by WebGoat is a security testing software developed by OWASP (Open Web Application Security Project), written on the J2EE (Java 2 Enterprise Edition) platform that contains hundreds of vulnerabilities, and you can learn about the vulnerabilities in web applications by yourself. The focus of the software is web applications. With courses in various categories, security experts or web application developers; It aims to gain the ability to understand, solve and exploit the related vulnerability. If you want to learn in-depth, we recommend using the version written in the language you are learning. The version of Webgoat prepared in Java language has platform independence. Apart from Windows, it can also run on Linux and mac osx operating systems. Webgoat version prepared with ASP.NET can only run on the Windows platform.
For example, using the SQL injection vulnerability, you are asked to shop with fake credit card information. At this stage, you should be able to bypass and exploit the form information in the system with the SQL injection method. If you succeed, you are directed to the next test and you get points for each test you pass. Since people who have successfully completed all of the tests in WebGoat will have serious experience and knowledge in this regard, they will aim to keep the security risks at a minimum level in their future audits. It basically includes tests on the following topics.
- Cross-Site Scripting
- Access Control
- Thread Safety
- Hidden Form Field Manipulation
- Parameter Manipulation
- Weak Session Cookies
- Blind SQL Injection
- Numeric SQL Injection
- String SQL Injection
- Web Services
- Fail Open Authentication
- Dangers of HTML Comments
If you intend to work with this web application, we recommend that you tamper with DVWA (Damn Vulnerable Web Application) before that. Thanks to DVWA, you can find satisfactory answers to questions such as how a hacker hacks a site, how a hacker searches for a security vulnerability in a site. DVWA Lessons DVWA is the foundation of the business, so to speak. WebGoat, on the other hand, is more advanced. You can learn how to exploit security vulnerabilities caused by architectural errors of web applications developed with WebGoat.
