings.AppSettings["log4net-config-file"]));
-
-
-
-
-
-
-
-
-
- using log4net.Config;
- using System.IO;
- using System.Configuration;
- ...
- XmlConfigurator.Configure(new FileInfo(ConfigurationSettings.AppSettings["log4net-config-file"]));
-
-
-
-
-
-
-
-
-
- log.Debug("This is entry number: " + i );
-
-
- if (log.IsDebugEnabled())
- {
- log.Debug("This is entry number: " + i );
- }
-
-
- StringWriter writer = new StringWriter();
- Layout.Format(writer, loggingEvent);
- string formattedEvent = writer.ToString();
-
-
- ILog log = LogManager.GetLogger(typeof(TestApp));
- log.Debug("Message 1");
- log.Warn("Message 2");
-
-
- DEBUG [main]: Message 1
- WARN [main]: Message 2
-
- | Format modifier | -left justify | -minimum width | -maximum width | -comment | -
|---|---|---|---|---|
| %20logger | -false | -20 | -none | -
- |
-
| %-20logger | -true | -20 | -none | -
- |
-
| %.30logger | -NA | -none | -30 | -
- |
-
|
- |
- false | -20 | -30 | -
- |
-
| %-20.30logger | -true | -20 | -30 | -
- |
-
%timestamp [%thread] %level %logger %ndc - %message%newline%-6timestamp [%15.15thread] %-5level %30.30logger %ndc - %message%newline
- DEBUG - Hello world
-
- <?xml version="1.0" ?>
- <!DOCTYPE log4net:events SYSTEM "log4net-events.dtd" [<!ENTITY data SYSTEM "abc">]>
- <log4net:events version="1.2" xmlns:log4net="http://logging.apache.org/log4net/schemas/log4net-events-1.2>
- &data;
- </log4net:events>
-
-
-
-
-
-
-
-
-
- string s = OptionConverter.SubstituteVariables("Value of key is ${key}.");
-
-
- string s = OptionConverter.SubstituteVariables("Value of nonExistentKey is [${nonExistentKey}]");
-
-
- {key1=value1, key2=value2, key3=value3}
-
-
- {key1=value1, key2=value2, key3=value3}
-
-
- using(log4net.ThreadContext.Stacks["NDC"].Push("Stack_Message"))
- {
- log.Warn("This should have an ThreadContext Stack message");
- }
-
- GlobalContext.Properties["hostname"] = Environment.MachineName;
-
-
- ILog log = LogManager.GetLogger("application-log");
- log.Info("Application Start");
- log.Debug("This is a debug message");
- if (log.IsDebugEnabled)
- {
- log.Debug("This is another debug message");
- }
-
- log.Debug("This is entry number: " + i );
-
-
- if (log.IsDebugEnabled)
- {
- log.Debug("This is entry number: " + i );
- }
-
-
- private static readonly bool isDebugEnabled = log.IsDebugEnabled;
-
-
- if (isDebugEnabled)
- {
- log.Debug("This is entry number: " + i );
- }
-
-
- ILog log = LogManager.GetLogger("application-log");
- log.Info("Application Start");
- log.Debug("This is a debug message");
- if (log.IsDebugEnabled)
- {
- log.Debug("This is another debug message");
- }
-
- LogicalThreadContext.Properties["user"] = userName;
- log.Info("This log message has a LogicalThreadContext Property called 'user'");
-
- using(LogicalThreadContext.Stacks["LDC"].Push("my context message"))
- {
- log.Info("This log message has a LogicalThreadContext Stack message that includes 'my context message'");
- } // at the end of the using block the message is automatically popped
-
- using(NDC.Push("my context message"))
- {
- ... all log calls will have 'my context message' included ...
- } // at the end of the using block the message is automatically removed
-
- using(log4net.NDC.Push("NDC_Message"))
- {
- log.Warn("This should have an NDC message");
- }
-
- ThreadContext.Properties["user"] = userName;
- log.Info("This log message has a ThreadContext Property called 'user'");
-
- using(ThreadContext.Stacks["NDC"].Push("my context message"))
- {
- log.Info("This log message has a ThreadContext Stack message that includes 'my context message'");
- } // at the end of the using block the message is automatically popped
-
+
+ WebGoat.NET is a purposefully broken ASP.NET web application. It contains many common vulnerabilities, and is intended for use in classroom environments.
Mono.Data.Sqlite
+I have only tested WebGoat.NET in MonoDevelop - but in MonoDevelop you should be able to simply open the solution file and it should just work. You *may* need to right click on the references folder and add in Mono.Data.Sqlite and System.Configuration manually.
+GPL
+Jerry Hoff (jerry@owasp.org)
jerry@owasp.org
+ You can download this project in either + zip or + tar formats. +
+You can also clone the project with Git + by running: +
$ git clone git://github.com/jerryhoff/WebGoat.NET+ + + + +