diff --git a/.gitignore b/.gitignore index 85cfca11..265163f3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,14 +1,199 @@ -# Project Files # -################# -*.userprefs -*.pidb -*swp -bin -obj -WebGoat/App_Data/*.txt -*.sqlite* -WebGoat/Configuration/*.config - -# Trash Files # -############### -.DS_Store +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. + +# User-specific files +*.suo +*.user +*.sln.docstates + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +x64/ +#build/ +bld/ +[Bb]in/ +[Oo]bj/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +#NUNIT +*.VisualState.xml +TestResult.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +*_i.c +*_p.c +*_i.h +*.ilk +*.meta +*.obj +*.pch +*.pdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opensdf +*.sdf +*.cachefile + +# Visual Studio profiler +*.psess +*.vsp +*.vspx + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +**/*.[Rr]e[Ss]harper +**/*.DotSettings.user +**/*.DotSettings + +# JustCode is a .NET coding addin-in +.JustCode + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# NCrunch +*.ncrunch* +_NCrunch_* +.*crunch*.local.xml + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml + +# NuGet Packages Directory +packages/ +## TODO: If the tool you use requires repositories.config uncomment the next line +#!packages/repositories.config + +# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets +# This line needs to be after the ignore of the build folder (and the packages folder if the line above has been uncommented) +!packages/build/ + +# Windows Azure Build Output +csx/ +*.build.csdef + +# Windows Store app package directory +AppPackages/ + +# Others +sql/ +*.Cache +ClientBin/ +[Ss]tyle[Cc]op.* +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.pfx +*.publishsettings +node_modules/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file to a newer +# Visual Studio version. Backup files are not needed, because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm + +# SQL Server files +*.mdf +*.ldf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings + +# Microsoft Fakes +FakesAssemblies/ + +# ========================= +# Windows detritus +# ========================= + +# Windows image file caches +Thumbs.db +ehthumbs.db + +# Folder config file +Desktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Project Files # +################# +WebGoat/App_Data/*.txt +*.sqlite* +WebGoat/Configuration/*.config + +# Trash Files # +############### +.DS_Store diff --git a/CSRF-Exploit.html b/CSRF-Exploit.html new file mode 100644 index 00000000..73129234 --- /dev/null +++ b/CSRF-Exploit.html @@ -0,0 +1,41 @@ + + + + + \ No newline at end of file diff --git a/WebGoat.NET.sln b/WebGoat.NET.sln index 89f8133c..e35e9644 100644 --- a/WebGoat.NET.sln +++ b/WebGoat.NET.sln @@ -1,6 +1,8 @@  -Microsoft Visual Studio Solution File, Format Version 11.00 -# Visual Studio 2010 +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.30110.0 +MinimumVisualStudioVersion = 10.0.40219.1 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WebGoat.NET", "WebGoat\WebGoat.NET.csproj", "{83B04441-0F79-4424-AAD0-46E0C3CDDAA1}" EndProject Global @@ -14,6 +16,9 @@ Global {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Release|Any CPU.ActiveCfg = Release|Any CPU {83B04441-0F79-4424-AAD0-46E0C3CDDAA1}.Release|Any CPU.Build.0 = Release|Any CPU EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection GlobalSection(MonoDevelopProperties) = preSolution StartupItem = WebGoat\WebGoat.NET.csproj Policies = $0 @@ -23,7 +28,7 @@ Global $0.StandardHeader = $2 $2.Text = $2.IncludeInNewFiles = True - $0.TextStylePolicy = $3 + $0.TextStylePolicy = $34 $3.inheritsSet = null $3.scope = text/x-csharp $0.CSharpFormattingPolicy = $4 @@ -46,28 +51,25 @@ Global $4.inheritsSet = Mono $4.inheritsScope = text/x-csharp $4.scope = text/x-csharp - $0.TextStylePolicy = $5 $5.FileWidth = 120 $5.inheritsSet = VisualStudio $5.inheritsScope = text/plain $5.scope = text/plain $0.NameConventionPolicy = $6 $6.Rules = $7 - $7.NamingRule = $8 + $7.NamingRule = $32 $8.Name = Namespaces $8.AffectedEntity = Namespace $8.VisibilityMask = VisibilityMask $8.NamingStyle = PascalCase $8.IncludeInstanceMembers = True $8.IncludeStaticEntities = True - $7.NamingRule = $9 $9.Name = Types $9.AffectedEntity = Class, Struct, Enum, Delegate $9.VisibilityMask = VisibilityMask $9.NamingStyle = PascalCase $9.IncludeInstanceMembers = True $9.IncludeStaticEntities = True - $7.NamingRule = $10 $10.Name = Interfaces $10.RequiredPrefixes = $11 $11.String = I @@ -76,7 +78,6 @@ Global $10.NamingStyle = PascalCase $10.IncludeInstanceMembers = True $10.IncludeStaticEntities = True - $7.NamingRule = $12 $12.Name = Attributes $12.RequiredSuffixes = $13 $13.String = Attribute @@ -85,7 +86,6 @@ Global $12.NamingStyle = PascalCase $12.IncludeInstanceMembers = True $12.IncludeStaticEntities = True - $7.NamingRule = $14 $14.Name = Event Arguments $14.RequiredSuffixes = $15 $15.String = EventArgs @@ -94,7 +94,6 @@ Global $14.NamingStyle = PascalCase $14.IncludeInstanceMembers = True $14.IncludeStaticEntities = True - $7.NamingRule = $16 $16.Name = Exceptions $16.RequiredSuffixes = $17 $17.String = Exception @@ -103,97 +102,82 @@ Global $16.NamingStyle = PascalCase $16.IncludeInstanceMembers = True $16.IncludeStaticEntities = True - $7.NamingRule = $18 $18.Name = Methods $18.AffectedEntity = Methods $18.VisibilityMask = VisibilityMask $18.NamingStyle = PascalCase $18.IncludeInstanceMembers = True $18.IncludeStaticEntities = True - $7.NamingRule = $19 $19.Name = Static Readonly Fields $19.AffectedEntity = ReadonlyField $19.VisibilityMask = Internal, Protected, Public $19.NamingStyle = PascalCase $19.IncludeInstanceMembers = False $19.IncludeStaticEntities = True - $7.NamingRule = $20 $20.Name = Fields (Non Private) $20.AffectedEntity = Field $20.VisibilityMask = Internal, Protected, Public $20.NamingStyle = PascalCase $20.IncludeInstanceMembers = True $20.IncludeStaticEntities = True - $7.NamingRule = $21 $21.Name = ReadOnly Fields (Non Private) $21.AffectedEntity = ReadonlyField $21.VisibilityMask = Internal, Protected, Public $21.NamingStyle = PascalCase $21.IncludeInstanceMembers = True $21.IncludeStaticEntities = False - $7.NamingRule = $22 $22.Name = Fields (Private) $22.AllowedPrefixes = $23 - $23.String = _ $23.String = m_ $22.AffectedEntity = Field, ReadonlyField $22.VisibilityMask = Private $22.NamingStyle = CamelCase $22.IncludeInstanceMembers = True $22.IncludeStaticEntities = False - $7.NamingRule = $24 $24.Name = Static Fields (Private) $24.AffectedEntity = Field $24.VisibilityMask = Private $24.NamingStyle = CamelCase $24.IncludeInstanceMembers = False $24.IncludeStaticEntities = True - $7.NamingRule = $25 $25.Name = ReadOnly Fields (Private) $25.AllowedPrefixes = $26 - $26.String = _ $26.String = m_ $25.AffectedEntity = ReadonlyField $25.VisibilityMask = Private $25.NamingStyle = CamelCase $25.IncludeInstanceMembers = True $25.IncludeStaticEntities = False - $7.NamingRule = $27 $27.Name = Constant Fields $27.AffectedEntity = ConstantField $27.VisibilityMask = VisibilityMask $27.NamingStyle = PascalCase $27.IncludeInstanceMembers = True $27.IncludeStaticEntities = True - $7.NamingRule = $28 $28.Name = Properties $28.AffectedEntity = Property $28.VisibilityMask = VisibilityMask $28.NamingStyle = PascalCase $28.IncludeInstanceMembers = True $28.IncludeStaticEntities = True - $7.NamingRule = $29 $29.Name = Events $29.AffectedEntity = Event $29.VisibilityMask = VisibilityMask $29.NamingStyle = PascalCase $29.IncludeInstanceMembers = True $29.IncludeStaticEntities = True - $7.NamingRule = $30 $30.Name = Enum Members $30.AffectedEntity = EnumMember $30.VisibilityMask = VisibilityMask $30.NamingStyle = PascalCase $30.IncludeInstanceMembers = True $30.IncludeStaticEntities = True - $7.NamingRule = $31 $31.Name = Parameters $31.AffectedEntity = Parameter $31.VisibilityMask = VisibilityMask $31.NamingStyle = CamelCase $31.IncludeInstanceMembers = True $31.IncludeStaticEntities = True - $7.NamingRule = $32 $32.Name = Type Parameters $32.RequiredPrefixes = $33 $33.String = T @@ -202,11 +186,7 @@ Global $32.NamingStyle = PascalCase $32.IncludeInstanceMembers = True $32.IncludeStaticEntities = True - $0.TextStylePolicy = $34 $34.inheritsSet = null $34.scope = application/x-ashx EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection EndGlobal diff --git a/WebGoat/App_Code/DB/DummyDbProvider.cs b/WebGoat/App_Code/DB/DummyDbProvider.cs index b3e58ad6..a99b1364 100644 --- a/WebGoat/App_Code/DB/DummyDbProvider.cs +++ b/WebGoat/App_Code/DB/DummyDbProvider.cs @@ -1,130 +1,144 @@ -using System; -using System.Data; - -namespace OWASP.WebGoat.NET.App_Code.DB -{ - public class DummyDbProvider : IDbProvider - { - - public bool TestConnection() - { - return true; - } - - public ConfigFile DbConfigFile - { - get; set; - } - - public DataSet GetCatalogData() - { - return null; - } - - public bool IsValidCustomerLogin(string email, string password) - { - return false; - } - - public bool RecreateGoatDb() - { - return false; - } - - public string GetCustomerEmail(string customerNumber) - { - return string.Empty; - } - - public DataSet GetCustomerDetails(string customerNumber) - { - return null; - } - - public DataSet GetOffice(string city) - { - return null; - } - - public DataSet GetComments(string productCode) - { - return null; - } - - public string AddComment(string productCode, string email, string comment) - { - return string.Empty; - } - - public string UpdateCustomerPassword(int customerNumber, string password) - { - return string.Empty; - } - - public string[] GetSecurityQuestionAndAnswer(string email) - { - return null; - } - - public string GetPasswordByEmail(string email) - { - return string.Empty; - } - - public DataSet GetUsers() - { - return null; - } - - public DataSet GetOrders(int customerID) - { - return null; - } - - public DataSet GetProductDetails(string productCode) - { - return null; - } - - public DataSet GetOrderDetails(int orderNumber) - { - return null; - } - - public DataSet GetPayments(int customerNumber) - { - return null; - } - - public DataSet GetProductsAndCategories() - { - return null; - } - - public DataSet GetProductsAndCategories(int catNumber) - { - return null; - } - - public DataSet GetEmailByName(string name) - { - return null; - } - - public string GetEmailByCustomerNumber(string num) - { - return string.Empty; - } - - public DataSet GetCustomerEmails(string email) - { - return null; - } - - public string Name - { - get { return "Dummy"; } - } - } -} - +using System.Data; + +namespace OWASP.WebGoat.NET.App_Code.DB +{ + public class DummyDbProvider : IDbProvider + { + + public bool TestConnection() + { + return true; + } + + public ConfigFile DbConfigFile + { + get; set; + } + + public DataSet GetCatalogData() + { + return null; + } + + public bool IsValidCustomerLogin(string email, string password) + { + return false; + } + + public bool IsAdminCustomerLogin(string email) + { + return false; + } + + public bool CreateCustomer(string name, string email, string password, bool isAdmin, int question, string answer) + { + return false; + } + + public bool RecreateGoatDb() + { + return false; + } + + public string GetCustomerEmail(string customerNumber) + { + return string.Empty; + } + + public DataSet GetCustomerDetails(string customerNumber) + { + return null; + } + + public DataSet GetOffice(string city) + { + return null; + } + + public DataSet GetMessages(string customerLogin) + { + return null; + } + + public DataSet GetComments(string productCode) + { + return null; + } + + public string AddComment(string productCode, string email, string comment) + { + return string.Empty; + } + + public string UpdateCustomerPassword(int customerNumber, string password) + { + return string.Empty; + } + + public string[] GetSecurityQuestionAndAnswer(string email) + { + return null; + } + + public string GetPasswordByEmail(string email) + { + return string.Empty; + } + + public DataSet GetUsers() + { + return null; + } + + public DataSet GetOrders(int customerID) + { + return null; + } + + public DataSet GetProductDetails(string productCode) + { + return null; + } + + public DataSet GetOrderDetails(int orderNumber) + { + return null; + } + + public DataSet GetPayments(int customerNumber) + { + return null; + } + + public DataSet GetProductsAndCategories() + { + return null; + } + + public DataSet GetProductsAndCategories(int catNumber) + { + return null; + } + + public DataSet GetEmailByName(string name) + { + return null; + } + + public string GetEmailByCustomerNumber(string num) + { + return string.Empty; + } + + public DataSet GetCustomerEmails(string email) + { + return null; + } + + public string Name + { + get { return "Dummy"; } + } + } +} + diff --git a/WebGoat/App_Code/DB/IDbProvider.cs b/WebGoat/App_Code/DB/IDbProvider.cs index cc9e4fdd..d44d122b 100644 --- a/WebGoat/App_Code/DB/IDbProvider.cs +++ b/WebGoat/App_Code/DB/IDbProvider.cs @@ -1,54 +1,60 @@ -using System; -using System.Data; - -namespace OWASP.WebGoat.NET.App_Code.DB -{ - public interface IDbProvider - { - string Name { get; } - - bool TestConnection(); - - DataSet GetCatalogData(); - - bool IsValidCustomerLogin(string email, string password); - - bool RecreateGoatDb(); - - string GetCustomerEmail(string customerNumber); - - DataSet GetCustomerDetails(string customerNumber); - - DataSet GetOffice(string city); - - DataSet GetComments(string productCode); - - string AddComment(string productCode, string email, string comment); - - string UpdateCustomerPassword(int customerNumber, string password); - - string[] GetSecurityQuestionAndAnswer(string email); - - string GetPasswordByEmail(string email); - - DataSet GetUsers(); - - DataSet GetOrders(int customerID); - - DataSet GetProductDetails(string productCode); - - DataSet GetOrderDetails(int orderNumber); - - DataSet GetPayments(int customerNumber); - - DataSet GetProductsAndCategories(); - - DataSet GetProductsAndCategories(int catNumber); - - DataSet GetEmailByName(string name); - - string GetEmailByCustomerNumber(string num); - - DataSet GetCustomerEmails(string email); - } +using System; +using System.Data; + +namespace OWASP.WebGoat.NET.App_Code.DB +{ + public interface IDbProvider + { + string Name { get; } + + bool TestConnection(); + + DataSet GetCatalogData(); + + bool IsValidCustomerLogin(string email, string password); + + bool IsAdminCustomerLogin(string email); + + bool CreateCustomer(string name, string email, string password, bool isAdmin, int question, string answer); + + bool RecreateGoatDb(); + + string GetCustomerEmail(string customerNumber); + + DataSet GetCustomerDetails(string customerNumber); + + DataSet GetOffice(string city); + + DataSet GetMessages(string customerLogin); + + DataSet GetComments(string productCode); + + string AddComment(string productCode, string email, string comment); + + string UpdateCustomerPassword(int customerNumber, string password); + + string[] GetSecurityQuestionAndAnswer(string email); + + string GetPasswordByEmail(string email); + + DataSet GetUsers(); + + DataSet GetOrders(int customerID); + + DataSet GetProductDetails(string productCode); + + DataSet GetOrderDetails(int orderNumber); + + DataSet GetPayments(int customerNumber); + + DataSet GetProductsAndCategories(); + + DataSet GetProductsAndCategories(int catNumber); + + DataSet GetEmailByName(string name); + + string GetEmailByCustomerNumber(string num); + + DataSet GetCustomerEmails(string email); + } } \ No newline at end of file diff --git a/WebGoat/App_Code/DB/MySqlDbProvider.cs b/WebGoat/App_Code/DB/MySqlDbProvider.cs index 0bc79812..253ba26c 100644 --- a/WebGoat/App_Code/DB/MySqlDbProvider.cs +++ b/WebGoat/App_Code/DB/MySqlDbProvider.cs @@ -24,8 +24,11 @@ public class MySqlDbProvider : IDbProvider public MySqlDbProvider(ConfigFile configFile) { if (configFile == null) + { _connectionString = string.Empty; - + return; + } + if (!string.IsNullOrEmpty(configFile.Get(DbConstants.KEY_PWD))) { _connectionString = string.Format("SERVER={0};PORT={1};DATABASE={2};UID={3};PWD={4}", @@ -90,6 +93,16 @@ public DataSet GetCatalogData() } } + public bool IsAdminCustomerLogin(string email) + { + throw new NotImplementedException(); + } + + public bool CreateCustomer(string name, string email, string password, bool isAdmin, int question, string answer) + { + throw new NotImplementedException(); + } + public bool RecreateGoatDb() { string args; @@ -254,6 +267,11 @@ public DataSet GetOffice(string city) } } + public DataSet GetMessages(string customerLogin) + { + throw new NotImplementedException(); + } + public DataSet GetComments(string productCode) { diff --git a/WebGoat/App_Code/DB/SqliteDbProvider.cs b/WebGoat/App_Code/DB/SqliteDbProvider.cs index 0e88a6d8..9546e5c5 100644 --- a/WebGoat/App_Code/DB/SqliteDbProvider.cs +++ b/WebGoat/App_Code/DB/SqliteDbProvider.cs @@ -1,11 +1,9 @@ using System; using System.Data; -using Mono.Data.Sqlite; -using log4net; -using System.Reflection; using System.IO; -using System.Diagnostics; -using System.Threading; +using System.Reflection; +using log4net; +using Mono.Data.Sqlite; namespace OWASP.WebGoat.NET.App_Code.DB { @@ -92,7 +90,7 @@ public bool