Used to create database connections using the FileInputProperties.readfile method to gather property information
Initiated by Getter.java, Setter.java
This file is part of the Security Shepherd Project.
@@ -117,206 +114,242 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
closeConnection(java.sql.Connection conn)
-
-
- This method is used by the application to close an open connection to a database server
-
-
-
-static java.sql.Connection
-
getConnection(java.lang.String ApplicationRoot)
-
-
- This method is used by the application to get a connection to the secure database sever
-
-
-
-static java.sql.Connection
-
getVulnerableDbConnection(java.lang.String ApplicationRoot)
-
-
- This method is used by the application to get a connection to the vulnerable database sever
-Locates the database Properties File for Database manipulation methods. This file contains the application sign on credentials for the database.
+
+
+
+
public class FileInputProperties
+extends java.lang.Object
+
Locates the database Properties File for Database manipulation methods. This file contains the application sign on credentials for the database.
This file is part of the Security Shepherd Project.
@@ -116,165 +113,169 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
This file is part of the Security Shepherd Project.
@@ -116,764 +113,803 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
authUser(java.lang.String ApplicationRoot,
- java.lang.String userName,
- java.lang.String password)
-
-
- This method hashes the user submitted password and sends it to the database.
-
-
-
-static java.lang.String
-
checkPlayerResult(java.lang.String ApplicationRoot,
- java.lang.String moduleId,
- java.lang.String userId)
-
-
- Used to determine if a user has completed a module already
-
-
-
-static boolean
-
findPlayerById(java.lang.String ApplicationRoot,
- java.lang.String userId)
-
-
- Used to decipher whether or not a user exists as a player
-
-
-
-static java.util.ArrayList<java.lang.String[]>
-
getAllModuleInfo(java.lang.String ApplicationRoot)
-
-
- Used to gather all module information for internal functionality.
-
-
-
-static java.lang.String
-
getChallenges(java.lang.String ApplicationRoot,
- java.lang.String userId)
-
-
- Returns HTML menu for challenges.
getCsrfForum(java.lang.String ApplicationRoot,
- java.lang.String classId,
- java.lang.String moduleId)
-
-
- The CSRF forum is used in CSRF levels for users to deliver CSRF attacks against each other.
-
-
-
-static java.lang.String
-
getFeedback(java.lang.String applicationRoot,
- java.lang.String moduleId)
-
-
- Used to present a modules feedback, including averages and raw results.
-
-
-
-static java.lang.String
-
getIncrementalModules(java.lang.String ApplicationRoot,
- java.lang.String userId,
- java.lang.String csrfToken)
-
-
- This method prepares the incremental module menu.
-
-
-
-static java.lang.String
-
getLessons(java.lang.String ApplicationRoot,
- java.lang.String userId)
-
-
- Used to gather a menu of lessons for a user, including markers for each lesson they have completed or not completed
-
-
-
-static java.lang.String
-
getModuleAddress(java.lang.String ApplicationRoot,
- java.lang.String moduleId,
- java.lang.String userId)
-
-
- This method returns the address of a module based on the module identifier submitted.
-
-
-
-static java.lang.String
-
getModuleCategory(java.lang.String ApplicationRoot,
- java.lang.String moduleId)
-
-
- Retrieves the module category based on the moduleId submitted
getModuleResultFromHash(java.lang.String ApplicationRoot,
- java.lang.String moduleHash)
-
-
- Returns the result key for a module using the module's hash for the lookup procedure.
-
-
-
-static java.lang.String
-
getModulesInOptionTags(java.lang.String ApplicationRoot)
-
-
- Used in creating functionality that requires a user to select a module.
-
-
-
-static java.lang.String
-
getModulesInOptionTagsCTF(java.lang.String ApplicationRoot)
-
-
- Used in creating functionality that requires a user to select a module.
-
-
-
-static java.lang.String[]
-
getModuleSolution(java.lang.String ApplicationRoot,
- java.lang.String moduleId)
-
-
- Used to return a module cheat sheet
-
-
-
-static java.sql.ResultSet
-
getPlayersByClass(java.lang.String ApplicationRoot,
- java.lang.String classId)
-
-
- This method is used to gather users according by class.
-
-
-
-static java.lang.String
-
getProgress(java.lang.String applicationRoot,
- java.lang.String classId)
-
-
- Used to present the progress of a class in a series of loading bars
-
-
-
-static java.lang.String
-
getProgressJSON(java.lang.String applicationRoot,
- java.lang.String classId)
-
-
- Use to return the current progress of a class in JSON format with information like user name, score and completed modules
isUserLocked(java.lang.String ApplicationRoot,
- java.lang.String userName)
-
-
- Used by authentication to check if account is locked before continuing with authentication process.
This method hashes the user submitted password and sends it to the database.
- The database does the rest of the work, including Brute Force prevention.
-
-
-
Parameters:
userName - The submitted user name to be used in authentication process
password - The submitted password in plain text to be used in authentication
-
Returns:
A string array made up of nothing or information to be consumed by the initiating authentication process.
Returns HTML menu for challenges. Challenges are only referenced by their id,
- The user will have to go through another servlet to get the module's View address
-
-
-
Parameters:
ApplicationRoot - The current running context of the application
-
Returns:
HTML menu for challenges
-
-
-
-
-
-getClassCount
-
-public static int getClassCount(java.lang.String ApplicationRoot)
-
-
-
Parameters:
ApplicationRoot - The current running context of the application
-
Returns:
The amount of classes currently existing in the database
This method prepares the incremental module menu. This is when Security Shepherd is in "Game Mode".
+ along with the Security Shepherd project. If not, see .
This method hashes the user submitted password and sends it to the database.
+ The database does the rest of the work, including Brute Force prevention.
+
Parameters:
userName - The submitted user name to be used in authentication process
password - The submitted password in plain text to be used in authentication
+
Returns:
A string array made up of nothing or information to be consumed by the initiating authentication process.
This method is used to determine if a CSRF level has been completed. A call is made to the DB that returns the CSRF counter for a level. If this counter is greater than 0, the level has been completed
+
Parameters:
applicationRoot - Running context of the application
moduleHash - Hash ID of the CSRF module you wish to check if a user has completed
userId - the ID of the user to check
+
Returns:
True or False value depicting if the user has completed the module
public static java.lang.String getChallenges(java.lang.String ApplicationRoot,
+ java.lang.String userId)
+
Returns HTML menu for challenges. Challenges are only referenced by their id,
+ The user will have to go through another servlet to get the module's View address
+
Parameters:
ApplicationRoot - The current running context of the application
This method prepares the incremental module menu. This is when Security Shepherd is in "Game Mode".
