Skip to content

Commit 9eea141

Browse files
author
owen-jones-diffblue
authored
Merge pull request diffblue#435 from diffblue/owen-jones-diffblue/webgoat-makefile
SEC-430: WebGoat makefile
2 parents 7b6f678 + 69fe25e commit 9eea141

File tree

3 files changed

+316
-0
lines changed

3 files changed

+316
-0
lines changed

‎benchmarks/GENUINE/Makefile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
lessons-which-work := webgoat-run-SqlInjectionLesson5a webgoat-run-SqlInjectionLesson5b webgoat-run-SqlInjectionLesson6a webgoat-run-SqlInjectionLesson12a webgoat-run-SqlInjectionChallenge webgoat-run-Assignment5 webgoat-run-Assignment6 webgoat-run-CrossSiteScriptingLesson5a webgoat-run-SimpleXXE webgoat-run-BlindSendFileAssignment
2+
lessons-which-do-not-work := webgoat-run-CrossSiteScriptingLesson5a webgoat-run-Assignment3 webgoat-run-ContentTypeAssignment webgoat-run-VulnerableComponentsLesson webgoat-run-MissingFunctionACUsers
3+
4+
webgoat-run: $(lessons-which-work)
5+
6+
webgoat-run-all: $(lessons-which-work) $(lessons-which-do-not-work)
7+
8+
webgoat-run-%: WebGoat/__MAIN__/target/classes/Main.class
9+
cd ../../dist && python3 ../driver/run.py -C ../benchmarks/GENUINE/WebGoatRules.json -I ../benchmarks/GENUINE/WebGoat -L ../benchmarks/GENUINE/WebGoat -R GENUINE/WebGoat/$*/RESULTS -T GENUINE/WebGoat/TEMP --name WebGoat --verbosity 9 --use-models-library --do-not-use-precise-access-paths --rebuild --timeout 10000000 --entry-point Main.$*
10+
11+
WebGoat/__MAIN__/target/classes/Main.class:
12+
git clone [email protected]:WebGoat/WebGoat.git
13+
cd WebGoat && git checkout a922c00
14+
cd WebGoat && mvn clean install -DskipTests
15+
mkdir -p WebGoat/__MAIN__/src/main/java && cp WebGoat_files/Main.java WebGoat/__MAIN__/src/main/java/Main.java && cp WebGoat_files/pom.xml WebGoat/__MAIN__/pom.xml && cp -r ../LIBRARIES/models/model/src/main/java/org WebGoat/__MAIN__/src/main/java/
16+
cd WebGoat/__MAIN__ && rm -rf target && mvn clean package && rm -rf ./target/classes/org && rm -f ./target/__MAIN__-8.0.0.M3.jar
17+
rm -rf webgoat-container