IsValidCustomerLogin(string email, string password) try { - return ds.Tables[0].Rows.Count == 0; + return ds.Tables[0].Rows.Count != 0; } catch (Exception ex) { @@ -104,6 +102,63 @@ public bool IsValidCustomerLogin(string email, string password) } } + public bool IsAdminCustomerLogin(string email) + { + using (var connection = new SqliteConnection(_connectionString)) + { + connection.Open(); + var command = new SqliteCommand( + "SELECT is_admin FROM CustomerLogin where email = @email", + connection); + command.Parameters.AddWithValue("@email", email); + var result = (long?)command.ExecuteScalar(); + return result.HasValue && result.Value == 1; + } + } + + public bool CreateCustomer(string name, string email, string password, bool isAdmin, int question, string answer) + { + using (var connection = new SqliteConnection(_connectionString)) + { + connection.Open(); + var da = new SqliteDataAdapter( + "SELECT email FROM CustomerLogin WHERE email = '" + email + "'", + connection); + var ds = new DataSet(); + da.Fill(ds); + if (ds.Tables[0].Rows.Count != 0) + { + return false; + } + + var insertCustomerCommand = new SqliteCommand( + "INSERT INTO Customers " + + "(customerName, logoFileName, contactLastName, contactFirstName, phone, addressLine1, addressLine2, city, state, postalCode, country, salesRepEmployeeNumber, creditLimit) " + + "VALUES (@name, '', '', '', '', '', '', '', '', '', '', '', '')", + connection); + insertCustomerCommand.Parameters.AddWithValue("@name", name); + insertCustomerCommand.ExecuteNonQuery(); + + var lastInsertRowidCommand = new SqliteCommand("SELECT last_insert_rowid()", connection); + var id = (long)lastInsertRowidCommand.ExecuteScalar(); + + var insertCustomerLogin = new SqliteCommand( + "INSERT INTO CustomerLogin " + + "(email, customerNumber, password, question_id, answer, is_admin) " + + "VALUES (@email, @id, @password, @question, @answer, @is_admin)", + connection); + insertCustomerLogin.Parameters.AddWithValue("@email", email); + insertCustomerLogin.Parameters.AddWithValue("@id", id); + insertCustomerLogin.Parameters.AddWithValue("@password", Encoder.Encode(password)); + insertCustomerLogin.Parameters.AddWithValue("@question", question); + insertCustomerLogin.Parameters.AddWithValue("@answer", answer); + insertCustomerLogin.Parameters.AddWithValue("@is_admin", isAdmin ? 1 : 0); + insertCustomerLogin.ExecuteNonQuery(); + + return true; + } + } + public bool RecreateGoatDb() { try @@ -245,6 +300,24 @@ public DataSet GetOffice(string city) } } + public DataSet GetMessages(string customerLogin) + { + using (SqliteConnection connection = new SqliteConnection(_connectionString)) + { + connection.Open(); + + string sql = "SELECT Messages.id, Messages.title, Messages.text " + + "FROM Messages " + + "INNER JOIN CustomerLogin ON CustomerLogin.customerNumber = Messages.customerId " + + "WHERE (CustomerLogin.email = @login)"; + SqliteDataAdapter da = new SqliteDataAdapter(sql, connection); + da.SelectCommand.Parameters.AddWithValue("@login", customerLogin); + DataSet ds = new DataSet(); + da.Fill(ds); + return ds; + } + } + public DataSet GetComments(string productCode) { using (SqliteConnection connection = new SqliteConnection(_connectionString)) diff --git a/WebGoat/App_Data/webgoat_coins.sqlite b/WebGoat/App_Data/webgoat_coins.sqlite new file mode 100644 index 00000000..624c1526 Binary files /dev/null and b/WebGoat/App_Data/webgoat_coins.sqlite differ diff --git a/WebGoat/Configuration/Default.config b/WebGoat/Configuration/Default.config index 3ed7cdc3..3dd20920 100644 --- a/WebGoat/Configuration/Default.config +++ b/WebGoat/Configuration/Default.config @@ -1 +1,2 @@ -dbtype=MySql \ No newline at end of file +dbtype=Sqlite +filename=\WebGoat\App_Data\webgoat_coins.sqlite diff --git a/WebGoat/Content/DomXSS.aspx b/WebGoat/Content/DomXSS.aspx index 2a13ae43..c5f79359 100644 --- a/WebGoat/Content/DomXSS.aspx +++ b/WebGoat/Content/DomXSS.aspx @@ -1,5 +1,46 @@ -<%@ Page Title="" Language="C#" MasterPageFile="~/Resources/Master-Pages/Site.Master" AutoEventWireup="true" CodeBehind="DomXSS.aspx.cs" Inherits="OWASP.WebGoat.NET.DomXSS" %> +<%@ Page Language="C#" MasterPageFile="~/Resources/Master-Pages/SiteNew.Master" AutoEventWireup="true" CodeBehind="DomXSS.aspx.cs" Inherits="OWASP.WebGoat.NET.DomXSS" %> + + + + +
+ + +
+

