tobyash86 / webgoat.net Goto Github PK

View Code? Open in Web Editor NEW

28.0 5.0 98.0 5.26 MB

WebGoat.NETCore - port of original WebGoat.NET to .NET Core

Home Page: https://wiki.owasp.org/index.php/Category:OWASP_WebGoat.NET

HTML 29.90% C# 65.79% CSS 3.20% JavaScript 0.17% Dockerfile 0.44% Batchfile 0.24% Shell 0.24%

owasp security vulnerability learning asp-net-core aspnetcore aspnet-core dotnet dotnet-core dotnetcore

webgoat.net's Introduction

WebGoat.NET version 0.3

Build status

The next generation of the WebGoat example project to demonstrate OWASP TOP 10 vulnerabilities

This is a re-implementation of the original WebGoat project for .NET.

This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications. It also contains lessons that specifically pertain to the .NET framework. The exercises in this app are intended to teach about web security attacks and how developers can overcome them.

WARNING!:

THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES WHICH WILL RENDER YOUR COMPUTER VERY INSECURE WHILE RUNNING! IT IS HIGHLY RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE RUNNING!

Notes:

Google Chrome performs filtering for reflected XSS attacks. These attacks will not work unless chrome is run with the argument --disable-xss-auditor.

Requirements

.NET 8 SDK

How to build and run

1. Running in a Docker container

The provided Dockerfile is compatible with both Linux and Windows containers.
To build a Docker image, execute the following command:

docker build --pull --rm -t webgoat.net .

Please note that Linux image is already built by pipeline and can be pulled from here.

Linux containers

To run the webgoat.net image, execute the following command:

docker run --rm -d -p 5000:80 --name webgoat.net webgoat.net

WebGoat.NET website should be accessible at http://localhost:5000.

Windows containers

To run webgoat.net image, execute the following command:

docker run --rm --name webgoat.net webgoat.net

Windows containers do not support binding to localhost. To access the website, you need to provide the IP address of your Docker container. To obtain the IP, execute the following command:

docker exec webgoat.net ipconfig

The output will include the IP of the 'webgoat.net' container, for example:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : 
   Link-local IPv6 Address . . . . . : fe80::1967:6598:124:cfa3%4
   IPv4 Address. . . . . . . . . . . : 172.29.245.43
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . : 172.29.240.1

In the above example, you can access the WebGoat.NETCore website at http://172.29.245.43.

Stopping Docker container

To stop the webgoat.net container, execute the following command:

docker stop webgoat.net

2. Run locally using dotnet.exe (Kestrel)

Build and publish WebGoat.NET with the following command:

dotnet publish -c release -o ./app

The web application will be deployed to the app folder in the current directory.

Execute the web application on localhost with the following command:

dotnet ./app/WebGoat.NET.dll --urls=http://localhost:5000

The the WebGoat.NET website will be accessible at the URL specified with the --urls parameter: http://localhost:5000.

3. Run using a script

The WebGoat.NET projects ships with scripts that allow you to conveniently run the web application. The following scripts are located in the the "script" directory in the root of the project:

runInDocker.bat - Runs the application in a Docker container on Windows.
runInDocker.sh - Runs the application in a Docker container on Linux.
runLocal.bat - Runs the application locally on Windows.
runLocal.sh - Runs the application locally on Linux.

Known issues:

The latest OWASP Top 10 is not covered. The uncovered vulnerabilities need to be added to the code base.
Educational documents/trainings for any categories of the latest OWASP Top 10 are not available.

webgoat.net's People

Contributors

Stargazers

Watchers

Forkers

dannybarrus billmcmullin ma-rybak phonomenal petermond sq2907 spsig hdiv fypjsecuredevops2021 praetor-ian-testing siguser-am atxjd rfuller jennysnyk cx-demo cloudswar hareeshvp jeremy-chua dystudio ogtryt napalicorp cmaheshbl vulna-felickz mpuglin divi7777777 thebpc jdsmithit deeby yasir-choudhry dylanbthomas shiftleft-mark sgrabinski gutfraindr razermuse turly221 bawar9 hieunc-nt danielhou0 pprofili-contrast anthonyjcosta rdaunce jonas-sci dhabolt xyz031702 qademox scantist cyberrift cltalam hoolicorp srussellni weirdyang jjstewart scantistdemo mattjohnson contrast-security-oss ppnnfsun sumanth-thyagarajan snps-steve dsp-testing lilixz grdemo markzielinskitest senal rongarlit abhishektyagi9 pama-labs thaadur nouredinali kari5 chuckaude hvitved sokunpiseth-dgc stantoxt plexicus octodemo ox-demo jpalanco scorpionbytes soundardpm relaxnow dsp-testing sambit-rgb pixee nahsra mirox13 elson-snyk dotkas

webgoat.net's Issues

It should not be possible to add to cart a negative quantity of product

when user adds a negative quantity of product, shipping cost is also a negative number and order looks like :

Replace OWASP logo with WebGoat logo

Currently we use OWASP icon, but we should use WebGoat icon.
By the way we could update logo in website menu.

Package Tracking page, Shipping Cost and Order Total, should be justified to the right.

Right now this page looks

Unify Order date format

On Package Tracking page:

On My orders page:

About page: the link to FAQ returns code 404

Feedback from Dave W.:

There is an FAQ link on this page that points to: http://localhost:5000/Home/FAQ.aspx - That page does not exist.

Random order of products on product list

Feedback from Dave W.:

In the products list, can you sort the list alphabetically by product name? It seems weird to have this apparently random order, which I understand is ordered by product ID.

Document minimal requirements to run WebGoat

Feedback from Dave W.:

In the readme, or somewhere, can you add the tools required to install/run it outside of Docker? I.e., exactly what .NET installer you need, and anything else. (e.g., .NET Core SDK?). And the minimum version of each would be helpful too.