‎benchmarks/GENUINE/WebGoat_files/Main.java

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
/*
2+
Lessons considered in this file:
3+
[Sql Injection] Assignment6, registerNewUser
4+
[Sql Injection] Assignment5, login
5+
[Sql Injection] SqlInjectionLesson12a, completed
6+
[Sql Injection] SqlInjectionLesson5a, completed
7+
[Sql Injection] SqlInjectionLesson5b, completed
8+
[Sql Injection] SqlInjectionLesson6a, completed
9+
[Sql Injection] SqlInjectionChallenge, registerNewUser
10+
11+
[XXE] Assignment3, createNewComment
12+
[XXE] SimpleXXE, createNewComment
13+
[XXE] ContentTypeAssignment, createNewUser
14+
[XXE] BlindSendFileAssignment, addComment
15+
16+
[XSS] CrossSiteScriptingLesson5a, completed
17+
18+
[Insecure Deserialization] VulnerableComponentsLesson, completed
19+
20+
[Sensitive Data Exposure] MissingFunctionACUsers, usersService
21+
22+
[Email Redirection] Assignment7, sendPasswordResetLink
23+
[Email Redirection] Assignment9, sendPasswordResetLink
24+
*/
25+
26+
import javax.servlet.http.HttpServletRequest;
27+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5a;
28+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5b;
29+
import org.owasp.webgoat.plugin.introduction.SqlInjectionLesson6a;
30+
import org.owasp.webgoat.plugin.mitigation.SqlInjectionLesson12a;
31+
import org.owasp.webgoat.plugin.advanced.SqlInjectionChallenge;
32+
import org.owasp.webgoat.plugin.challenge5.challenge6.Assignment5;
33+
import org.owasp.webgoat.plugin.challenge6.Assignment6;
34+
import org.owasp.webgoat.plugin.CrossSiteScriptingLesson5a;
35+
import org.owasp.webgoat.plugin.challenge3.Assignment3;
36+
import org.owasp.webgoat.plugin.SimpleXXE;
37+
import org.owasp.webgoat.plugin.ContentTypeAssignment;
38+
import org.owasp.webgoat.plugin.BlindSendFileAssignment;
39+
import org.owasp.webgoat.plugin.VulnerableComponentsLesson;
40+
import org.owasp.webgoat.plugin.MissingFunctionACUsers;
41+
import org.cprover.CProver;
42+
43+
public class Main {
44+
45+
static String makeTainted(String accountName) {
46+
return accountName;
47+
}
48+
49+
public static void main(String[] args) {
50+
// [Sql Injection]
51+
52+
SqlInjectionLesson5a(args);
53+
SqlInjectionLesson5b(args);
54+
SqlInjectionLesson6a(args);
55+
SqlInjectionLesson12a(args);
56+
SqlInjectionChallenge(args);
57+
Assignment5(args);
58+
Assignment6(args);
59+
60+
// [XSS]
61+
62+
// CrossSiteScriptingLesson5a(args);
63+
64+
// [XXE]
65+
66+
// Assignment3(args);
67+
SimpleXXE(args);
68+
// ContentTypeAssignment(args);
69+
BlindSendFileAssignment(args);
70+
71+
// [Remaining]
72+
73+
// VulnerableComponentsLesson(args);
74+
// MissingFunctionACUsers(args);
75+
}
76+
77+
public static void SqlInjectionLesson5a(String[] args) {
78+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
79+
String test = makeTainted("dave");
80+
SqlInjectionLesson5a obj = CProver.nondetWithNull();
81+
obj.completed(test);
82+
}
83+
84+
public static void SqlInjectionLesson5b(String[] args) {
85+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5b.java
86+
String test = makeTainted("dave");
87+
SqlInjectionLesson5b obj = CProver.nondetWithNull();
88+
try {
89+
obj.completed(test, null);
90+
}
91+
catch(java.io.IOException e) {
92+
}
93+
}
94+
95+
public static void SqlInjectionLesson6a(String[] args) {
96+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson6a.java
97+
String test = makeTainted(args[0]);
98+
SqlInjectionLesson6a obj = CProver.nondetWithNull();
99+
try {
100+
obj.completed(test);
101+
}
102+
catch(java.io.IOException e) {
103+
}
104+
}
105+
106+
public static void SqlInjectionLesson12a(String[] args) {
107+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/mitigation/SqlInjectionLesson12a.java
108+
String arg0 = makeTainted(args[0]);
109+
SqlInjectionLesson12a obj = CProver.nondetWithNull();
110+
try {
111+
obj.completed(arg0);
112+
}
113+
catch(Exception e) {
114+
}
115+
}
116+
117+
public static void SqlInjectionChallenge(String[] args) {
118+
// WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
119+
String arg0 = makeTainted(args[0]);
120+
String arg1 = makeTainted(args[1]);
121+
String arg2 = makeTainted(args[2]);
122+
SqlInjectionChallenge obj = CProver.nondetWithNull();
123+
try {
124+
obj.registerNewUser(arg0, arg1, arg2);
125+
}
126+
catch(Exception e) {
127+
}
128+
}
129+
130+
public static void Assignment5(String[] args) {
131+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge5/challenge6/Assignment5.java
132+
String arg0 = makeTainted(args[0]);
133+
String arg1 = makeTainted(args[1]);
134+
Assignment5 obj = CProver.nondetWithNull();
135+
try {
136+
obj.login(arg0, arg1);
137+
}
138+
catch(Exception e) {
139+
}
140+
}
141+
142+
public static void Assignment6(String[] args) {
143+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge6/Assignment6.java
144+
String arg0 = makeTainted(args[0]);
145+
String arg1 = makeTainted(args[1]);
146+
String arg2 = makeTainted(args[2]);
147+
Assignment6 obj = CProver.nondetWithNull();
148+
try {
149+
obj.registerNewUser(arg0, arg1, arg2);
150+
}
151+
catch(Exception e) {
152+
}
153+
}
154+
155+
public static void CrossSiteScriptingLesson5a(String[] args) {
156+
// WebGoat/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson5a.java
157+
String arg0 = makeTainted(args[0]);
158+
CrossSiteScriptingLesson5a obj = CProver.nondetWithNull();
159+
try {
160+
obj.completed(1, 2, 3, 4, arg0, 5, null);
161+
}
162+
catch(Exception e) {
163+
}
164+
}
165+
166+
public static void Assignment3(String[] args) {
167+
// WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Assignment3.java
168+
String arg0 = makeTainted(args[0]);
169+
String arg1 = makeTainted(args[1]);
170+
Assignment3 obj = CProver.nondetWithNull();
171+
try {
172+
obj.createNewComment(arg0, arg1);
173+
}
174+
catch(Exception e) {
175+
}
176+
}
177+
178+
public static void SimpleXXE(String[] args) {
179+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java
180+
String arg0 = makeTainted(args[0]);
181+
SimpleXXE obj = CProver.nondetWithNull();
182+
try {
183+
obj.createNewComment(arg0);
184+
}
185+
catch(Exception e) {
186+
}
187+
}
188+
189+
public static void ContentTypeAssignment(String[] args) {
190+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/ContentTypeAssignment.java
191+
String arg0 = makeTainted(args[0]);
192+
String arg1 = args[1];
193+
ContentTypeAssignment obj = CProver.nondetWithNull();
194+
try {
195+
obj.createNewUser(arg0, arg1);
196+
}
197+
catch(Exception e) {
198+
}
199+
}
200+
201+
public static void BlindSendFileAssignment(String[] args) {
202+
// WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/BlindSendFileAssignment.java
203+
String arg0 = makeTainted(args[0]);
204+
BlindSendFileAssignment obj = CProver.nondetWithNull();
205+
try {
206+
obj.addComment(arg0);
207+
}
208+
catch(Exception e) {
209+
}
210+
}
211+
212+
public static void VulnerableComponentsLesson(String[] args) {
213+
// WebGoat/webgoat-lessons/vulnerable-components/src/main/java/org/owasp/webgoat/plugin/VulnerableComponentsLesson.java
214+
String arg0 = makeTainted(args[0]);
215+
VulnerableComponentsLesson obj = CProver.nondetWithNull();
216+
try {
217+
obj.completed(arg0);
218+
}
219+
catch(Exception e) {
220+
}
221+
}
222+
223+
public static void MissingFunctionACUsers(String[] args) {
224+
// WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingFunctionACUsers.java
225+
HttpServletRequest arg0 = CProver.nondetWithNull();
226+
MissingFunctionACUsers obj = CProver.nondetWithNull();
227+
try {
228+
obj.usersService(arg0);
229+
}
230+
catch(Exception e) {
231+
}
232+
}
233+
234+
}