Users are presented with one uncompleted module at a time. This method also returns a script to be executed every time the menu is chanegd.
- This is script defines the animation and operations to be carried out when the menu is interacted with
-
-
-
Parameters:
ApplicationRoot - The running context of the applicaiton.
userId - The user identifier of the user.
csrfToken - The cross site request forgery token
-
Returns:
A HTML menu of a users current module progress and a script for interaction with this menu
This method returns the address of a module based on the module identifier submitted.
+ This is script defines the animation and operations to be carried out when the menu is interacted with
+
Parameters:
ApplicationRoot - The running context of the application.
userId - The user identifier of the user.
csrfToken - The cross site request forgery token
+
Returns:
A HTML menu of a users current module progress and a script for interaction with this menu
This method returns the address of a module based on the module identifier submitted.
If user has not accessed this level before, they are put down as starting the level at this time.
If the level is a client side attack, or other issues that cannot be abused to return a result key (like XSS, CSRF or network sniffing)
- the address is of the core server. Otherwise the modules sit on the vulnerable application server
-
-
-
Parameters:
ApplicationRoot - The current running context of the application
moduleId - Identifier of the module the to return
userId - The identifier of the user that wants to get the module
-
Used in creating functionality that requires a user to select a module.
- This method only prepares the option tags for this type of input. It must still be wrapped in select tags.
-
-
-
Parameters:
ApplicationRoot - The current running context of the applicaiton
-
Used in creating functionality that requires a user to select a module.
- This method only prepares the option tags for this type of input. It must still be wrapped in select tags.
-
-
-
Parameters:
ApplicationRoot - The current running context of the applicaiton
-
This method is used to gather users according by class. Thanks to MySQL syntax, where class = null will return nothing, is null must be used.
+ the address is of the core server. Otherwise the modules sit on the vulnerable application server
+
Parameters:
ApplicationRoot - The current running context of the application
moduleId - Identifier of the module the to return
userId - The identifier of the user that wants to get the module
public static java.lang.String getModulesInOptionTags(java.lang.String ApplicationRoot)
+
Used in creating functionality that requires a user to select a module.
+ This method only prepares the option tags for this type of input. It must still be wrapped in select tags.
+
Parameters:
ApplicationRoot - The current running context of the application
public static java.lang.String getModulesInOptionTagsCTF(java.lang.String ApplicationRoot)
+
Used in creating functionality that requires a user to select a module.
+ This method only prepares the option tags for this type of input. It must still be wrapped in select tags.
+
Parameters:
ApplicationRoot - The current running context of the application
public static java.sql.ResultSet getPlayersByClass(java.lang.String ApplicationRoot,
+ java.lang.String classId)
+
This method is used to gather users according by class. Thanks to MySQL syntax, where class = null will return nothing, is null must be used.
is 'validClass' will Error, = 'validclass' must be used.
- So there are two proecureds this method calls. One that handles null classes, one that does not
-
-
-
Parameters:
ClassId - Identifier of class
ApplicationRoot - The current running context of the application
-
Returns:
ResultSet that contains users for the selected class
public static java.lang.String getTournamentModules(java.lang.String ApplicationRoot,
+ java.lang.String userId)
+
This method prepares the Tournament module menu. This is when Security Shepherd is in "Tournament Mode".
+ Users are presented with a list of that are specified as open.
+
Parameters:
ApplicationRoot - The running context of the application.
userId - The user identifier of the user.
csrfToken - The cross site request forgery token
+
Returns:
A HTML menu of a users current module progress and a script for interaction with this menu
This file is part of the Security Shepherd Project.
@@ -116,550 +113,827 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
addRestrictedUserToVulnerableDb(java.sql.Connection conn,
- java.lang.String userName,
- java.lang.String userPass,
- java.lang.String schemaName,
- java.lang.String tableName)
-
-
- Used to create a user the application can use to sign on as when interacting with a specific schema on the vulnerable database server
createModule(java.lang.String applicationRoot,
- java.lang.String challengeName,
- java.lang.String challengeType,
- java.lang.String challengeCategory,
- java.lang.String challengeSolution)
-
-
- Used to create a new module entry in the core database.
-
-
-
-static java.lang.String
-
createVulnerableSchema(java.sql.Connection conn,
- java.lang.String challengeName,
- java.lang.String tableName,
- java.lang.String[] attrib,
- int attribAmount)
-
-
- Used by the challenge builder to create a new schema on the vulnerable database server.
-
-
-
-static void
-
populateVulnerableSchema(java.sql.Connection conn,
- java.lang.String schemaName,
- java.lang.String theTable,
- java.lang.String[] data,
- java.lang.String[] attrib,
- int attribAmount)
-
-
- Used to populate the vulnerable schemas table with an array of attribues.
-
-
-
-static boolean
-
setStoredMessage(java.lang.String ApplicationRoot,
- java.lang.String message,
- java.lang.String userId,
- java.lang.String moduleId)
-
-
- Used by CSRF levels to store their CSRF attack string, that will be displayed in a CSRF forum for the class the user is in
-
-
-
-static boolean
-
updateCheatSheet(java.lang.String applicationRoot,
- java.lang.String moduleId,
- java.lang.String newSolution)
-
-
- Used to update a module's cheat sheet
-
-
-
-static boolean
-
updateCsrfCounter(java.lang.String ApplicationRoot,
- java.lang.String moduleId,
- java.lang.String userId)
-
-
- Used to increment a users CSRF counter for CSRF levels.
updatePlayerClass(java.lang.String ApplicationRoot,
- java.lang.String classId,
- java.lang.String playerId)
-
-
- Updates a PLAYER's class identifier
-
-
-
-static java.lang.String
-
updatePlayerClassToNull(java.lang.String ApplicationRoot,
- java.lang.String playerId)
-
-
- Updates a PLAYER's class identifier to null
-
-
-
-static java.lang.String
-
updatePlayerResult(java.lang.String ApplicationRoot,
- java.lang.String moduleId,
- java.lang.String userId,
- java.lang.String extra,
- int before,
- int after,
- int difficulty)
-
-
- Updates a users result of a specific module
-
-
-
-static java.lang.String
-
updateUserRole(java.lang.String ApplicationRoot,
- java.lang.String playerId,
- java.lang.String newRole)
-
-
- Updates a USER's role
-
-
-
-static boolean
-
userCreate(java.lang.String ApplicationRoot,
- java.lang.String classId,
- java.lang.String userName,
- java.lang.String userPass,
- java.lang.String userRole,
- java.lang.String userAddress,
- boolean tempPass)
-
-
- Used by many functions to create players or admins
Used to create a new module entry in the core database. The database will handle creating the new module identifier and module hash.
