streichsbaer

bundles:
  - php
  - general
report:
  pullRequest:
    findings: "onAllFiles"
    comment: true

streichsbaer

public void serveResource(ResourceRequest resourceRequest, ResourceResponse resourceResponse) throws IOException, PortletException {
  HttpServletRequest request = PortalUtil.getOriginalServletRequest(PortalUtil.getHttpServletRequest(resourceRequest));
  try {
      HttpServletRequestWrapper wrapper = new HttpServletRequestWrapper(PortalUtil.getHttpServletRequest(resourceRequest)){
          @Override
          public String getParameter(String name) {
              if (name.equals("p_auth")) {
                  return PortalUtil.getOriginalServletRequest((HttpServletRequest) super.getRequest()).getParameter(name);
              }

streichsbaer

Loading scanner...
Processing application in /Users/at/src/github.com/OWASP/railsgoat
Processing gems...
[Notice] Detected Rails 5 application
Processing configuration...
[Notice] Escaping HTML by default
Parsing files...
Processing initializers...
Processing libs...sed
Processing routes...

streichsbaer

# Prequisites: (Tested on Mac only)
# 1. Install openssl
# 2. Install python
# 3. Clone the trustkit repository 
# 4. cd into the trustkit repository and create the getPublicKeyHashes.sh file in there

if [ -z "$1" ]
  then
    echo "Please provide a hostname and port. E.g ./getPublicKeyHashes.sh google.com 443"
elif [ -z "$2" ]

streichsbaer

git clone https://github.com/continuumsecurity/bdd-security.git
cd bdd-security
./gradlew -Dcucumber.options="--tags @authentication --tags ~@skip" test

streichsbaer

package net.continuumsecurity;

import net.continuumsecurity.Config;
import net.continuumsecurity.Credentials;
import net.continuumsecurity.UserPassCredentials;
import net.continuumsecurity.behaviour.ILogin;
import net.continuumsecurity.behaviour.ILogout;
import net.continuumsecurity.behaviour.INavigable;
import net.continuumsecurity.web.WebApplication;
import org.openqa.selenium.By;

streichsbaer

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app>

    <!-- Base URL of the application to test -->
    <baseUrl>http://10.1.1.251:8080/WebGoat/</baseUrl>

    <!-- A Java class to hold the Selenium steps to test the application in depth. Optionally required for in-depth authn/z and session management testing. -->
    <class>net.continuumsecurity.WebGoatApplication</class>

    <sslyze>

streichsbaer

package net.continuumsecurity;

import net.continuumsecurity.Config;
import net.continuumsecurity.Credentials;
import net.continuumsecurity.UserPassCredentials;
import net.continuumsecurity.behaviour.ILogin;
import net.continuumsecurity.behaviour.ILogout;
import net.continuumsecurity.behaviour.INavigable;
import net.continuumsecurity.web.WebApplication;
import org.openqa.selenium.By;

streichsbaer

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app>
  [...]
  <baseUrl>http://localhost:8080/WebGoat/</baseUrl>
  <class>net.continuumsecurity.WebGoatApplication</class>
  <defaultUsername>guest</defaultUsername>
  <defaultPassword>guest</defaultPassword>
  [...]
</web-app>

streichsbaer

wget https://s3.amazonaws.com/webgoat-war/webgoat-container-7.0.1-war-exec.jar
java -jar webgoat-container-7.0.1-war-exec.jar