Merge branch 'develop' of https://github.com/WebGoat/WebGoat into dev…

…elop

webgoat-container/src/main/java/org/owasp/webgoat/session/Course.java

@@ -82,7 +82,7 @@ public List<AbstractLesson> getLessons() {
      * @return a {@link java.util.List} object.
      */
     public List<AbstractLesson> getLessons(Category category) {
-        return this.lessons.stream().filter(l -> l.getCategory() == category).collect(toList());
+        return this.lessons.stream().filter(l -> l.getCategory() == category).sorted().collect(toList());
     }
 
     public void setLessons(List<AbstractLesson> lessons) {

webgoat-container/src/main/resources/static/js/goatApp/goatApp.js

@@ -1,5 +1,15 @@
-define(['jquery', 'underscore', 'backbone', 'polyglot', 'goatApp/view/GoatRouter', 'goatApp/support/goatAsyncErrorHandler'],
-    function ($, _, Backbone, Polyglot, Router, asyncErrorHandler) {
+define(['jquery',
+        'underscore',
+        'backbone',
+        'polyglot',
+        'goatApp/view/GoatRouter',
+        'goatApp/support/goatAsyncErrorHandler'],
+    function ($,
+         _,
+         Backbone,
+         Polyglot,
+         Router,
+         asyncErrorHandler) {
         'use strict'
         return {
             initApp: function () {

webgoat-container/src/main/resources/static/js/goatApp/view/GoatRouter.js

@@ -1,4 +1,5 @@
 define(['jquery',
+    'libs/jquery-vuln',
     'underscore',
     'backbone',
     'goatApp/controller/LessonController',
@@ -8,6 +9,7 @@ define(['jquery',
     'goatApp/view/DeveloperControlsView',
     'goatApp/view/TitleView'
 ], function ($,
+             $vuln,
              _,
              Backbone,
              LessonController,
@@ -48,6 +50,7 @@ define(['jquery',
 
         setUpCustomJS: function () {
             webgoat.customjs.jquery = $; //passing jquery into custom js scope ... still klunky, but works for now
+            webgoat.customjs.jqueryVuln = $vuln;
 
             // temporary shim to support dom-xss lesson
             webgoat.customjs.phoneHome = function (e) {

webgoat-container/src/main/resources/static/js/libs/jquery-base.js

@@ -0,0 +1,9 @@
+// AMD (Asynchronous Module Definition) wrapper for jQuery 1.8
+define([
+    // Load the jQuery source file
+    '/WebGoat/js/libs/jquery-2.2.4.min.js'
+    ],
+    function(){
+        // Tell Require.js that this module returns a reference to jQuery
+        return $; // Return the global scope object
+});

webgoat-container/src/main/resources/static/js/libs/jquery-vuln.js

@@ -0,0 +1,9 @@
+// AMD (Asynchronous Module Definition) wrapper for jQuery 1.8
+define([
+    // Load the jQuery source file
+    '/WebGoat/js/libs/jquery-2.1.4.min.js'
+    ],
+    function(){
+        // Tell Require.js that this module returns a reference to jQuery
+        return $.noConflict(true); // Return the global scope object
+});

webgoat-container/src/main/resources/static/js/main.js

@@ -13,13 +13,19 @@ js/main.js << main file for require.js
 require.config({
   baseUrl: "js/",
   paths: {
-    jquery: 'libs/jquery-1.10.2.min',
+    jquery: 'libs/jquery-2.2.4.min',
     underscore: 'libs/underscore-min',
     backbone: 'libs/backbone-min',
     text: 'libs/text',
     templates: 'goatApp/templates',
     polyglot: 'libs/polyglot.min'
   },
+
+  map: {
+    'libs/jquery-base' : {'jquery':'libs/jquery-2.2.4.min'},
+    'libs/jquery-vuln' : {'jquery':'libs/jquery-2.1.4.min'}
+  },
+
   shim: {
     underscore: {
       exports: "_"
@@ -31,6 +37,6 @@ require.config({
   }
 });
 
-require(['jquery','underscore','backbone','goatApp/goatApp'], function($,_,Backbone,Goat){
-  Goat.initApp();
+require(['jquery','libs/jquery-base','libs/jquery-vuln','underscore','backbone','goatApp/goatApp'], function($,jqueryBase,jqueryVuln,_,Backbone,Goat){
+    Goat.initApp();
 });

webgoat-lessons/http-basics/src/main/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequest.java