Murphy’s Law I

+

If that guy has any way of making a mistake, he will.

+
+
+

Murphy’s Law II

+

Everything takes longer than you think.

+
+
+

Smith's Law

+

Murphy was an optimist.

+
+
diff --git a/WebGoat/Content/DomXSS.aspx.cs b/WebGoat/Content/DomXSS.aspx.cs index f1d63ba3..5b01299c 100644 --- a/WebGoat/Content/DomXSS.aspx.cs +++ b/WebGoat/Content/DomXSS.aspx.cs @@ -1,13 +1,9 @@ using System; -using System.Collections.Generic; -using System.Linq; -using System.Web; using System.Web.UI; -using System.Web.UI.WebControls; namespace OWASP.WebGoat.NET { - public partial class DomXSS : System.Web.UI.Page + public partial class DomXSS : Page { protected void Page_Load(object sender, EventArgs e) { diff --git a/WebGoat/Content/DomXSS.aspx.designer.cs b/WebGoat/Content/DomXSS.aspx.designer.cs index 14014008..ec01c695 100644 --- a/WebGoat/Content/DomXSS.aspx.designer.cs +++ b/WebGoat/Content/DomXSS.aspx.designer.cs @@ -1,20 +1,15 @@ -// ------------------------------------------------------------------------------ -// -// This code was generated by a tool. -// Mono Runtime Version: 4.0.30319.1 -// -// Changes to this file may cause incorrect behavior and will be lost if -// the code is regenerated. -// -// ------------------------------------------------------------------------------ - -namespace OWASP.WebGoat.NET { - - - public partial class DomXSS { - - protected System.Web.UI.WebControls.Content Content1; - - protected System.Web.UI.WebControls.Content Content2; - } -} +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace OWASP.WebGoat.NET { + + + public partial class DomXSS { + } +} diff --git a/WebGoat/Content/EFSQLInjection.aspx b/WebGoat/Content/EFSQLInjection.aspx new file mode 100644 index 00000000..95c1a1bc --- /dev/null +++ b/WebGoat/Content/EFSQLInjection.aspx @@ -0,0 +1,55 @@ +<%@ Page Language="C#" MasterPageFile="~/Resources/Master-Pages/Site.Master" AutoEventWireup="true" CodeBehind="EFSQLInjection.aspx.cs" Inherits="OWASP.WebGoat.NET.Content.EFSQLInjection" %> + + + + + + + + +

+ Employee Email +

+ Are you looking to contact one of our employees?  Use this form to find + their email quickly!
+
+ Enter the office code of employer (e.g. 1 or 7):
+