- The module has will be returned form the database, and if it does not start will a letter, the applicaiton will update the database to reflect a hash starting with a letter, without safrifising the uniqueness of the hash
-
-
-
Parameters:
applicationRoot - The current running context of the application
challengeName - The name of the module to create
challengeType - The type of module to create
challengeCategory - The category of the new challenge
challengeSolution - The solution of the new challenge
-
Used to create a new module entry in the core database. The database will handle creating the new module identifier and module hash.
+ The module has will be returned form the database, and if it does not start will a letter, the application will update the database to reflect a hash starting with a letter, without sacrificing the uniqueness of the hash
+
Parameters:
applicationRoot - The current running context of the application
challengeName - The name of the module to create
challengeType - The type of module to create
challengeCategory - The category of the new challenge
challengeSolution - The solution of the new challenge
isUserSpecificKey - Is the Key for this level a user specific key or is it hard coded
This method is used to store a CSRF Token for a specific user in the csrfChallengeSeven DB Schema. May not necessarily be a new CSRF token after running
+
Parameters:
userId - User Identifier
csrfToken - CSRF Token to add to the csrfChallengeSix DB Schema
ApplicationRoot - Running context of the application
-This API (Application Programming Interface) document has pages corresponding to the items in the navigation bar, described as follows.
-Overview
-
-
-
-The Overview page is the front page of this API document and provides a list of all packages with a summary for each. This page can also contain an overall description of the set of packages.
-
-Package
-
-
-
-Each package has a page that contains a list of its classes and interfaces, with a summary for each. This page can contain four categories:
-
Interfaces (italic)
Classes
Enums
Exceptions
Errors
Annotation Types
-
-
-Class/Interface
-
-
-
-Each class, interface, nested class and nested interface has its own separate page. Each of these pages has three sections consisting of a class/interface description, summary tables, and detailed member descriptions:
-
Class inheritance diagram
Direct Subclasses
All Known Subinterfaces
All Known Implementing Classes
Class/interface declaration
Class/interface description
-
-
Nested Class Summary
Field Summary
Constructor Summary
Method Summary
-
-
Field Detail
Constructor Detail
Method Detail
-Each summary entry contains the first sentence from the detailed description for that item. The summary entries are alphabetical, while the detailed descriptions are in the order they appear in the source code. This preserves the logical groupings established by the programmer.
-
-
-Annotation Type
-
-
-
-Each annotation type has its own separate page with the following sections:
-
Annotation Type declaration
Annotation Type description
Required Element Summary
Optional Element Summary
Element Detail
-
-
-
-Enum
-
-
-
-Each enum has its own separate page with the following sections:
-
Enum declaration
Enum description
Enum Constant Summary
Enum Constant Detail
-
-
-Use
-
-Each documented package, class and interface has its own Use page. This page describes what packages, classes, methods, constructors and fields use any part of the given class or package. Given a class or interface A, its Use page includes subclasses of A, fields declared as A, methods that return A, and methods and constructors with parameters of type A. You can access this page by first going to the package, class or interface, then clicking on the "Use" link in the navigation bar.
-
-Tree (Class Hierarchy)
-
-There is a Class Hierarchy page for all packages, plus a hierarchy for each package. Each hierarchy page contains a list of classes and a list of interfaces. The classes are organized by inheritance structure starting with java.lang.Object. The interfaces do not inherit from java.lang.Object.
-
When viewing the Overview page, clicking on "Tree" displays the hierarchy for all packages.
When viewing a particular package, class or interface page, clicking "Tree" displays the hierarchy for only that package.
-
-
-Deprecated API
-
-The Deprecated API page lists all of the API that have been deprecated. A deprecated API is not recommended for use, generally due to improvements, and a replacement API is usually given. Deprecated APIs may be removed in future implementations.
-
-Index
-
-The Index contains an alphabetic list of all classes, interfaces, constructors, methods, and fields.
-
-Prev/Next
-These links take you to the next or previous class, interface, package, or related page.
-Frames/No Frames
-These links show and hide the HTML frames. All pages are available with or without frames.
-
-
-Serialized Form
-Each serializable or externalizable class has a description of its serialization fields and methods. This information is of interest to re-implementors, not to developers using the API. While there is no link in the navigation bar, you can get to this information by going to any serialized class and clicking "Serialized Form" in the "See also" section of the class description.
-
This API (Application Programming Interface) document has pages corresponding to the items in the navigation bar, described as follows.
+
+
+
+
+
Overview
+
The Overview page is the front page of this API document and provides a list of all packages with a summary for each. This page can also contain an overall description of the set of packages.
+
+
+
Package
+
Each package has a page that contains a list of its classes and interfaces, with a summary for each. This page can contain six categories:
+
+
Interfaces (italic)
+
Classes
+
Enums
+
Exceptions
+
Errors
+
Annotation Types
+
+
+
+
Class/Interface
+
Each class, interface, nested class and nested interface has its own separate page. Each of these pages has three sections consisting of a class/interface description, summary tables, and detailed member descriptions:
+
+
Class inheritance diagram
+
Direct Subclasses
+
All Known Subinterfaces
+
All Known Implementing Classes
+
Class/interface declaration
+
Class/interface description
+
+
+
Nested Class Summary
+
Field Summary
+
Constructor Summary
+
Method Summary
+
+
+
Field Detail
+
Constructor Detail
+
Method Detail
+
+
Each summary entry contains the first sentence from the detailed description for that item. The summary entries are alphabetical, while the detailed descriptions are in the order they appear in the source code. This preserves the logical groupings established by the programmer.
+
+
+
Annotation Type
+
Each annotation type has its own separate page with the following sections:
+
+
Annotation Type declaration
+
Annotation Type description
+
Required Element Summary
+
Optional Element Summary
+
Element Detail
+
+
+
+
Enum
+
Each enum has its own separate page with the following sections:
+
+
Enum declaration
+
Enum description
+
Enum Constant Summary
+
Enum Constant Detail
+
+
+
+
Use
+
Each documented package, class and interface has its own Use page. This page describes what packages, classes, methods, constructors and fields use any part of the given class or package. Given a class or interface A, its Use page includes subclasses of A, fields declared as A, methods that return A, and methods and constructors with parameters of type A. You can access this page by first going to the package, class or interface, then clicking on the "Use" link in the navigation bar.
+
+
+
Tree (Class Hierarchy)
+
There is a Class Hierarchy page for all packages, plus a hierarchy for each package. Each hierarchy page contains a list of classes and a list of interfaces. The classes are organized by inheritance structure starting with java.lang.Object. The interfaces do not inherit from java.lang.Object.
