1. Copyright © 2004 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation OWASP AppSec June 2004 NYC http://www.owasp.org WebGoat Project Review Bruce Mayhew WebGoat Project Technical Lead bruce.mayhew@aspectsecurity.com 443.745.7732

2. 1 OWASP AppSec 2004 How Do You Teach Application Security? Change the way developers think…  They have to understand the danger  Prove their code can be broken  Show them how to exploit flaws

3. 1 OWASP AppSec 2004 What is WebGoat?  Concept  Full web application riddled with holes  Training environment  Hands-on learning for developers  Individual lessons for OWASP Top 10  Implementation  J2EE Servlet with JDBC database  Basic authenticaton, roles  Declarative and programatic access control  Persistant  Very easy to add new lessons

4. 1 OWASP AppSec 2004 What's in a Lesson?  Explain the vulnerability.  Show the broken code.  Allow the user to exploit the vulnerabilty.  Show the correct code.

5. 1 OWASP AppSec 2004 Explain the Vulnerabilty  Fail Open Authentication  This lesson presents the basics for understanding the "fail open" condition regarding authentication. The security term, “fail open” describes a behavior of a verification mechanism. This is when an error (i.e. unexpected exception) occurs during a verification method causing that method to evaluate to true. This is especially dangerous during login.

6. 1 OWASP AppSec 2004 Show the Broken Code String username = ""; String password = ""; try { username = s.getParser().getRawParameter( USERNAME ); password = s.getParser().getRawParameter( PASSWORD ); // if credentials are bad, send the login page if ( !"webgoat".equals( username ) || !password.equals( "webgoat" ) ) { s.setMessage( "Invalid username and password entered." ); return ( makeLogin( s ) ); } catch ( Exception e ) { s.setMessage( "Error generating " + this.getClass().getName() ); } return ( makeUser( s, username, "Login Succeeded" ));

7. 1 OWASP AppSec 2004 Exploit the Vulnerability  Picture of WebGoat Lesson

8. 1 OWASP AppSec 2004 Exploit the Vulnerability  Picture of WebGoat Lesson

9. 1 OWASP AppSec 2004 How It Should Be Done String username = ""; String password = ""; try { username = s.getParser().getRawParameter( USERNAME ); password = s.getParser().getRawParameter( PASSWORD ); // if credentials are bad, send the login page if ( "webgoat".equals( username ) && password.equals( "webgoat" ) ) { s.setMessage( "Invalid username and password entered." ); return ( makeUser( s, username, "Login Succeeded" ) ); } catch ( Exception e ) { s.setMessage( "User name or password is incorrect ); } return ( makeLogin( s ));

10. 1 OWASP AppSec 2004 It's Simple to Add a Lesson  Set up the framework.  Implement createContent().  Implement the other methods.  Install and run.

11. 1 OWASP AppSec 2004 Setup the Framework  Use the WebGoat LessonAdapter. public class NewLesson extends LessonAdapter { protected Element createContent(WebSession s) { return( new StringElement( "Hello World" ) ); } public String getCategory() { } protected List getHints() { } protected String getInstructions() { } protected Element getMenuItem() { } protected Integer getRanking() { } public String getTitle() { } }

12. 1 OWASP AppSec 2004 Implement createContent()  The “brains” of the lesson. protected Element createContent(WebSession s) { ElementContainer ec = new ElementContainer(); try { // get some input from the user -- see ParameterParser for details String userInput = s.getParser().getStringParameter(INPUT, ""); // do something with the input // -- SQL query?, -- Runtime.exec? -- Some other dangerous thing // generate some output -- a string and an input field ec.addElement(new StringElement("Enter a string: ")); ec.addElement( new Input(Input.TEXT, INPUT, userInput) ); // Tell the lesson tracker the lesson has completed, when lesson has been “hacked” getLessonTracker( s ).setCompleted( true ); } catch (Exception e) { s.setMessage("Error generating " + this.getClass().getName()); e.printStackTrace(); } return (ec); }

13. 1 OWASP AppSec 2004 Implement the other methods  Add the supporting details  Use Ant to build, install, and run public String getCategory() { return( "New Category or Existing Category" ); } protected List getHints() { // Hints will be returned to the user in the order they appear below // when the user clicks on the "next hint" List hints = new ArrayList(); hints.add("A general hint to put users on the right track"); hints.add("A hint that gives away a little piece of the problem"); hints.add("A hint that basically gives the answer"); return hints; } protected String getInstructions(){ return(“Lesson scenario and instructions"); } protected Element getMenuItem() { return( "MyLesson" ); } protected Integer getRanking() { return new Integer(10); } public String getTitle() { return ("My Lesson's Short Title"); }

14. 1 OWASP AppSec 2004 It Looked Pretty Easy It Was! You can create a simple lesson in 30 minutes.

15. 1 OWASP AppSec 2004 How Do You Run WebGoat?  Problems with old installer fixed  Download, Unzip, Click, & Browse  http://sourceforge.net/project/showfiles.php?group_id=64424  Unzip the distribution  Use WebGoat-3.0b.zip if you have Java  Use WebGoat-3.0b_JAVA.zip if you don’t  Double-click tomcat.bat  Browse to http://localhost/WebGoat/attack

16. 1 OWASP AppSec 2004 Cool Stuff  Report Card

17. 1 OWASP AppSec 2004 Cool Stuff  Hackable Admin Interface

18. 1 OWASP AppSec 2004 WebGoat Supports the OWASP Top 10  Thread Safety  Hidden Field Tampering  Anonymous/Dangerous Email  Javascript Validation  Remote Admin  Access Control  Weak Authentication Cookie  Stored and Reflected Cross Site Scripting  HTML Clues  Encoding Basic  Forced Browsing  HTTP Basic  Fail Open Authentication  Command Injection  Forget password *  Buffer Overflow *  Denial of Service (Login ) **  Challenge

19. 1 OWASP AppSec 2004 Roadmap  For the user:  More lessons  Update the User's Guide  Is it too simple?  Improve the infrastructure:  Use JSP's to replace ECS  Port to Apache struts  Refactor internal database

20. 1 OWASP AppSec 2004 OWASP Wants Your Ideas!  Is WebGoat part of your training environment?  What features do you need?  How can you get involved?  Even a little effort helps  Great place to learn web application basics  WebGoat could use help with:  Converting to JSP's and Struts ( Java, HTML, Struts )  Storybooking lessons  Updating lesson plans and lesson instructions

21. 1 OWASP AppSec 2004 Share your Ideas Bruce Mayhew bruce.mayhew@aspectsecurity.com 443.745.7732 http://www.owasp.org/webgoat