Skip to content

Commit 5de2baf

Browse files
author
Owen Jones
committed
Script for installing and analysing WebGoat
Includes some fixes to the readme for WebGoat. The script must be run with the SECURITY_SCANNER_HOME environment variable set to the path of the cmake directory that should be used, e.g. the path to cmake-build-relDebugWithInfo .
1 parent 7b6f678 commit 5de2baf

File tree

5 files changed

+401
-15
lines changed

5 files changed

+401
-15
lines changed

‎benchmarks/GENUINE/README.txt

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,10 @@ Install guide for Ubuntu:
3434

3535
1. git clone [email protected]:WebGoat/WebGoat.git
3636
2. cd WebGoat
37-
3. git checkout develop
38-
4. Add handling of exception 'SQLException' to the method 'completed' in file:
39-
/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
40-
So, the updated should be line 34 and it should look like this:
41-
public AttackResult completed(@RequestParam String ip) throws SQLException {
42-
5. mvn clean install -DskipTests
43-
6. Create the following files representing the entry point to WebGoat:
44-
./WebGoat/__MAIN__/src/main/java/Main.java:
37+
3. git checkout a922c00
38+
4. mvn clean install -DskipTests
39+
5. Create the following files representing the entry point to WebGoat:
40+
./__MAIN__/src/main/java/Main.java:
4541
/*
4642
Lessons considered in this file:
4743
[Sql Injection] Assignment6, registerNewUser
@@ -281,7 +277,7 @@ Install guide for Ubuntu:
281277

282278
Uncomment one of the blocks (depending on what lesson you want to analyse).
283279

284-
./WebGoat/__MAIN__/pom.xml:
280+
./__MAIN__/pom.xml:
285281
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
286282
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
287283
<modelVersion>4.0.0</modelVersion>
@@ -348,7 +344,7 @@ Install guide for Ubuntu:
348344
</dependencies>
349345
</project>
350346

351-
./WebGoat/__MAIN__/build.py:
347+
./__MAIN__/build.py:
352348
import os
353349
import shutil
354350

@@ -359,12 +355,13 @@ Install guide for Ubuntu:
359355
shutil.rmtree("./target/classes/org")
360356
if os.path.isfile("./target/__MAIN__-8.0.0.M3.jar"):
361357
os.remove("./target/__MAIN__-8.0.0.M3.jar")
362-
363-
6. cd __MAIN__
364-
7. python3 ./build.py
365-
8. cd ..
358+
359+
6. copy ../../LIBRARIES/models/model/src/main/java/org to ./__MAIN__/src/main/java/
360+
7. cd __MAIN__
361+
8. python3 ./build.py
366362
9. cd ..
367-
10. rm -rf ./webgoat-container
363+
10. cd ..
364+
11. rm -rf ./webgoat-container
368365

369366
The WebGoat does not seem to have a deployment step. Fortunately, the whole
370367
app is relatively small, so we can load everything for each lesson. It means

‎benchmarks/GENUINE/WebGoat.sh

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
#!/usr/bin/env bash
2+
3+
if [ -z "$SECURITY_SCANNER_HOME" ]; then
4+
echo "Need to set SECURITY_SCANNER_HOME to cmake directory"
5+
exit 1
6+
fi
7+
8+
set -u
9+
set -x
10+
11+
# 1. git clone [email protected]:WebGoat/WebGoat.git
12+
git clone [email protected]:WebGoat/WebGoat.git
13+
14+
# 2. cd WebGoat
15+
cd WebGoat
16+
17+
# 3. git checkout develop
18+
git checkout a922c00
19+
20+
# 4. mvn clean install -DskipTests
21+
mvn clean install -DskipTests
22+
23+
# 5. Create the following files representing the entry point to WebGoat:
24+
mkdir -p __MAIN__/src/main/java
25+
cp ../WebGoat_sh_files/Main.java __MAIN__/src/main/java/Main.java
26+
cp ../WebGoat_sh_files/pom.xml __MAIN__/pom.xml
27+
28+
# 6. copy ../../LIBRARIES/models/model/src/main/java/org to ./__MAIN__/src/main/java/
29+
cp -r ../../LIBRARIES/models/model/src/main/java/org __MAIN__/src/main/java/
30+
31+
# 7. cd __MAIN__
32+
cd __MAIN__
33+
34+
# 8. python3 ./build.py
35+
if [ -d "./target" ]; then
36+
rm -rf ./target
37+
fi
38+
mvn clean package
39+
if [ -d "./target/classes/org" ]; then
40+
rm -rf ./target/classes/org
41+
fi
42+
if [ -e "./target/__MAIN__-8.0.0.M3.jar" ]; then
43+
rm ./target/__MAIN__-8.0.0.M3.jar
44+
fi
45+
46+
# 9. cd ..
47+
# 10. cd ..
48+
# 11. rm -rf ./webgoat-container
49+
rm -rf ../../webgoat-container
50+
51+
# Build and install security-analyser
52+
cd ../../../../
53+
54+
(cd $SECURITY_SCANNER_HOME && make install)
55+
56+
# Run security-analyser on each lesson separately
57+
cd dist
58+
59+
# [Sql Injection]
60+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SqlInjectionLesson5a/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SqlInjectionLesson5a
61+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SqlInjectionLesson5b/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SqlInjectionLesson5b
62+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SqlInjectionLesson6a/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SqlInjectionLesson6a
63+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SqlInjectionLesson12a/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SqlInjectionLesson12a
64+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SqlInjectionChallenge/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SqlInjectionChallenge
65+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/Assignment5/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.Assignment5
66+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/Assignment6/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.Assignment6
67+
68+
# [XSS]
69+
# python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/CrossSiteScriptingLesson5a/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.CrossSiteScriptingLesson5a
70+
71+
# [XXE]
72+
# python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/Assignment3/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.Assignment3
73+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/SimpleXXE/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.SimpleXXE
74+
# python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/ContentTypeAssignment/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.ContentTypeAssignment
75+
python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/BlindSendFileAssignment/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.BlindSendFileAssignment
76+
77+
# [Remaining]
78+
79+
# python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/VulnerableComponentsLesson/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.VulnerableComponentsLesson
80+
# python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/MissingFunctionACUsers/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.MissingFunctionACUsers

