Hello @nbaars and @itsmeyjc, and props on this nice learning tool. I ran into this issue as well, and share @aiddroid 's concerns. I'm using Version: 8.0.0.M21.

Step 1: http://127.0.0.1:8080/WebGoat/start.mvc#lesson/HttpBasics.lesson/0
Just read HTTP basics.

Step 2: http://127.0.0.1:8080/WebGoat/start.mvc#lesson/HttpBasics.lesson/1
Enter your name and see how the server responds with the reversed version of it. Use a proxy to see the traffic. You only see the following in the POST request:

POST /WebGoat/HttpBasics/attack1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8080/WebGoat/start.mvc
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 15
Cookie: JSESSIONID=07EAEABCFAD252D56272222992ABB12C
Connection: close

person=testname

Step 3: http://127.0.0.1:8080/WebGoat/start.mvc#lesson/HttpBasics.lesson/2
The question reads: What type of HTTP command did WebGoat use for this lesson. A POST or a GET. It's using the past tense did use and therefore refers to the previous step (step 2), the one you already tried and captured in your proxy. When you look at the request, there's no magic number (as shown above).

It's not clear that you actually need to try the request on step 3 itself, with a dummy value for the magic number question, since you don't have it yet. It's confusing that you need to fail purposely in order to have a first chance to capture the magic number you need to correctly answer the question.

I can think of two solutions:

Include the magic number in step 2, and leave everything else as is, XOR
Rename step 3 so that it's clear you need to try the request in step 3 in order to get the magic number.

I suggest option (1) above. I hope all this make sense, and can serve as a tiny contribution to this cool project. Cheers.

Uh oh!

What is the magic number mean in HttpBasics.lesson/2 ? #494

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions