Skip to content

Releases: WebGoat/WebGoat

v2023.8

05 Dec 10:23
@github-actions github-actions
v2023.8
5357a65
Compare
Choose a tag to compare
v2023.8 Latest
Latest

Version v2023.8

🚀 New functionality

  • Consistent environment values and url references (#1677)
  • Show directly requested file in requests overview
  • Show creating time in file upload overview

🐞 Bug fixes

  • Fix startup message (#1687)
  • Fix/state of software supply chain links (#1683)
  • Fix WebWolf UI (#1686)

🔄 Technical tasks

  • bump actions/setup-java from 3 to 4 (#1690)
  • bump commons-io:commons-io from 2.14.0 to 2.15.1 (#1689)
  • bump com.diffplug.spotless:spotless-maven-plugin (#1688)

Full change log: v2023.5...v2023.8

Team WebGoat

Assets 3

v2023.5

23 Nov 15:07
@github-actions github-actions
v2023.5
f7a9995
Compare
Choose a tag to compare
v2023.5

Version 2023.5

New functionality

  • Implement JWT jku example (#1552)
  • Java 21 initial support (#1622)
  • improve MFAC lesson hint texts for a better user experience (#1424)
  • upgrade to Spring Boot version 3 (#1477)

Bug fixes

  • typo in WebGoad.txt (#1667)
  • search box moved and jwt encode/decode with little delay (#1664)
  • skip validation for JWT (#1663)
  • fixed issue in JWT test tool and added robot test (#1658)
  • Password reset link test condition more strict and move all WebWolf links to /WebWolf (#1645)
  • fix servers id (#1619)
  • potential NPE in the stored XSS assignment
  • crypto basics broken links
  • fixes the default change in trailing slash matching and address the affected assignments
  • hint that was breaking the template, causing hints from different assignments to mix (#1424)
  • HijackSession lesson template deprecated Tymeleaf attribute
  • Fix NPE in IDOR lesson
  • Add new assignment IT tests
  • XSS mitigation
  • Stored Cross-Site Scripting Lesson
  • Add Assignment7 Tests
  • Fix IDOR lesson
  • remove steps from release script (#1509)
  • robotframework fails due to updated dependencies (#1508)
  • fix Java image inside Docker file The image now downloads the correct Java version based on the architecture.
  • Fix typo of HijackSession_content0.adoc
  • Restrict SSRF Regexes
  • update challenge code - Flags are now wired through a Spring config - Introduced Flag class - Removed Flags from the FlagController

Full change log: v2023.4...v2023.5

Contributors

Special thanks to the following contributors providing us with a pull request:

  • Àngel Ollé Blázquez
  • Nanne Baars
  • René Zubcevic
  • Agustín Díaz
  • François Capon
  • Loris Sierra
  • caputdraconis
  • test2user-aqil

And everyone who provided feedback through Github.

Team WebGoat

Assets 3

v2023.4

17 Feb 12:16
@github-actions github-actions
v2023.4
3fd66ee
Compare
Choose a tag to compare
v2023.4

Version 2023.4

New functionality

Bug fixes

Assets 3

2023.3

05 Jan 21:01
@github-actions github-actions
v2023.3
edd9aa3
Compare
Choose a tag to compare
2023.3

Version 2023.3

With great pleasure, we present you with a new release of WebGoat 2023.3. Finally, it has been a while. This year starts with a new release of WebGoat. This year we will undoubtedly release more often. From this release on, we began to use a new versioning scheme (https://calver.org/#scheme).

A big thanks to René Zubcevic and Àngel Ollé Blázquez for keeping the project alive this last year, and hopefully, we can make
many more releases this year.

New functionality

  • New year's resolution(2022): major refactoring of WebGoat to simplify the setup and improve building times.
  • Move away from multi-project setup:
    • This has a huge performance benefit when building the application. Build time locally is now Total time: 42.469 s (depends on your local machine of course)
    • No longer add Maven dependencies in several places
    • H2 no longer needs to run as separate process, which solves the issue of WebWolf sharing and needing to configure the correct database connection.
  • More explicit paths in html files to reference adoc files, less magic.
  • Integrate WebWolf in WebGoat, the setup was way too complicated and needed configuration which could lead to mistakes and a not working application. This also simplifies the Docker configuration as there is only 1 Docker image.
  • Add WebWolf button in WebGoat
  • Move all lessons into src/main/resources
  • WebGoat selects a port dynamically when starting. It will still start of port 8080 it will try another port to ease the user experience.
  • WebGoat logs URL after startup: Please browse to http://127.0.0.1:8080/WebGoat to get started...
  • Simplify Dockerfile as we no longer need a script to start everything
  • Maven build now start WebGoat jar with Maven plugin to make sure we run against the latest build.
  • Added Initializable interface for a lesson, an assignment can implement this interface to set it up for a specific user and to reset the assignment back to its original state when a reset lesson occurs. See BlindSendFileAssignment for an example.
  • Integration tests now use the same user. This saves a lot of time as before every test used a different user which triggered the Flyway migration to set up the database schema for the user. This migration took a lot of time.
  • Updated introduction lesson to WebWolf.
  • Added language switch for support for multiple languages.
  • Removed logic to start WebGoat on a random port when port 8080 is taken. We would loop until we found a free port. We simplified this to just start on the specified port.
  • Add Google formatter for all our code, a PR now checks whether the code adheres to the standard.
  • Renaming of all packages and folders.
  • #1039 New OWASP Top 10
  • #1065 New lesson about logging