‎benchmarks/GENUINE/WebGoat_sh_files/Main.java

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
/*
2+
Lessons considered in this file:
3+
[Sql Injection] Assignment6, registerNewUser
4+
[Sql Injection] Assignment5, login
5+
[Sql Injection] SqlInjectionLesson12a, completed
6+
[Sql Injection] SqlInjectionLesson5a, completed
7+
[Sql Injection] SqlInjectionLesson5b, completed
8+
[Sql Injection] SqlInjectionLesson6a, completed
9+
[Sql Injection] SqlInjectionChallenge, registerNewUser
10+
11+
[XXE] Assignment3, createNewComment
12+
[XXE] SimpleXXE, createNewComment
13+
[XXE] ContentTypeAssignment, createNewUser
14+
[XXE] BlindSendFileAssignment, addComment
15+
16+
[XSS] CrossSiteScriptingLesson5a, completed
17+
18+
[Insecure Deserialization] VulnerableComponentsLesson, completed
19+
20+
[Sensitive Data Exposure] MissingFunctionACUsers, usersService
21+
22+
[Email Redirection] Assignment7, sendPasswordResetLink
23+
[Email Redirection] Assignment9, sendPasswordResetLink
24+
*/
25+
26+
import javax.servlet.http.HttpServletRequest;
27+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5a;
28+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5b;
29+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson6a;
30+
import org.owasp.webgoat.plugin.mitigation.SqlInjectionLesson12a;
31+
import org.owasp.webgoat.plugin.advanced.SqlInjectionChallenge;
32+
import org.owasp.webgoat.plugin.challenge5.challenge6.Assignment5;
33+
import org.owasp.webgoat.plugin.challenge6.Assignment6;
34+
import org.owasp.webgoat.plugin.CrossSiteScriptingLesson5a;
35+
import org.owasp.webgoat.plugin.challenge3.Assignment3;
36+
import org.owasp.webgoat.plugin.SimpleXXE;
37+
import org.owasp.webgoat.plugin.ContentTypeAssignment;
38+
import org.owasp.webgoat.plugin.BlindSendFileAssignment;
39+
import org.owasp.webgoat.plugin.VulnerableComponentsLesson;
40+
import org.owasp.webgoat.plugin.MissingFunctionACUsers;
41+
import org.cprover.CProver;
42+
43+
public class Main {
44+
45+
static String makeTainted(String accountName) {
46+
return accountName;
47+
}
48+
49+
public static void main(String[] args) {
50+
// [Sql Injection]
51+
52+
SqlInjectionLesson5a(args);
53+
SqlInjectionLesson5b(args);
54+
SqlInjectionLesson6a(args);
55+
SqlInjectionLesson12a(args);
56+
SqlInjectionChallenge(args);
57+
Assignment5(args);
58+
Assignment6(args);
59+
60+
// [XSS]
61+
62+
// CrossSiteScriptingLesson5a(args);
63+
64+
// [XXE]
65+
66+
// Assignment3(args);
67+
SimpleXXE(args);
68+
// ContentTypeAssignment(args);
69+
BlindSendFileAssignment(args);
70+
71+
// [Remaining]
72+
73+
// VulnerableComponentsLesson(args);
74+
// MissingFunctionACUsers(args);
75+
}
76+
77+
public static void SqlInjectionLesson5a(String[] args) {
78+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
79+
String test = makeTainted("dave");
80+
SqlInjectionLesson5a obj = CProver.nondetWithNull();
81+
obj.completed(test);
82+
}
83+
84+
public static void SqlInjectionLesson5b(String[] args) {
85+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
86+
String test = makeTainted("dave");
87+
SqlInjectionLesson5b obj = CProver.nondetWithNull();
88+
try {
89+
obj.completed(test, null);
90+
}
91+
catch(java.io.IOException e) {
92+
}
93+
}
94+
95+
public static void SqlInjectionLesson6a(String[] args) {
96+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6a.java
97+
String test = makeTainted(args[0]);
98+
SqlInjectionLesson6a obj = CProver.nondetWithNull();
99+
try {
100+
obj.completed(test);
101+
}
102+
catch(java.io.IOException e) {
103+
}
104+
}
105+
106+
public static void SqlInjectionLesson12a(String[] args) {
107+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
108+
String arg0 = makeTainted(args[0]);
109+
SqlInjectionLesson12a obj = CProver.nondetWithNull();
110+
try {
111+
obj.completed(arg0);
112+
}
113+
catch(Exception e) {
114+
}
115+
}
116+
117+
public static void SqlInjectionChallenge(String[] args) {