+ + + + + + +
Code: + + + + + + +
+

+

+ +

+
+

+ +

+

+ + +

+
+ + + diff --git a/WebGoat/Content/EFSQLInjection.aspx.cs b/WebGoat/Content/EFSQLInjection.aspx.cs new file mode 100644 index 00000000..5bec75c0 --- /dev/null +++ b/WebGoat/Content/EFSQLInjection.aspx.cs @@ -0,0 +1,34 @@ +using System; +using System.Linq; +using System.Web; +using System.Web.UI; +using OWASP.WebGoat.NET.Entities; + +namespace OWASP.WebGoat.NET.Content +{ + public partial class EFSQLInjection : Page + { + protected void Page_Load(object sender, EventArgs e) + { + + } + + protected void btnFind_Click(object sender, EventArgs e) + { + using (var db = new CoinsDB()) + { + var code = txtOfficeCode.Text; + var output = db.Database + .SqlQuery("SELECT email FROM Employees " + + "WHERE officeCode = {0}", + code) + .ToArray(); + + lblOutput.Text = output.Length == 0 + ? "Not found email" + : String.Join("
", output); + } + + } + } +} \ No newline at end of file diff --git a/WebGoat/Content/EFSQLInjection.aspx.designer.cs b/WebGoat/Content/EFSQLInjection.aspx.designer.cs new file mode 100644 index 00000000..4106d53a --- /dev/null +++ b/WebGoat/Content/EFSQLInjection.aspx.designer.cs @@ -0,0 +1,60 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace OWASP.WebGoat.NET.Content { + + + public partial class EFSQLInjection { + + /// + /// txtOfficeCode control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.TextBox txtOfficeCode; + + /// + /// ddlOrder control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.DropDownList ddlOrder; + + /// + /// btnFind control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.Button btnFind; + + /// + /// lblOutput control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.Label lblOutput; + + /// + /// grdEmail control. + /// + /// + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// + protected global::System.Web.UI.WebControls.GridView grdEmail; + } +} diff --git a/WebGoat/Entities/Categories.cs b/WebGoat/Entities/Categories.cs new file mode 100644 index 00000000..94f7aa37 --- /dev/null +++ b/WebGoat/Entities/Categories.cs @@ -0,0 +1,20 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Categories + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long catNumber { get; set; } + + [Required] + [StringLength(50)] + public string catName { get; set; } + + [Required] + [StringLength(2147483647)] + public string catDesc { get; set; } + } +} diff --git a/WebGoat/Entities/CoinsDB.cs b/WebGoat/Entities/CoinsDB.cs new file mode 100644 index 00000000..0f3ca4be --- /dev/null +++ b/WebGoat/Entities/CoinsDB.cs @@ -0,0 +1,203 @@ +using System.Data.Entity; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class CoinsDB : DbContext + { + public CoinsDB() + : base("name=CoinsDB") + { + } + + public virtual DbSet Categories { get; set; } + public virtual DbSet Comments { get; set; } + public virtual DbSet CustomerLogin { get; set; } + public virtual DbSet Customers { get; set; } + public virtual DbSet Employees { get; set; } + public virtual DbSet Offices { get; set; } + public virtual DbSet OrderDetails { get; set; } + public virtual DbSet Orders { get; set; } + public virtual DbSet Payments { get; set; } + public virtual DbSet Products { get; set; } + public virtual DbSet SecurityQuestions { get; set; } + + protected override void OnModelCreating(DbModelBuilder modelBuilder) + { + modelBuilder.Entity() + .Property(e => e.catName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.email) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.email) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.password) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.answer) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.customerName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.logoFileName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.contactLastName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.contactFirstName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.phone) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.addressLine1) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.addressLine2) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.city) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.state) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.postalCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.country) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.lastName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.firstName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.extension) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.email) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.officeCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.jobTitle) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.officeCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.city) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.phone) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.addressLine1) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.addressLine2) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.state) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.country) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.postalCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.territory) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.status) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.cardType) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.creditCardNumber) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.cardExpirationMonth) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.cardExpirationYear) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.confirmationCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productCode) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productName) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productImage) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.productVendor) + .IsUnicode(false); + + modelBuilder.Entity() + .Property(e => e.question_text) + .IsUnicode(false); + } + } +} diff --git a/WebGoat/Entities/Comments.cs b/WebGoat/Entities/Comments.cs new file mode 100644 index 00000000..5f759f66 --- /dev/null +++ b/WebGoat/Entities/Comments.cs @@ -0,0 +1,24 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Comments + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long commentNumber { get; set; } + + [Required] + [StringLength(15)] + public string productCode { get; set; } + + [Required] + [StringLength(100)] + public string email { get; set; } + + [Required] + [StringLength(2147483647)] + public string comment { get; set; } + } +} diff --git a/WebGoat/Entities/CustomerLogin.cs b/WebGoat/Entities/CustomerLogin.cs new file mode 100644 index 00000000..fdcaac8c --- /dev/null +++ b/WebGoat/Entities/CustomerLogin.cs @@ -0,0 +1,24 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + [Table("CustomerLogin")] + public partial class CustomerLogin + { + [Key] + [StringLength(100)] + public string email { get; set; } + + public long customerNumber { get; set; } + + [Required] + [StringLength(40)] + public string password { get; set; } + + public short? question_id { get; set; } + + [StringLength(50)] + public string answer { get; set; } + } +} diff --git a/WebGoat/Entities/Customers.cs b/WebGoat/Entities/Customers.cs new file mode 