Skip to content

Commit 68b80fa

Browse files
author
[email protected]
committed
WebGoat 5.4 distribution before WebGoat 6.0
git-svn-id: http://webgoat.googlecode.com/svn/trunk@479 4033779f-a91e-0410-96ef-6bf7bf53c507
1 parent 31570e7 commit 68b80fa

File tree

1,206 files changed

+87644
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,206 files changed

+87644
-0
lines changed

‎webgoat-5.4/README.txt‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
**********
2+
********** WebGoat 5.4
3+
********** April/27/2012
4+
**********
5+
**
6+
** Home Page: http://code.google.com/p/webgoat
7+
** Home Page: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
8+
** Source Code: http://code.google.com/p/webgoat/source/checkout
9+
** Download: http://code.google.com/p/webgoat/downloads/list
10+
** Download: http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=61824 (older stuff)
11+
** User Guide: http://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents
12+
** Wiki: http://code.google.com/p/webgoat/w/list
13+
** FAQ: http://code.google.com/p/webgoat/wiki/FAQ
14+
** Contact Info: [email protected] (Direct to Bruce Mayhew)
15+
** Mailing List: [email protected] (WebGoat Community - For most questions)
16+
**
17+
**********
18+
19+
Thank you for downloading WebGoat!
20+
21+
This program is a demonstration of common server-side
22+
application flaws. The exercises are intended to
23+
be used by people to learn about application penetration
24+
testing techniques.
25+
26+
27+
WARNING 1: While running this program your machine will be
28+
extremely vulnerable to attack. You should to disconnect
29+
from the Internet while using this program.
30+
31+
WARNING 2: This program is for educational purposes only. If you
32+
attempt these techniques without authorization, you are very
33+
likely to get caught. If you are caught engaging in unauthorized
34+
hacking, most companies will fire you. Claiming that you were
35+
doing security research will not work as that is the first thing
36+
that all hackers claim.
37+
38+
You can find more information about WebGoat at:
39+
http://code.google.com/p/webgoat
40+
41+
42+
----------------------------------------------------------------------------------------
43+
Prerequisites for Developers (Skip to Option 3 for unzip and click to run configruation)
44+
----------------------------------------------------------------------------------------
45+
46+
These tools must be installed independent of the webgoat download.
47+
- Java 1.6
48+
Java can ne downloaded at http://java.sun.com/javase/downloads/index.jsp
49+
You only need to download and install the "Java SE Development Kit (JDK)"
50+
- Maven > 2.0.9
51+
Maven can be downloaded at: http://maven.apache.org/
52+
In Ubuntu it can be installed with:
53+
> apt-get install maven2
54+
- WebGoat source code
55+
WebGoat source code can be downloaded at:
56+
http://code.google.com/p/webgoat/source/checkout
57+
Use an svn client (ex: Tortoise svn) to checkout the code in the trunk.
58+
59+
60+
61+
---------------------------------
62+
Building the project (Developers)
63+
---------------------------------
64+
65+
Using a command shell/window:
66+
67+
> cd webgoat
68+
> mvn compile
69+
70+
copy it to the local repository
71+
> mvn install
72+
73+
delete artifacts from previous build:
74+
> mvn clean
75+
76+
77+
-----------------------------------------------
78+
Building the Eclipse project files (Developers)
79+
-----------------------------------------------
80+
81+
> mvn eclipse:clean
82+
> mvn eclipse:eclipse
83+
84+
Afterward the project can be imported within Eclipse:
85+
File -> Import -> General -> Existing Projects into Workspace
86+
and select the webgoat directory as the "root directory." A webgoat should appear in the Projects section of your dialogue window.
87+
88+
Don't forget to declare a classpath variable named M2_REPO, pointing to ~/.m2/repository, otherwise many links to existing jars will be broken.
89+
This folder is located in your username root folder, the same folder where "my documents" and "my pictures" are located.
90+
You can declare new variables in Eclipse in Windows -> Preferences... and selecting Java -> Build Path -> Classpath Variables
91+
92+
93+
-------------------------------------------------------------------
94+
Option 1: (Developers) Run the project on Tomcat within Eclipse
95+
