Merge branch 'develop' of https://github.com/WebGoat/WebGoat into dev…

…elop
gaobaoru · Feb 7, 2017 · a005466 · a005466
2 parents b415938 + 92533b4
commit a005466
Show file tree

Hide file tree

Showing 11 changed files with 65 additions and 104 deletions.
diff --git a/README.MD b/README.MD
@@ -21,7 +21,7 @@ exercises are intended to be used by people to learn about application security
 penetration testing techniques.
 
 **WARNING 1:** *While running this program your machine will be extremely
-vulnerable to attack. You should to disconnect from the Internet while using
+vulnerable to attack. You should disconnect from the Internet while using
 this program.*  WebGoat's default configuration binds to localhost to minimize 
 the exposure.
 

diff --git a/webgoat-container/src/main/resources/static/css/main.css b/webgoat-container/src/main/resources/static/css/main.css
@@ -14,7 +14,7 @@ a:link,
 a:visited {
   text-decoration: none;
   outline: none;
-  color: #e84c3d;
+  /* color: #e84c3d; */
 }
 a:hover,
 a:active {
@@ -839,12 +839,6 @@ cookie-container {
   overflow-y:scroll auto;
   overflow-x:hidden;
 }
-
-#sidebar {
-  /*background-color:#333;*/
-  background-color:blue;
-}
-
 
 .sidebar-toggle {
   margin-left: -240px;
@@ -876,6 +870,7 @@ cookie-container {
   -ms-transition: all 200ms ease-in;
   transition: all 200ms ease-in;
 }
+
 #menu-container ul li a span {
   display: inline-block;
 }
@@ -897,6 +892,15 @@ cookie-container {
   margin-left:8px;
 }
 
+#menu-container ul ul li.selected a {
+    color:#e84c3d
+}
+
+#menu-container ul ul li.selected a:hover {
+    color:#ddd
+}
+
+
 #menu-container ul li a i {
   width: 20px;
 }
@@ -914,9 +918,11 @@ cookie-container {
   display: block;
 }
 
+#menu-container ul li:hover,
 #menu-container ul li a:hover,
 #menu-container ul li.active > a {
-  color: #e84c3d;
+  background-color: #e84c3d;
+  color:#ddd;
 }
 
 #menu-container ul span.lesson-complete {
@@ -927,16 +933,19 @@ cookie-container {
     display:inline-block;
 }
 
+/*
 #menu-container ul li.selected, #menu-container li a.selected {
-    background-color: ##aaa;
+    background-color: #aaa;
 }
+*/
 
 #menu-container ul li.stage {
   padding-left:3px;
 }
 
 #menu-container li.selected, #menu-container a.selected {
   color:#fff;
+  /* background-color:#000; */
   font-weight:550;
 }
 

diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/MenuView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/MenuView.js
@@ -108,14 +108,15 @@ define(['jquery',
 		},
 
 		onLessonClick: function (elementId) {
-			$('#'+this.curLessonLinkId).removeClass('selected');
+			$('#'+this.curLessonLinkId).removeClass('selected').parent().removeClass('selected');
 			//update
-			$('#'+elementId).addClass('selected');
+			$('#'+elementId).addClass('selected').parent().addClass('selected');
 			this.curLessonLinkId = elementId;
 		},
 
 		expandCategory: function (id) {
 			if (id) {
+			    //this.selectedCategory = id;
 				this.accordionMenu(id);
 			}
 		},

diff --git a/webgoat-lessons/http-proxies/src/main/resources/plugin/HttpProxies/html/HttpProxies.html b/webgoat-lessons/http-proxies/src/main/resources/plugin/HttpProxies/html/HttpProxies.html
@@ -2,7 +2,14 @@
 
 <html xmlns:th="http://www.thymeleaf.org">
 
-	<div class="lesson-page-wrapper">
+    <div class="lesson-page-wrapper">
+        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+        <!-- include content here. Content will be presented via asciidocs files,
+        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+        <div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro0.adoc"></div>
+    </div>
+
+    <div class="lesson-page-wrapper">
 		<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
 		<!-- include content here. Content will be presented via asciidocs files,
         which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->