118+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
119+
String arg0 = makeTainted(args[0]);
120+
String arg1 = makeTainted(args[1]);
121+
String arg2 = makeTainted(args[2]);
122+
SqlInjectionChallenge obj = CProver.nondetWithNull();
123+
try {
124+
obj.registerNewUser(arg0, arg1, arg2);
125+
}
126+
catch(Exception e) {
127+
}
128+
}
129+
130+
public static void Assignment5(String[] args) {
131+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge5/challenge6/Assignment5.java
132+
String arg0 = makeTainted(args[0]);
133+
String arg1 = makeTainted(args[1]);
134+
Assignment5 obj = CProver.nondetWithNull();
135+
try {
136+
obj.login(arg0, arg1);
137+
}
138+
catch(Exception e) {
139+
}
140+
}
141+
142+
public static void Assignment6(String[] args) {
143+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge6/Assignment6.java
144+
String arg0 = makeTainted(args[0]);
145+
String arg1 = makeTainted(args[1]);
146+
String arg2 = makeTainted(args[2]);
147+
Assignment6 obj = CProver.nondetWithNull();
148+
try {
149+
obj.registerNewUser(arg0, arg1, arg2);
150+
}
151+
catch(Exception e) {
152+
}
153+
}
154+
155+
public static void CrossSiteScriptingLesson5a(String[] args) {
156+
// WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson5a.java
157+
String arg0 = makeTainted(args[0]);
158+
CrossSiteScriptingLesson5a obj = CProver.nondetWithNull();
159+
try {
160+
obj.completed(1, 2, 3, 4, arg0, 5, null);
161+
}
162+
catch(Exception e) {
163+
}
164+
}
165+
166+
public static void Assignment3(String[] args) {
167+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Assignment3.java
168+
String arg0 = makeTainted(args[0]);
169+
String arg1 = makeTainted(args[1]);
170+
Assignment3 obj = CProver.nondetWithNull();
171+
try {
172+
obj.createNewComment(arg0, arg1);
173+
}
174+
catch(Exception e) {
175+
}
176+
}
177+
178+
public static void SimpleXXE(String[] args) {
179+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
180+
String arg0 = makeTainted(args[0]);
181+
SimpleXXE obj = CProver.nondetWithNull();
182+
try {
183+
obj.createNewComment(arg0);
184+
}
185+
catch(Exception e) {
186+
}
187+
}
188+
189+
public static void ContentTypeAssignment(String[] args) {
190+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
191+
String arg0 = makeTainted(args[0]);
192+
String arg1 = args[1];
193+
ContentTypeAssignment obj = CProver.nondetWithNull();
194+
try {
195+
obj.createNewUser(arg0, arg1);
196+
}
197+
catch(Exception e) {
198+
}
199+
}
200+
201+
public static void BlindSendFileAssignment(String[] args) {
202+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
203+
String arg0 = makeTainted(args[0]);
204+
BlindSendFileAssignment obj = CProver.nondetWithNull();
205+
try {
206+
obj.addComment(arg0);
207+
}
208+
catch(Exception e) {
209+
}
210+
}
211+
212+
public static void VulnerableComponentsLesson(String[] args) {
213+
// WebGoat/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
214+
String arg0 = makeTainted(args[0]);
215+
VulnerableComponentsLesson obj = CProver.nondetWithNull();
216+
try {
217+
obj.completed(arg0);
218+
}
219+
catch(Exception e) {
220+
}
221+
}
222+
223+
public static void MissingFunctionACUsers(String[] args) {
224+
// WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
225+
HttpServletRequest arg0 = CProver.nondetWithNull();
226+
MissingFunctionACUsers obj = CProver.nondetWithNull();
227+
try {
228+
obj.usersService(arg0);
229+
}
230+
catch(Exception e) {
231+
}
232+
}
233+
234+
}

‎benchmarks/GENUINE/WebGoat_sh_files/build.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import os
2+
import shutil
3+
4+
if os.path.isdir("./target"):
5+
shutil.rmtree("./target")
6+
os.system("mvn clean package")
7+
if os.path.isdir("./target/classes/org"):
8+
shutil.rmtree("./target/classes/org")
9+
if os.path.isfile("./target/__MAIN__-8.0.0.M3.jar"):
10+
os.remove("./target/__MAIN__-8.0.0.M3.jar")

0 commit comments

Comments
 (0)