\nWhy is this OWASP Top 10 course using OWASP Webgoat, and what is it?<\/h2>\n<\/blockquote>\n\n\n\n
OWASP WebGoat is an insecure web application purposely developed to assist with Java-based application testing against the most prevalent web application vulnerabilities, namely the OWASP Top 10. Along with OWASP WebGoat, the OWASP WebWolf application <\/mark><\/strong><\/a>can be used to effectively simulate out-of-band attacks. WebGoat and WebWolf come as jar files, Docker images, and source code, which make them suitable for our OWASP Top 10 training purposes. <\/p>\n\n\n\n
How to Set Up a Safe Environment for OWASP Webgoat and WebWolf<\/h3>\n\n\n\n
As such, this is an excellent way to become knowledgeable in web application hacking and Docker usage for lab set-up. Please bear in mind that this is a deliberately vulnerable web application, so it should never be installed on a host machine. To demonstrate the proper way of setting up a secure lab, I will begin with a Debian 9 Virtual Machine running on Virtualbox, as illustrated in my YouTube video. For now, we will assume that you already have a Debian 9 VM on your preferred virtualization software. I’m using VirtualBox in my situation.<\/p>\n\n\n\n
\nHow to set up Webgoat and WebWolf using the JAR for OWASP<\/h2>\n<\/blockquote>\n\n\n\n
If you want to utilize Docker <\/mark><\/strong><\/a>in your OWASP Top 10 learning process, feel free to disregard this portion. I included it here so you would know how to set up Java on your computer. Possessing the ability to install packages is an invaluable aptitude in the process of becoming knowledgeable. It provides the opportunity to explore and experiment with new software, especially with the burgeoning amount of open-source programs released daily.<\/p>\n\n\n\n
\nSetting up Java<\/p>\n<\/blockquote>\n\n\n\n
After establishing a connection with your Debian 9 guest machine, execute the necessary commands. If you experience any difficulties, be sure to consult the blog<\/a><\/mark><\/strong>.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
\nRun the OWASP WebGoat program.<\/p>\n<\/blockquote>\n\n\n\n
<\/figure>\n\n\n\n
By default, WebGoat<\/em> can only be accessed from localhost, however, you can configure it to listen on all interfaces by setting the server. address option to 0.0.0.0.<\/p>\n\n\n\n
\nRun the OWASP WebWolf download<\/p>\n<\/blockquote>\n\n\n\n
<\/figure>\n\n\n\n
\nHow to install Docker’s OWASP Webgoat<\/p>\n<\/blockquote>\n\n\n\n
When it comes to OWASP Top 10 training and overall hacking exploration, Docker offers plentiful benefits in comparison to a traditional Java environment. Without any additional dependency setup and configuration, one simple command launches both Webgoat and Webwolf. Furthermore, this tool will enable an effortless setup for any other application you might come across.<\/p>\n\n\n\n
\nSetup Docker<\/h2>\n<\/blockquote>\n\n\n\n
I strongly advise against installing Docker using a one-time script as outlined in its documentation. Developing an understanding of the code you are running on your machines is essential. This article is based on the official Docker documentation for Debian and offers the following steps as guidance.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
You ought to receive an answer along these lines.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
\nRun OWASP WebGoat for Docker after downloading it.<\/p>\n<\/blockquote>\n\n\n\n
Execute both WebGoat and WebWolf simultaneously. Pay attention to setting the TZ environment variable correctly to ensure that the JWT challenges are properly functional. The timezone used should be determined by the location of the machine hosting these applications, and the following list of time zones should help with that.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
\nOWASP WebGoat testing with our setup<\/p>\n<\/blockquote>\n\n\n\n
Now that we have launched both OWASP WebGoat and WebWolf, we can test them to ensure that they are compatible with OWASP ZAP or Burp Suite. To do this, open either of these programs and select the FoxyProxy add-on as your proxy. For instructions on installing and configuring FoxyProxy, please follow this link. After this is completed, open up http:\/\/your-machine-ip:8080\/WebGoat, using your machine’s IP address for ‘your-machine-ip.’ If everything went as planned, you should be presented with a login screen similar to the screenshot provided.<\/p>\n\n\n
\n<\/figure><\/div>\n\n\n
\nOWASP WebWolf configuration being tested<\/p>\n<\/blockquote>\n\n\n\n
![\"\"](\"https:\/\/reconcybersecurity.com\/wp-content\/uploads\/2023\/02\/8-4.png\")
<\/figure>\n\n\n\n