From ee9e8257422f39e644dcae4e19982582da528821 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Wed, 30 Oct 2024 08:49:51 +0100 Subject: [PATCH 1/5] refactor: rewrite hints Use active voice and fix grammar issues. --- .../lessons/jwt/i18n/WebGoatLabels.properties | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/main/resources/lessons/jwt/i18n/WebGoatLabels.properties b/src/main/resources/lessons/jwt/i18n/WebGoatLabels.properties index cb023f59ff..709a1dd6a2 100644 --- a/src/main/resources/lessons/jwt/i18n/WebGoatLabels.properties +++ b/src/main/resources/lessons/jwt/i18n/WebGoatLabels.properties @@ -26,15 +26,15 @@ jwt-refresh-alg-none=Nicely found! You solved the assignment with 'alg: none' ca jwt-final-jerry-account=Yikes, you are removing Jerry's account, try to delete the account of Tom jwt-final-not-tom=Username is not Tom try to pass a token for Tom -jwt-jku-hint1=Take a look at the token and specifically and the header -jwt-jku-hint2=The 'jku' (key ID) header parameter is a hint indicating which key is used to verify the JWS +jwt-jku-hint1=Take a look at the token and specifically at the headers +jwt-jku-hint2=The 'jku' header parameter hints a URL pointing to a set of keys used by the server to sign the JWT. jwt-jku-hint3=Could you use WebWolf to host the public key as a JWKS? jwt-jku-hint4=Create a key pair and sign the token with the private key -jwt-jku-hint5=Change the JKU header claim and point it to a URL which hosts the public key in JWKS format. +jwt-jku-hint5=Change the JKU header claim and point it to a URL that hosts the public key in JWKS format. -jwt-kid-hint1=Take a look at the token and specifically and the header -jwt-kid-hint2=The 'kid' (key ID) header parameter is a hint indicating which key was used to secure the JWS -jwt-kid-hint3=The key can be located on the filesystem in memory or even reside in the database +jwt-kid-hint1=Take a look at the token and specifically at the headers +jwt-kid-hint2=The 'kid' (key ID) header parameter hints at the key was used to secure the JWS +jwt-kid-hint3=The key resides can for example, either in the filesystem in memory or the database. jwt-kid-hint4=The key is stored in the database and loaded while verifying a token -jwt-kid-hint5=Using a SQL injection you might be able to manipulate the key to something you know and create a new token. -jwt-kid-hint6=Use: hacked' UNION select 'deletingTom' from INFORMATION_SCHEMA.SYSTEM_USERS -- as the kid in the header and change the contents of the token to Tom and hit the endpoint with the new token +jwt-kid-hint5=Using an SQL injection, you might be able to manipulate the key to a known object and create a new token. +jwt-kid-hint6=Use: hacked' UNION select 'deletingTom' from INFORMATION_SCHEMA.SYSTEM_USERS -- as the kid in the header change the contents of the token to Tom and hit the endpoint with the new token From f796ca451cab2cc1bfba5fe20b5382f43daf3d00 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Thu, 7 Nov 2024 14:10:48 +0100 Subject: [PATCH 2/5] fix: use Thymeleaf `th:action` --- .../passwordreset/ResetLinkAssignment.java | 4 +++- .../lessons/authbypass/html/AuthBypass.html | 4 ++-- .../html/BypassRestrictions.html | 2 +- .../lessons/challenges/html/Challenge1.html | 4 ++-- .../lessons/challenges/html/Challenge5.html | 4 ++-- .../lessons/challenges/html/Challenge6.html | 6 +++--- .../lessons/challenges/html/Challenge7.html | 4 ++-- .../lessons/challenges/html/Challenge8.html | 2 +- .../chromedevtools/html/ChromeDevTools.html | 6 +++--- src/main/resources/lessons/cia/html/CIA.html | 2 +- .../html/ClientSideFiltering.html | 2 +- .../cryptography/html/Cryptography.html | 10 +++++----- src/main/resources/lessons/csrf/html/CSRF.html | 12 ++++++------ .../html/InsecureDeserialization.html | 2 +- .../hijacksession/templates/hijackform.html | 2 +- .../htmltampering/html/HtmlTampering.html | 2 +- .../lessons/httpbasics/html/HttpBasics.html | 6 +++--- .../lessons/httpproxies/html/HttpProxies.html | 2 +- src/main/resources/lessons/idor/html/IDOR.html | 12 ++++++------ .../insecurelogin/html/InsecureLogin.html | 4 ++-- src/main/resources/lessons/jwt/html/JWT.html | 14 +++++++------- .../lessontemplate/html/LessonTemplate.html | 2 +- .../lessons/logging/html/LogSpoofing.html | 4 ++-- .../missingac/html/MissingFunctionAC.html | 6 +++--- .../passwordreset/html/PasswordReset.html | 4 ++-- .../templates/password_reset.html | 2 +- .../pathtraversal/html/PathTraversal.html | 6 +++--- .../securepasswords/html/SecurePasswords.html | 2 +- .../spoofcookie/templates/spoofcookieform.html | 2 +- .../sqlinjection/html/SqlInjection.html | 18 +++++++++--------- .../html/SqlInjectionAdvanced.html | 10 +++++----- .../html/SqlInjectionMitigations.html | 12 ++++++------ src/main/resources/lessons/ssrf/html/SSRF.html | 4 ++-- .../html/WebWolfIntroduction.html | 4 ++-- .../CrossSiteScripting_content5b.adoc | 2 +- .../lessons/xss/html/CrossSiteScripting.html | 10 +++++----- .../xss/html/CrossSiteScriptingMitigation.html | 4 ++-- .../xss/html/CrossSiteScriptingStored.html | 2 +- src/main/resources/lessons/xxe/html/XXE.html | 6 +++--- 39 files changed, 104 insertions(+), 102 deletions(-) diff --git a/src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignment.java b/src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignment.java index be1da20fd3..eae7e4cfea 100644 --- a/src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignment.java +++ b/src/main/java/org/owasp/webgoat/lessons/passwordreset/ResetLinkAssignment.java @@ -22,6 +22,8 @@ package org.owasp.webgoat.lessons.passwordreset; +import static org.springframework.util.StringUtils.hasText; + import com.google.common.collect.Maps; import java.util.ArrayList; import java.util.HashMap; @@ -117,7 +119,7 @@ public ModelAndView changePassword( BindingResult bindingResult, @CurrentUsername String username) { ModelAndView modelAndView = new ModelAndView(); - if (!org.springframework.util.StringUtils.hasText(form.getPassword())) { + if (!hasText(form.getPassword())) { bindingResult.rejectValue("password", "not.empty"); } if (bindingResult.hasErrors()) { diff --git a/src/main/resources/lessons/authbypass/html/AuthBypass.html b/src/main/resources/lessons/authbypass/html/AuthBypass.html index 2fdeeb8268..3fe3326194 100644 --- a/src/main/resources/lessons/authbypass/html/AuthBypass.html +++ b/src/main/resources/lessons/authbypass/html/AuthBypass.html @@ -23,7 +23,7 @@
+ th:action="@{/auth-bypass/verify-account}">

Verify Your Account by answering the questions below:

What is the name of your favorite teacher?

@@ -43,7 +43,7 @@

Please provide a new password for your account

diff --git a/src/main/resources/lessons/bypassrestrictions/html/BypassRestrictions.html b/src/main/resources/lessons/bypassrestrictions/html/BypassRestrictions.html index d1c8d30016..e947734e2e 100755 --- a/src/main/resources/lessons/bypassrestrictions/html/BypassRestrictions.html +++ b/src/main/resources/lessons/bypassrestrictions/html/BypassRestrictions.html @@ -18,7 +18,7 @@
+ th:action="@{/BypassRestrictions/FieldRestrictions}">
Select field with two possible value
diff --git a/src/main/resources/lessons/challenges/html/Challenge1.html b/src/main/resources/lessons/challenges/html/Challenge1.html index 9122f2337c..03f5f05cfa 100644 --- a/src/main/resources/lessons/challenges/html/Challenge1.html +++ b/src/main/resources/lessons/challenges/html/Challenge1.html @@ -17,7 +17,7 @@
@@ -37,7 +37,7 @@
- +