WebScarab has a large amount of functionality, and as such can be quite intimidating to the new user. But, for the simplest case, intercepting and modifying requests and responses between a browser and HTTP/S server, there is not a lot that needs to be learned.

WebScarab is a framework for analysing web applications by operating as intercepting proxy, allowing the user to review and modify HTTP requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser.

Initially, I will assume that you have full unrestricted access to the Internet (that is, you are not behind a proxy). For the sake of simplicity, I will also assume that you are using Internet Explorer. If you need to use a proxy to get out of your corporate network, , see Chaining WebScarab onto another proxy

This is what WebScarab looks like at startup. There are a few major areas that might need explanation.

Firstly, the toolbar provides access to the various plugins, as well as the Summary window (main view), and messages (log) window.

The Summary window is split into two parts. On the top is a tree table which will show the layout of the sites that you have visited, and some attributes of the various URLs. Below that is a table showing all of the conversations that have been seen by WebScarab, normally sorted in reverse by ID, so that more recent conversations are at the top of the table. The sort order can be changed by clicking in the column headers if desired.

In order to start using WebScarab as a proxy, you need to configure your browser to use WebScarab as a proxy. This is configured in IE using the Tools menu. Select Tools -> Internet Options -> Connections -> LAN Settings to get the proxy configuration dialog.

WebScarab defaults to using port 8008 on localhost for its proxy. You need to configure IE to relay requests to WebScarab, rather than fetching them itself, as shown in the above image. Make sure that all checkboxes are unchecked, except for 'Use a proxy server'. Once you have configured IE to use the proxy, select Ok on all dialogs to get back to the browser. Browse to a non-SSL website, and then switch to WebScarab.

You should see something similar to the next image. Programs similar to screamer radio. If you don't, or you get an error while browsing, you should go back and check your proxy settings in Internet Explorer as described above. If the proxy settings are correct, one possibility is that there is already another program that is using port 8008, and preventing WebScarab from using it. If so, you should stop that other program. I will also show you how to tell WebScarab how to use a different port a bit later.

NOTE: If you are using WebScarab to test a site that is running the same computer as the browser (i.e. localhost or 127.0.0.1), and you are using IE7, you will need to add a dot '.' after the hostname to force IE7 to use the proxy that you have configured. This is NOT a bug in WebScarab, but an unfortunate design decision (I assume) made by the developers of IE. Basically, it will ignore any proxy settings if it thinks that the server you are trying to reach is on the local machine. One way of tricking it is to add the dot, as in http://localhost./WebGoat/attack. This will force IE to use your configured proxy.

Here you can see the tree of URL's, which represents the site layout, as well as the individual conversations that have passed through WebScarab. To see the details of a particular conversation, you can double-click on a row in the table, and a window showing the request and the details of the response will open. You can see the request and response in a variety of forms. The view shown here is the 'Parsed' view, where the headers are broken out into a table, and the request or response content is presented according to its Content-Type header. You can also choose the 'Raw' format, where the request or response is presented exactly as it would be seen on the wire.

You can step from one conversation (request/response) to the next in the conversation window using the 'previous' and 'next' buttons, as well as jumping directly to a particular conversation using the drop down combo box.

Now that you are familiar with the basic workings of WebScarab, and have made sure that your browser is correctly configured, the next step is to intercept some requests, and modify them before they are sent to the server.

You enable proxy intercepts via the Proxy plugin, accessible via the 'Proxy' button on the toolbar. Then choose the 'Manual Edit' tab. Once you click the 'Intercept Requests' checkbox, you can choose which request methods you wish to intercept (most commonly GET or POST), and can even choose multiple methods using 'Ctrl-click'. Select 'GET' for the moment.

Now go back to your browser, and click on a link. You should see something like the following window appear (it may only flash in the task bar initially, just select it. Future windows will pop-up properly).

You can now edit any part of the request you choose. Note that the headers are shown already URL-decoded, and anything that you type in will be URL-encoded automatically. If you do not want this to happen, you should use the Raw mode. In some cases, using the Raw mode may be the easiest anyway, especially if you have something that you wish to paste in.

Once you are happy with your changes, click on the 'Accept changes' button to allow the modified request to be sent to the server. If you decide that you wish to revert the changes that you have made so far, you can click on the 'Cancel changes' button to allow the original request to be sent to the server. You can also click on the 'Abort request' button if you don't want to send a request to the server at all. This will send an error back to the browser. Finally, if there are multiple intercept windows opened (e.g the browser is using several threads simultaneously), you can release all the requests using the 'Cancel ALL intercepts' button.

WebScarab will continue to intercept all requests that match the method you specified until you uncheck the 'Intercept requests' checkbox, either in the intercept conversation window, or in the 'Manual Edit' tab of the Proxy plugin. But you may be wondering why WebScarab does not intercept requests for images, stylesheets, javascript, etc. If you go back to the 'Manual Edit' tab, you will see a field labeled 'Exclude paths matching:'. This field contains a regular expression which is matched against the request URL. If there is a match, the request is never intercepted.

You can also configure WebScarab to intercept responses, in case you want to change the behaviour of some parts of the page. For example, you can disable JavaScript validation, change the list of possible items in a SELECT field, etc.

Tips and tricks

If you are using IE and you would like WebScarab to automatically update your proxy settings for you, you need to complete the following steps. Note: This only works with the -installer version of WebScarab!

• Change to the Full-Featured interface (Tools -> Use Full-featured Interface), then go to the Proxy->Listeners tab.
• Select the only listener showing, and click 'Stop'.
• About 2/3 of the way down the screen are several input fields, corresponding to the columns in the listener table.
• Each box should be filled in with the value from the most recently stopped proxy.
• At this point, you can check the 'Primary' checkbox, and then click 'Start'.

Your IE proxy settings will automatically be updated to point to WebScarab, and will be reset when you exit WebScarab. This setting will be saved, and used on subsequent runs of WebScarab.

This guide describes how to install and run WebGoat.

WebGoat contains 28 lessons, 4 labs, and 4 developer labs. Two distributions are available, depending on what you would like to do.

Please take note we DO NOT promote pirated materials or links that promote such things. The first 90 days michael watkins rapidshare. • No torrent links. Rules: • When submitting a post or link remember to keep the title's sweet, short, and succinct.

1. Easy-run package The easiest version to play with. The easy-run package is a platform-independent executable jar file, so it has minimal muss and fuss. Since this distribution does not include source, you cannot complete the 4 developer labs. Pre-requisites : Java JRE >= 1.6

2. Source distribution Allows modifying the source code of WebGoat. WebGoat is a standard Maven project. This is the right choice if you wish to complete the developer labs, or you wish to contribute to WebGoat. Pre-requisites -- Java JDK >= 1.6, Maven >= 3

How To Install Webscarab In Windows 7

Use this feature comparison to choose the right distribution for you

• Easy-run distribution: https://webgoat.atlassian.net/builds/browse/WEB-WGM/latestSuccessful/artifact/shared/WebGoat-Embedded-Tomcat/WebGoat-6.0.1-war-exec.jar
• Source distribution: https://github.com/WebGoat/WebGoat-Legacy

1. Install a Java JVM. You can get one here http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

2. Download WebGoat. https://webgoat.atlassian.net/builds/browse/WEB-WGM/latestSuccessful/artifact/shared/WebGoat-Embedded-Tomcat/WebGoat-6.0.1-war-exec.jar

3. Make Sure Java is in your path This should already be the case after you install Java. If it is not, add it to your path

4. Run WebGoat by executing this command in the same directory you downloaded WebGoat into:

5. Verify it worked by pointing your browser to http://localhost:8080/WebGoat. You should see a signin screen.

That's it! If you need to change the port or other options, you can use --help to display more options. For example, to run WebGoat on port 9090, you can run:

1. Install the Prerequisites Minimally, this is a JDK and Maven, but it may include an IDE Git if you do not have them.

2. Download the source from https://github.com/WebGoat/WebGoat-Legacy You'll want to clone it if you intend to contribute, otherwise you can just download an archive

3. Run WebGoat with Maven Change to the project location, and run:

4. Verify it worked by pointing your browser to http://localhost:8080/WebGoat. You should see a signin screen. How to download tv shows on ps3 2013.

5. Open with your IDE to modify the source. WebGoat is a standard maven project, so you should be able to import it with most any IDE

Note: If Tomcat7 is not specified, WebGoat will throw exceptions in some lessons.

All you need to run WebGoat is a Java VM, but you'll need the standard Java development tooling to use the source distribution.

Easy-run Prerequisites

Any JRE >= 1.6 will work. You an download one for your platform here: http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

How To Install Webscarab In Windows 8

Source Distribution Prerequisites

To run from source, you'll need a standard Java development environment. If you are already a Java developer, you've likely got the tooling you need.

1. Java JDK. A JRE distribution will not do. We recommend version 7 http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

2. Maven. We recommend maven 3.2.3. Maven is all that is required to compile, package, and run WebGoat. http://maven.apache.org/

Note: Many IDE's come bundled with Maven already, so you may not need to download separately

Optional Items, especially if you are contributing to WebGoat

Acpi driver windows 7 lenovo disk. Depending on your preferences, you may want a few other items:

1. Java IDE (Optional) A Java IDE is highly recommended if you will be contributing to WebGoat, or otherwise spending a lot of time in the WebGoat source code. Any Java IDE with Maven support will do. If you are open, we recommend NetBeans 8, JavaEE edition, because it includes all of the other software you will needhttps://netbeans.org/downloads/

We recommend the Netbeans JavaEE distribution, which includes maven 3, git support, and Tomcat as well.

How To Install Webscarab In Windows 7

2. Git (Optional) Only if you wish to contribute to WebGoat. You have serveral choices for Git support:

   • Netbeans: Git support is built in
   • Eclipse : we recommend the egit plugin
   • Native installation of git ( depending on your operating system)

3. Your Own Servlet Container (Optional) If you insist, you can install WebGoat in your own servlet container. This is NOT the recommended method, as it requires you to add webgoat users to your container configuration.