Collaborate Disseminate
The WebGoat challenge is making me pathetic. I am unable to clear even the first challenge. How do we view source code (Java) for the first challenge? F12 gives me the full source code, which is too large to investigate. Can … Continue reading Viewing Source code in WebGoat [on hold]
As an instructor, from time to time to teach a concept, I need to perform an actual test to get my point across to the students. Testing or hacking a live site may have some […]
The post WebGoat 8: An intentionally Insecure Web Application for WebAp… Continue reading WebGoat 8: An intentionally Insecure Web Application for WebApp Testing
I am new to web security. I want to install owasp webgoat
I have installed javasdk and tomcat.
but I am not running tomcat.
downloaded webgoat from the following url:
https://github.com/WebGoat/WebGoat/releases
I am fol… Continue reading how to install webgoat: shows blank page [on hold]
I’ve recently installed WebGoat 8.00M12 on my computer and I tried to solve the “Access Control” section for a demonstration in my class.
Everything was simple and smooth till I got stuck at the last point in “Missing functi… Continue reading Webgoat missing function level access control lesson
I’m trying to make a presentation on how to scan a website using OWASP ZAP 2.7.0 and I’m trying to use WebGoat7.1 as a target for this purpose. I would like to first use the AJAX scanner to discover all the lessons pages so t… Continue reading How can I scan WebGoat7.1 with OWASP ZAP
For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson.
One of the first lesson sets is entitled ""Access Control Flaws"…. Continue reading How can I intercept localhost traffic to/from WebGoat with ZED attack proxy?
I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.
I have configured Zap to listen to my Firefox, but I’m only able to send HTTP GET requests, there are no POST requests showing up.
I … Continue reading ZAP and Tamper Data is not getting any POST requests
I’m working through OWASP’s “WebGoat” (version 5.4) vulnerable web application, but I’m getting stuck on one of the earliest lessons which is to do with HTTP response splitting.
I’ve looked in all the hints and the solution … Continue reading Why is this response splitting attack not working?