Bug fixes

Full change log: v8.2.2...v2023.3

Contributors

Special thanks to the following contributors providing us with a pull request:

And everyone who provided feedback through Github.

Team WebGoat

Assets 3

2023.2

05 Jan 20:39
@github-actions github-actions
v2023.2
81ed738
Compare
Choose a tag to compare
2023.2

Version 2023.2

With great pleasure, we present you with a new release of WebGoat 2023.2. Finally, it has been a while. This year starts with a new release of WebGoat. This year we will undoubtedly release more often. From this release on, we began to use a new versioning scheme (https://calver.org/#scheme).

A big thanks to René Zubcevic and Àngel Ollé Blázquez for keeping the project alive this last year, and hopefully, we can make
many more releases this year.

New functionality

  • New year's resolution(2022): major refactoring of WebGoat to simplify the setup and improve building times.
  • Move away from multi-project setup:
    • This has a huge performance benefit when building the application. Build time locally is now Total time: 42.469 s (depends on your local machine of course)
    • No longer add Maven dependencies in several places
    • H2 no longer needs to run as separate process, which solves the issue of WebWolf sharing and needing to configure the correct database connection.
  • More explicit paths in html files to reference adoc files, less magic.
  • Integrate WebWolf in WebGoat, the setup was way too complicated and needed configuration which could lead to mistakes and a not working application. This also simplifies the Docker configuration as there is only 1 Docker image.
  • Add WebWolf button in WebGoat
  • Move all lessons into src/main/resources
  • WebGoat selects a port dynamically when starting. It will still start of port 8080 it will try another port to ease the user experience.
  • WebGoat logs URL after startup: Please browse to http://127.0.0.1:8080/WebGoat to get started...
  • Simplify Dockerfile as we no longer need a script to start everything
  • Maven build now start WebGoat jar with Maven plugin to make sure we run against the latest build.
  • Added Initializable interface for a lesson, an assignment can implement this interface to set it up for a specific user and to reset the assignment back to its original state when a reset lesson occurs. See BlindSendFileAssignment for an example.
  • Integration tests now use the same user. This saves a lot of time as before every test used a different user which triggered the Flyway migration to set up the database schema for the user. This migration took a lot of time.
  • Updated introduction lesson to WebWolf.
  • Added language switch for support for multiple languages.
  • Removed logic to start WebGoat on a random port when port 8080 is taken. We would loop until we found a free port. We simplified this to just start on the specified port.
  • Add Google formatter for all our code, a PR now checks whether the code adheres to the standard.
  • Renaming of all packages and folders.
  • #1039 New OWASP Top 10
  • #1065 New lesson about logging

Bug fixes

Full change log: v8.2.2...v2023.2

Contributors

Special thanks to the following contributors providing us with a pull request:

And everyone who provided feedback through Github.

Team WebGoat

Assets 2

v8.2.2

05 Sep 12:44
@github-actions github-actions
v8.2.2
e75cfbe
This commit was signed with the committer’s verified signature.
nbaars Nanne Baars
GPG key ID: A6D6C06FE4EC14E7
Learn about vigilant mode.
Compare
Choose a tag to compare
v8.2.2

Version 8.2.2

New functionality

  • Docker image now supports nginx when browsing to http://localhost a landing page is shown.

Bug fixes

Assets 4

v8.2.1

30 Jul 14:14
@github-actions github-actions
v8.2.1
032b90d
This commit was signed with the committer’s verified signature.
nbaars Nanne Baars
GPG key ID: A6D6C06FE4EC14E7
Learn about vigilant mode.
Compare
Choose a tag to compare
v8.2.1

Version v8.2.1

New functionality

  • New Docker image for arm64 architecture is now available (for Apple M1)
Assets 4

v8.2.0

26 Jul 14:47
@github-actions github-actions
v8.2.0
e9df66c
This commit was signed with the committer’s verified signature.
nbaars Nanne Baars
GPG key ID: A6D6C06FE4EC14E7
Learn about vigilant mode.
Compare
Choose a tag to compare
v8.2.0

