Skip to content

Fixed issues to make it work for WebGoat v8.0.0.M25 #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fixed issues to make it work for WebGoat v8.0.0.M25 #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad137ce
Modified to work with latest WG8M25
Jul 11, 2019
6972b8d
Fixed issue for WebGoat 8.25
Jul 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 23 additions & 10 deletions src/main/java/com/contrastsecurity/webgoat/selenium/ChromeScript.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,68 +46,80 @@ public static void run(String un, String pw, String url, boolean headless, Strin
driver.findElement(By.className("btn-primary")).click();
}

// Navigate to String SQL Injection section
driver.get(url + "/start.mvc#lesson/SqlInjection.lesson/6");
// Navigate to String SQL Injection section
driver.get(url + "/start.mvc#lesson/SqlInjection.lesson/8");
delay(1000);
retryingFindSendKeys(driver, By.xpath("//*[@id=\"lesson-content-wrapper\"]/div[6]/div[9]/div[2]/form/table/tbody/tr/td[2]/input"), "' OR '1'='1");
// driver.findElement(By.name("account")).sendKeys("' OR '1'='1");
driver.findElement(By.name("Get Account Info")).click();
driver.findElement(By.name("account")).sendKeys("'");
driver.findElement(By.name("operator")).sendKeys(" OR ");
driver.findElement(By.name("injection")).sendKeys("'1'='1");
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[11]/div[2]/form/table/tbody/tr/td[5]/input")).click();

// Navigate to Numeric SQL Injection section
driver.get(url + "/start.mvc#lesson/SqlInjection.lesson/7");
driver.get(url + "/start.mvc#lesson/SqlInjection.lesson/9");
delay(1000);
driver.findElement(By.name("login_count")).sendKeys("1");
driver.findElement(By.name("userid")).sendKeys("1 OR 1=1");
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[10]/div[2]/form/table/tbody/tr/td[3]/input")).click();
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[12]/div[2]/form/table/tbody/tr[3]/td[2]/input")).click();

// Navigate to SQL Injection (advanced)
driver.get(url + "/start.mvc#lesson/SqlInjectionAdvanced.lesson/2");
delay(1000);
driver.findElement(By.name("userid_6a")).sendKeys("Smith'; SELECT * FROM user_system_data WHERE '1'='1");
driver.findElement(By.name("Get Account Info")).click();
driver.findElement(By.name("userid_6b")).sendKeys("dave");
driver.findElement(By.name("userid_6b")).sendKeys("passW0rD");
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[5]/div[3]/form/table/tbody/tr/td[3]/input")).click();

driver.get(url + "/start.mvc#lesson/SqlInjectionAdvanced.lesson/4");
delay(1000);
driver.findElement(By.id("username4")).sendKeys("username");
driver.findElement(By.id("password4")).sendKeys("password");
driver.findElement(By.id("login-submit")).click();

// SQL Injection (mitigations)
driver.navigate().to(url + "/start.mvc#lesson/SqlInjectionMitigations.lesson/7");
driver.navigate().to(url + "/start.mvc#lesson/SqlInjectionMitigations.lesson/9");
delay(1000);
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[10]/div[3]/form[1]/div/div/div/table/thead/tr/th[4]/span")).click();
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[12]/div[3]/form[1]/div/div/div/table/thead/tr/th[4]/span")).click();

// XXE (page 3)
driver.navigate().to(url + "/start.mvc#lesson/XXE.lesson/2");
delay(1000);
driver.findElement(By.id("commentInputSimple")).sendKeys("Test comment");
driver.findElement(By.id("postCommentSimple")).submit();

// XXE (page 4)
driver.navigate().to(url + "/start.mvc#lesson/XXE.lesson/3");
delay(1000);
retryingFindSendKeys(driver, By.id("commentInputContentType"), "Test comment 2");
// driver.findElement(By.id("commentInputContentType")).sendKeys("Test comment 2");
driver.findElement(By.id("postCommentContentType")).submit();

//XXE (page 7)
driver.navigate().to(url + "/start.mvc#lesson/XXE.lesson/6");
delay(1000);
driver.findElement(By.id("commentInputBlind")).sendKeys("Test comment 3");
driver.findElement(By.id("postCommentBlind")).submit();

// XSS (page 2)
driver.navigate().to(url + "/start.mvc#lesson/CrossSiteScripting.lesson/1");
delay(1000);
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[4]/div[3]/div[1]/form/table/tbody/tr/td[2]/input")).sendKeys("Yes");
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[4]/div[3]/div[1]/form/table/tbody/tr/td[3]/input")).submit();

// XSS (page 7)
driver.navigate().to(url + "/start.mvc#lesson/CrossSiteScripting.lesson/6");
delay(1000);
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[9]/div[2]/div[1]/form/table[2]/tbody/tr[1]/td[3]/input")).submit();
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[9]/div[2]/div[1]/form/table[2]/tbody/tr[5]/td/input")).submit();

// XSS (page 10)
driver.navigate().to(url + "/start.mvc#lesson/CrossSiteScripting.lesson/9");
delay(1000);
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[12]/div[2]/form/input[1]")).sendKeys("Test");
driver.findElement(By.name("SubmitTestRoute")).submit();

// XSS (page 11)
driver.navigate().to(url + "/start.mvc#lesson/CrossSiteScripting.lesson/10");
delay(1000);
driver.findElement(By.name("successMessage")).sendKeys("Test");
driver.findElement(By.name("submitMessage")).submit();

Expand All @@ -120,6 +132,7 @@ public static void run(String un, String pw, String url, boolean headless, Strin

// Insecure Direct Object References (page 3)
driver.navigate().to(url + "/start.mvc#lesson/IDOR.lesson/2");
delay(1000);
driver.findElement(By.xpath("/html/body/section/section/section/div[1]/div[1]/div/div/div/div[6]/div[5]/div[2]/form/input")).submit();
driver.findElement(By.name("attributes")).sendKeys("role,userId");
driver.findElement(By.name("Submit Diffs")).submit();
Expand Down