";
+ }
+ else //final tags to ensure valid HTML
+ {
+ log.debug("Appending End tags");
+ //output += ""; //Commented Out to prevent Search Box being pushed into Footer
+ }
+ }
+ catch(Exception e)
+ {
+ log.error("Challenge Retrieval: " + e.toString());
+ }
+ Database.closeConnection(conn);
+ log.debug("*** END getIncrementalChallengesWithoutScript() ***");
+ return output;
+ }
+
/**
* Use to return the current progress of a class in JSON format with information like userid, user name and score
* @param applicationRoot The current running context of the application
* @param classId The identifier of the class to use in lookup
- * @return A JSON representation of a class's progress in the application
+ * @return A JSON representation of a class's score in the order {id, username, userTitle, score, scale, place, order,
+ * goldmedalcount, goldDisplay, silverMedalCount, silverDisplay, bronzeDisplay, bronzeMedalCount}
*/
@SuppressWarnings("unchecked")
public static String getJsonScore(String applicationRoot, String classId)
{
+ log.debug("classId: " + classId);
String result = new String();
- Encoder encoder = ESAPI.encoder();
Connection conn = Database.getCoreConnection(applicationRoot);
try
{
+ Encoder encoder = ESAPI.encoder();
//Returns User's: Name, # of Completed modules and Score
CallableStatement callstmnt = null;
- if(ScoreboardStatus.getScoreboardClass().isEmpty())
+ if(ScoreboardStatus.getScoreboardClass().isEmpty() && !ScoreboardStatus.isClassSpecificScoreboard())
callstmnt = conn.prepareCall("call totalScoreboard()"); //Open Scoreboard not based on a class
else
{
@@ -954,7 +983,7 @@ public static String getJsonScore(String applicationRoot, String classId)
* Used to gather a menu of lessons for a user, including markers for each lesson they have completed or not completed
* @param ApplicationRoot The current running context of the application
* @param userId Identifier of the user
- * @return HTML lesson menu.
+ * @return HTML lesson menu for Open Floor Plan.
*/
public static String getLessons (String ApplicationRoot, String userId, Locale lang)
{
@@ -1051,6 +1080,8 @@ public static String getModuleAddress (String ApplicationRoot, String moduleId,
catch(Exception e)
{
log.error("Module Hash Retrieval: " + e.toString());
+ log.error("moduleID = " + moduleId);
+ log.error("userID = " + userId);
}
Database.closeConnection(conn);
log.debug("*** END getModuleAddress() ***");
@@ -1115,7 +1146,6 @@ public static String getModuleHash(String applicationRoot, String moduleId)
log.debug("*** END getModuleHash ***");
return result;
}
-
/**
* Convert module hash to ID
* @param ApplicationRoot The current running context of the application
@@ -1181,10 +1211,41 @@ public static boolean getModuleKeyType (String ApplicationRoot, String moduleId)
return theKeyType;
}
+ /**
+ * This method retrieves the i18n local key for a module's name.
+ * @param applicationRoot Application Running Context
+ * @param moduleId ID of the module to lookup
+ * @return Locale key for the Module's Name.
+ */
+ public static String getModuleNameLocaleKey(String applicationRoot, String moduleId)
+ {
+ log.debug("*** Getter.getModuleNameLocaleKey ***");
+ String result = new String();
+ Connection conn = Database.getCoreConnection(applicationRoot);
+ try
+ {
+ CallableStatement callstmt = conn.prepareCall("call moduleGetNameLocale(?)");
+ log.debug("Gathering moduleGetNameLocale ResultSet");
+ callstmt.setString(1, moduleId);
+ ResultSet resultSet = callstmt.executeQuery();
+ log.debug("Opening Result Set from moduleGetNameLocale");
+ resultSet.next();
+ result = resultSet.getString(1);
+ }
+ catch (SQLException e)
+ {
+ log.error("Could not execute moduleGetNameLocale: " + e.toString());
+ result = null;
+ }
+ Database.closeConnection(conn);
+ log.debug("*** END getModuleNameLocaleKey ***");
+ return result;
+ }
+
/**
* @param ApplicationRoot The current running context of the application
* @param moduleId Identifier of module
- * @return The solution key for a module
+ * @return The db stored solution key value for the moduleId submitted
*/
public static String getModuleResult (String ApplicationRoot, String moduleId)
{
@@ -1216,7 +1277,7 @@ public static String getModuleResult (String ApplicationRoot, String moduleId)
* Returns the result key for a module using the module's hash for the lookup procedure.
* @param ApplicationRoot The current running context of the application
* @param moduleHash The hash to use for module look up
- * @return
+ * @return The db stored solution key value for the moduleHash submited
*/
public static String getModuleResultFromHash (String ApplicationRoot, String moduleHash)
{
@@ -1283,7 +1344,7 @@ public static String getModulesInOptionTags (String ApplicationRoot)
* Used in creating functionality that requires a user to select a module.
* This method only prepares the option tags for this type of input. It must still be wrapped in select tags.
* @param ApplicationRoot The current running context of the application
- * @return All modules in HTML option tags
+ * @return All modules in HTML option tags ordered by incrementalRank
*/
public static String getModulesInOptionTagsCTF (String ApplicationRoot)
{
@@ -1317,7 +1378,8 @@ public static String getModulesInOptionTagsCTF (String ApplicationRoot)
* Used to return a module cheat sheet
* @param ApplicationRoot The current running context of the application
* @param moduleId The identifier of the module to return the cheat sheet for
- * @return Module cheat sheet
+ * @param lang The Locale the user has enabled
+ * @return String[] containing {ModuleName, CheatSheetSolution}
*/
public static String[] getModuleSolution (String ApplicationRoot, String moduleId, Locale lang)
{
@@ -1334,7 +1396,7 @@ public static String[] getModuleSolution (String ApplicationRoot, String moduleI
ResultSet resultSet = callstmt.executeQuery();
log.debug("Opening Result Set from cheatSheetGetSolution");
resultSet.next();
- result[0] = resultSet.getString(1);//TODO investigate translation
+ result[0] = resultSet.getString(1);
result[1] = bundle.getString(resultSet.getString(2));
}
@@ -1349,11 +1411,10 @@ public static String[] getModuleSolution (String ApplicationRoot, String moduleI
}
/**
- * This method returns the modules with open and closed in different <select> elements for administration manipulation
- * @param ApplicationRoot
- * @param userId
- * @param csrfToken
- * @return
+ * This method returns modules in option tags in different <select> elements depending on their current open/closed status.
