Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Misconfiguration in JWT's jku lesson #1715

Open
NightfoxHS opened this issue Dec 30, 2023 · 2 comments
Open

Misconfiguration in JWT's jku lesson #1715

NightfoxHS opened this issue Dec 30, 2023 · 2 comments

Comments

@NightfoxHS
Copy link

In the JWT's jku lesson, the lesson html page configure submission linkage as /WebGoat/JWT/final/delete?token=... . However, it should correspond to the controller whose path is /WebGoat/JWT/jku/delete?token=... , that sits in org.owasp.webgoat.lessons.jwt.claimmisuse.JWTHeaderJKUEndpoint.
I am not familiar with the the html framework this project use, but after checking it, it seems that this problem is still existing in current branch.
BTW, I also notice that the docker image can't show the quiz and can't upload file to webwolf, but I have no idea why they take place. I am using the newest docker image of webgoat on Ubuntu 22.04.
Appreciate for this project and maintainers, it indeed helps me gain more knowledge about web security.

Copy link

Thanks for submitting your first issue, we will have a look as quickly as possible.

@joonhwa
Copy link

joonhwa commented Feb 26, 2024

I was able to get around this config issue by using BurpSuite entirely to send the request to the correct endpoint and managed to successfully complete the assignment. However, the lesson still isn't marked as completed even though i get this response "Congratulations. You have successfully completed the assignment". Is there something missing?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants