diff --git a/.gitignore b/.gitignore index bf001a5dd..85cfca11b 100644 --- a/.gitignore +++ b/.gitignore @@ -2,10 +2,11 @@ ################# *.userprefs *.pidb +*swp bin obj WebGoat/App_Data/*.txt -*.sqlite +*.sqlite* WebGoat/Configuration/*.config # Trash Files # diff --git a/README b/README index c31cb0034..a5ce616ca 100644 --- a/README +++ b/README @@ -1,19 +1,64 @@ -***************************** Webgoat.NET ************************************* +***************************** Webgoat.NET ********************************** * Source Code: https://github.com/jerryhoff/WebGoat.NET * Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master -******************************************************************************* +**************************************************************************** This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications. It also contains lessons that specifically pertain to -the .NET framework. The excercises in this app are intented to teach about web -security attacks and how developers can overcome them. +the .NET framework. The excercises in this app are intented to teach about +web security attacks and how developers can overcome them. -WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES WHICH -WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY +WARNING: THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES +WHICH WILL RENDER YOUR COMPUTER VERY INSECURURE WHILE RUNNING! IT IS HIGHLY RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE RUNNING! Notes: - Google Chrome performs filtering for reflected XSS attacks. These attacks - will not work unless chrome is run with the argument --disable-xss-auditor. + will not work unless chrome is run with the argument + --disable-xss-auditor. +- Some (but not all!) of the lessons require a working SQL database. Setup + guidelines are shown below. + +How To Build And Run under Mac OS X and Linux: + 1. Prerequisites + a. Mono framework for your respective OS. It can be downloaded at + http://www.go-mono.com/mono-downloads/download.html. Make sure + that ALL components get installed, including GTK and xsp. + b. A DB for some of the lessions. Sqlite3 is recommended as it's + faster and easier to use for the purposes of these lessions. + Binaries can be found here: http://www.sqlite.org/download.html + 2. Install the mono framework and sqlite3 binaries. + 3. IMPORTANT: Make sure that the the mono executable is in your PATH. + 4. Grab WebGoat.NET and cd into the root dir. + 5. Run 'xbuild'. There may be a few warnings but there should be no + errors! If there are please let us know. + 6. cd into the WebGoat project and run 'xsp4'. Then open your favorite + browser and go to http://localhost:8080 (or whatever port your + xsp4 is using if you're not using the default). Note: The first run + may take take some time as it's compiling everything on the fly. + 7. If you see the WebGoat.NET page that means you're almost there! Next + step is to click on 'Set Up Database!' + 8. You should see a form with a bunch of setup information for the + database. For 'Data Provider' choose Sqlite. For 'Data File Path' put + in 'db.sqlite3' and for 'Client Executable' put in the sqlite3 + executable of your OS (usually /usr/bin/sqlite3). + 9. Click on 'Test Configuration', followed by 'Rebuild Database' and + hopefully you should be good go! Enjoy your hackathon! + +How to build and run under Windows: + 1. Prerequisites: + a. Visual Studio 2010 and above. + b. Mysql database that's up and running with at least one user + aleady setup with full permissions. + 2. Open WebGoat.sln file via Visual Studio, and click on debug. + 3. You should see the WebGoat.NET page at which point click on + 'Set Up Database'. + 3. You should see a form with a bunch of setup information for the + database. For 'Data Provider' choose MySql. You'll need to fill in + the respective data entries for your mysql db. 'Client Executable' + and 'Data File Path' are not necessary for MySql so you can leave + them empty. + 4. Click on 'Test Configuration', followed by 'Rebuild Database' and + hopefully you should be good go! Enjoy your hackathon! diff --git a/WebGoat/App_Code/CustomerLoginData.cs b/WebGoat/App_Code/CustomerLoginData.cs index 9d4a5e136..fa431889b 100644 --- a/WebGoat/App_Code/CustomerLoginData.cs +++ b/WebGoat/App_Code/CustomerLoginData.cs @@ -1,6 +1,5 @@ using System; using System.Collections.Generic; -using System.Linq; using System.Web; namespace OWASP.WebGoat.NET @@ -31,4 +30,4 @@ public String Message } } -} \ No newline at end of file +} diff --git a/WebGoat/App_Code/DB/SqliteDbProvider.cs b/WebGoat/App_Code/DB/SqliteDbProvider.cs index 56ecb3484..0e88a6d86 100644 --- a/WebGoat/App_Code/DB/SqliteDbProvider.cs +++ b/WebGoat/App_Code/DB/SqliteDbProvider.cs @@ -59,6 +59,8 @@ public DataSet GetCatalogData() { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter("select * from Products", connection); DataSet ds = new DataSet(); @@ -79,6 +81,8 @@ public bool IsValidCustomerLogin(string email, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); //TODO: User reader instead (for all calls) @@ -132,6 +136,8 @@ public string CustomCustomerLogin(string email, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -179,6 +185,8 @@ public string GetCustomerEmail(string customerNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select email from CustomerLogin where customerNumber = " + customerNumber; SqliteCommand command = new SqliteCommand(sql, connection); output = command.ExecuteScalar().ToString(); @@ -204,6 +212,8 @@ public DataSet GetCustomerDetails(string customerNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.Fill(ds); } @@ -224,6 +234,8 @@ public DataSet GetOffice(string city) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select * from Offices where city = @city"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.SelectCommand.Parameters.AddWithValue("@city", city); @@ -237,6 +249,8 @@ public DataSet GetComments(string productCode) { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select * from Comments where productCode = @productCode"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); da.SelectCommand.Parameters.AddWithValue("@productCode", productCode); @@ -279,6 +293,8 @@ public string UpdateCustomerPassword(int customerNumber, string password) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteCommand command = new SqliteCommand(sql, connection); int rows_added = command.ExecuteNonQuery(); @@ -304,6 +320,8 @@ public string[] GetSecurityQuestionAndAnswer(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -328,6 +346,8 @@ public string GetPasswordByEmail(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + //get data string sql = "select * from CustomerLogin where email = '" + email + "';"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); @@ -356,6 +376,8 @@ public DataSet GetUsers() { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select * from CustomerLogin;"; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -369,6 +391,8 @@ public DataSet GetOrders(int customerID) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select * from Orders where customerNumber = " + customerID; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -390,6 +414,8 @@ public DataSet GetProductDetails(string productCode) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + sql = "select * from Products where productCode = '" + productCode + "'"; da = new SqliteDataAdapter(sql, connection); da.Fill(ds, "products"); @@ -422,6 +448,8 @@ public DataSet GetOrderDetails(int orderNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -437,6 +465,8 @@ public DataSet GetPayments(int customerNumber) { using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select * from Payments where customerNumber = " + customerNumber; SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); @@ -469,6 +499,7 @@ public DataSet GetProductsAndCategories(int catNumber) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); sql = "select * from Categories" + catClause; da = new SqliteDataAdapter(sql, connection); @@ -497,6 +528,8 @@ public DataSet GetEmailByName(string name) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); @@ -516,6 +549,8 @@ public string GetEmailByCustomerNumber(string num) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + string sql = "select email from CustomerLogin where customerNumber = " + num; SqliteCommand cmd = new SqliteCommand(sql, connection); output = (string)cmd.ExecuteScalar(); @@ -538,6 +573,8 @@ public DataSet GetCustomerEmails(string email) using (SqliteConnection connection = new SqliteConnection(_connectionString)) { + connection.Open(); + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); DataSet ds = new DataSet(); da.Fill(ds); diff --git a/WebGoat/App_Code/Encoder.cs b/WebGoat/App_Code/Encoder.cs index 5d792c51e..99bb022e3 100644 --- a/WebGoat/App_Code/Encoder.cs +++ b/WebGoat/App_Code/Encoder.cs @@ -1,6 +1,5 @@ using System; using System.Collections.Generic; -using System.Linq; using System.Web; using System.IO; using System.Text; @@ -242,4 +241,4 @@ public string EncodeTicket(string token) } } -} \ No newline at end of file +} diff --git a/WebGoat/Configuration/Default.config b/WebGoat/Configuration/Default.config new file mode 100644 index 000000000..3ed7cdc33 --- /dev/null +++ b/WebGoat/Configuration/Default.config @@ -0,0 +1 @@ +dbtype=MySql \ No newline at end of file diff --git a/WebGoat/Global.asax.cs b/WebGoat/Global.asax.cs index 424a3b9fc..e826ca68a 100644 --- a/WebGoat/Global.asax.cs +++ b/WebGoat/Global.asax.cs @@ -34,7 +34,7 @@ protected void Application_BeginRequest(object sender, EventArgs e) void Application_PreSendRequestHeaders(Object sender, EventArgs e) { - Response.Headers.Set("X-XSS-Protection", "0"); + Response.AddHeader("X-XSS-Protection", "0"); } protected void Application_AuthenticateRequest(object sender, EventArgs e) diff --git a/WebGoat/Web.config b/WebGoat/Web.config index 35702a9b0..ed1e0ab01 100644 --- a/WebGoat/Web.config +++ b/WebGoat/Web.config @@ -84,7 +84,6 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx - @@ -170,4 +169,4 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx - \ No newline at end of file +