+ * The output assumes it is contained in a table context
+ * @param ApplicationRoot The Running Context of the Application
+ * @return Tr/td elements containing a moduleStatusMenu that has lists of the current open and closed modules
*/
public static String getModuleStatusMenu (String ApplicationRoot)
{
@@ -1399,13 +1460,10 @@ public static String getModuleStatusMenu (String ApplicationRoot)
Database.closeConnection(conn);
return output;
}
-
/**
- * This method returns the module categories to open or closed in a <select> element for administration manipulation
+ * This method returns the module categories in option tags that are to be open or closed in a <select> element for administration manipulation
* @param ApplicationRoot
- * @param userId
- * @param csrfToken
- * @return
+ * @return Module Category List for Html (<SELECT> element)
*/
public static String getOpenCloseCategoryMenu (String ApplicationRoot)
{
@@ -1436,14 +1494,13 @@ public static String getOpenCloseCategoryMenu (String ApplicationRoot)
Database.closeConnection(conn);
return output;
}
-
/**
* This method is used to gather users according by class. Thanks to MySQL syntax, where class = null will return nothing, is null must be used.
* is 'validClass' will Error, = 'validclass' must be used.
* So there are two procedures this method calls. One that handles null classes, one that does not
* @param ClassId Identifier of class
* @param ApplicationRoot The current running context of the application
- * @return ResultSet that contains users for the selected class
+ * @return ResultSet that contains users for the selected class in the formate {userId, userName, userAddress}
*/
public static ResultSet getPlayersByClass(String ApplicationRoot, String classId)
{
@@ -1479,7 +1536,6 @@ public static ResultSet getPlayersByClass(String ApplicationRoot, String classId
log.debug("*** END getPlayersByClass");
return result;
}
-
/**
* Used to present the progress of a class in a series of loading bars
* @param applicationRoot The current running context of the application
@@ -1530,7 +1586,6 @@ public static String getProgress(String applicationRoot, String classId)
log.debug("*** END getProgress ***");
return result;
}
-
/**
* Use to return the current progress of a class in JSON format with information like user name, score and completed modules
* @param applicationRoot The current running context of the application
@@ -1588,7 +1643,25 @@ public static String getProgressJSON(String applicationRoot, String classId)
log.debug("*** END getProgressJSON ***");
return result;
}
-
+ private static int getTounnamentSectionFromRankNumber (int rankNumber)
+ {
+ if(rankNumber < fieldTrainingCap)
+ return 1;
+ else if (rankNumber < privateCap)
+ return 2;
+ else if (rankNumber < corporalCap)
+ return 3;
+ else if (rankNumber < sergeantCap)
+ return 4;
+ else if (rankNumber < lieutenantCap)
+ return 5;
+ else if (rankNumber < majorCap)
+ return 6;
+ else if (rankNumber < admiralCap)
+ return 7;
+ else
+ return 7; //Max level is 7.
+ }
/**
* This method prepares the Tournament module menu. This is when Security Shepherd is in "Tournament Mode".
* Users are presented with a list of that are specified as open.
@@ -1713,32 +1786,65 @@ public static String getTournamentModules (String ApplicationRoot, String userId
Database.closeConnection(conn);
return levelMasterList;
}
+ /**
+ * @param ApplicationRoot The current running context of the application
+ * @param userName The username of the user
+ * @return The class id of the submitted user name
+ */
+ public static String getUserClassFromName (String ApplicationRoot, String userName)
+ {
+ log.debug("*** Getter.getUserClass ***");
+ String result = new String();
+ Connection conn = Database.getCoreConnection(ApplicationRoot);
+ try
+ {
+ CallableStatement callstmt = conn.prepareCall("call userClassId(?)");
+ log.debug("Gathering userClassId ResultSet");
+ callstmt.setString(1, userName);
+ ResultSet resultSet = callstmt.executeQuery();
+ log.debug("Opening Result Set from userClassId");
+ resultSet.next();
+ result = resultSet.getString(1);
+ log.debug("Found " + result);
+ }
+ catch (SQLException e)
+ {
+ log.error("Could not execute userClassId: " + e.toString());
+ result = new String();
+ }
+ Database.closeConnection(conn);
+ log.debug("*** END getUserClass ***");
+ return result;
+ }
- private static int fieldTrainingCap = 45;
- private static int privateCap = 80;
- private static int corporalCap = 105;
- private static int sergeantCap = 130;
- private static int lieutenantCap = 145;
- private static int majorCap = 175;
- private static int admiralCap = 999; //everything above Major is Admiral
- private static int getTounnamentSectionFromRankNumber (int rankNumber)
+ /**
+ * @param ApplicationRoot The current running context of the application
+ * @param userName The username of the user
+ * @return The user id of the submitted user name
+ */
+ public static String getUserIdFromName (String ApplicationRoot, String userName)
{
- if(rankNumber < fieldTrainingCap)
- return 1;
- else if (rankNumber < privateCap)
- return 2;
- else if (rankNumber < corporalCap)
- return 3;
- else if (rankNumber < sergeantCap)
- return 4;
- else if (rankNumber < lieutenantCap)
- return 5;
- else if (rankNumber < majorCap)
- return 6;
- else if (rankNumber < admiralCap)
- return 7;
- else
- return 7; //Max level is 7.
+ log.debug("*** Getter.getUserIdFromName ***");
+ String result = new String();
+ Connection conn = Database.getCoreConnection(ApplicationRoot);
+ try
+ {
+ CallableStatement callstmt = conn.prepareCall("call userGetIdByName(?)");
+ log.debug("Gathering userGetIdByName ResultSet");
+ callstmt.setString(1, userName);
+ ResultSet resultSet = callstmt.executeQuery();
+ log.debug("Opening Result Set from userGetIdByName");
+ resultSet.next();
+ result = resultSet.getString(1);
+ }
+ catch (SQLException e)
+ {
+ log.error("Could not execute query: " + e.toString());
+ result = null;
+ }
+ Database.closeConnection(conn);
+ log.debug("*** END getUserIdFromName ***");
+ return result;
}
/**
@@ -1772,32 +1878,43 @@ public static String getUserName (String ApplicationRoot, String userId)
}
/**
- * Used by authentication to check if account is locked before continuing with authentication process.
- * @param ApplicationRoot The current running context of the application
- * @param userName The userName to use for check
- * @return A boolean value of if the user account is locked
+ * This method is used to determine if a CSRF level has been completed.
+ * A call is made to the DB that returns the CSRF counter for a level.
