diff --git a/.gitignore b/.gitignore
index bf001a5dd..85cfca11b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,10 +2,11 @@
#################
*.userprefs
*.pidb
+*swp
bin
obj
WebGoat/App_Data/*.txt
-*.sqlite
+*.sqlite*
WebGoat/Configuration/*.config
# Trash Files #
diff --git a/README b/README
index c31cb0034..a5ce616ca 100644
--- a/README
+++ b/README
@@ -1,19 +1,64 @@
-***************************** Webgoat.NET *************************************
+***************************** Webgoat.NET **********************************
* Source Code: https://github.com/jerryhoff/WebGoat.NET
* Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master
-*******************************************************************************
+****************************************************************************
This web application is a learning platform that attempts to teach about
common web security flaws. It contains generic security flaws that apply to
most web applications. It also contains lessons that specifically pertain to
-the .NET framework. The excercises in this app are intented to teach about web
-security attacks and how developers can overcome them.
+the .NET framework. The excercises in this app are intented to teach about
+web security attacks and how developers can overcome them.
-WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES WHICH
-WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY
+WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES
+WHICH WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY
RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE
RUNNING!
Notes:
- Google Chrome performs filtering for reflected XSS attacks. These attacks
- will not work unless chrome is run with the argument --disable-xss-auditor.
+ will not work unless chrome is run with the argument
+ --disable-xss-auditor.
+- Some (but not all!) of the lessons require a working SQL database. Setup
+ guidelines are shown below.
+
+How To Build And Run under Mac OS X and Linux:
+ 1. Prerequisites
+ a. Mono framework for your respective OS. It can be downloaded at
+ http://www.go-mono.com/mono-downloads/download.html. Make sure
+ that ALL components get installed, including GTK and xsp.
+ b. A DB for some of the lessions. Sqlite3 is recommended as it's
+ faster and easier to use for the purposes of these lessions.
+ Binaries can be found here: http://www.sqlite.org/download.html
+ 2. Install the mono framework and sqlite3 binaries.
+ 3. IMPORTANT: Make sure that the the mono executable is in your PATH.
+ 4. Grab WebGoat.NET and cd into the root dir.
+ 5. Run 'xbuild'. There may be a few warnings but there should be no
+ errors! If there are please let us know.
+ 6. cd into the WebGoat project and run 'xsp4'. Then open your favorite
+ browser and go to http://localhost:8080 (or whatever port your
+ xsp4 is using if you're not using the default). Note: The first run
+ may take take some time as it's compiling everything on the fly.
+ 7. If you see the WebGoat.NET page that means you're almost there! Next
+ step is to click on 'Set Up Database!'
+ 8. You should see a form with a bunch of setup information for the
+ database. For 'Data Provider' choose Sqlite. For 'Data File Path' put
+ in 'db.sqlite3' and for 'Client Executable' put in the sqlite3
+ executable of your OS (usually /usr/bin/sqlite3).
+ 9. Click on 'Test Configuration', followed by 'Rebuild Database' and
+ hopefully you should be good go! Enjoy your hackathon!
+
+How to build and run under Windows:
+ 1. Prerequisites:
+ a. Visual Studio 2010 and above.
+ b. Mysql database that's up and running with at least one user
+ aleady setup with full permissions.
+ 2. Open WebGoat.sln file via Visual Studio, and click on debug.
+ 3. You should see the WebGoat.NET page at which point click on
+ 'Set Up Database'.
+ 3. You should see a form with a bunch of setup information for the
+ database. For 'Data Provider' choose MySql. You'll need to fill in
+ the respective data entries for your mysql db. 'Client Executable'
+ and 'Data File Path' are not necessary for MySql so you can leave
+ them empty.
+ 4. Click on 'Test Configuration', followed by 'Rebuild Database' and
+ hopefully you should be good go! Enjoy your hackathon!