+
+
When viewing the Overview page, clicking on "Tree" displays the hierarchy for all packages.
+
When viewing a particular package, class or interface page, clicking "Tree" displays the hierarchy for only that package.
+
+
+
+
Deprecated API
+
The Deprecated API page lists all of the API that have been deprecated. A deprecated API is not recommended for use, generally due to improvements, and a replacement API is usually given. Deprecated APIs may be removed in future implementations.
+
+
+
Index
+
The Index contains an alphabetic list of all classes, interfaces, constructors, methods, and fields.
+
+
+
Prev/Next
+
These links take you to the next or previous class, interface, package, or related page.
+
+
+
Frames/No Frames
+
These links show and hide the HTML frames. All pages are available with or without frames.
+
+
+
All Classes
+
The All Classes link shows all classes and interfaces except non-static nested types.
+
+
+
Serialized Form
+
Each serializable or externalizable class has a description of its serialization fields and methods. This information is of interest to re-implementors, not to developers using the API. While there is no link in the navigation bar, you can get to this information by going to any serialized class and clicking "Serialized Form" in the "See also" section of the class description.
Session Management Challenge Five SessionManagement5SetToken
+ (Does not Return Result Key)
+
+ This function is a shell to give the appearance that a token has been set for a user.
This method when called by an administrator toggles the availability of the registraion functionality,
- This is actually performed by the OpenRegistration.toggle() method.
-
Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
- this method checks the existace of the submitted module identifier before ensuring that the submission is correct.
-
Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
-
If this method is called by a valid administrator the site.properties file that contains the database information required to make a connection is updated
This method when called by an administrator toggles the availability of the registraion functionality,
+ This is actually performed by the OpenRegistration.toggle() method.
A user with the submitted email address is set a new random password, the password is also returned from the database procedure and is forwards through to the HTTP response.
Users must take advance of the broken session management in this application by modifying the tracking cookie "challengeRole" which is encoded in ATOM-128.
Users must take advance of the broken session management in this application by modifying the tracking cookie "currentPerson" which is encoded in Base64.
Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
+ this method checks the existence of the submitted module identifier before ensuring that the submission is correct.
Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
Cross Site Request Forgery Lesson
- Currently does not use user specific result key because of current CSRF blanket rule
+
+
+
+
+
+E-Index
+
+
+
+
+
+
+
+
public class ChangePassword
+extends javax.servlet.http.HttpServlet
+
Control class for the Change Password function
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by index.jsp, getStarted.jsp. This changes a users password. If the user gets it wrong 3 times in a row, they'll be locked out (This is handed by database)
-
-
-
Overrides:
doPost in class javax.servlet.http.HttpServlet
-
-
-
Parameters:
csrfToken -
currentPassword - User's current password
newPassword - Submitted new password
passwordConfirmation - Confirmation of the new password
-
Initiated by index.jsp, getStarted.jsp. This changes a users password. If the user gets it wrong 3 times in a row, they'll be locked out (This is handed by database)
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
csrfToken -
currentPassword - User's current password
newPassword - Submitted new password
passwordConfirmation - Confirmation of the new password
public class GetJsonScore
+extends javax.servlet.http.HttpServlet
+
This control class returns a JSON array containing Scoreboard data for a class defined in utils.ScoreboardStatus
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Used to return an administrator with the current progress of each player in a class.
+ This will require a complex client page to parse the returned JSON information to make a very pretty score board
public class Login
+extends javax.servlet.http.HttpServlet
+
Control class for the authentication procedure.
This file is part of the Security Shepherd Project.
@@ -121,222 +127,218 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily.
- This method takes the credentials submitted and determines if they are correct. If they are correct, a session is prepared for the user and they are assigned a CSRF token.
-
Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily.
+ This method takes the credentials submitted and determines if they are correct. If they are correct, a session is prepared for the user and they are assigned a CSRF token.
public class Logout
+extends javax.servlet.http.HttpServlet
+
Control class for the logout operation
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class MobileLogin
+extends javax.servlet.http.HttpServlet
+
Control class for the authentication procedure. Response tuned for Shepherd Mobile Auth
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily.
+ This method takes the credentials submitted and determines if they are correct. If they are correct, a session is prepared for the user and they are assigned a CSRF token.
This file is part of the Security Shepherd Project.
@@ -116,239 +113,231 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class Register
+extends javax.servlet.http.HttpServlet
+
Control class for the Registration process.
This file is part of the Security Shepherd Project.
@@ -121,223 +127,245 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by register.jsp. If successful a player is added to the system, otherwise there is no change.
+ along with the Security Shepherd project. If not, see .
Initiated by register.jsp. If successful a player is added to the system, otherwise there is no change.
Adding the player to the database is handled by the dbProcs.Setter class. Email is stored for future application expansion
- This function will request requests if the application's registration functionality has been marked as closed by administration.
-
public class CreateCheat
+extends javax.servlet.http.HttpServlet
+
Control class for the Create Cheat sheet function.
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- This method validates input and then attempts to update the cheat sheet for the specified module
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class DisableCheats
+extends javax.servlet.http.HttpServlet
+
Control class responsible for disabling cheat sheets
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- If this functionality is validly called by an administrator, the cheat sheets will become or remain unavailable.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class EnableCheats
+extends javax.servlet.http.HttpServlet
+
Control class responsible for enabling cheat sheet functionality
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- If this functionality is validly called by an administrator, the cheat sheets will become or remain unavailable.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class GetCheat
+extends javax.servlet.http.HttpServlet
+
Control class responsible for returning a cheat sheet for a module
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- This method will reject requests if cheat sheet availability is marked as unavailable by administration.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class ChangeCoreDatabase
+extends javax.servlet.http.HttpServlet
+
This class is responsible for requests to configure the applications core database sign on information.
