Tuesday, 4 June 2013

WebGoat.NET in Action (and how I set-it up)

For the OWASP EU Tour London event I showed the WebGoat.NET vulnerable web app (which is a .NET variation of the highly successful Java-based OWASP WebGoat project).

Here are (draft) notes on my efforts to get WebGoat.Net up and running (which might help help others since there is very little documentation about this great new OWASP Project)

After cloning from https://github.com/jerryhoff/WebGoat.NET and using the code from the https://github.com/jerryhoff/WebGoat.NET/tree/new-lessons branch (note that there is now the https://github.com/OWASP/WebGoat.NET repo, which is a better home for this code), I was able to get WebGoat.Net running (see below the probs I had to solve), and here is what the first page looks like:

image

Clicking on ‘Customer Login’ takes us to a login page:

image

Where we can see an SQL Injection in action:

image

Note the Mono.Data.Sqlite.SqliteException: SQLite error near "bbb" message

image

At the moment the login doesn’t seem to be really working, since we can login as any user

image

with no password:

image

BE INVOLVED and HELP this project:

There doesn't seem to be a lot of documentation and help about this project, so if you are looking for a nice project to be involved, this is a good one.

I enabled the GitHub Issues in the repo, and added a couple ones in there to kickstart it:

image


Next are my draft notes and screenshots about how I got WebGoat.Net to run

Forking the original REPO into the OWASP Organization

From https://github.com/jerryhoff/WebGoat.NET I forked into https://github.com/OWASP/WebGoat.NET

image

where I pushed my changes into the VS_2010 branch

image

Here are the two commits I added

image 

Here is the Network map (note that my changes where made from the new-lessons branch:

image


Installation Process (Creating the Database)

After dealing with the errors described below, this is what the first page looks like

image

clicking on Set Up Database! gives us:

image

And clicking on the Rebuild Database (after setting the Client Executable value)

image

created a test database for us:

image

Errors and issues that where solved during setup

Initially I had an error happening because of a failure to load the SQLITE3 dll by Mono.Data.Sqlite (see $exeception value below)


image

The solution was to copy the sqlite3.dll version from http://sqlite.org/download.html to the bin folder

image

Where I also copied the sqlite3.exe (which was used during the install)

image


Weird errors:

After upgrading to VS 2010, I got this error on first execution:

image

Looking at the references, it looks like System.Core.dll is missing

image

But it can’t seem to be added using Add References:

image

This was solved by removing the using statements and other references to System.Linq

 Other weird errors were (resolved after a code recompile)

image

and (also resolved after a server recompile):

image
Post a Comment