LAB

© Copyright 2017 QUALITANCE.

The information contained herein is subject to change without notice.
 SETUP
https://github.com/WebGoat/WebGoat/releases

Download: webgoat-container-7.0.1-war-exec.jar

From command line:

java -jar webgoat-container-7.0.1-war-exec.jar

Homepage: http://localhost:8080/WebGoat
 Stored XSS

Navigate to Cross Site Scripting (XSS) > Stored XSS Attacks

Fill title and/or message with a valid script and submit.

Example:

<script>alert(document.cookie);</script>

<script>alert(1);</script>
 Reflected XSS

Navigate to Cross Site Scripting (XSS) > Reflected XSS Attacks

Try to submit a script in digit input.

Example:

<script>alert(1);</script>
 Numeric SQL injection

Navigate to Injection Flaws > Numeric SQL Injection

Edit any value from select to display weather for all stations.

Example:

101 OR station < 102

 String SQL injection

Navigate to Injection Flaws > Stage 1 String SQL Injection

Login without using the correct password.

Example:

' or 'a'='a
 Blind Numeric SQL Injection

Navigate to Injection Flaws > Blind Numeric SQL Injection

Discover PIN number.

Example:

101 AND ((SELECT pin FROM pins WHERE

cc_number='1111222233334444') > 10000 );
Q&A