WebGoat is an open-source web application developed by OWASP (Open Web Application Security Project) for the purpose of teaching and learning about web application security vulnerabilities and how to mitigate them. It is designed to be deliberately vulnerable, allowing users to practice exploiting and addressing various security issues in a safe and controlled environment.

Learning and practicing web application security can be challenging. Few individuals possess fully functional web applications like online bookstores or online banks that can serve as testing grounds for vulnerability scanning. Moreover, security professionals often require a vulnerable platform to assess the efficacy of testing tools in a controlled environment, ensuring their expected performance. All of this must occur within a secure and legally permissible context.

It's essential to emphasize that even with good intentions, attempting to uncover vulnerabilities without proper authorization is strongly discouraged. The fundamental aim of the WebGoat project is straightforward: establish an interactive educational platform for web application security. Looking ahead, the project team envisions expanding WebGoat's role into a security benchmarking platform and a Java-based website honeypot.

CAUTION 1: During program execution, the system will become extremely susceptible to attacks. For safe usage, it's advised to disconnect from the Internet while running this program. WebGoat's default configuration binds to localhost to minimize exposure.

CAUTION 2: This program is exclusively intended for educational purposes. Engaging in these techniques without proper authorization significantly increases the likelihood of detection. Unauthorized hacking attempts can result in severe consequences, including potential termination of employment by most organizations. Claiming research motives is typically ineffective, as such claims are often made by hackers.


Key Benefits of WebGoat

1. Hands-On Learning: WebGoat provides a hands-on and interactive learning experience for individuals interested in understanding common web application security vulnerabilities. Users can directly engage with real-world scenarios and vulnerabilities.
2. Safe Environment: Since WebGoat is intentionally vulnerable, users can practice their skills without any risk to real systems or applications. This controlled environment ensures that learning takes place in a safe and risk-free manner.
3. Comprehensive Coverage: The application covers a wide range of security vulnerabilities, including Cross-Site Scripting (XSS), SQL injection, Cross-Site Request Forgery (CSRF), and more. This comprehensive coverage allows users to explore different types of vulnerabilities.
4. Realistic Scenarios: WebGoat presents realistic scenarios that mimic vulnerabilities encountered in actual web applications. This authenticity enhances the learning experience by simulating real-world challenges.
5. Guided Learning: The application provides explanations, hints, and guidance on exploiting vulnerabilities and implementing proper mitigation measures. This support helps users learn and understand the concepts behind the vulnerabilities.
   
   

Key Features of WebGoat

1. Vulnerability Challenges: WebGoat includes a variety of challenges and lessons that focus on different security vulnerabilities. Each challenge presents a specific vulnerability scenario for users to identify and exploit.
2. Progress Tracking: The platform allows users to track their progress and completion of challenges, providing a sense of accomplishment as they advance through the lessons.
3. Built-in Hints: WebGoat offers hints and guidance for each challenge, helping users who may be stuck or seeking assistance to progress through the lessons.
4. Exploit Prevention: Some challenges in WebGoat also focus on implementing proper security measures to prevent the exploitation of vulnerabilities. This helps users understand both sides of the security equation: exploiting and securing.
5. Step-by-Step Instructions: The platform provides step-by-step instructions on how to set up and use the application, making it accessible even for those new to web application security.
6. Open Source: WebGoat is an open-source project, meaning that it can be freely accessed, used, and even contributed to by the community.
7. Extensibility: Users can modify and extend WebGoat to include new challenges, vulnerabilities, or lessons, allowing it to be customized to fit specific educational needs.

WebGoat serves as a valuable resource for individuals looking to enhance their understanding of web application security vulnerabilities and their mitigation strategies. It's widely used in training sessions, workshops, and educational programs to provide practical insights into the world of web application security.


Installing WebGoat on Docker

• Pull the latest WebGoat image from hub.docker.com repository then run.
  
  

  $ docker pull webgoat/webgoat:latest $ docker run --name webgoat -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat

  
  
• To access WebGoat, on the host machine, point the browser to https://localhost:8080/WebGoat
  
  Important: Choose the correct timezone, so that the docker container and the host are in the same timezone. As it is important for the validity of JWT tokens used in certain exercises.
  
  e.g.
  

  $ docker run -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/webgoat

  
  

WebWolf: An Autonomous Web Application Emulating Attacker Environments

WebWolf stands as an independent web application meticulously crafted to replicate an attacker's operational environment. This innovative tool serves a crucial purpose: facilitating a distinct demarcation between the activities unfolding on the targeted website and the specific actions undertaken in the role of an "attacker." The inception of WebWolf followed insightful feedback garnered from workshops, where participants underscored the necessity for a clear separation between the responsibilities assigned to the "attacker" and those undertaken by "users" during 

To access WebWolf, on the host machine, point the browser to https://localhost:9090



The following items are supported in WebWolf:

• Host a file: Upload a file needed to be downloaded during an assignment
  
• E-mail client: WebWolf serves a mail client with which we can easily simulate sending an e-mail.
  
• Landing page for incoming requests: WebWolf can serve as a landing page to which you can make a call from inside an assignment, giving you as the attacker information about the complete request. Think of it as a very simple form of netcat.
  
  

For more information about WebGoat, visit the following links:
https://owasp.org/www-project-webgoat
https://github.com/WebGoat/WebGoat
https://hub.docker.com/r/webgoat/goatandwolf