+ * If this counter is greater than 0, the level has been completed
+ * @param applicationRoot Running context of the application
+ * @param moduleHash Hash ID of the CSRF module you wish to check if a user has completed
+ * @param userId the ID of the user to check
+ * @return True or False value depicting if the user has completed the module
*/
- public static boolean isUserLocked (String ApplicationRoot, String userName)
+ public static boolean isCsrfLevelComplete (String applicationRoot, String moduleId, String userId)
{
- log.debug("*** Getter.isUserLocked ***");
- boolean result = true;
- Connection conn = Database.getCoreConnection(ApplicationRoot);
+ log.debug("*** Setter.isCsrfLevelComplete ***");
+
+ boolean result = false;
+
+ Connection conn = Database.getCoreConnection(applicationRoot);
try
{
- CallableStatement callstmt = conn.prepareCall("call userLocked(?)");
- log.debug("Gathering userLocked ResultSet");
- callstmt.setString(1, userName);
- ResultSet userLocked = callstmt.executeQuery();
- log.debug("Opening Result Set from userLocked");
- userLocked.next();
- result = !userLocked.getString(1).equalsIgnoreCase(userName);
+ log.debug("Preparing csrfLevelComplete call");
+ CallableStatement callstmnt = conn.prepareCall("call csrfLevelComplete(?, ?)");
+ callstmnt.setString(1, moduleId);
+ callstmnt.setString(2, userId);
+ log.debug("moduleId: " + moduleId);
+ log.debug("userId: " + userId);
+ log.debug("Executing csrfLevelComplete");
+ ResultSet resultSet = callstmnt.executeQuery();
+ resultSet.next();
+ result = resultSet.getInt(1) > 0; // If Result is > 0, then the CSRF level is complete
+ if(result)
+ log.debug("CSRF Level is complete");
}
- catch (SQLException e)
+ catch(SQLException e)
{
- log.error("Could not execute query: " + e.toString());
+ log.error("csrfLevelComplete Failure: " + e.toString());
+ result = false;
}
Database.closeConnection(conn);
- log.debug("*** END isUserLocked ***");
+ log.debug("*** END isCsrfLevelComplete ***");
return result;
}
}
diff --git a/SecurityShepherdCore/src/dbProcs/Setter.java b/SecurityShepherdCore/src/dbProcs/Setter.java
index 9f5d36a4f..8727bfa36 100644
--- a/SecurityShepherdCore/src/dbProcs/Setter.java
+++ b/SecurityShepherdCore/src/dbProcs/Setter.java
@@ -11,10 +11,6 @@
import java.sql.SQLException;
import org.apache.log4j.Logger;
-import org.owasp.esapi.ESAPI;
-import org.owasp.esapi.Encoder;
-import org.owasp.esapi.codecs.Codec;
-import org.owasp.esapi.codecs.MySQLCodec;
/**
* Used to add information to the Database
@@ -97,162 +93,6 @@ public static boolean closeAllModules (String ApplicationRoot)
return result;
}
- /**
- * Used to create a new module entry in the core database. The database will handle creating the new module identifier and module hash.
- * The module has will be returned form the database, and if it does not start will a letter, the application will update the database to reflect a hash starting with a letter, without sacrificing the uniqueness of the hash
- * @param applicationRoot The current running context of the application
- * @param challengeName The name of the module to create
- * @param challengeType The type of module to create
- * @param challengeCategory The category of the new challenge
- * @param challengeSolution The solution of the new challenge
- * @param isUserSpecificKey Is the Key for this level a user specific key or is it hard coded
- * @return The new module identifier
- */
- public static String createModule(String applicationRoot, String challengeName, String challengeType, String challengeCategory, String challengeSolution, boolean isUserSpecificKey)
- {
- log.debug("*** Setter.createModule ***");
- String moduleId = null;
- Connection conn = Database.getCoreConnection(applicationRoot);
- try
- {
- CallableStatement callstmt = conn.prepareCall("call moduleCreate(?, ?, ?, ?, ?)");
- log.debug("Preparing moduleCreate procedure");
- callstmt.setString(1, challengeName);
- callstmt.setString(2, challengeType);
- callstmt.setString(3, challengeCategory);
- callstmt.setString(4, challengeSolution);
- callstmt.setBoolean(5, isUserSpecificKey);
- ResultSet resultSet = callstmt.executeQuery();
- log.debug("Retrieving new moduleId");
- //moduleCreate should return the new modules ID
- resultSet.next();
- moduleId = resultSet.getString(1);
- log.debug("Returning: " + moduleId);
-
- //Ensuring module hash is Java friendly (starts with letter... For expanding framework in future work!
- String theHash = resultSet.getString(2);
- String firstChar = theHash.substring(0, 1);
- try
- {
- //Cast char to int, if it works then if must be changed to a letter!
- Integer theFirst = Integer.parseInt(firstChar);
- //First char must be changed to a letter, but it canot be in the hash range a - f, to ensure that the hashes remain unique
- switch(theFirst)
- {
- case 1:
- firstChar = "o";
- break;
- case 2:
- firstChar = "w";
- break;
- case 3:
- firstChar = "r";
- break;
- case 4:
- firstChar = "u";
- break;
- case 5:
- firstChar = "i";
- break;
- case 6:
- firstChar = "x";
- break;
- case 7:
- firstChar = "v";
- break;
- case 8:
- firstChar = "q";
- break;
- case 9:
- firstChar = "y";
- break;
- case 0:
- firstChar = "z";
- break;
- }
- theHash = firstChar + theHash.substring(1);
- log.debug("hash Change suggestion: " + theHash);
- PreparedStatement prepStat = conn.prepareStatement("UPDATE modules SET moduleHash = ? WHERE moduleId = ?");
- prepStat.setString(1, theHash);
- prepStat.setString(2, moduleId);
- log.debug("Updating moduleHash to class friendly Name");
- prepStat.execute();
- }
- catch(Exception e)
- {
- log.debug("Error Occurred: " + e.toString());
- }
- log.debug("moduleHash: " + theHash);
- }
- catch (SQLException e)
- {
- log.error("Could not execute cheatSheetCreate: " + e.toString());
- }
- Database.closeConnection(conn);
- log.debug("*** END createModule ***");
- return moduleId;
- }
-
- /**
- * Used by the challenge builder to create a new schema on the vulnerable database server.
