Questions tagged [webgoat]
WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.
13
questions
1
vote
1
answer
275
views
What is happening to second response in HTTP Splitting?
Doing the webgoat HTTP splitting exercise. I feel like I'm doing something wrong or there is something that I don't understand.
The idea is that since we can control the referer parameter, we can ...
- 133
2
votes
1
answer
395
views
Is there a difference between editing HTTP messages manually or with burp for example? (WebGoat HTTP intercept exercise "problem")
I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked.
...
- 23
0
votes
1
answer
815
views
Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations
I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat.
1 Setup Local proxies in webgoat to run on localhost 8090
2 Exported the certificate and imported it in ...
1
vote
1
answer
2k
views
WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]
I cracked the hash, and I got this:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
- 113
2
votes
2
answers
995
views
CSRF methods: img vs iframe vs form/javascript
I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
- 121
1
vote
0
answers
2k
views
Can anyone provide a hint for Webgoat 8's Deserialization exercise?
Working on the Deserialization exercise in Webgoat (v. 8)
The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload.
...
- 6,874
3
votes
1
answer
2k
views
Webgoat missing function level access control lesson
I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class.
Everything was simple and smooth till I got stuck at the last ...
- 133
1
vote
2
answers
2k
views
How can I intercept localhost traffic to/from WebGoat with ZED attack proxy?
For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson.
One of the first lesson sets is entitled &...
- 11
-1
votes
1
answer
666
views
WebGoat on a separate computer? [closed]
I was wondering if it's possible to have webgoat on one computer and access it from another computer running Kali Linux.
Detailed instructions would be very much appreciated
2
votes
0
answers
2k
views
ZAP and Tamper Data is not getting any POST requests
I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.
I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
- 29
5
votes
1
answer
2k
views
OWASP WebGoat Warning Meaning
I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted:
WARNING 1: While running this program your machine will be
extremely ...
- 153
5
votes
3
answers
3k
views
Do WebGoat style XSS attacks still work?
I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks.
Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize input....
- 3,536
5
votes
4
answers
3k
views
Why is this response splitting attack not working?
I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting.
I've looked in all ...
- 652