WebGoat: A deliberately insecure Web Application

Important Information

The WebGoat Lesson Server, is currently UNDER MAJOR DEVELOMENT.

As of November 2016, 7.1 is the current stable release and 8.x is under development ('develop') branch here.

Older/Legacy version of WebGoat an be found at: WebGoat-Legacy

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.

This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.

• Home Page
• OWASP Project Home Page
• Source Code
• Easy-Run Download
• Wiki
• FAQ (old info):
• Project Leader - Direct to Bruce Mayhew
• Mailing List - WebGoat Community - For most questions
• Artifacts generated from Continuous Integration
• Output from our Travis.CI Build server

WARNING 1: While running this program your machine will be extremely vulnerable to attack. You should to disconnect from the Internet while using this program. WebGoat's default configuration binds to localhost to minimize the exposure.

WARNING 2: This program is for educational purposes only. If you attempt these techniques without authorization, you are very likely to get caught. If you are caught engaging in unauthorized hacking, most companies will fire you. Claiming that you were doing security research will not work as that is the first thing that all hackers claim.

Easy Run ( For non-developers )

Every successful build of the WebGoat Lessons Container and the WebGoat Lessons in our Continuous Integration Server creates an "Easy Run" Executable WAR file, which contains the WebGoat Lessons Server, the lessons and a embedded Tomcat server.

You can check for the "Last Modified" date of our "Easy Run" war file HERE

The "Easy Run" JAR file offers a no hassle approach to testing and running WebGoat. Follow these instructions if you wish to simply try/test/run the current development version of WebGoat

Prerequisites:

• Java VM 1.8 or Docker installed

Easy Run Instructions:

1. Docker image

The latest version of WebGoat is available at DockerHub, see https://hub.docker.com/r/webgoat/webgoat-container/. First install Docker, then open a command shell/window and type:

docker pull webgoat/webgoat-container
docker run -p 8080:8080 webgoat/webgoat-container

Wait for the Docker container to start and go to step 3.

2. Download the easy run executable jar file which contains all the lessons and a embedded Tomcat server:

https://s3.amazonaws.com/webgoat-war/webgoat-standalone-7.1-SNAPSHOT-exec.jar

3. Run it using java:

Open a command shell/window, browse to where you downloaded the easy run jar and type:

java -jar webgoat-standalone-7.0.1-exec.jar [-p | --p <port>] [-a | --address <address>]

Using the --help option will show the allowed command line arguments.

3. Browse to the url shown in the console and happy hacking !

Vagrant

To run WebGoat with Vagrant you must first have Vagrant and Virtualbox installed.

   $ cd WebGoat/webgoat-images/vagrant-users
   $ vagrant up

Once you see the message 'Browse to http://localhost:9999/WebGoat and happy hacking! you can open a browser.

For Developers

Set up manual

Follow these instructions if you wish to run Webgoat and modify the source code as well.

Prerequisites:

• Java 8
• Maven > 3.2.1
• Your favorite IDE, with Maven awareness: Netbeans/IntelliJ/Eclipse with m2e installed.
• Git, or Git support in your IDE

The Easy Way: Developer Edition run using Linux or Mac

The webgoat_developer_bootstrap.sh script will clone the necessary repositories, call the maven goals in order launch Tomcat listening on localhost:8080

mkdir WebGoat-Workspace
cd WebGoat-Workspace
curl -o webgoat_developer_bootstrap.sh https://raw.githubusercontent.com/WebGoat/WebGoat/master/webgoat_developer_bootstrap.sh
./webgoat_developer_bootstrap.sh

The Manual Way: Developer Edition!

Cloning the Lesson Server and the Lessons project:

Open a command shell/window, navigate to where you wish to download the source and type: mvn clean package mvn –pl webgoat-container spring-boot:run

git clone [email protected]:WebGoat/WebGoat.git

Now let's start by compiling the project.

NOTE: the -DskipTests below is temporary, until we root out an issue (but we didn't want to delay updating these instructions anymore)

cd WebGoat
git checkout develop
mvn clean package -DskipTests=true

Now we are ready to run the project. WebGoat 8.x is using Spring-Boot.

mvn -pl webgoat-container spring-boot:run

... you should be running webgoat on localhost:8080/WebGoat momentarily

Building a new Docker image

WebGoat now has Docker support you can build a container with the following commands:

cd WebGoat/
mvn package
cd webgoat-container
mvn docker:build
docker login
docker push webgoat/webgoat-container

With the following command you are able to run the Docker container on your local machine:

docker run -p 8080:8080 -t webgoat/webgoat-container
docker ps

With the last command you are able to determine ip address to connect to.

Vagrant

For an easy development experience you can use Vagrant. Note you should have Vagrant and Virtualbox installed on your system.

   $ cd WebGoat/webgoat-images/vagrant-developers
   $ vagrant up

Once the provisioning is complete login to the Virtualbox with username vagrant and password vagrant. The source code will be available in the home directory.