What you will do
Almost every WebGoat lesson asks you to look at what your browser sends and receives. The tool for that is already in your browser: the developer tools. In this lesson you meet them, and see the same request from your terminal.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. WebGoat is a Java program and goes on starting for about a minute after the bar says it is running: if its page does not open yet, wait a minute and try again. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Open the developer tools lesson
Press the first link on the lab bar, WebGoat, and sign in (or register, if you did not in WebGoat Basics). Open General in the menu on the left, then Developer Tools. Read the first page: it says how to open the tools.
2. Open the tools
Right-click anywhere on the page and choose Inspect, or press Ctrl + Shift + I (Cmd + Option + I on a Mac). The tools open beside the page. The Elements tab shows the page's HTML: move over a line and the part of the page it draws turns blue. The lesson goes on to the other tabs, and each exercise ticks itself off when you get it right.
3. See a response from the terminal
The Network tab lists every request the browser makes, and what came back. The terminal can ask for a page too. -I shows only the answer's first part, the headers: the first line says 200, "here it is", and the rest says what kind of page it is. This is what the Network tab shows under a request.
curl -s -I http://web/WebGoat/loginShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. Developer tools are the first tool a web security student learns, and WebGoat teaches them inside the lab. The lab sends nothing to you: ask for a screenshot of the Network tab with one request open. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.