- * @param conn Connection to the vulnerable database server
- * @param challengeName The name of the challenge been created by the builder
- * @param tableName The name of the table to create in the vulnerable schema
- * @param attrib An array of attributes to use when creating the schema's table
- * @param attribAmount The amount of attributes been created in the table
- * @return The new schema's name if successful
- * @throws SQLException Throws this exception if there is an error creating the vulnerable schema
- */
- @SuppressWarnings("deprecation")
- public static String createVulnerableSchema(Connection conn, String challengeName, String tableName, String[] attrib, int attribAmount)
- throws SQLException
- {
- String schemaName = new String();
- log.debug("*** Setter.createVulnerableSchema ***");
- Encoder encoder = ESAPI.encoder();
- Codec mySql = new MySQLCodec(MySQLCodec.MYSQL_MODE);
- try
- {
- //Preparing schema, table and attribute names
- schemaName = "schema_" + encoder.encodeForSQL(mySql, challengeName.trim().toLowerCase().replaceAll(" ", ""));
- String theTable = "tb_" + encoder.encodeForSQL(mySql, tableName);
- for(int i = 0; i < 5; i++)
- {
- attrib[i] = "at_" + encoder.encodeForSQL(mySql, attrib[i]);
- log.debug("attrib[" + i + "] = " + attrib[i]);
- }
- log.debug("Creating Challenge Schema: " + schemaName);
-
- //Not Parametrising, because parametrising sticks ' around the parameter. Which is invalid syntax for CREATE SCHEMA. So Encoding for Mysql should also prevent SQL injection
- PreparedStatement prepStat = conn.prepareStatement("CREATE SCHEMA IF NOT EXISTS " + schemaName);
- log.debug("Preparing Statement... CREATE SCHEMA IF NOT EXISTS " + schemaName);
- prepStat.execute();
-
- log.debug("Creating Schema Table");
- //Preparing sql String
- String sql = "CREATE TABLE IF NOT EXISTS " + schemaName + "." + theTable + " (id INT NOT NULL AUTO_INCREMENT, ";
- for(int i = 0; i < 5; i++)
- sql += attrib[i] + " VARCHAR(64) NOT NULL, ";
- sql += "PRIMARY KEY (id))ENGINE = InnoDB; ";
- log.debug("Preparing Execution");
- prepStat = conn.prepareStatement(sql);
- prepStat.execute();
- log.debug("Table Created");
-
- log.debug("Committing Changes");
- prepStat = conn.prepareStatement("COMMIT;");
- prepStat.execute();
- }
- catch (SQLException e)
- {
- schemaName = null;
- log.error("Could not create schema: " + e.toString());
- throw e;
- }
- log.debug("*** END Setter.createVulnerableSchema ***");
- return schemaName;
- }
-
/**
* Used to increment bad submission counter in DB. DB will handle point deductions once the counter hits 40
* @param ApplicationRoot application running context
@@ -311,7 +151,7 @@ public static boolean openAllModules (String ApplicationRoot)
return result;
}
- final static String webModuleCategoryHardcodedWhereClause = new String(""
+ final public static String webModuleCategoryHardcodedWhereClause = new String(""
+ "moduleCategory = 'CSRF'"
+ " OR moduleCategory = 'Failure to Restrict URL Access'"
+ " OR moduleCategory = 'Injection'"
@@ -322,13 +162,14 @@ public static boolean openAllModules (String ApplicationRoot)
+ " OR moduleCategory = 'XSS'"
+ " OR moduleCategory = 'Poor Data Validation'"
+ " OR moduleCategory = 'Security Misconfigurations'");
- final static String mobileModuleCategoryHardcodedWhereClause = new String(""
+ final public static String mobileModuleCategoryHardcodedWhereClause = new String(""
+ "moduleCategory = 'Mobile Data Leakage'"
+ " OR moduleCategory = 'Mobile Injection'"
+ " OR moduleCategory = 'Mobile Insecure Data Storage'"
+ " OR moduleCategory = 'Mobile Reverse Engineering'"
+ " OR moduleCategory = 'Mobile Broken Crypto'"
- + " OR moduleCategory = 'Mobile Mobile Poor Authentication'");
+ + " OR moduleCategory = 'Mobile Content Providers'"
+ + " OR moduleCategory = 'Mobile Poor Authentication'");
/**
* This is used to only open Mobile category levels
@@ -388,92 +229,6 @@ public static boolean openOnlyWebCategories (String ApplicationRoot)
return result;
}
- /**
- * Used to populate the vulnerable schemas table with an array of attributes. This method adds ONE row to a table
- * @param conn Connection to the vulnerable database server
- * @param schemaName The name of the schema in the vulnerable database server
- * @param theTable The name of the table to populate
- * @param data The data to use for population
- * @param attrib The list of attributes to be populated
- * @param attribAmount The amount of attributes been populated
- * @throws SQLException Thrown if there is a population error
- */
- public static void populateVulnerableSchema(Connection conn, String schemaName, String theTable, String[] data, String[] attrib, int attribAmount)
- throws SQLException
- {
- log.debug("In-putted Parameters;");
- log.debug("conn: " + conn.toString());
- log.debug("schemaName: " + schemaName);
- log.debug("data: " + data.toString());
- log.debug("attrib: " + attrib.toString());
- log.debug("attribAmount: " + attribAmount);
-
- //Preparing population script
- String sql = new String();
- log.debug("Adding data to table");
- // Creating: INSERT INTO schema.tb_table (
- sql = "INSERT INTO " + schemaName + ".tb_" + theTable + " (";
- // Creating: attrib1, attrib2, attrib3, attrib4, attrib5
- for(int i = 0; i < attribAmount; i++)
- {
- sql += attrib[i];
- if(i < attribAmount - 1)
- sql += ", ";
- }
- // Creating: ) VALUES (val1, val2, val3, val4, val5);
- sql += ") VALUES (";
- for(int i = 0; i < attribAmount; i++)
- {
- sql += "?";
- if(i < attribAmount - 1)
- sql += ", ";
- }
- sql += ");";
-
- try
- {
- log.debug("Prepared Statement: " + sql);
- PreparedStatement prepStat1;
- if(conn.isClosed())
- {
- log.error("Connection is closed");
- }
-
- log.debug("Adding Row");
- prepStat1 = conn.prepareStatement(sql);
-
- //debug statements and prepare statements
- log.debug("prepStat.setString(1, " + data[0] + ")");
- prepStat1.setString(1, data[0]);
- log.debug("prepStat.setString(2, " + data[1] + ")");
- prepStat1.setString(2, data[1]);
- log.debug("prepStat.setString(3, " + data[2] + ")");
- prepStat1.setString(3, data[2]);
- log.debug("prepStat.setString(4, " + data[3] + ")");
- prepStat1.setString(4, data[3]);
- log.debug("prepStat.setString(5, " + data[4] + ")");
- prepStat1.setString(5, data[4]);
-
- log.debug("Executing Statement for row");
