Re: need help with webgoat

[chris () learnsecurityonline com]

with Version 3 it was in the source, with Version 4 which i am assuming you are using you have to append &admin=true

below is an exerpt from our answer key:

----

4-3)  Remote Admin Access

Applications have an administrative interface that allows privileged users access to functionality that normal users 
are not able to see. On top of this the application server will often have an admin interface as well.

Our goal in this lesson is to gain access to the admin interface of Webgoat. While performing this exercise I 
discovered that Webgoat has one admin interface that is controlled via a URL parameter.

http://localhost/WebGoat/attack?admin=true 

http://192.168.0.102/WebGoat/attack?Screen=30&admin=true 

This gives us access easily by circumventing the authentication and gaining access.

Once we are able to gain access to the admin function we are able to see a lot of other subsections below the admin 
functions tab.

-We append out &admin=true to the end of our request to give us the extended Admin Functions menu.

-We then view our Product Information and User Information screens, ensuring we append &admin=true to the request

-Once we finish that we return to our Remote Admin Access screen to get credit for completing the challenge
----

hope that helps you out

Chris

-- 

Chris Gates, CISSP
C|EH, CPTS, MCP 2003, A+, Network+, Security+

Web:        https://www.learnsecurityonline.com

Learn Security Online, Inc.

* Security Games        * Simulators
* Challenge Servers     * Courses
* Mentor Led Training   * Hacklab Access

-------------------------------------------------------------------------
Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of 
sensitive data - personal, medical and financial - are exchanged, and 
stored. Consumers expect and demand security for this information. This 
whitepaper examines a few vulnerability detection methods - specifically 
comparing and contrasting manual penetration testing with automated 
scanning tools. Download "Automated Scanning or Manual Penetration 
Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------