search

shailendra333 / webgoat

Automatically exported from code.google.com/p/webgoat
0 stars 0 forks source link

Stage 2 of Challenge can't be completed in Firefox 2.0.0.13, often doesn't work for IE 6.0, too #9

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Try to modify the cookie as per normal to White' or '1'='1
2. Turn on Show Cookies. You'll see no matter how often you modify the cookie, 
it'll never show up as White' or '1'='1
3. Fail. 

What is the expected output? What do you see instead?

SQL injection to occur, then win! No win. 

What version of the product are you using? On what operating system?

Latest from SVN. MacOS X 10.5, had about 10 failures today (and only one win) 
with IE 6.0 on XP SP2

Please provide any additional information below.

I think there's two possibilities:

Firefox is blocking the dodgy cookie. Maybe we need to encode it with base64 to 
make it a little more challenging and also 
Firefox proof.

WebScarab is not making the change stick and not passing it in. However, when I 
try another way, such as using Web 
Developer toolbar - edit cookie, it still fails.

Original issue reported on code.google.com by vande...@gmail.com on 4 Apr 2008 at 3:43

GoogleCodeExporter commented 9 years ago 
Perhaps you are modifying the wrong user=white.  This works fine for me in 
IE6/7 and
firefox. It's the cookie that must be modified not the hidden field.

I did notice the credit card numbers are no longer being displayed after the sql
injections.  You get a proceed to stage 3 without the credit card list. I will 
file
an issue for this.

Original comment by mayhe...@gmail.com on 4 Apr 2008 at 12:49