Version 8.2.0

New functionality

  • Add new zip slip lesson (part of path traversal)
  • SQL lessons are now separate for each user, database are now per user and no longer shared across users
  • Moved to Java 15 & Spring Boot 2.4 & moved to JUnit 5

Bug fixes

Contributors

Special thanks to the following contributors providing us with a pull request:

  • nicholas-quirk
  • VijoPlays
  • aolle
  • trollingHeifer
  • maximmasiutin
  • toshihue
  • avivmu
  • KellyMarchewa
  • NatasG
  • gabe-sky
Assets 4

v8.1.0

23 May 12:27
@webgoat-github webgoat-github
v8.1.0
a4f7059
Compare
Choose a tag to compare
v8.1.0

Version 8.1.0

New functionality

  • Added new lessons for cryptography and path-traversal
  • Extra content added to the XXE lesson
  • Explanation of the assignments will be part of WebGoat, in this release we added detailed descriptions on how to solve the XXE lesson. In the upcoming releases new explanations will be added. If you want to contribute please create a pull request on Github.
  • Docker improvements + docker stack for complete container with nginx
  • Included JWT token decoding and generation, since jwt.io does not support None anymore

Bug fixes

Contributors

Special thanks to the following contributors providing us with a pull request:

  • Satoshi SAKAO
  • Philippe Lafoucrière
  • Cotonne
  • Tiago Mussi
  • thegoodcrumpets
  • Atharva Vaidya
  • torleif
  • August Detlefsen
  • Choe Hyeong Jin

And everyone who provided feedback through Github.

Team WebGoat

Assets 4

The OWASP WebGoat 7.1 Release

19 Nov 02:02
@dougmorato dougmorato
7.1
2d1a89e
Compare
Choose a tag to compare
The OWASP WebGoat 7.1 Release

The WebGoat 7.1 Release is comprised 104 commits from 16 different contributors a over a period of 9 months.

This is a release ta include many bug fixes and is intended to be the last release of the 7.X branch, as the WebGoat team have big plans for next release.

For a glimpse of what has been implemented, check our change log:

Change Log

7.1 (2016-11-18)

Full Changelog

Implemented enhancements:

  • i8n highlighting #96
  • Improve uniqueness of menu item Id's #45

Fixed bugs:

  • Stored XSS Lesson does not render message and attack does not fire #141
  • Source code is not available for this lesson. #137

Closed issues:

  • Fix lesson client side filtering #272
  • Reset lesson does not work anymore #271
  • Lesson plans not loading with manual build and easy-run jar (standalone jar) not running at all #268
  • Unable to download webgoat jar file #261
  • Developer edition build isn't working in its entirety #260
  • Amazon S3 downloadable JAR is missing #259
  • Code does not compile on dev branch #258
  • Executable jar crashes if empty .extract folder exist #251
  • Java Error Message in Lesson "How to Bypass a Path Based Access Control Scheme" #240
  • developer bootstrap says git is missing when it is installed #236
  • Application Won't Start #234
  • Restart lesson button isn't working #226
  • Navigation to start page is broken after login #218
  • Links in menu missing pointer cursor #216
  • Restart lesson button not working #213
  • WebGoat stops at DEBUG - Exit: getEngine() #211
  • Labs: Remnant files and solved stages #208
  • Labs: Navigating to Instructor java examples #206
  • WebGoat 7.0 and ZAP 2.4.3 will not proxy #204
  • Failing Build #201
  • Missing mvn package of webgoat-container in README.MD #200
  • Seems translation to Russian for "Congratulations. You have successfully completed this lesson." phrase is broken. #199
  • HtmlEncoder uses static methods but must be instantiated #195
  • webgoat-container should unpack all the lessons #192
  • Access Control Flaws, LAB stage 3: Remove the FindProfile screen #186
  • Injection Flaws | XPath Injection date file path issue #184
  • hints don't appear to work on labs #183
  • Session Management Flaws - Spoof an Authentication Cookie render issue #181
  • Challenge - Show* buttons show on initial lesson load #180
  • Http Basics - minor edits and change completion state #178
  • Lab Cross-Site Scripting Stage 1 solution #176
  • Backdoor lesson breaks menu CSS #175
  • Redirect localhost:8080 to localhost:8080/WebGoat #173
  • Session Fixation link in stage 2 does not work #170
  • A failure occurred when execute the command "sh webgoat_developer_bootstrap.sh" #145
  • Copy lessons into plugin_lessons #254
  • WebGoat // Lesson Plan and Solution are note available #242
  • Lab: Client side filtering - broken path #232
  • AXIS class not found error in Web Services / WSDL Scanning #222
  • WSDL link in SOAP Request Lesson crashing with AXIS error #221
  • Labs: RBAC stage 1 and 3 not working #209
  • How to create a Legacy Lesson - instruction edit #177
  • Can't tell when WebGoat has actually started when using: webgoat_developer_bootstrap.sh #75

Merged pull requests:

Assets 6