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
If this method is called by a valid administrator the site.properties file that contains the database information required to make a connection is updated
If this method is called by a valid administrator the site.properties file that contains the database information required to make a connection is updated
public class DisableFeedback
+extends javax.servlet.http.HttpServlet
+
This class is responsible for requests to configure the applications Feedback Status. It is used specifically to disable feedback
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DisableScoreboard
+extends javax.servlet.http.HttpServlet
+
This is the control class for disabling the the user accessible scoreboard
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Initiated by assignPlayers.jsp. A number of players can be assigned to a new class. Changing the actual class of the player is handed by Setter.changePlayerClass
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
classId - The identifier of the class to add the players to
players[] - An array of player identifiers to add to the specified class
public class EnableFeedback
+extends javax.servlet.http.HttpServlet
+
This class is responsible for requests to configure the applications Feedback Status. It is used specifically to enable feedback
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class EnableScoreboard
+extends javax.servlet.http.HttpServlet
+
This is the control class for enabling the the user accessible scoreboard
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Initiated by assignPlayers.jsp. A number of players can be assigned to a new class. Changing the actual class of the player is handed by Setter.changePlayerClass
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
classId - The identifier of the class to add the players to
players[] - An array of player identifiers to add to the specified class
public class SetCtfMode
+extends javax.servlet.http.HttpServlet
+
Control class that modifies the server floor plan to a CTF/Incremental state. This is due a name change
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SetOpenFloorMode
+extends javax.servlet.http.HttpServlet
+
This control class is responsible for achieve the server functionality section of the Open Floor Schema
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SetTournamentMode
+extends javax.servlet.http.HttpServlet
+
Control class that modifies the server floor plan to a Tournament state.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class ToggleRegistration
+extends javax.servlet.http.HttpServlet
+
This control class is responsible for toggling the availability of the Registration functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
This method when called by an administrator toggles the availability of the registraion functionality,
+ This is actually performed by the OpenRegistration.toggle() method.
This method when called by an administrator toggles the availability of the registraion functionality,
+ This is actually performed by the OpenRegistration.toggle() method.
public class EnableModuleBlock
+extends javax.servlet.http.HttpServlet
+
Class to manage interaction of an optional blocking module. This is used to prevent users from getting ahead of themselfs. By deafult this is not enabled
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class GetFeedback
+extends javax.servlet.http.HttpServlet
+
This is the control class in the Get Feedback functionality
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- This class validates it's input and returns the user with the feedback for a specific module.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
-This control class is responseable for the server operation in the Get Progress use case where the result of which is a JSON object of JSON arrays. This is used to create a scoreboard environment that updates in real time.
+
+
+
+
public class GetJsonProgress
+extends javax.servlet.http.HttpServlet
+
This control class is responsible for the server operation in the Get Progress use case where the result of which is a JSON object of JSON arrays. This is used to create a scoreboard environment that updates in real time.
This Servlet should be poled regularly to achieve this.
This file is part of the Security Shepherd Project.
@@ -122,191 +128,192 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- Used to return an administrator with the current progress of each player in a class.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
Used to return an administrator with the current progress of each player in a class.
- This will require a complex client page to parse the returned JSON information to make a very pretty score board
-
Used to return an administrator with the current progress of each player in a class.
+ This will require a complex client page to parse the returned JSON information to make a very pretty score board
public class GetProgress
+extends javax.servlet.http.HttpServlet
+
This control class is responseable for the server operation in the Get Progress function
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- Used to return an administrator with the current progress of each player in a class
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class RemoveModuleLock
+extends javax.servlet.http.HttpServlet
+
Class to remove an optional blocking module that had been enabled.
This file is part of the Security Shepherd Project.
@@ -121,262 +127,252 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- Used to remove a limit on the progress a player can make in a CTF environment
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class AddPlayer
+extends javax.servlet.http.HttpServlet
+
The add players server side functionality is hanled by this control class
This file is part of the Security Shepherd Project.
@@ -121,191 +127,192 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by addPlayers.jsp. Player is ether added to the system under a specific or null class or invalid data is detected and no player is added to the database
- Adding of player to Core Database is handed by Setter.createUser
-
Initiated by addPlayers.jsp. Player is ether added to the system under a specific or null class or invalid data is detected and no player is added to the database
+ Adding of player to Core Database is handed by Setter.createUser
public class AssignPlayers
+extends javax.servlet.http.HttpServlet
+
This is the control class for the Assign Players to Class functionality
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by assignPlayers.jsp. A number of players can be assigned to a new class. Changing the actual class of the player is handed by Setter.changePlayerClass
-
-
-
Overrides:
doPost in class javax.servlet.http.HttpServlet
-
-
-
Parameters:
classId - The identifier of the class to add the players to
players[] - An array of player identifiers to add to the specified class
Initiated by assignPlayers.jsp. A number of players can be assigned to a new class. Changing the actual class of the player is handed by Setter.changePlayerClass
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
classId - The identifier of the class to add the players to
players[] - An array of player identifiers to add to the specified class
public class ChangeUserPassword
+extends javax.servlet.http.HttpServlet
+
Control class of the "Update player password" functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CreateClass
+extends javax.servlet.http.HttpServlet
+
This class is the control structure of the Create class vulnerability
This file is part of the Security Shepherd Project.
@@ -121,191 +127,192 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by createClass.jsp. Class is added to the system if valid data has been submitted. Otherwise no class is added to the core database schema.
- Adding of class to Core Database is handed by Setter.createClass
-
-
-
Overrides:
doPost in class javax.servlet.http.HttpServlet
-
-
-
Parameters:
className - Name of the new class
classyear - Class's year, in the format YY/YY, eg 11/12
Initiated by createClass.jsp. Class is added to the system if valid data has been submitted. Otherwise no class is added to the core database schema.
+ Adding of class to Core Database is handed by Setter.createClass
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
className - Name of the new class
classYear - Class's year, in the format YY/YY, eg 11/12
public class CreateNewAdmin
+extends javax.servlet.http.HttpServlet
+
The control class of the Create New Administrator functionality.
This file is part of the Security Shepherd Project.
@@ -121,191 +127,192 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by createNewAdmin.jsp. This method adds administrators to the system if valid data is submitted, otherwise no admin will be added to the database.
- Email is gathered for future functionality. Adding of the player to the core database is handed by Setter.playerCreate
-
Initiated by createNewAdmin.jsp. This method adds administrators to the system if valid data is submitted, otherwise no admin will be added to the database.
+ Email is gathered for future functionality. Adding of the player to the core database is handed by Setter.playerCreate
public class GetPlayersByClass
+extends javax.servlet.http.HttpServlet
+
This class is used by View classes to generate class displays that change based on user input.
This file is part of the Security Shepherd Project.
@@ -121,190 +127,204 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class GiveTakePoints
+extends javax.servlet.http.HttpServlet
+
Control class of the "Give Take Points" functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SetDefaultClass
+extends javax.servlet.http.HttpServlet
+
This is the control class for the Set Default Class functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Initiated by assignPlayers.jsp. A number of players can be assigned to a new class. Changing the actual class of the player is handed by Setter.changePlayerClass
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
classId - The identifier of the class to add the players to
players[] - An array of player identifiers to add to the specified class
public class SuspendUser
+extends javax.servlet.http.HttpServlet
+
Control class of the "Suspend User" functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UnSuspendUser
+extends javax.servlet.http.HttpServlet
+
Control class of the "UnSuspend User" functionality
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UpgradePlayer
+extends javax.servlet.http.HttpServlet
+
Control class of the Upgrade player to admin functionality
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Initiated by upgradePlayers.jsp. This method upgrades multiple players to administrators at a time. Changing the actual role of the player is handed by Setter.updateUserRole.
