Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
OWASP's guided, lesson-by-lesson tour of how web apps break.
WebGoat is OWASP's teaching application. Unlike a free-for-all target, it walks you through one class at a time with instructions, a live form, and a -side check that only passes when you genuinely the bug. It is a step up from the trivial boxes because the lessons demand you actually land the attack, not just recognize it.
Your two objectives here: clear an injection lesson (user), then clear an access lesson ().
You are running this on your own machine. That is the only reason it is legal to attack it. Never point these techniques at an application you do not own or have written permission to test.
Docker and bring-your-own-VM boxes use proof revealed through the hints once you have genuinely completed the objective. Capture a flag by doing the work, then submitting the token. Phase B hosted machines will issue real per-instance flags planted on the target.
Spin the container up and load http://localhost:8080/WebGoat. a local
account, in, then work the objectives below. The lessons check your work
server-side, so a token is only fair once the lesson itself shows success. Use
the hints if you stall; each one costs a few points, so try on your own first.
Spin this up locally with Docker, then attack it from your Kali box.
$docker run --rm -p 8080:8080 webgoat/webgoatThen hit it at http://localhost:8080/WebGoat