Questions tagged [webgoat]

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.

Filter by
Sorted by
Tagged with
2
votes
1answer
54 views

Is there a difference between editing HTTP messages manually or with burp for example? (WebGoat HTTP intercept exercise “problem”)

I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked. ...
0
votes
1answer
191 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
1
vote
1answer
590 views

WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]

I cracked the hash, and I got this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
2
votes
2answers
300 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
1
vote
0answers
1k views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
3
votes
1answer
852 views

Webgoat missing function level access control lesson

I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class. Everything was simple and smooth till I got stuck at the last ...
1
vote
2answers
2k views

How can I intercept localhost traffic to/from WebGoat with ZED attack proxy?

For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson. One of the first lesson sets is entitled ...
-1
votes
1answer
366 views

WebGoat on a separate computer? [closed]

I was wondering if it's possible to have webgoat on one computer and access it from another computer running Kali Linux. Detailed instructions would be very much appreciated
2
votes
0answers
1k views

ZAP and Tamper Data is not getting any POST requests

I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac. I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
3
votes
1answer
910 views

OWASP WebGoat Warning Meaning

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted: WARNING 1: While running this program your machine will be extremely ...
5
votes
3answers
2k views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize input....
5
votes
4answers
3k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...