MIS Week 5 Site:

 Test 1  In the news  Introduction to WebGoat  Next Week  Presentation 1 2MIS

3

 Submitted   breach/researcher-releases-10-million-usernames- passwords-from-data-breaches.html#tk.rss_news breach/researcher-releases-10-million-usernames- passwords-from-data-breaches.html#tk.rss_news   accounts-disabled-claims-hacking-group-anonymous accounts-disabled-claims-hacking-group-anonymous  ways-legal-and-illegal-vpn-technology-is-erasing- international-borders/?_r=0&referrer= ways-legal-and-illegal-vpn-technology-is-erasing- international-borders/?_r=0&referrer MIS

 Submitted  target-health-care-industry-goes- digital?phint=newt%3Ditnews_daily&phint=idg_eid%3D e cd3a feddd9dac7#tk.ITNEWSNLE_nlt _itndaily_ target-health-care-industry-goes- digital?phint=newt%3Ditnews_daily&phint=idg_eid%3D e cd3a feddd9dac7#tk.ITNEWSNLE_nlt _itndaily_  today.com/articles/2015/02/10/samsung-smarttvs-may- record-conversations.aspx today.com/articles/2015/02/10/samsung-smarttvs-may- record-conversations.aspx  breaches/chinese-hacking-group-codoso-team-uses- forbescom-as-watering-hole-/d/d-id/ breaches/chinese-hacking-group-codoso-team-uses- forbescom-as-watering-hole-/d/d-id/  security-operations security-operations MIS

 What I noted  doesnt-want-anyone-to-know-about-stingray-use-by- local-cops/ doesnt-want-anyone-to-know-about-stingray-use-by- local-cops/  samsung-off-the-hook-for-smart-tv- eavesdropping/?utm_content=buffer828a2&utm_mediu m=social&utm_source=twitter.com&utm_campaign=buff er samsung-off-the-hook-for-smart-tv- eavesdropping/?utm_content=buffer828a2&utm_mediu m=social&utm_source=twitter.com&utm_campaign=buff er  search-engine.html search-engine.html  MIS

 WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons  The current version is 6.0, this is still a work in progress.  WebGoat for J2EE is written in Java and therefore installs on any platform with a Java virtual machine. MIS

 You can download WebGoat at:  -WGM/latestSuccessful/artifact/shared/WebGoat- Embedded-Tomcat/WebGoat war-exec.jar -WGM/latestSuccessful/artifact/shared/WebGoat- Embedded-Tomcat/WebGoat war-exec.jar  You will also need Java >= 1.6 (JDK 1.7 Recommended)  downloads/index.html downloads/index.html MIS

9

 Entering URL for WebGoat gives:  Use the down arrow and select “Save As” to save file to the location of your choice. MIS

 Follow URL to: MIS

 Selecting “JRE” gives: MIS

 Click “Accept” and select the OS  Same as WebGoat, use save as option to put the file where you want it  Once downloaded, run the file and follow the prompts  To launch in Windows, open the command line and type:  Java –jar WebGoat war-exec.jar  Command line will say busy and will look like it hangs at Initializing Spring …. MIS

 Open a browser and type the following in the URL bar:  MIS

 Download the “jar” file as described on slide 10  Java JRE is already installed in Kali  Open a terminal and execute the same command  Java –jar WebGoat war-exec.jar  Verify same as slide 14 MIS

 If you downloaded the jar file to Kali, you are ready to launch the Intercepting Proxy, point the browser the proxy and start  If you want to work in Windows, you will need to get an intercepting proxy on to your windows machine  Go to:   Select “Download” tab and then “Free”  This will bring down another jar file for BurpSuite MIS

 Once WebGoat is running, you are one of the most vulnerable systems on the internet!  Once you have downloaded the files consider disconnecting from the network MIS

 In the news  Presentation 1 – What did you learn about Metasploit?  Working through WebGoat MIS

? MIS