@@ -0,0 +1,59 @@
+package org.owasp.webgoat.plugin;
+
+import org.owasp.webgoat.endpoints.AssignmentEndpoint;
+import org.owasp.webgoat.endpoints.AssignmentHints;
+import org.owasp.webgoat.endpoints.AssignmentPath;
+import org.owasp.webgoat.lessons.AttackResult;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ *
+ * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
+ * @created October 28, 2003
+ */
+@AssignmentPath("/HttpBasics/intercept-request")
+public class HttpBasicsInterceptRequest extends AssignmentEndpoint {
+
+	@RequestMapping(method = RequestMethod.GET)
+	public @ResponseBody AttackResult completed(HttpServletRequest request) throws IOException {
+		if (request.getHeader("x-request-intercepted").toLowerCase().equals("true") && request.getParameter("changeMe").equals("Requests are tampered easily")) {
+            return trackProgress(AttackResult.success("Well done, you tampered the request as expected"));
+		} else {
+            return trackProgress(AttackResult.failed("Please try again. Make sure to make all the changes. And case sensitivity may matter ... or not, you never know!"));
+        }
+	}
+}

webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html

@@ -85,24 +85,4 @@
 		</div>
 	</div>
 
-	<div class="lesson-page-wrapper">
-		<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro1.adoc"></div>
-	</div>
-
-    <div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-        <!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-        <div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro2.adoc"></div>
-    </div>
-
-	<div class="lesson-page-wrapper">
-		<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro3.adoc"></div>
-	</div>
 </html>

webgoat-lessons/http-proxies/pom.xml

@@ -0,0 +1,12 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>http-proxies</artifactId>
+    <packaging>jar</packaging>
+    <parent>
+        <groupId>org.owasp.webgoat.lesson</groupId>
+        <artifactId>webgoat-lessons-parent</artifactId>
+        <version>8.0-SNAPSHOT</version>
+    </parent>
+
+</project>

webgoat-lessons/http-proxies/src/main/java/org/owasp/webgoat/plugin/HttpBasicsInterceptRequest.java

@@ -0,0 +1,59 @@
+package org.owasp.webgoat.plugin;
+
+import org.owasp.webgoat.endpoints.AssignmentEndpoint;
+import org.owasp.webgoat.endpoints.AssignmentHints;
+import org.owasp.webgoat.endpoints.AssignmentPath;
+import org.owasp.webgoat.lessons.AttackResult;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
+ * for free software projects.
+ *
+ * For details, please see http://webgoat.github.io
+ *
+ * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
+ * @created October 28, 2003
+ */
+@AssignmentPath("/HttpProxies/intercept-request")
+public class HttpBasicsInterceptRequest extends AssignmentEndpoint {
+
+	@RequestMapping(method = RequestMethod.GET)
+	public @ResponseBody AttackResult completed(HttpServletRequest request) throws IOException {
+		if (request.getHeader("x-request-intercepted").toLowerCase().equals("true") && request.getParameter("changeMe").equals("Requests are tampered easily")) {
+            return trackProgress(AttackResult.success("Well done, you tampered the request as expected"));
+		} else {
+            return trackProgress(AttackResult.failed("Please try again. Make sure to make all the changes. And case sensitivity may matter ... or not, you never know!"));
+        }
+	}
+}

webgoat-lessons/http-proxies/src/main/java/org/owasp/webgoat/plugin/HttpProxies.java

@@ -0,0 +1,63 @@
+package org.owasp.webgoat.plugin;
+
+import com.beust.jcommander.internal.Lists;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.NewLesson;
+
+import java.util.List;
+
+/**
+ * ************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * <p>
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ * <p>
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * <p>
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * <p>
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * <p>
+ * Getting Source ==============
+ * <p>
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ * <p>
+ *
+ * @author WebGoat
+ * @version $Id: $Id
+ * @since October 12, 2016
+ */
+public class HttpProxies extends NewLesson {
+    @Override
+    public Category getDefaultCategory() {
+        return Category.GENERAL;
+    }
+
+    @Override
+    public List<String> getHints() {
+        return Lists.newArrayList();
+    }
+
+    @Override
+    public Integer getDefaultRanking() {
+        return 2;
+    }
+
+    @Override
+    public String getTitle() {
+        return "http-proxies.title";
+    }
+
+    @Override
+    public String getId() {
+        return "HttpProxies";
+    }
+}

webgoat-lessons/http-proxies/src/main/resources/plugin/HttpProxies/html/HttpProxies.html

@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+
+<html xmlns:th="http://www.thymeleaf.org">
+
+	<div class="lesson-page-wrapper">
+		<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+		<!-- include content here. Content will be presented via asciidocs files,
+        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+		<div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro1.adoc"></div>
+	</div>
+
+    <div class="lesson-page-wrapper">
+        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+        <!-- include content here. Content will be presented via asciidocs files,
+        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+        <div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro2.adoc"></div>
+    </div>
+
+	<div class="lesson-page-wrapper">
+		<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+		<!-- include content here. Content will be presented via asciidocs files,
+        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+		<div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntro3.adoc"></div>
+	</div>
+
+    <div class="lesson-page-wrapper">
+        <!-- stripped down without extra comments -->
+        <div class="adoc-content" th:replace="doc:HttpBasics_ProxyIntercept.adoc"></div>
+        <div class="attack-container">
+            <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+            <form class="attack-form" accept-charset="UNKNOWN" name="intercept-request"
+                  method="POST"
+                  action="/WebGoat/HttpBasics/intercept-request"
+                  enctype="application/json;charset=UTF-8">
+
+                <input type="text" value="doesn't matter really" name="changeMe" />
+                <input type="submit" value="Submit" />
+
+            </form>
+            <div class="attack-feedback"></div>
+            <div class="attack-output"></div>
+        </div>
+    </div>
+</html>