PVXs

WebGoat Admin password reset Challenge

This challenge is basically a “suggestion” to make use of source code, when available, to get as much information as possible

First of all send yourself a mail on WebWolf to get the reset link structure, put <username>@<anydomain> and press “Reset Password”

--

--

WebGoat Without password challenge

Second WebGoat challenge, we have to log in as Larry, let’s see what’s in here

The “Forgot Password” link is fake and not much in HTML source

Burp shows that, apart from the request to /WebGoat/Challenge5.lesson.lesson and its HTML, there is not much else when requesting the page

There is…

--

--