- log.debug(prepStat1.toString());
- prepStat1.execute();
- log.debug("Tables Populated");
- log.debug("Committing Changes");
- prepStat1 = conn.prepareStatement("COMMIT;");
- prepStat1.execute();
- }
- catch(SQLException e1)
- {
- log.error("Could not populate table: " + e1.toString());
- throw e1;
- }
- catch(Exception e1)
- {
- log.error("Could not populate table, None Database Error: " + e1.toString());
- throw new SQLException("Could not execute Population");
- }
- }
-
/**
* Resets user bad submission counter to 0
* @param ApplicationRoot Application's running context
@@ -544,7 +299,7 @@ public static boolean setCoreDatabaseInfo(String applicationRoot, String url, St
/**
* This method is used to store a CSRF Token for a specific user in the csrfChallengeSeven DB Schema. May not necessarily be a new CSRF token after running
* @param userId User Identifier
- * @param csrfToken CSRF Token to add to the csrfChallengeSix DB Schema
+ * @param csrfToken CSRF Token to add to the csrfChallengeFour DB Schema
* @param ApplicationRoot Running context of the application
* @return Returns current CSRF token for user for CSRF Ch4
*/
@@ -676,7 +431,7 @@ public static boolean setExposedDatabaseInfo(String applicationRoot, String url,
* @param ApplicationRoot Used to locate database properties file
* @param moduleCategory The module category to open or closed
* @param openOrClosed What to set the module status to. Can only be "open" or "closed"
- * @return
+ * @return True if method executes without failure
*/
public static boolean setModuleCategoryStatusOpen (String ApplicationRoot, String moduleCategory, String openOrClosed)
{
@@ -858,36 +613,6 @@ public static boolean unSuspendUser(String ApplicationRoot, String userId)
return result;
}
- /**
- * Used to update a module's cheat sheet
- * @param applicationRoot The current running context of the application
- * @param moduleId The identifier of the module to update
- * @param newSolution The new cheat sheet content
- * @return A boolean value reflecting the success of the operation
- */
- public static boolean updateCheatSheet(String applicationRoot, String moduleId, String newSolution)
- {
- log.debug("*** Getter.updateCheatSheet ***");
- boolean result = false;
- Connection conn = Database.getCoreConnection(applicationRoot);
- try
- {
- CallableStatement callstmt = conn.prepareCall("call cheatSheetCreate(?, ?)");
- log.debug("Preparing cheatSheetCreate procedure");
- callstmt.setString(1, moduleId);
- callstmt.setString(2, newSolution);
- callstmt.execute();
- result = true;
- }
- catch (SQLException e)
- {
- log.error("Could not execute cheatSheetCreate: " + e.toString());
- }
- Database.closeConnection(conn);
- log.debug("*** END updateCheatSheet ***");
- return result;
- }
-
/**
* Used to increment a users CSRF counter for CSRF levels.
* @param ApplicationRoot The current running context of the application.
@@ -954,7 +679,7 @@ public static boolean updatePassword (String ApplicationRoot, String userName, S
/**
* Updates a player's password without needing the current password
* @param ApplicationRoot Running context of the applicaiton
- * @param userName The username of the user to update
+ * @param userId The user id of the user to update
* @param newPassword The new password to assign to the user
* @return
*/
@@ -1077,9 +802,9 @@ public static String updatePlayerResult(String ApplicationRoot, String moduleId,
callstmnt.setInt(5, difficulty);
callstmnt.setString(6, extra);
log.debug("Executing userUpdateResult");
- ResultSet resultSet = callstmnt.executeQuery();
- resultSet.next();
- result = resultSet.getString(1);
+ callstmnt.execute();
+ //User Executed. Now Get the Level Name Langauge Key
+ result = Getter.getModuleNameLocaleKey(ApplicationRoot, moduleId);
}
catch(SQLException e)
{
@@ -1220,6 +945,7 @@ public static boolean userCreate (String ApplicationRoot, String classId, String
catch(SQLException e)
{
log.fatal("userCreate Failure: " + e.toString());
+ throw new SQLException(e);
}
Database.closeConnection(conn);
log.debug("*** END userCreate ***");
diff --git a/SecurityShepherdCore/src/i18n/challenges/directObject/1f0935baec6ba69d79cfb2eba5fdfa6ac5d77fadee08585eb98b130ec524d00c.properties b/SecurityShepherdCore/src/i18n/challenges/directObject/1f0935baec6ba69d79cfb2eba5fdfa6ac5d77fadee08585eb98b130ec524d00c.properties
new file mode 100644
index 000000000..ff8ecf4e7
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/directObject/1f0935baec6ba69d79cfb2eba5fdfa6ac5d77fadee08585eb98b130ec524d00c.properties
@@ -0,0 +1,19 @@
+challenge.challengeName = Insecure Direct Object References Challenge Two
+challenge.whatToDo = To complete this challenge you must sign in to a bank account that has more than 5000000 euro in it. If you have more than this amount in your account, just sign out and back in again of the bank account to get the key, or open this level again.
+
+insecureBank.title = InsecureDirectBank
+insecureBank.message = Hey new customers. We're up and coming in the banking sector and would like to give you a free account. Just create an account and sign in here:
+insecureBank.signInNow = Sign in Now!
+insecureBank.signInNow.message = Use this form to sign into your account now!
+
+loginForm.holder = Account Holder:
+loginForm.password = Account Password:
+loginForm.signIn = Sign Into Bank Account
+
+form.loading = Loading...
+
+register.makeAccount = Register An Account!
+register.makeAccount.message = Use this form to register an account now!
+register.createAccount = Create Bank Account
+
+error.occurred = An Error Occurred
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/directObject/o9a450a64cc2a196f55878e2bd9a27a72daea0f17017253f87e7ebd98c71c98c.properties b/SecurityShepherdCore/src/i18n/challenges/directObject/o9a450a64cc2a196f55878e2bd9a27a72daea0f17017253f87e7ebd98c71c98c.properties
new file mode 100644
index 000000000..2bf692b82
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/directObject/o9a450a64cc2a196f55878e2bd9a27a72daea0f17017253f87e7ebd98c71c98c.properties
@@ -0,0 +1,4 @@
+challenge.challengeName = Insecure Direct Object References Challenge One
+challenge.whatToDo = The result key for this challenge is stored in the private message for a user that is not listed below...
