forked from WebGoat/WebGoat
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Adding extra lesson for order by clauses
- Loading branch information
Showing
20 changed files
with
1,318 additions
and
1,010 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1,913 changes: 926 additions & 987 deletions
1,913
webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java
Large diffs are not rendered by default.
Oops, something went wrong.
2 changes: 1 addition & 1 deletion
2
.../webgoat/plugin/SqlInjectionAdvanced.java → ...plugin/advanced/SqlInjectionAdvanced.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
...webgoat/plugin/SqlInjectionChallenge.java → ...lugin/advanced/SqlInjectionChallenge.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
...rg/owasp/webgoat/plugin/SqlInjection.java → ...oat/plugin/introduction/SqlInjection.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
.../webgoat/plugin/SqlInjectionLesson5a.java → ...in/introduction/SqlInjectionLesson5a.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
.../webgoat/plugin/SqlInjectionLesson5b.java → ...in/introduction/SqlInjectionLesson5b.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
.../webgoat/plugin/SqlInjectionLesson6b.java → ...in/introduction/SqlInjectionLesson6b.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
56 changes: 56 additions & 0 deletions
56
webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/Servers.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package org.owasp.webgoat.plugin.mitigation; | ||
|
|
||
| import com.google.common.collect.Lists; | ||
| import lombok.AllArgsConstructor; | ||
| import lombok.Getter; | ||
| import lombok.SneakyThrows; | ||
| import org.owasp.webgoat.session.DatabaseUtilities; | ||
| import org.owasp.webgoat.session.WebSession; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.web.bind.annotation.*; | ||
|
|
||
| import java.sql.Connection; | ||
| import java.sql.PreparedStatement; | ||
| import java.sql.ResultSet; | ||
| import java.util.List; | ||
|
|
||
| /** | ||
| * @author nbaars | ||
| * @since 6/13/17. | ||
| */ | ||
| @RestController | ||
| @RequestMapping("SqlInjection/servers") | ||
| public class Servers { | ||
|
|
||
| @AllArgsConstructor | ||
| @Getter | ||
| private class Server { | ||
|
|
||
| private String id; | ||
| private String hostname; | ||
| private String ip; | ||
| private String mac; | ||
| private String status; | ||
| private String description; | ||
| } | ||
|
|
||
| @Autowired | ||
| private WebSession webSession; | ||
|
|
||
| @GetMapping(produces = MediaType.APPLICATION_JSON_VALUE) | ||
| @SneakyThrows | ||
| @ResponseBody | ||
| public List<Server> sort(@RequestParam String column) { | ||
| Connection connection = DatabaseUtilities.getConnection(webSession); | ||
| PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column); | ||
| ResultSet rs = preparedStatement.executeQuery(); | ||
| List<Server> servers = Lists.newArrayList(); | ||
| while (rs.next()) { | ||
| Server server = new Server(rs.getString(1), rs.getString(2), rs.getString(3), rs.getString(4), rs.getString(5), rs.getString(6)); | ||
| servers.add(server); | ||
| } | ||
| return servers; | ||
| } | ||
|
|
||
| } |
46 changes: 46 additions & 0 deletions
46
...ql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package org.owasp.webgoat.plugin.mitigation; | ||
|
|
||
| import lombok.SneakyThrows; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.owasp.webgoat.assignments.AssignmentEndpoint; | ||
| import org.owasp.webgoat.assignments.AssignmentHints; | ||
| import org.owasp.webgoat.assignments.AssignmentPath; | ||
| import org.owasp.webgoat.assignments.AttackResult; | ||
| import org.owasp.webgoat.session.DatabaseUtilities; | ||
| import org.owasp.webgoat.session.WebSession; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.web.bind.annotation.RequestMapping; | ||