-
Initiated by upgradePlayers.jsp. This method upgrades multiple players to administrators at a time. Changing the actual role of the player is handed by Setter.updateUserRole.
This control class is responable for toggling the availability of the Registration functionality
+ This file is part of the Security Shepherd Project.
+
public class FeedbackSubmit
+extends javax.servlet.http.HttpServlet
+
Marks modules as completed and stores feedback
This file is part of the Security Shepherd Project.
@@ -121,194 +127,208 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
- this method checks the existace of the submitted module identifier before ensuring that the submission is correct.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
- this method checks the existace of the submitted module identifier before ensuring that the submission is correct.
- If the module solution submission is found to be valid then the feedback submiited is stored, marking the module as completed for the user
- If the submission is found to be valid then the user is returned with a feedback form.
-
-
-
Overrides:
doPost in class javax.servlet.http.HttpServlet
-
-
-
Parameters:
mouleId - The identifier of the module that the solution is been submitted for
solutionKey - The solution key for the proposed module
before - The knowledge the user had before completing the module
after - The knowledge the user had after completing the module
difficulty - The difficulty the user had completing the module
Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
+ this method checks the existence of the submitted module identifier before ensuring that the submission is correct.
Initiated by a dynamic form returned by servlets.module.SolutionSubmit.doPost()
+ this method checks the existence of the submitted module identifier before ensuring that the submission is correct.
+ If the module solution submission is found to be valid then the feedback submitted is stored, marking the module as completed for the user
+ If the submission is found to be valid then the user is returned with a feedback form.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
mouleId - The identifier of the module that the solution is been submitted for
solutionKey - The solution key for the proposed module
before - The knowledge the user had before completing the module
after - The knowledge the user had after completing the module
difficulty - The difficulty the user had completing the module
public class GetModule
+extends javax.servlet.http.HttpServlet
+
Responsable for returning the directories of modules
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
-
-
-
Overrides:
doPost in class javax.servlet.http.HttpServlet
-
-
-
Parameters:
moduleId - The identifier of the module to be returned
-
Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
Initiated by an Ajax call defined in index.jsp, this method takes a module identifier and returns the valid directory of where the module's View structure is stored.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
moduleId - The identifier of the module to be returned
public class ModuleServletTemplate
+extends javax.servlet.http.HttpServlet
+
SQL Injection Lesson - Does not use User Specific Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class RefreshMenu
+extends javax.servlet.http.HttpServlet
+
Class used to return a fresh incremental menu upon completion of a module in incremental mode.
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- This method refreshs the user's menu after they complete a level incremental mode.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
This method refreshs the user's menu after they complete a level incremental mode. This ensures that the process of continuing challenges is a fluid one.
-
This method refreshes the user's menu after they complete a level incremental mode. This ensures that the process of continuing challenges is a fluid one.
public class SolutionSubmit
+extends javax.servlet.http.HttpServlet
+
Control class that returns a feedback form for users if they submit the correct solution
This file is part of the Security Shepherd Project.
@@ -121,188 +127,187 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class BrokenCrypto3
+extends javax.servlet.http.HttpServlet
+
Bad Crypto Challenge Three
+ Really bad crypto algorithm to break. Will reveal key if spaces are submitted
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class BrokenCrypto4
+extends javax.servlet.http.HttpServlet
+
Level : Broken Crypto NEW
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeFive
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Five - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetFive
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeFour
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Four - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetFour
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeJSON
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge New - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetTwo
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeOne
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge One - Does not return reslut key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeSeven
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Seven - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetSeven
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeSevenGetToken
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Seven - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeSix
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Six
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetSix
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeSixGetToken
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Six - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetFive
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target Five - Does not return Result key
+
+ Weak Nonce Variety can be broken
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetFour
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target Four - Does not return Result key
+
+ Weak Nonce Variety can be broken
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetJSON
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target SON - Does not return Result key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetOne
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery challenge target One - Does not return result key
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doGet(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- CSRF vulnerable function that can be used by users to force other users to mark their CSRF challenge One as complete.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class CsrfChallengeTargetSeven
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target Seven - Does not return Result key
+
+ Weak Nonce Variety can be broken
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetSix
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target Six
+
+ Weak Nonce Variety can be broken
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class CsrfChallengeTargetThree
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery challenge Target Three - Does not return result key
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- CSRF vulnerable function that can be used by users to force other users to mark their CSRF challenge Three as complete.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class CsrfChallengeTargetTwo
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Target Two - Does not return Result key
This file is part of the Security Shepherd Project.
@@ -121,190 +127,191 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
doPost(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-
- CSRF vulnerable function that can be used by users to force other users to mark their CSRF challenge Two as complete.
-
-
-
-
-
-
Methods inherited from class javax.servlet.http.HttpServlet
-
-
-
service
-
-
-
-
-
-
Methods inherited from class javax.servlet.GenericServlet
public class CsrfChallengeThree
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Three - Does not return result key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetThree
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class CsrfChallengeTwo
+extends javax.servlet.http.HttpServlet
+
Cross Site Request Forgery Challenge Two - Does not return result Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Allows users to set their CSRF attack string to complete this module. They should be using this to force users to visit their own pages that
+ forces the victim to submit a post request to the CSRFChallengeTargetTwo
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
myMessage - To Be stored as the users message for this module
public class DirectObject1
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Challenge Challenge One
+ Does not use user specific key because key is currently hard coded into database schema
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObject2
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Challenge Two
+ Does not use user specific key because key is currently hard coded into database schema
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObjectBankCurrentBalance
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Bank Challenge Get Balance Function
+ DOES NOT RETURN RESULT KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObjectBankLogin
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Bank Challenge
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObjectBankLogout
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Bank Challenge Logout Function
+ DOES NOT RETURN RESULT KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObjectBankRegistration
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Bank Challenge Registration Function
+ DOES NOT RETURN RESULT KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class DirectObjectBankTransfer
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Reference Bank Challenge Transfer Funds Function
+ DOES NOT RETURN RESULT KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class PoorValidation1
+extends javax.servlet.http.HttpServlet
+
Level : Poor Validation 1
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class PoorValidation2
+extends javax.servlet.http.HttpServlet
+
Level : Poor Validation 2
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SecurityMisconfigStealTokens
+extends javax.servlet.http.HttpServlet
+
Security Misconfiguration Steal Tokens
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement1
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge One
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users must take advance of the broken session management in this application by modifying the tracking cookie "checksum" which is encoded in base 64. They must modify this cookie to be equal to administrator to access the result key.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
upgraeUserToAdmin - Red herring
returnPassword - Red herring
adminDetected - Red herring
checksum - Cookie encoded base 64 that manages who is signed in to the sub schema
public class SessionManagement2
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Two
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
The user attempts to use this function to sign into a sub schema. If they successfully sign in then they are able to retrieve the result key for the challenge
+ If they sign in with a correct user name but incorrect password then the email address of the user will be returned in a error message
public class SessionManagement2ChangePassword
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Two - Password Reset Servlet
+ Does not return result key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
A user with the submitted email address is set a new random password, the password is also returned from the database procedure and is forwards through to the HTTP response.