+challenge.showProfile = Show this Profile
+challenge.loading = Loading...
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/directObject/vc9b78627df2c032ceaf7375df1d847e47ed7abac2a4ce4cb6086646e0f313a4.properties b/SecurityShepherdCore/src/i18n/challenges/directObject/vc9b78627df2c032ceaf7375df1d847e47ed7abac2a4ce4cb6086646e0f313a4.properties
new file mode 100644
index 000000000..9e3347fee
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/directObject/vc9b78627df2c032ceaf7375df1d847e47ed7abac2a4ce4cb6086646e0f313a4.properties
@@ -0,0 +1,4 @@
+challenge.challengeName = Insecure Direct Object References Challenge Two
+challenge.whatToDo = The result key for this challenge is stored in the private message for a user that is not listed below...
+challenge.showProfile = Show this Profile
+challenge.loading = Loading...
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/1feccf2205b4c5ddf743630b46aece3784d61adc56498f7603ccd7cb8ae92629.properties b/SecurityShepherdCore/src/i18n/challenges/injection/1feccf2205b4c5ddf743630b46aece3784d61adc56498f7603ccd7cb8ae92629.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/1feccf2205b4c5ddf743630b46aece3784d61adc56498f7603ccd7cb8ae92629.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/1feccf2205b4c5ddf743630b46aece3784d61adc56498f7603ccd7cb8ae92629.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties b/SecurityShepherdCore/src/i18n/challenges/injection/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties
similarity index 91%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties
index eb08e484b..863cf44f1 100644
--- a/SecurityShepherdCore/src/i18n/challenges/sqli/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties
+++ b/SecurityShepherdCore/src/i18n/challenges/injection/7edcbc1418f11347167dabb69fcb54137960405da2f7a90a0684f86c4d45a2e7.properties
@@ -3,7 +3,7 @@ challenge.description = To complete this challenge, you must exploit the SQL inj
challenge.hint = Challenge Hint
challenge.hint.description = This is the query you are attempting to inject code into!
challenge.form.pleaseEnter = Please enter the
-challenge.form.customerEmail = Customer Email
+challenge.form.customerName = Customer Name
challenge.form.userLookUp = of the user that you want to look up
challenge.form.getUser = Get this user
sign.hint = Would you like a hint?
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/8c2dd7e9818e5c6a9f8562feefa002dc0e455f0e92c8a46ab0cf519b1547eced.properties b/SecurityShepherdCore/src/i18n/challenges/injection/8c2dd7e9818e5c6a9f8562feefa002dc0e455f0e92c8a46ab0cf519b1547eced.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/8c2dd7e9818e5c6a9f8562feefa002dc0e455f0e92c8a46ab0cf519b1547eced.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/8c2dd7e9818e5c6a9f8562feefa002dc0e455f0e92c8a46ab0cf519b1547eced.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/8c3c35c30cdbbb73b7be3a4f8587aa9d88044dc43e248984a252c6e861f673d4.properties b/SecurityShepherdCore/src/i18n/challenges/injection/8c3c35c30cdbbb73b7be3a4f8587aa9d88044dc43e248984a252c6e861f673d4.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/8c3c35c30cdbbb73b7be3a4f8587aa9d88044dc43e248984a252c6e861f673d4.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/8c3c35c30cdbbb73b7be3a4f8587aa9d88044dc43e248984a252c6e861f673d4.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/8edf0a8ed891e6fef1b650935a6c46b03379a0eebab36afcd1d9076f65d4ce62.properties b/SecurityShepherdCore/src/i18n/challenges/injection/8edf0a8ed891e6fef1b650935a6c46b03379a0eebab36afcd1d9076f65d4ce62.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/8edf0a8ed891e6fef1b650935a6c46b03379a0eebab36afcd1d9076f65d4ce62.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/8edf0a8ed891e6fef1b650935a6c46b03379a0eebab36afcd1d9076f65d4ce62.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/b7327828a90da59df54b27499c0dc2e875344035e38608fcfb7c1ab8924923f6.properties b/SecurityShepherdCore/src/i18n/challenges/injection/b7327828a90da59df54b27499c0dc2e875344035e38608fcfb7c1ab8924923f6.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/b7327828a90da59df54b27499c0dc2e875344035e38608fcfb7c1ab8924923f6.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/b7327828a90da59df54b27499c0dc2e875344035e38608fcfb7c1ab8924923f6.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/d0e12e91dafdba4825b261ad5221aae15d28c36c7981222eb59f7fc8d8f212a2.properties b/SecurityShepherdCore/src/i18n/challenges/injection/d0e12e91dafdba4825b261ad5221aae15d28c36c7981222eb59f7fc8d8f212a2.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/d0e12e91dafdba4825b261ad5221aae15d28c36c7981222eb59f7fc8d8f212a2.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/d0e12e91dafdba4825b261ad5221aae15d28c36c7981222eb59f7fc8d8f212a2.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/d63c2fb5da9b81ca26237f1308afe54491d1bacf9fffa0b21a072b03c5bafe66.properties b/SecurityShepherdCore/src/i18n/challenges/injection/d63c2fb5da9b81ca26237f1308afe54491d1bacf9fffa0b21a072b03c5bafe66.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/d63c2fb5da9b81ca26237f1308afe54491d1bacf9fffa0b21a072b03c5bafe66.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/d63c2fb5da9b81ca26237f1308afe54491d1bacf9fffa0b21a072b03c5bafe66.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/e1e109444bf5d7ae3d67b816538613e64f7d0f51c432a164efc8418513711b0a.properties b/SecurityShepherdCore/src/i18n/challenges/injection/e1e109444bf5d7ae3d67b816538613e64f7d0f51c432a164efc8418513711b0a.properties
similarity index 100%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/e1e109444bf5d7ae3d67b816538613e64f7d0f51c432a164efc8418513711b0a.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/e1e109444bf5d7ae3d67b816538613e64f7d0f51c432a164efc8418513711b0a.properties
diff --git a/SecurityShepherdCore/src/i18n/challenges/sqli/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties b/SecurityShepherdCore/src/i18n/challenges/injection/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties
similarity index 82%
rename from SecurityShepherdCore/src/i18n/challenges/sqli/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties
rename to SecurityShepherdCore/src/i18n/challenges/injection/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties
index 35228e27e..69e63ce71 100644
--- a/SecurityShepherdCore/src/i18n/challenges/sqli/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties
+++ b/SecurityShepherdCore/src/i18n/challenges/injection/ffd39cb26727f34cbf9fce3e82b9d703404e99cdef54d2aa745f497abe070b.properties
@@ -2,7 +2,7 @@ challenge.challengeName = SQL Injection Challenge Two
challenge.description = To complete this challenge, you must exploit the SQL injection flaw in the following form to find the result key.
challenge.hint = Challenge Hint
challenge.hint.description = This is the query you are attempting to inject code into... But your input is been validated by the server before being sent to the interpreter!
