What is WebGoat?
According to OWASP site: WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat.
There are other 'goats' such as WebGoat for .Net. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat applications. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application aims to provide a realistic teaching environment, providing users with hints and code to further explain the lesson.
There are many ways to setup WebGoat in your Windows machine:
According to OWASP site: WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat.
There are other 'goats' such as WebGoat for .Net. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat applications. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application aims to provide a realistic teaching environment, providing users with hints and code to further explain the lesson.
There are many ways to setup WebGoat in your Windows machine:
- Using Docker
- Standalone setup with Java
- Cloning it from the Github repository then compiling with Maven
In this tutorial, we will be setting up WebGoat with Java. So first, let's make sure that you have the following:
- Java installed in your system. You can download the latest version here.
- The WebGoat .jar file which can be downloaded from here. Make sure you get the latest one under the The OWASP WebGoat Release. At the time of writing this tutorial, I can download version 7.1.
Great! Now that we have the two prerequisites above, we can proceed with the setup.
1. Open you command prompt as an Administrator.
2. Open the directory where you put the webgoat .jar file you just downloaded in the terminal using CD command. In my case I saved it to Downloads folder so I am going to type:
cd %UserProfile%\Downloads
3. Now, you should be in the right directory. Type the following command:
java -jar webgoat-container-7.1-exec.jar
*webgoat-container-7.1-exec.jar is the filename of the downloaded .jar file
You can also add additional parameter to open webgoat in different port aside from 8080
java -jar webgoat-container-7.1-exec.jar --server.port=9090
4. Press Enter and let it initialize.
5. If you see the message below, you are good to go! You can now access WebGoat via 127.0.0.1:8080/WebGoat
*8080 since I didn't change the default port. You can change this with the --server.port parameter in case there are already services running on port 8080 in your machine.
Cheers!