A user with the submitted email address is set a new random password, the password is also returned from the database procedure and is forwards through to the HTTP response.
+ This response is not consumed by the client interface by default, and the user will have to discover it.
public class SessionManagement3
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Three
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users must use this functionality to sign in as an administrator to retrieve the result key. If the user name is valid but not the passwor, an error message with the user name is returned.
public class SessionManagement3ChangePassword
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Three - Change Password
+ This is a level function - DOES NOT RETURN KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement4
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Four
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users must discover the session id for this sub application is very weak. The default session ID for a guest will be 00000001 base64'd. The admin's session will be 00000021
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
upgraeUserToAdmin - Red herring
returnPassword - Red herring
adminDetected - Red herring
checksum - Cookie encoded base 64 that manages who is signed in to the sub schema
public class SessionManagement5
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Five
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement5ChangePassword
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Five - Change Password
+ This is a level function - DOES NOT RETURN KEY
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Function used by Session Management Challenge Five to change the password of the submitted user name. The function requires a valid token which is a base64'd timestamp. If the current time is within 10 minutes of the token, the function will execute
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
userName - User cookie used to store the user password to be reset
newPassword - the password which to use to update an accounts password
public class SessionManagement5SetToken
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Five SessionManagement5SetToken
+ (Does not Return Result Key)
+
+ This function is a shell to give the appearance that a token has been set for a user.
+ A DB call is made to check if a user exists. If the user does exist the server returns an ok message
+ claiming that the user has been emailed a URL with a token embedded for resetting their password.
+ This in fact does not happen. User must find another way to sign in as an admin.
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement6
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Six
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement6SecretQuestion
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Six - Security Question
+ Does not return result key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement7
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge 7
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement7SecretQuestion
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge 7 - Security Question
+ Does not return result key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagement8
+extends javax.servlet.http.HttpServlet
+
Session Management Challenge Eight
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users must take advance of the broken session management in this application by modifying the tracking cookie "challengeRole" which is encoded in ATOM-128.
Users must take advance of the broken session management in this application by modifying the tracking cookie "challengeRole" which is encoded in ATOM-128. They must modify this cookie to be equal to superuser to access the result key.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
returnUserRole - Red herring
returnPassword - Red herring
adminDetected - Red herring
challengeRole - Cookie encoded ATOM-128 that manages who is signed in to the sub schema
public class SqlInjection1
+extends javax.servlet.http.HttpServlet
+
SQL Injection Challenge One - Does not use user specific keys
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
This function is used to make a call to a database and process its results. The call made to the database is secured using an insufficient privilege.
+ Players must overcome this filter to complete the module
public class SqlInjection2
+extends javax.servlet.http.HttpServlet
+
SQL Injection Challenge 2 - Does not use User specific keys
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
This function is used to make a call to a database and process its results. The call made to the database is secured using an insufficient privilege.
+ Players must overcome this filter to complete the module
public class SqlInjection3
+extends javax.servlet.http.HttpServlet
+
SQL Injection Challenge Three - Does not use user specific key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users have to use SQL injection to get a specific users credit card number. The query they are injecting into by default only outputs usernames.
+ The input they enter is also been filtered.
public class SqlInjection4
+extends javax.servlet.http.HttpServlet
+
SQL Injection Challenge Four - Does not use user specific key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjection5
+extends javax.servlet.http.HttpServlet
+
Level : SQL Injection 5
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjection5VipCheck
+extends javax.servlet.http.HttpServlet
+
Level : SQL Injection 5
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjection6
+extends javax.servlet.http.HttpServlet
+
Level : SQL Injection 6
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjection7
+extends javax.servlet.http.HttpServlet
+
Level : SQL Injection 7
+
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjectionStoredProcedure
+extends javax.servlet.http.HttpServlet
+
SQL Injection Stored Procedure Challenge - Does not use user specific keys
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UrlAccess1
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access Challenge 1
+
+ This class is a red herring, displaying guest type functionality for the challenge.
+ The information required to find the admin version of this function is
+ contained in the javascript of the JSP page associated with the level
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UrlAccess1Admin
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access Challenge 1 (Admin)
+
+ This class is the target functionality for the challenge.
+ The information required to find this admin function is
+ contained in the JavaScript of the JSP page associated with the level. This level returns
+ a user specific key.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UrlAccess2
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access Challenge 2
+
+ This class is a red herring, displaying guest type functionality for the challenge.
+ The information required to find the admin version of this function is
+ contained in the javascript of the JSP page associated with the level
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UrlAccess2Admin
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access Challenge 2 (Admin)
+
+ This class is the target functionality for the challenge.
+ The information required to find this admin function is
+ contained in the javascript of the JSP page associated with the level. This level returns
+ a user specific key.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UrlAccess3
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access 3
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Users must take advance of the broken session management in this application by modifying the tracking cookie "currentPerson" which is encoded in Base64.
Users must take advance of the broken session management in this application by modifying the tracking cookie "currentPerson" which is encoded in Base64. They must modify this cookie to be equal a super admin to access the result key.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
userId - Red herring that is pre set to d3d9446802a44259755d38e6d163e820
secure - Red herring that is pre set to true
adminDetected - Red herring
currentPerson - Cookie encoded base64 that manages who is signed in to the sub schema
public class UrlAccess3UserList
+extends javax.servlet.http.HttpServlet
+
Failure to Restrict URL Access Challenge 3 (UserList)
+
+ This class is the target functionality for the challenge.