-------------------------------------------------------------------
96+
97+
Install a local Tomcat server (We use Tomcat 7)
98+
1. Download and unzip Apache Tomcat from http://tomcat.apache.org.
99+
2. Adapt the conf/tomcat-users.xml file of your Tomcat server:
100+
<?xml version="1.0" encoding="UTF-8"?>
101+
<tomcat-users>
102+
<role rolename="webgoat_basic"/>
103+
<role rolename="webgoat_admin"/>
104+
<role rolename="webgoat_user"/>
105+
<role rolename="tomcat"/>
106+
<user password="webgoat" roles="webgoat_admin" username="webgoat"/>
107+
<user password="basic" roles="webgoat_user,webgoat_basic" username="basic"/>
108+
<user password="tomcat" roles="tomcat" username="tomcat"/>
109+
<user password="guest" roles="webgoat_user" username="guest"/>
110+
</tomcat-users>
111+
3. Open Eclipse (WTP version) -> File -> New -> Other -> Server -> Apache
112+
4. Choose your Tomcat version
113+
-> Click next "browse" to your tomcat install.
114+
-> Make sure the "JRE" dropdown is pointing to your jdk. If it isn't listed, press
115+
"Installed JREs" and add it.
116+
-> Click next and add "webgoat" to the list of configured applications
117+
-> Finish
118+
119+
120+
3. Right Click on the webgoat project within eclipse -> Run As -> Run on server
121+
122+
Point your browser to http://localhost:8080/webgoat/attack
123+
** Note - When running in eclipse, the default url will be lowercase "webgoat"
124+
125+
126+
-----------------------------------------------------------
127+
Option 2: (Developers) Run the project on Tomcat with Maven
128+
-----------------------------------------------------------
129+
130+
1. mvn tomcat:run-war
131+
2. http://localhost:8080/WebGoat/attack
132+
133+
134+
------------------------------------------------------------------
135+
Option 3: Run from the WebGoat 5.X Standard distribution (Windows)
136+
------------------------------------------------------------------
137+
138+
1. Download the WebGoat-5.X-OWASP_Standard_Win32.zip file from:
139+
- http://code.google.com/p/webgoat/downloads/list
140+
2. Unzip the file
141+
3. Double click webgoat.bat
142+
4. Browse to http://localhost/WebGoat/attack
143+
144+
** Note: if you receive a bind address error use:
145+
146+
3. Double click webgoat8080.bat
147+
4. Browse to http://localhost:8080/WebGoat/attack
148+
149+
150+
------------------------------------------------------------------
151+
Option 4: Run from the WebGoat 5.X Standard distribution (Ubuntu)
152+
------------------------------------------------------------------
153+
154+
1. Download the WebGoat-5.X-OWASP_Standard_Ubuntu32.zip file from:
155+
- http://code.google.com/p/webgoat/downloads/list
156+
2. Unzip the file
157+
3. run sudu ./webgoat.sh start80
158+
4. Browse to http://localhost/WebGoat/attack
159+
160+
** Note: if you receive a bind address or privilege error:
161+
162+
3. run ./webgoat.sh start8080
163+
4. Browse to http://localhost:8080/WebGoat/attack
164+
165+
shutdown the server with:
166+
./webgoat.sh stop
167+
168+
------------------------------------------------------------------
169+
Option 5: Using the WebgGoat-5.X.war
170+
------------------------------------------------------------------
171+
172+
Windows:
173+
174+
1. Download and install Java 1.6 and Tomcat 7 if needed
175+
2. Download the WebgGoat-5.X.war and README-5.X file from:
176+
- http://code.google.com/p/webgoat/downloads/list
177+
3. Rename WebgGoat-5.X.war to WebgGoat.war
178+
4. Copy WebGoat.war to <tomcat>/webapps/WebGoat.war
179+
5. Modify the <tomcat>/conf/tomcat-users.xml to add in WebGoat users and roles
180+
- see the FAQ for directions
181+
6. Start the tomcat server (default is usually port 8080)
182+
7. Browse to http://localhost:8080/WebGoat/attack
183+
184+
Ubuntu:
185+
186+
1. Install Java 1.6 and Tomcat 7 if needed
187+
- Install java using: sudo apt-get install openjdk-7-jre
188+
- Download Tomcat 7 from http://tomcat.apache.org/download-70.cgi (core tar.gz)
189+
2. Download the WebgGoat-5.X.war and README-5.X file from:
190+
- http://code.google.com/p/webgoat/downloads/list
191+
3. Rename WebgGoat-5.X.war to WebgGoat.war
192+
4. Copy WebGoat.war to <tomcat>/webapps/WebGoat.war
193+
5. Modify the <tomcat>/conf/tomcat-users.xml to add in WebGoat users and roles
194+
- see the FAQ for directions
195+
6. Start the tomcat server (default is usually port 8080)
196+
7. Browse to http://localhost:8080/WebGoat/attack

0 commit comments

Comments
 (0)