| import org.springframework.web.bind.annotation.RequestMethod; | ||
| import org.springframework.web.bind.annotation.RequestParam; | ||
| import org.springframework.web.bind.annotation.ResponseBody; | ||
|
|
||
| import java.sql.*; | ||
|
|
||
| /** | ||
| * @author nbaars | ||
| * @since 6/13/17. | ||
| */ | ||
| @AssignmentPath("SqlInjection/attack12a") | ||
| @AssignmentHints(value = {"SqlStringInjectionHint8", "SqlStringInjectionHint9", "SqlStringInjectionHint10", "SqlStringInjectionHint11"}) | ||
| @Slf4j | ||
| public class SqlInjectionLesson12a extends AssignmentEndpoint { | ||
|
|
||
| @Autowired | ||
| private WebSession webSession; | ||
|
|
||
| @RequestMapping(method = RequestMethod.POST) | ||
| @ResponseBody | ||
| @SneakyThrows | ||
| public AttackResult completed(@RequestParam String ip) { | ||
| Connection connection = DatabaseUtilities.getConnection(webSession); | ||
| PreparedStatement preparedStatement = connection.prepareStatement("select ip from servers where ip = ?"); | ||
| preparedStatement.setString(1, ip); | ||
| ResultSet resultSet = preparedStatement.executeQuery(); | ||
| if (resultSet.next()) { | ||
| return trackProgress(success().build()); | ||
| } | ||
| return trackProgress(failed().build()); | ||
| } | ||
| } | ||
|
|
||
|
|
2 changes: 1 addition & 1 deletion
2
...bgoat/plugin/SqlInjectionMitigations.java → ...n/mitigation/SqlInjectionMitigations.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
webgoat-lessons/sql-injection/src/main/resources/js/assignment12.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| $(function () { | ||
| $('.col-check').hide(); | ||
| $('#btn-admin').on('click', function () { | ||
| if ($("#toolbar-admin").is(":visible")) { | ||
| $("#toolbar-admin").hide(); | ||
| $(".col-check").hide(); | ||
| } | ||
| else { | ||
| $("#toolbar-admin").show(); | ||
| $(".col-check").show(); | ||
| } | ||
| }); | ||
|
|
||
| $('#btn-online').on('click', function () { | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('success'); | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('online'); | ||
| }); | ||
| $('#btn-offline').on('click', function () { | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('warning'); | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('offline'); | ||
| }); | ||
| $('#btn-out-of-order').on('click', function () { | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td').parent().removeClass().addClass('danger'); | ||
| $('table tr').filter(':has(:checkbox:checked)').find('td.status').text('out of order'); | ||
| }); | ||
|
|
||
| }); | ||
|
|
||
| $(document).ready(function () { | ||
| getServers('id'); | ||
| }); | ||
|
|
||
| var html = '<tr class="STATUS">' + | ||
| '<td class="col-check"><input type="checkbox" class="form-check-input"/></td>' + | ||
| '<td>HOSTNAME</td>' + | ||
| '<td>IP</td>' + | ||
| '<td>MAC</td>' + | ||
| '<td class="status">ONLINE</td>' + | ||
| '<td>DESCRIPTION</td>' + | ||
| '</tr>'; | ||
|
|
||
| function getServers(column) { | ||
| $.get("SqlInjection/servers?column=" + column, function (result, status) { | ||
| $("#servers").empty(); | ||
| for (var i = 0; i < result.length; i++) { | ||
| var server = html.replace('ID', result[i].id); | ||
| var status = "success"; | ||
| if (result[i].status === 'offline') { | ||
| status = "danger"; | ||
| } | ||
| server = server.replace('ONLINE', status); | ||
| server = server.replace('STATUS', status); | ||
| server = server.replace('HOSTNAME', result[i].hostname); | ||
| server = server.replace('IP', result[i].ip); | ||
| server = server.replace('MAC', result[i].mac); | ||
| server = server.replace('DESCRIPTION', result[i].description); | ||
| $("#servers").append(server); | ||
| } | ||
|
|
||
| }); | ||
| } |
Oops, something went wrong.