+ The information required to find this admin function is
+ contained in the javascript of the JSP page associated with the level. This level returns
+ a user specific key.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class XssChallengeFive
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge Five control class.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotely exploited, and there fore only is executable against the person initiating the function.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been encoded for wrong HTML Context
public class XssChallengeFour
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge Four control class.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotely exploited, and there fore only is executable against the person initiating the function.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been encoded for wrong HTML Context
public class XssChallengeOne
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge One
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotly deployed, and therfore only is executable against the person initating the funciton.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been filtered
public class XssChallengeSix
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge Six control class.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotely exploited, and there fore only is executable against the person initiating the function.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been encoded for wrong HTML Context
public class XssChallengeThree
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge Three control class.
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotly deployed, and therfore only is executable against the person initating the funciton.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been filtered
public class XssChallengeTwo
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Challenge Two
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. As there is no CSRF risk, this XSS flaw cannot be remotely exploited, and therefore is only is executable against the person initiating the function.
+
+
Overrides:
+
doPost in class javax.servlet.http.HttpServlet
+
Parameters:
searchTerm - To be spat back out at the user after been filtered
Session Management Challenge Five SessionManagement5SetToken
+ (Does not Return Result Key)
+
+ This function is a shell to give the appearance that a token has been set for a user.
public class CsrfLesson
+extends javax.servlet.http.HttpServlet
+
CSRF Lesson
+ Currently does not use user specific result key because of current CSRF blanket rule
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
User submission is parsed for a valid HTML IMG tag. The SRC attribute of this tag is then used to construct a URL object. This URL object is then checked to ensure a valid attack
public class CsrfLessonTarget
+extends javax.servlet.http.HttpServlet
+
CSRF Lesson module Target - Does not return result key
This file is part of the Security Shepherd Project.
@@ -121,188 +127,187 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class DirectObjectLesson
+extends javax.servlet.http.HttpServlet
+
Insecure Direct Object Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class PoorValidationLesson
+extends javax.servlet.http.HttpServlet
+
Poor Validation Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class Redirect
+extends javax.servlet.http.HttpServlet
+
Hardened Vulnerable Redirect example. Does not return result key
This file is part of the Security Shepherd Project.
@@ -121,188 +127,187 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class RedirectLessonTarget
+extends javax.servlet.http.HttpServlet
+
Unvalidated and redirect lesson targer. Does not return result key
This file is part of the Security Shepherd Project.
@@ -121,188 +127,187 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class SecurityMisconfigLesson
+extends javax.servlet.http.HttpServlet
+
Security Misconfiguration Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SessionManagementLesson
+extends javax.servlet.http.HttpServlet
+
Session Management Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class SqlInjectionLesson
+extends javax.servlet.http.HttpServlet
+
SQL Injection Lesson - Does not use User Specific Key
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class UnvalidatedForwardsLesson
+extends javax.servlet.http.HttpServlet
+
Unvalidated Redirects and Forwards Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
public class XssLesson
+extends javax.servlet.http.HttpServlet
+
Cross Site Scripting Lesson
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
Cross Site Request Forgery safe Reflected XSS vulnerability. cannot be remotely deployed, and therefore only is executable against the person initiating the function.
public class CheatSheetStatus
+extends java.lang.Object
+
Class that holds the status of the avilablility of the Cheat Sheet functionality
This file is part of the Security Shepherd Project.
@@ -116,217 +113,258 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Class is responsible for finding valid XSS and CSRF attacks in user submissions
This file is part of the Security Shepherd Project.
@@ -116,188 +113,297 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Method used to detect valid java script in a user submission. Specifically the presence of a script that will execute an alert command.
- Script tag, Url java script and java script tiggeres vectors are all including in this detection method.
-
-
-
Parameters:
xssString - User XSS submission (After filter if any)
-
Returns:
Boolean returned reflecting the presence of valid XSS attacks or not.
public static java.lang.String[] javascriptTriggers
+
Method used to detect valid java script in a user submission. Specifically the presence of a script that will execute an alert command.
+ Script tag, URI java script and java script triggers vectors are all including in this detection method.
This file is part of the Security Shepherd Project.
@@ -116,250 +113,439 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
-This class is just an instance memory structure for module blockers. Including the id of the module block, the message to give users and the current block status.
+
+
+
+
public class ModuleBlock
+extends java.lang.Object
+
This class is just an instance memory structure for module blockers. Including the id of the module block, the message to give users and the current block status.
This file is part of the Security Shepherd Project.
@@ -116,234 +113,240 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
This class Determines how the users are presented with the modules. By default this method sets the floor plan to CTF mode
This file is part of the Security Shepherd Project.
@@ -116,254 +113,302 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public class OpenRegistration
+extends java.lang.Object
+
This class Determines how the registration functionality is available
This file is part of the Security Shepherd Project.
@@ -116,236 +113,214 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
Filters used to make SQL injection more difficult to perform
+
+ This file is part of the Security Shepherd Project.
+
+ The Security Shepherd project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ The Security Shepherd project is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with the Security Shepherd project. If not, see .
This file is part of the Security Shepherd Project.
@@ -116,393 +113,433 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
isValidUser(java.lang.String userName,
- java.lang.String passWord)
-
-
- Used to validate user creation requests
-
-
-
-static boolean
-
isValidUser(java.lang.String userName,
- java.lang.String passWord,
- java.lang.String userAddress)
-
-
- Used to validate user creation requests
-
-
-
-static boolean
-
validateAdminSession(javax.servlet.http.HttpSession ses)
-
-
- Session is checked for credentials and ensures that they have not been modified and that they are valid for an administrator
-
-
-
-static java.lang.String
-
validateFileName(java.lang.String fileName)
-
-
- Validates file name attributes to defend against path traversal
-
-
-
-static java.lang.String
-
validateParameter(java.lang.Object input,
- int maxLength)
-
-
- Validates objects received through a function request.
-
-
-
-static boolean
-
validateSession(javax.servlet.http.HttpSession ses)
-
-
- Session is checked for credentials and ensures that they have not been modified and that they are valid
-
-
-
-static boolean
-
validateTokens(javax.servlet.http.Cookie cookieToken,
- java.lang.Object requestToken)
-
-
- This method compares the two submitted tokens after ensuring they are not null and not empty.
Session is checked for credentials and ensures that they have not been modified and that they are valid for an administrator. This function also validates CSRF tokens
+
Parameters:
ses - HttpSession from users browser
+
Returns:
Boolean value that reflects the validity of the admins session
Provides a number of filters that are used in different XSS challenges.
This file is part of the Security Shepherd Project.
@@ -116,217 +113,275 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with the Security Shepherd project. If not, see .
-
public static java.lang.String levelFour(java.lang.String input)
+
Filters for specific javascript events recursively in a specific order. Can be bypassed by embedding a trigger late in the list in a trigger early in the list
dbProcs.Database
-javax.servlet.GenericServlet -
javax.servlet.GenericServlet -