‎benchmarks/GENUINE/WebGoat_files/pom.xml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>__MAIN__</groupId>
5+
<artifactId>__MAIN__</artifactId>
6+
<packaging>jar</packaging>
7+
8+
<parent>
9+
<groupId>org.owasp.webgoat</groupId>
10+
<artifactId>webgoat-parent</artifactId>
11+
<version>8.0.0.M3</version>
12+
</parent>
13+
14+
<dependencies>
15+
<dependency>
16+
<groupId>org.owasp.webgoat.lesson</groupId>
17+
<artifactId>sql-injection</artifactId>
18+
<version>${project.version}</version>
19+
<scope>provided</scope>
20+
<type>jar</type>
21+
</dependency>
22+
<dependency>
23+
<groupId>org.owasp.webgoat.lesson</groupId>
24+
<artifactId>challenge</artifactId>
25+
<version>${project.version}</version>
26+
<scope>provided</scope>
27+
<type>jar</type>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.owasp.webgoat.lesson</groupId>
31+
<artifactId>cross-site-scripting</artifactId>
32+
<version>${project.version}</version>
33+
<scope>provided</scope>
34+
<type>jar</type>
35+
</dependency>
36+
<dependency>
37+
<groupId>org.owasp.webgoat.lesson</groupId>
38+
<artifactId>xxe</artifactId>
39+
<version>${project.version}</version>
40+
<scope>provided</scope>
41+
<type>jar</type>
42+
</dependency>
43+
<dependency>
44+
<groupId>org.owasp.webgoat</groupId>
45+
<artifactId>webgoat-container</artifactId>
46+
<version>${project.version}</version>
47+
<scope>provided</scope>
48+
<type>jar</type>
49+
</dependency>
50+
<dependency>
51+
<groupId>org.owasp.webgoat.lesson</groupId>
52+
<artifactId>vulnerable-components</artifactId>
53+
<version>${project.version}</version>
54+
<scope>provided</scope>
55+
<type>jar</type>
56+
</dependency>
57+
<dependency>
58+
<groupId>org.owasp.webgoat.lesson</groupId>
59+
<artifactId>missing-function-ac</artifactId>
60+
<version>${project.version}</version>
61+
<scope>provided</scope>
62+
<type>jar</type>
63+
</dependency>
64+
</dependencies>
65+
</project>

0 commit comments

Comments
 (0)