Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webgoat]

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.

0
votes
0answers
28 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
0
votes
1answer
137 views

WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]

I cracked the hash, and I got this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
2
votes
2answers
190 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
0
votes
0answers
632 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
3
votes
1answer
662 views

Webgoat missing function level access control lesson

I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class. Everything was simple and smooth till I got stuck at the last ...
1
vote
2answers
1k views

How can I intercept localhost traffic to/from WebGoat with ZED attack proxy?

For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson. One of the first lesson sets is entitled ...
-1
votes
1answer
299 views

WebGoat on a separate computer? [closed]

I was wondering if it's possible to have webgoat on one computer and access it from another computer running Kali Linux. Detailed instructions would be very much appreciated
2
votes
0answers
1k views

ZAP and Tamper Data is not getting any POST requests

I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac. I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
4
votes
1answer
803 views

OWASP WebGoat Warning Meaning

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted: WARNING 1: While running this program your machine will be extremely ...
5
votes
3answers
2k views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize input....
5
votes
4answers
3k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...