100644 index 00000000..7dd094ab --- /dev/null +++ b/WebGoat/Entities/Customers.cs @@ -0,0 +1,57 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Customers + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long customerNumber { get; set; } + + [Required] + [StringLength(50)] + public string customerName { get; set; } + + [StringLength(100)] + public string logoFileName { get; set; } + + [Required] + [StringLength(50)] + public string contactLastName { get; set; } + + [Required] + [StringLength(50)] + public string contactFirstName { get; set; } + + [Required] + [StringLength(50)] + public string phone { get; set; } + + [Required] + [StringLength(50)] + public string addressLine1 { get; set; } + + [StringLength(50)] + public string addressLine2 { get; set; } + + [Required] + [StringLength(50)] + public string city { get; set; } + + [StringLength(50)] + public string state { get; set; } + + [StringLength(15)] + public string postalCode { get; set; } + + [Required] + [StringLength(50)] + public string country { get; set; } + + public long? salesRepEmployeeNumber { get; set; } + + [Column(TypeName = "real")] + public double? creditLimit { get; set; } + } +} diff --git a/WebGoat/Entities/Employees.cs b/WebGoat/Entities/Employees.cs new file mode 100644 index 00000000..7349d3df --- /dev/null +++ b/WebGoat/Entities/Employees.cs @@ -0,0 +1,38 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Employees + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long employeeNumber { get; set; } + + [Required] + [StringLength(50)] + public string lastName { get; set; } + + [Required] + [StringLength(50)] + public string firstName { get; set; } + + [Required] + [StringLength(10)] + public string extension { get; set; } + + [Required] + [StringLength(100)] + public string email { get; set; } + + [Required] + [StringLength(10)] + public string officeCode { get; set; } + + public long? reportsTo { get; set; } + + [Required] + [StringLength(50)] + public string jobTitle { get; set; } + } +} diff --git a/WebGoat/Entities/Offices.cs b/WebGoat/Entities/Offices.cs new file mode 100644 index 00000000..8a36870c --- /dev/null +++ b/WebGoat/Entities/Offices.cs @@ -0,0 +1,41 @@ +using System.ComponentModel.DataAnnotations; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Offices + { + [Key] + [StringLength(10)] + public string officeCode { get; set; } + + [Required] + [StringLength(50)] + public string city { get; set; } + + [Required] + [StringLength(50)] + public string phone { get; set; } + + [Required] + [StringLength(50)] + public string addressLine1 { get; set; } + + [StringLength(50)] + public string addressLine2 { get; set; } + + [StringLength(50)] + public string state { get; set; } + + [Required] + [StringLength(50)] + public string country { get; set; } + + [Required] + [StringLength(15)] + public string postalCode { get; set; } + + [Required] + [StringLength(10)] + public string territory { get; set; } + } +} diff --git a/WebGoat/Entities/OrderDetails.cs b/WebGoat/Entities/OrderDetails.cs new file mode 100644 index 00000000..364edbbb --- /dev/null +++ b/WebGoat/Entities/OrderDetails.cs @@ -0,0 +1,25 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class OrderDetails + { + [Key] + [Column(Order = 0)] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long orderNumber { get; set; } + + [Key] + [Column(Order = 1)] + [StringLength(15)] + public string productCode { get; set; } + + public long quantityOrdered { get; set; } + + [Column(TypeName = "real")] + public double priceEach { get; set; } + + public short orderLineNumber { get; set; } + } +} diff --git a/WebGoat/Entities/Orders.cs b/WebGoat/Entities/Orders.cs new file mode 100644 index 00000000..bf68afe8 --- /dev/null +++ b/WebGoat/Entities/Orders.cs @@ -0,0 +1,28 @@ +using System; +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Orders + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long orderNumber { get; set; } + + public DateTime orderDate { get; set; } + + public DateTime requiredDate { get; set; } + + public DateTime? shippedDate { get; set; } + + [Required] + [StringLength(15)] + public string status { get; set; } + + [StringLength(2147483647)] + public string comments { get; set; } + + public long customerNumber { get; set; } + } +} diff --git a/WebGoat/Entities/Payments.cs b/WebGoat/Entities/Payments.cs new file mode 100644 index 00000000..a4e673ac --- /dev/null +++ b/WebGoat/Entities/Payments.cs @@ -0,0 +1,42 @@ +using System; +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Payments + { + [Key] + [Column(Order = 0)] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public long customerNumber { get; set; } + + [Required] + [StringLength(50)] + public string cardType { get; set; } + + [Required] + [StringLength(50)] + public string creditCardNumber { get; set; } + + public short verificationCode { get; set; } + + [Required] + [StringLength(3)] + public string cardExpirationMonth { get; set; } + + [Required] + [StringLength(5)] + public string cardExpirationYear { get; set; } + + [Key] + [Column(Order = 1)] + [StringLength(50)] + public string confirmationCode { get; set; } + + public DateTime paymentDate { get; set; } + + [Column(TypeName = "real")] + public double amount { get; set; } + } +} diff --git a/WebGoat/Entities/Products.cs b/WebGoat/Entities/Products.cs new file mode 100644 index 00000000..7fa1958e --- /dev/null +++ b/WebGoat/Entities/Products.cs @@ -0,0 +1,38 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class Products + { + [Key] + [StringLength(15)] + public string productCode { get; set; } + + [Required] + [StringLength(200)] + public string productName { get; set; } + + public long catNumber { get; set; } + + [Required] + [StringLength(100)] + public string productImage { get; set; } + + [Required] + [StringLength(50)] + public string productVendor { get; set; } + + [Required] + [StringLength(2147483647)] + public string productDescription { get; set; } + + public short quantityInStock { get; set; } + + [Column(TypeName = "real")] + public double buyPrice { get; set; } + + [Column(TypeName = "real")] + public double MSRP { get; set; } + } +} diff --git a/WebGoat/Entities/SecurityQuestions.cs b/WebGoat/Entities/SecurityQuestions.cs new file mode 100644 index 00000000..561a0583 --- /dev/null +++ b/WebGoat/Entities/SecurityQuestions.cs @@ -0,0 +1,16 @@ +using System.ComponentModel.DataAnnotations; +using System.ComponentModel.DataAnnotations.Schema; + +namespace OWASP.WebGoat.NET.Entities +{ + public partial class SecurityQuestions + { + [Key] + [DatabaseGenerated(DatabaseGeneratedOption.None)] + public short question_id { get; set; } + + [Required] + [StringLength(400)] + public string question_text { get; set; } + } +} diff --git a/WebGoat/Resources/Master-Pages/Site.Master b/WebGoat/Resources/Master-Pages/Site.Master index 2296b426..fc39fb95 100644 --- a/WebGoat/Resources/Master-Pages/Site.Master +++ b/WebGoat/Resources/Master-Pages/Site.Master @@ -3,8 +3,9 @@ - - + + + WebGoat.NET @@ -13,14 +14,14 @@ - + @@ -32,22 +33,22 @@ + $( "#dialog_link" ).click(function() { + $( "#dialog" ).dialog( "open" ); + return false; + }); + + + }); +
@@ -59,6 +60,9 @@ Welcome + + <%=IsAdmin ? "(admin role)" : "(user role)" %> + | @@ -104,7 +108,7 @@ <%-- original "> - <%# Eval("Title") %> + <%# Eval("Title") %> --%> @@ -130,7 +134,7 @@
- +