WebGoat lab: guided web security lessons with WebWolf in your own copy

WebGoat is a guided course in web security. Each lesson explains a weakness, such as injection, broken access control, insecure deserialisation, JWT mistakes or path traversal, and then asks the student to use it, with the lesson marked complete when they do. WebWolf sits beside it for the lessons that need a second party.

Every target is inside the student’s own lab copy, which has no route to the internet and none to any other student, so the only thing a student can attack is the application the lab started for them. The rule is said at the top of the lab: attack your own copy, never a site you do not own.

What students learn

A first introduction to each class of weakness with the explanation beside it, plus cryptography, token and deserialisation basics. It suits a first lesson and work set for home, because the lessons say what to do.

Run it in your browser

WebGoat is a Java application and is given 1 GB, the most of the three security labs, so it takes a few seconds longer to start. A student’s progress lasts while the lab runs.

  1. Open the Container page. Open Build on the bar and choose Run a container. Anybody may open it, and the Git lab and the SQL lab start with no account. Every other lab needs a free account: create one, sign in, then press Start.
  2. Find the lab. The Sample labs card lists every sample. Find WebGoat.
  3. Press Start. Start runs it as it is, in one press. Edit the file first opens the compose file so you can change it before you start.
  4. Open it. On the lab’s page there are two links, WebGoat and WebWolf. Open WebGoat, choose Register and make up a username and password for this copy. WebWolf is for the lessons that say to use it.

What to ask students to hand in

A screenshot of each lesson marked complete, with the lab’s own address visible, and for each a paragraph in their own words on why the weakness exists and how a developer prevents it. The second half tells you whether the lesson was understood or only clicked through.

The code on GitHub

The compose file runs WebGoat’s own public image, pinned to a version, behind a small nginx that sends the lab’s link on to WebGoat’s page. WebGoat is GPL-2.0 licensed and is not distributed by us.

A basic lesson on this lab

WebGoat Basics and WebGoat Basics 2 are small lessons worked in this lab, each starting with the rule that a student attacks their own copy and nothing else. In the first they check both websites are running from their terminal, register, open a first lesson and visit WebWolf. In the second they open the developer tools that almost every WebGoat lesson uses and see a response from the terminal.

A free personal account is given them on the Basics module, which is on Home, every college can copy them from the Library’s Basics folder, and a new college opens with them in a module called Lab Basics (Sample). They are deliberately small: they show a teacher what a lesson worked in a lab is, and the lab does the rest. Copy one into a module of your own to change it.

Set it as work

Say in the task which lessons to complete and what to hand in.

  1. Make the lab. In your module add a task and choose the Container lab card, then In a GitHub repository. Give https://github.com/mitsurutech/lab-webgoat with the branch main. The compose file is the default, compose.yaml. Fork the repository first if you want to change it.
  2. Publish and try it. Publish pins the commit you were shown, so a later change in the repository does not alter a lab you have already set. Start your own copy first.
  3. Hand it out. Assign it like any task, with a due date if you want one, and say in the task what to do and what to hand in.
  4. Mark what is handed in. Open a student’s copy and the work they handed in, mark it, and send it back with a reason if it needs more.

Questions people ask

What is WebWolf?
A second application that comes with WebGoat, for the lessons that need a party other than the student, such as a place to receive a message. The lab’s page has a link to each.
Is progress kept when the lab stops?
No. A student’s lessons last while the lab runs, so a long course is better done in sittings that each complete some lessons.
Is WebGoat suitable for work set for home?
Yes, because each lesson says what to do and is marked complete when the student does it. Ask for a screenshot of each completed lesson with the lab’s own address visible and a paragraph on why the weakness exists and how a developer prevents it; progress lasts only while the lab runs.