diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js index fbc2abf944..0ef51ad2db 100644 --- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js +++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js @@ -91,6 +91,7 @@ define(['jquery', this.curForm = curForm; this.$curFeedback = $(curForm).closest('.attack-container').find('.attack-feedback'); this.$curOutput = $(curForm).closest('.attack-container').find('.attack-output'); + var formUrl = $(curForm).attr('action'); var formMethod = $(curForm).attr('method'); var contentType = ($(curForm).attr('contentType')) ? $(curForm).attr('contentType') : 'application/x-www-form-urlencoded; charset=UTF-8'; @@ -100,9 +101,9 @@ define(['jquery', method:formMethod, contentType:contentType, data: submitData, - complete: function (data) { - callbackFunction(); - } + //complete: function (data) { + //callbackFunction(data); + //} }).then(self.onSuccessResponse.bind(self), self.onErrorResponse.bind(self)); return false; }, @@ -110,13 +111,20 @@ define(['jquery', onSuccessResponse: function(data) { this.renderFeedback(data.feedback); this.renderOutput(data.output || ""); + + var successCallBackFunctionName = this.$form.attr('successCallback'); + var failureCallbackFunctionName = this.$form.attr('failureCallback'); + //var submitData = (typeof webgoat.customjs[prepareDataFunctionName] === 'function') ? webgoat.customjs[prepareDataFunctionName]() : $(curForm).serialize(); + successCallbackFunction = (typeof webgoat.customjs[successCallBackFunctionName] === 'function') ? webgoat.customjs[successCallBackFunctionName] : function() {}; + failureCallbackFunction = (typeof webgoat.customjs[failureCallbackFunctionName] === 'function') ? webgoat.customjs[failureCallbackFunctionName] : function() {}; //TODO: refactor back assignmentCompleted in Java if (data.lessonCompleted || data.assignmentCompleted) { - this.markAssignmentComplete(); + successCallbackFunction(data); //data is likely not useful, except maybe the output ... this.trigger('assignment:complete'); } else { - this.markAssignmentIncomplete(); + this.markAssignmentIncomplete(data); //again, data might be useful, especially the output + failureCallbackFunction(); } return false; }, diff --git a/webgoat-lessons/auth-bypass/.DS_Store b/webgoat-lessons/auth-bypass/.DS_Store new file mode 100644 index 0000000000..0d597e3dbf Binary files /dev/null and b/webgoat-lessons/auth-bypass/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/pom.xml b/webgoat-lessons/auth-bypass/pom.xml new file mode 100644 index 0000000000..fe1fca0441 --- /dev/null +++ b/webgoat-lessons/auth-bypass/pom.xml @@ -0,0 +1,12 @@ + + 4.0.0 + auth-bypass + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + + diff --git a/webgoat-lessons/auth-bypass/src/.DS_Store b/webgoat-lessons/auth-bypass/src/.DS_Store new file mode 100644 index 0000000000..0913be2c6a Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/.DS_Store b/webgoat-lessons/auth-bypass/src/main/.DS_Store new file mode 100644 index 0000000000..7ee598c2b5 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/java/.DS_Store b/webgoat-lessons/auth-bypass/src/main/java/.DS_Store new file mode 100644 index 0000000000..da3ec95ed2 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/java/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/.DS_Store b/webgoat-lessons/auth-bypass/src/main/java/org/.DS_Store new file mode 100644 index 0000000000..8339472c99 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/java/org/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/.DS_Store b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/.DS_Store new file mode 100644 index 0000000000..2609cccd36 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/.DS_Store b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/.DS_Store new file mode 100644 index 0000000000..3efe5f7123 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AccountVerificationHelper.java b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AccountVerificationHelper.java new file mode 100644 index 0000000000..dd9aaeee5a --- /dev/null +++ b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AccountVerificationHelper.java @@ -0,0 +1,69 @@ +package org.owasp.webgoat.plugin; + +import org.jcodings.util.Hash; +import org.owasp.webgoat.session.UserSessionData; +import org.springframework.beans.factory.annotation.Autowired; + +import java.util.HashMap; +import java.util.Map; + +/** + * Created by appsec on 7/18/17. + */ +public class AccountVerificationHelper { + + + + //simulating database storage of verification credentials + private static final Integer verifyUserId = new Integer(1223445); + private static final Map userSecQuestions = new HashMap<>(); + static { + userSecQuestions.put("secQuestion0","Dr. Watson"); + userSecQuestions.put("secQuestion1","Baker Street"); + } + + private static final Map secQuestionStore = new HashMap<>(); + static { + secQuestionStore.put(verifyUserId,userSecQuestions); + } + // end 'data store set up' + + // this is to aid feedback in the attack process and is not intended to be part of the 'vulnerable' code + public boolean didUserLikelylCheat(HashMap submittedAnswers) { + boolean likely = false; + + if (submittedAnswers.size() == secQuestionStore.get(verifyUserId).size()) { + likely = true; + } + + if ((submittedAnswers.containsKey("secQuestion0") && submittedAnswers.get("secQuestion0").equals(secQuestionStore.get(verifyUserId).get("secQuestion0"))) && + (submittedAnswers.containsKey("secQuestion1") && submittedAnswers.get("secQuestion1").equals(secQuestionStore.get(verifyUserId).get("secQuestion1"))) ) { + likely = true; + } else { + likely = false; + } + + return likely; + + } + //end of cheating check ... the method below is the one of real interest. Can you find the flaw? + + public boolean verifyAccount(Integer userId, HashMap submittedQuestions ) { + //short circuit if no questions are submitted + if (submittedQuestions.entrySet().size() != secQuestionStore.get(verifyUserId).size()) { + return false; + } + + if (submittedQuestions.containsKey("secQuestion0") && !submittedQuestions.get("secQuestion0").equals(secQuestionStore.get(verifyUserId).get("secQuestion0"))) { + return false; + } + + if (submittedQuestions.containsKey("secQuestion1") && !submittedQuestions.get("seQuestion1").equals(secQuestionStore.get(verifyUserId).get("secQuestion1"))) { + return false; + } + + // else + return true; + + } +} diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java new file mode 100644 index 0000000000..3588303c41 --- /dev/null +++ b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/AuthBypass.java @@ -0,0 +1,65 @@ +package org.owasp.webgoat.plugin; + +import com.beust.jcommander.internal.Lists; +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

+ * Copyright (c) 2002 - 20014 Bruce Mayhew + *

+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

+ * Getting Source ============== + *

+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

+ * + * @author misfir3 + * @version $Id: $Id + * @since January 3, 2017 + */ +public class AuthBypass extends NewLesson { + + @Override + public Category getDefaultCategory() { + return Category.AUTHENTICATION; + } + + @Override + public List getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 30; + } + + @Override + public String getTitle() { + return "auth-bypass.title"; + } + + @Override + public String getId() { + return "AuthBypass"; + } + +} diff --git a/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java new file mode 100644 index 0000000000..2fc04c5bff --- /dev/null +++ b/webgoat-lessons/auth-bypass/src/main/java/org/owasp/webgoat/plugin/VerifyAccount.java @@ -0,0 +1,80 @@ +package org.owasp.webgoat.plugin; + +import com.google.common.collect.Lists; +import org.jcodings.util.Hash; +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentHints; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.owasp.webgoat.session.UserSessionData; +import org.owasp.webgoat.session.WebSession; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.*; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.util.Collections; +import java.util.HashMap; +import java.util.List; + +import java.util.Map; + +/** + * Created by jason on 1/5/17. + */ + +@AssignmentPath("/auth-bypass/verify-account") +@AssignmentHints({"auth-bypass.hints.verify.1", "auth-bypass.hints.verify.2", "auth-bypass.hints.verify.3", "auth-bypass.hints.verify.4"}) +public class VerifyAccount extends AssignmentEndpoint { + + @Autowired + private WebSession webSession; + + @Autowired + UserSessionData userSessionData; + + @PostMapping(produces = {"application/json"}) + @ResponseBody + public AttackResult completed(@RequestParam String userId, @RequestParam String verifyMethod, HttpServletRequest req) throws ServletException, IOException { + + + AccountVerificationHelper verificationHelper = new AccountVerificationHelper(); + Map submittedAnswers = parseSecQuestions(req); + if (verificationHelper.didUserLikelylCheat((HashMap)submittedAnswers)) { + return trackProgress(failed() + .feedback("verify-account.cheated") + .output("Yes, you guessed correcctly,but see the feedback message") + .build()); + } + + // else + if (verificationHelper.verifyAccount(new Integer(userId),(HashMap)submittedAnswers)) { + userSessionData.setValue("account-verified-id", userId); + return trackProgress(success() + .feedback("verify-account.success") + .build()); + } else { + return trackProgress(failed() + .feedback("verify-account.failed") + .build()); + } + + } + + private HashMap parseSecQuestions (HttpServletRequest req) { + + Map userAnswers = new HashMap<>(); + List paramNames = Collections.list(req.getParameterNames()); + for (String paramName : paramNames) { + //String paramName = req.getParameterNames().nextElement(); + if (paramName.contains("secQuestion")) { + userAnswers.put(paramName,req.getParameter(paramName)); + } + } + return (HashMap)userAnswers; + + } + +} diff --git a/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store b/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store new file mode 100644 index 0000000000..6efa04a20a Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/resources/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store b/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store new file mode 100644 index 0000000000..5008ddfcf5 Binary files /dev/null and b/webgoat-lessons/auth-bypass/src/main/resources/html/.DS_Store differ diff --git a/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html b/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html new file mode 100644 index 0000000000..88a7c908b5 --- /dev/null +++ b/webgoat-lessons/auth-bypass/src/main/resources/html/AuthBypass.html @@ -0,0 +1,88 @@ + + +

+ + +
+
+ +
+ + +
+
+
+ + + + + +