diff --git a/...lessons/http-proxies/src/main/resources/plugin/HttpProxies/lessonPlans/de/HttpBasics.html b/...lessons/http-proxies/src/main/resources/plugin/HttpProxies/lessonPlans/de/HttpBasics.html
diff --git a/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro0.adoc b/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro0.adoc
@@ -0,0 +1,20 @@
+
+== HTTP Proxy Overview
+
+Many times proxies are used as a way of accessing otehrwise blocked content.  A user might connect to server A, which relays content from server B
+ ... Because Server B is blocked wihtin the user's network. That's not the use case we will be dealing with here, but the concept is the same.
+HTTP Proxies receive requesets from a client and relay them. They also typically record them. They act as a man-in-the-middle (keep that in mind if you decide to
+use a proxy server to connect to some other system that is otherwise blocked). We won't get into HTTP vs HTTPS just yet, but that's an important topic in
+relationship to proxies.
+
+=== Proxy Capabilities
+
+Proxies sit between your client and the server the client is talking to. You can record and analyze the requests & responses.  You can also use the proxy to
+modify (tamper) the requests and responses.  Proxies also have automated or semi-automated functions that allow  you to gain efficiency in testing and
+analyzing the security of a website.
+
+=== Other Uses for Proxies
+
+ZAP specifically can also be used in the development process in a CI/CD, DevOps or otherwise automated build/test environment.  This lesson does
+not currently have any details on that, but it is worth mentioning. There are a number of examples on the internet of it being integrated into a
+CI/CD with Jenkins, maven or other build processes.
diff --git a/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro1.adoc b/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro1.adoc
@@ -1,9 +1,7 @@
-= HTTP Basics : Proxy
-
+
 == HTTP Proxy Setup
 
-HTTP Proxies are tools that allow an attacker, developer or researcher to act as a man-in-the-middle on requests and responses. Since this is an
-OWASP project, we'll be using ZAP. If you are comfortable using another proxy (e.g. Burp), you can skip this. Otherwise,
+Since this is an OWASP project, we'll be using ZAP. If you are comfortable using another proxy (e.g. Burp), you can skip this. Otherwise,
 this will show you how to set up ZAP to act as a proxy on your localhost.
 
 === Setting up ZAP
@@ -27,4 +25,3 @@ image::plugin_lessons/plugin/HttpProxies/images/zap-start.png[ZAP Start,548,256,
 . Click OK
 
 image::plugin_lessons/plugin/HttpProxies/images/zap-local-proxy.png[ZAP local proxy,800,648,style="lesson-image"]
-
diff --git a/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro2.adoc b/...rc/main/resources/plugin/HttpProxies/lessonPlans/en/HttpBasics_ProxyIntro2.adoc
@@ -1,11 +1,9 @@
 == HTTP Proxy Setup: The Browser
 
-=== Point Browser at Proxy
-
 There are many plugins to manage this, but this will show you how to do this manually in Firefox and Chrome.
 This will send all of your traffic to the proxy. Since we haven't set up a trusted cert. yet, that may cause issues with any https requests. More on that in a bit though. Let's stick to basics for now:
 
-==== Firefox Proxy Config
+=== Firefox Proxy Config
 
 . Go to your Firefox Preferences (Mac, Linux) or Options (Windows) from the menu.
 . Select _Advanced_ on the left
@@ -18,7 +16,7 @@ This will send all of your traffic to the proxy. Since we haven't set up a trust
 
 image::plugin_lessons/plugin/HttpProxies/images/firefox-proxy-config.png[Firefox Proxy Config,510,634,style="lesson-image"]
 
-==== Chrome Proxy Config
+=== Chrome Proxy Config
 
 . Bring up Chrome's settings form the menu
 . In the _Search settings_ box type in *proxy* and hit Enter/Return. This should bring up the Network heading with a _Change proxy settings_ button.
@@ -28,4 +26,14 @@ image::plugin_lessons/plugin/HttpProxies/images/firefox-proxy-config.png[Firefox
 . Input 127..0.0.1 in the first box under _Web Proxy Server_ and your port # (8090 is what used earlier) in the second box (to the right)
 . You may also want to clear the _Bypass proxy settings for these Hosts & Domains_ text input at the bottom, but shouldn't need to
 
-image::plugin_lessons/plugin/HttpProxies/images/chrome-manual-proxy.png[Chrome Proxy Config,700,447,style="lesson-image"]
+image::plugin_lessons/plugin/HttpProxies/images/chrome-manual-proxy.png[Chrome Proxy Config,700,447,style="lesson-image"]
+
+=== Other Proxy Configuration Options
+
+If you don't want to manage the proxy manually, there are extensions or plugins that can help you to do so without digging through as much config,
+or based on URL patterns. Examples include:
+
+* FoxyProxy for Firefox
+* Proxy Switcher for Firefox
+* Toggle Proxy for Firefox
+* Still looking for suggestions for Chrome ...
diff --git a/...lessons/http-proxies/src/main/resources/plugin/HttpProxies/lessonPlans/ru/HttpBasics.html b/...lessons/http-proxies/src/main/resources/plugin/HttpProxies/lessonPlans/ru/HttpBasics.html
diff --git a/...c/main/resources/plugin/HttpProxies/lessonSolutions/en/HttpBasics_solution.adoc b/...c/main/resources/plugin/HttpProxies/lessonSolutions/en/HttpBasics_solution.adoc
diff --git a/...s/http-proxies/src/main/resources/plugin/HttpProxies/lessonSolutions/html/HttpBasics.html b/...s/http-proxies/src/main/resources/plugin/HttpProxies/lessonSolutions/html/HttpBasics.html