diff --git a/WebGoat/App_Code/CustomerLoginData.cs b/WebGoat/App_Code/CustomerLoginData.cs
index 9d4a5e136..fa431889b 100644
--- a/WebGoat/App_Code/CustomerLoginData.cs
+++ b/WebGoat/App_Code/CustomerLoginData.cs
@@ -1,6 +1,5 @@
using System;
using System.Collections.Generic;
-using System.Linq;
using System.Web;
namespace OWASP.WebGoat.NET
@@ -31,4 +30,4 @@ public String Message
}
}
-}
\ No newline at end of file
+}
diff --git a/WebGoat/App_Code/DB/SqliteDbProvider.cs b/WebGoat/App_Code/DB/SqliteDbProvider.cs
index 56ecb3484..0e88a6d86 100644
--- a/WebGoat/App_Code/DB/SqliteDbProvider.cs
+++ b/WebGoat/App_Code/DB/SqliteDbProvider.cs
@@ -59,6 +59,8 @@ public DataSet GetCatalogData()
{
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter("select * from Products", connection);
DataSet ds = new DataSet();
@@ -79,6 +81,8 @@ public bool IsValidCustomerLogin(string email, string password)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
//TODO: User reader instead (for all calls)
@@ -132,6 +136,8 @@ public string CustomCustomerLogin(string email, string password)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
da.Fill(ds);
@@ -179,6 +185,8 @@ public string GetCustomerEmail(string customerNumber)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select email from CustomerLogin where customerNumber = " + customerNumber;
SqliteCommand command = new SqliteCommand(sql, connection);
output = command.ExecuteScalar().ToString();
@@ -204,6 +212,8 @@ public DataSet GetCustomerDetails(string customerNumber)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
da.Fill(ds);
}
@@ -224,6 +234,8 @@ public DataSet GetOffice(string city)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select * from Offices where city = @city";
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
da.SelectCommand.Parameters.AddWithValue("@city", city);
@@ -237,6 +249,8 @@ public DataSet GetComments(string productCode)
{
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select * from Comments where productCode = @productCode";
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
da.SelectCommand.Parameters.AddWithValue("@productCode", productCode);
@@ -279,6 +293,8 @@ public string UpdateCustomerPassword(int customerNumber, string password)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteCommand command = new SqliteCommand(sql, connection);
int rows_added = command.ExecuteNonQuery();
@@ -304,6 +320,8 @@ public string[] GetSecurityQuestionAndAnswer(string email)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
@@ -328,6 +346,8 @@ public string GetPasswordByEmail(string email)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
//get data
string sql = "select * from CustomerLogin where email = '" + email + "';";
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
@@ -356,6 +376,8 @@ public DataSet GetUsers()
{
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select * from CustomerLogin;";
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
@@ -369,6 +391,8 @@ public DataSet GetOrders(int customerID)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select * from Orders where customerNumber = " + customerID;
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
@@ -390,6 +414,8 @@ public DataSet GetProductDetails(string productCode)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
sql = "select * from Products where productCode = '" + productCode + "'";
da = new SqliteDataAdapter(sql, connection);
da.Fill(ds, "products");
@@ -422,6 +448,8 @@ public DataSet GetOrderDetails(int orderNumber)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
da.Fill(ds);
@@ -437,6 +465,8 @@ public DataSet GetPayments(int customerNumber)
{
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select * from Payments where customerNumber = " + customerNumber;
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
@@ -469,6 +499,7 @@ public DataSet GetProductsAndCategories(int catNumber)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
sql = "select * from Categories" + catClause;
da = new SqliteDataAdapter(sql, connection);
@@ -497,6 +528,8 @@ public DataSet GetEmailByName(string name)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
da.Fill(ds);
@@ -516,6 +549,8 @@ public string GetEmailByCustomerNumber(string num)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
string sql = "select email from CustomerLogin where customerNumber = " + num;
SqliteCommand cmd = new SqliteCommand(sql, connection);
output = (string)cmd.ExecuteScalar();
@@ -538,6 +573,8 @@ public DataSet GetCustomerEmails(string email)
using (SqliteConnection connection = new SqliteConnection(_connectionString))
{
+ connection.Open();
+
SqliteDataAdapter da = new SqliteDataAdapter(sql, connection);
DataSet ds = new DataSet();
da.Fill(ds);
diff --git a/WebGoat/App_Code/Encoder.cs b/WebGoat/App_Code/Encoder.cs
index 5d792c51e..99bb022e3 100644
--- a/WebGoat/App_Code/Encoder.cs
+++ b/WebGoat/App_Code/Encoder.cs
@@ -1,6 +1,5 @@
using System;
using System.Collections.Generic;
-using System.Linq;
using System.Web;
using System.IO;
using System.Text;
@@ -242,4 +241,4 @@ public string EncodeTicket(string token)
}
}
-}
\ No newline at end of file
+}
diff --git a/WebGoat/Configuration/Default.config b/WebGoat/Configuration/Default.config
new file mode 100644
index 000000000..3ed7cdc33
--- /dev/null
+++ b/WebGoat/Configuration/Default.config
@@ -0,0 +1 @@
+dbtype=MySql
\ No newline at end of file
diff --git a/WebGoat/Global.asax.cs b/WebGoat/Global.asax.cs
index 424a3b9fc..e826ca68a 100644
--- a/WebGoat/Global.asax.cs
+++ b/WebGoat/Global.asax.cs
@@ -34,7 +34,7 @@ protected void Application_BeginRequest(object sender, EventArgs e)
void Application_PreSendRequestHeaders(Object sender, EventArgs e)
{
- Response.Headers.Set("X-XSS-Protection", "0");
+ Response.AddHeader("X-XSS-Protection", "0");
}
protected void Application_AuthenticateRequest(object sender, EventArgs e)
diff --git a/WebGoat/Web.config b/WebGoat/Web.config
index 35702a9b0..ed1e0ab01 100644
--- a/WebGoat/Web.config
+++ b/WebGoat/Web.config
@@ -84,7 +84,6 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx
-
@@ -170,4 +169,4 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx
-
\ No newline at end of file
+