Bring back ClickJacking example or remove it completely

For now, ClickJacking does not work. We need to find out if it does have any sense to bring it back (e.g. the ASP.NET Core may be secured against it). If we will drop it, we need to remove all the ClickJacking content (e.g. from About).

No app icon in the browser

Feedback from Dave W.:

Can you add a web icon to the app, so there is an Icon for this app in the browser? Ideally some kind of WebGoatdotNET icon.

De-static database context

Merge a commit from the original WebGoat project which improves database usage.

Message about empty credit card field is needed

login to WebGOAT
create order, use credit cart and select 'Remember this credit card number for next time I check out'.
Create next order, at checkout credit card is specified - OK.
Clear credit card field and click Place order (credit card field is empty).
Instead of message 'Please provide valid card number' I get

Fix/disable compilation warnings for dotnet publish

Feedback from Dave W.:

To avoid scaring people, can you eliminate most/all the compilation warnings that occur when you run: dotnet publish ...

Cart not cleared after logout

Feedback from Dave W.:

Logout doesn't clear my cart (or do anything else?) - On purpose vuln??

We need to consider if this may be used in the context of newest Top 10. Otherwise, we need to fix it.

My Account/My orders page, order's total should be justified

We need to make it similar to how it looks on receipt/cart. Currently it looks like that:

Add scripts to simplify deployment and usage

Feedback from Dave W.:

Whatever you can do to make it SUPER EASY to use, is always good. If you look at the root directory of my OWASP project: https://github.com/OWASP/Benchmark you'll see things like:

URL file that points to the web app home page

various prebuilt scripts to do common tasks

Remove raw SQL usage from the codebase

There are some raw SQL queries in the code. We should consider using EF Core instead.
For some reason EF does not work properly in the checkout, we need to find out why and fix it.

Make it easier to enter a valid credit card number

Feedback from Dave W.:

I was trying to enter a credit card and I keep getting "That card is not valid. Please enter a valid card."

Can you provide an explanation of what is legal? Either in a tooltip/or in the error message.

Add newest OWASP Top 10 vulnerabilities

The latest OWASP Top 10 is not covered. The uncovered vulnerabilities need to be added to the codebase. Currently, the project covers version 2010.

Invalid number of displayed featured products

Sometimes there is only one featured product displayed on the main page (instead of four).

Add excercises for OWASP Top 10 vulnerabilities

For now, exercises were provided in the form of pdf documents. For sure we need to update them, but we need to consider if we want to stay with pdf documents or change the format.

Rename docker image for WebGoat

Feedback from Dave W.:

For the docker stuff, I think maybe the image/container should be called webgoatdotnet to distinguish it from original webgoat (for Java)?

Quantity field should not be editable in Cart view

Changing number there is not affecting cart content so user shouldn't be able to edit it.

About page: content needs to be updated to OWASP Top 10 2021

Currently, the supported version of OWASP Top 10 is 2010. In general, we should update the WebGoat project to be compatible (contain vulnerabilities) of the newest standard.

I think we need to delay the update. Possibly a new OWASP version may be released before we will finalize the work. Also, first, we should include the vulnerabilities in the code.

Improve WebGoat.NET branding

We should keep WebGoat.NET as the name of web app. We need to make sure that we use it across entire application and GitHub project.

My Account link should redirect to account information

Feedback from Dave W.:

Going to 'My Account' takes you to the login page? I would have thought it would have shown info about 'My Account'.

Order's view, columns should be justified to the right

Currently it looks like this:

all the columns with numbers should be justified to the right to improve readability.

Old blog dates looks weird in new version of WebGoat

Feedback from Dave W.:

Maybe update the dates on the blog posts to be 2019 instead of 2011 :-)

There are a number of references on this page to specific .NET technology, which I suspect is not valid anymore. For example:
"Other Notes: When a user registers, he must enter a username and company name. His customerId will be based on CompanyName. His contact Name will be his UserName. Customer.ContactName cannot be changed once set or the link between ASP.NET's authentication and the Northwind tables will be broken."

Extend readme by supplemental docker scripts

Feedback from Dave W.:

In the readme, for both docker run commands, please add --rm to both commands so the container is removed when it is stopped. Otherwise, when you try to run it again, it will complain there is already a container with that name. Can you also add instructions on how to stop the containers (docker stop webgoat).

Doubled User Name on register page

Feedback from Dave W.:

On the Register page, there is a User Name field in both the Account Info and Address blocks. Can you eliminate the 2nd one, or rename it to just 'Name' and list it first?

Add custom handlers for various HTTP response codes

Feedback from Dave W.:

Can you add a 404 response handler that returns a Generic 'Not Found' page, rather than the raw: "No webpage was found for the web address: http://localhost:5000/Product/Detail"

And maybe handlers for other response codes too. You could even add some vulns to some of these pages, like XSS (for example) :-)

Each shipping method costs 0

It wasn't like that in initial version. Regression.

Duplicate entries in cart causes exception during checkout

There is a possibility to add the same product into the cart. It does not increase the quantity, but adds separate entry to the cart instead. It causes a runtime exception during checkout.

tobyash86 / webgoat.net Goto Github PK

webgoat.net's Introduction

WebGoat.NET version 0.3

Build status

The next generation of the WebGoat example project to demonstrate OWASP TOP 10 vulnerabilities

WARNING!:

Notes:

Requirements

How to build and run

1. Running in a Docker container

Linux containers

Windows containers

Stopping Docker container

2. Run locally using dotnet.exe (Kestrel)

3. Run using a script

Known issues:

webgoat.net's People

Contributors

Stargazers

Watchers

Forkers

webgoat.net's Issues

Recommend Projects

Recommend Topics

Recommend Org