-challenge.form.pleaseEnter = Please enter the Customer Name of the user that you want to look up
+challenge.form.pleaseEnter = Please enter the Customer Email of the user that you want to look up
challenge.form.button.value = Get user
sign.loading = Loading
sign.hint = Would you like a hint?
diff --git a/SecurityShepherdCore/src/i18n/challenges/insecureCryptoStorage/insecureCryptoStorage.properties b/SecurityShepherdCore/src/i18n/challenges/insecureCryptoStorage/insecureCryptoStorage.properties
new file mode 100644
index 000000000..826b60c7e
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/insecureCryptoStorage/insecureCryptoStorage.properties
@@ -0,0 +1,36 @@
+insecureCryptoStorage.1.challengename = Insecure Cryptographic Storage Challenge 1
+insecureCryptoStorage.2.challengename = Insecure Cryptographic Storage Challenge 2
+insecureCryptoStorage.3.challengename = Insecure Cryptographic Storage Challenge 3
+insecureCryptoStorage.4.challengename = Insecure Crypto Storage Challenge 4
+
+insecureCryptoStorage.1.whatToDo = The result key has been encrypted to ensure that nobody can finish the challenge without knowing the secret key to decrypt it. However, the result key has been encrypted with a famous, but easily broken, Roman cipher. The Plain text is in English.
+
+insecureCryptoStorage.2.whatToDo = The result key has been encrypted to ensure that nobody can finish the challenge without knowing the secret key to decrypt it. The following form can be used to check if you have the correct result key.
+insecureCryptoStorage.2.checkKey = Check Result Key
+insecureCryptoStorage.2.hint = 2D Encryption
+insecureCyrptoStorage.2.commentedCode.1 = Validate theKey:
+insecureCyrptoStorage.2.commentedCode.2 = Transform input:
+insecureCyrptoStorage.2.commentedCode.3 = Check result for validity
+insecureCyrptoStorage.2.commentedCode.4 = Output the "output" variable to the HTML for viewing
+
+insecureCyrptoStorage.3.whatToDo = The result key to this level is the same as the encryption key used in the following sub application. Break the cipher and recover the encryption key! The result key is in all capital letters and is in English.
+insecureCyrptoStorage.3.ciphertextToDecrypt = Cipher text to decrypt:
+insecureCyrptoStorage.3.ciphertextExample = Cipher text Example
+insecureCyrptoStorage.3.tryDecryptThis = Try to decrypt this:
+
+insecureCyrptoStorage.4.whatToDo = If you can buy trolls for free you'll receive the key for this level!
+insecureCyrptoStorage.4.shop = Super Meme Shopping
+insecureCyrptoStorage.4.shop.message.1 = Hey customers: Due to a shipping mistake we are completely over stocked in rage Memes. Use the coupon code
+insecureCyrptoStorage.4.shop.message.2 = or
+insecureCyrptoStorage.4.shop.message.3 = to get yours for free!!!
+insecureCyrptoStorage.4.shop.picture = Picture
+insecureCyrptoStorage.4.shop.cost = Cost
+insecureCyrptoStorage.4.shop.quantity = Quantity
+insecureCyrptoStorage.4.shop.howToShop = Please select how many things you would like to buy and click submit
+insecureCyrptoStorage.4.shop.couponCode = Coupon Code:
+insecureCyrptoStorage.4.shop.submit = Place Order
+
+insecureCyrptoStorage.loading = Loading...
+insecureCyrptoStorage.errorOccurred = An Error Occurred
+insecureCyrptoStorage.decrypt = Decrypt
+
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/brokenCrypto/brokenCrypto.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/brokenCrypto/brokenCrypto.properties
new file mode 100644
index 000000000..0187da821
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/brokenCrypto/brokenCrypto.properties
@@ -0,0 +1,10 @@
+challenge1.challengeName = Mobile Broken Crypto 1
+challenge1.para1 = This App uses a deprecated encryption algorithm (DES) and breaks a vital rule of key management. The key is in the conversation. Decrypt the chat to get the key.
+
+
+challenge2.challengeName = Mobile Broken Crypto 2
+challenge2.para1 = This App uses DES to encrypt it's chat however it's developers have implemented this poorly. The key is in the conversation. Decrypt the chat to get the key.
+
+
+challenge3.challengeName = Mobile Broken Crypto 3
+challenge3.para1 = The key for this challenge can be found in the client side database. Get the key to pass this challenge.
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/clientSideInjection/clientSideInjection.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/clientSideInjection/clientSideInjection.properties
new file mode 100644
index 000000000..ec9333ec6
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/clientSideInjection/clientSideInjection.properties
@@ -0,0 +1,8 @@
+challenge1.challengeName = Mobile Client Side Injection 1
+challenge1.para1 = The App for this challenge uses sloppy filters in an attempt to thwart attackers. These filters can be easily bypassed. Login to get the key.
+
+
+//TODO
+
+challenge2.challengeName = Mobile Client Side Injection 2
+challenge2.para1 = This App has an upgraded form of filtering. Bypass the filtering, and perform SQL Injection to sign in as a legitimate user.
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/insecureData/insecureDataStrings.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/insecureData/insecureDataStrings.properties
new file mode 100644
index 000000000..d6e8dd35f
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/insecureData/insecureDataStrings.properties
@@ -0,0 +1,9 @@
+challenge1.challengeName = Mobile Insecure Data Storage 1
+challenge1.para1 = The App for this challenge stores user credentials within a database, the data has not been stored in plain text but it also has not been encrypted. Make the credentials readable to get the key. The key is the Admin's password.
+
+challenge2.challengeName = Mobile Insecure Data Storage 2
+challenge2.para1 = The App for this challenge, InsecureData2 uses a hashing algorithm on stored user credentials. However, there are two issues here, firstly the user is using a bad password. Secondly, the App does not use a salt when hashing the data. The result key to this challenge is the user's password.
