What you will do
WebGoat is a course in web security that runs as a website. Each lesson explains a weakness and then asks you to use it, and ticks itself off when you do. In this lesson you register, open your first lesson and see WebWolf, the second website that comes with it.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. WebGoat is a Java program and goes on starting for about a minute after the bar says it is running: if step 1 prints 502 for WebGoat, wait a minute and press Run again. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Check both websites are running
WebGoat and WebWolf are two websites in one lab. 200 means a website answered with its sign-in page. 502 means it is still starting.
curl -s -o /dev/null -w "%{http_code}\n" http://web/WebGoat/loginShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
curl -s -o /dev/null -w "%{http_code}\n" http://web:9090/WebWolf/loginShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Register
Press the first link on the lab bar, WebGoat. Choose Register, make up a username and a password (nobody else can see this copy, so any will do), agree to the terms and submit. The lesson list opens.
3. Open a first lesson
Open Introduction in the menu on the left and read the WebGoat page. Then open General, then HTTP Basics. Read it, type your name in the box and press Go!: the server reverses your name and shows it back, which is an HTTP request and its answer. The lesson goes on to more exercises, and each one ticks itself off in the menu when you get it right. WebGoat Basics 2 shows how to look at the request itself.
4. Visit WebWolf
Press the second link on the lab bar, WebWolf, and sign in with the same username and password. WebWolf is a second website that plays "the other person" in lessons that need one, for example to receive a message or a file. Each lesson tells you when to use it.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. WebGoat is a whole course in one lab, with a tick against each lesson a student finishes. The lab sends nothing to you: ask for a screenshot of the ticked lessons and a sentence on one weakness in their own words. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.