+
+
+challenge3.challengeName = Mobile Insecure Data Storage 3
+challenge3.para1 = Not all Apps will use sqlite to store user data, in some cases SharedPreferences is used. The key to this level can be gained once you log in as a legitimate user.
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/poorAuthentication/poorAuthentication.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/poorAuthentication/poorAuthentication.properties
new file mode 100644
index 000000000..df8582827
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/poorAuthentication/poorAuthentication.properties
@@ -0,0 +1,2 @@
+challenge1.challengeName = Poor Authentication 1
+challenge1.para1 = You must log into the App PoorAuthentication1.apk to get the key. The Username and Password have been saved but this App uses a specially generated Authentication Code.
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/reverseEngineer/reverseEngineer.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/reverseEngineer/reverseEngineer.properties
new file mode 100644
index 000000000..ed16354dd
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/reverseEngineer/reverseEngineer.properties
@@ -0,0 +1,8 @@
+challenge1.challengeName = Mobile Reverse Engineer 1
+challenge1.para1 = This key to this challenge is the App author's name. Find it to complete the challenge.
+
+challenge2.challengeName = Mobile Reverse Engineer 2
+challenge2.para1 = When an attacker reverse engineers an APK, they usually find multiple packages containing multiple activities, containing multiple methods which have all been obfuscated to crawl through. The key for this challenge has been hard coded into the APK for this challenge. To get to the key reverse engineer the APK and find the correct Activity which performs a conditional statement to check the validity of the key.
+
+challenge3.challengeName = Mobile Reverse Engineer 3
+challenge3.para1 = The developers of this App, ReverseEngineer3, have decided to use an algorithm to confirm or deny the authenticity of the key. You must Reverse Engineer ReverseEngineer3.APK to find this algorithm. If you are unsure whether or not the key is correct, there is a key validity checker in the App.
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/mobile/unintendedDataLeakage/dataLeakage.properties b/SecurityShepherdCore/src/i18n/challenges/mobile/unintendedDataLeakage/dataLeakage.properties
new file mode 100644
index 000000000..7e3ca6982
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/mobile/unintendedDataLeakage/dataLeakage.properties
@@ -0,0 +1,5 @@
+challenge1.challengeName = Unintended Data Leakage 1
+challenge1.para1 = Log in as the user of this App to get the key for this challenge. Some data has been logged but it is up to the attacker to know what to do with this data.
+
+challenge2.challengeName = Unintended Data Leakage 2
+challenge2.para1 = This App is leaking logs. The Key is the winning lotto number!
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/poorValidation/poorValidationStrings.properties b/SecurityShepherdCore/src/i18n/challenges/poorValidation/poorValidationStrings.properties
new file mode 100644
index 000000000..039cf51d6
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/poorValidation/poorValidationStrings.properties
@@ -0,0 +1,14 @@
+poorValidation.1.challengeName = Poor Validation One
+poorValidation.2.challengeName = Poor Validation Two
+
+poorValidation.whatToDo = If you can buy trolls for free you'll receive the key for this level!
+poorValidation.shopping = Super Meme Shopping
+poorValidation.shopping.whatToDo = Use this shop to buy whatever old memes you like!
+poorValidation.howToShop = Please select how many items you would like to buy and click submit
+poorValidation.picture = Picture
+poorValidation.cost = Cost
+poorValidation.quantity = Quantity
+poorValidation.placeOrder = Place Order
+poorValidation.loading = Loading...
+
+error.occurred = An Error Occurred
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/challenges/securityMisconfig/c4285bbc6734a10897d672c1ed3dd9417e0530a4e0186c27699f54637c7fb5d4.properties b/SecurityShepherdCore/src/i18n/challenges/securityMisconfig/c4285bbc6734a10897d672c1ed3dd9417e0530a4e0186c27699f54637c7fb5d4.properties
new file mode 100644
index 000000000..9e43ecbb1
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/challenges/securityMisconfig/c4285bbc6734a10897d672c1ed3dd9417e0530a4e0186c27699f54637c7fb5d4.properties
@@ -0,0 +1,10 @@
+securityMisconfig.stealTokens.challengeName = Security Misconfiguration Cookie Flag Challenge
+securityMisconfig.stealTokens.description = To complete this challenge, you must steal the securityMisconfigLesson cookie of another user. The administrators of the sub application have misconfigured the mechanism which enforces cookie security flags. The cookie set in this lesson has not been given the "secure" flag. This means that in any HTTP requests to the lesson will include this cookie. Even though the application (If Shepherd has been correctly configured) redirects to a HTTPs service upon access, the will have been sent across the network in plain text. When players open this lesson, they automatically send a HTTP request thanks to the following <IMG> element. Image elements do not follow the mixed content policy and will send HTTP requests even when loaded inside a HTTPs context. This will not work with an iFrame.
+securityMisconfig.stealTokens.whyThisImageIsHere = This Image has sent your securityMisconfigLesson across the network in plain text
+securityMisconfig.stealTokens.haveSomebodyOnYourNetwork = If there are no users on your local network, this lesson is very difficult to complete. Please ask your Shepherd Administrator to disable it.
+securityMisconfig.stealTokens.stealTokenThenDoThis = Once you have stolen another user's securityMisconfigLesson token, click the following button and sub in the other user's token where your own exists.
+
+form.securityMisconfig.stealTokens.submit = Get Result Key
+form.challenge.loading = Loading...
+
+error.occurred = An Error Occurred
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/cheatsheets/solutions.properties b/SecurityShepherdCore/src/i18n/cheatsheets/solutions.properties
index 6fd40d1b7..d43d33311 100644
--- a/SecurityShepherdCore/src/i18n/cheatsheets/solutions.properties
+++ b/SecurityShepherdCore/src/i18n/cheatsheets/solutions.properties
@@ -53,7 +53,7 @@ cfbf7b915ee56508ad46ab79878f37fd9afe0d27.solution = To complete this challenge a
9294ba32bdbd680e3260a0315cd98bf6ce8b69bd.solution = The first step in completing this challenge is to get an admin user's email address. Try to sign in as 'root' or 'superuser' to get one. To complete this challenge a user must use SQL Injection in the email Parameter in the GET request to the SecretQuestion servlet. The following email submission will achieve the response of the users secret answer (This example is URL Encoded)
You can then use this answer along with a user email address to complete the level.
7153290d128cfdef5f40742dbaeb129a36ac2340.solution = To complete this challenge a user must send the server a request with the 'challengeRole' value set to 'nmHqLjQknlHs'. The challengeRole cookie is encoded with ATOM-128. The value 'nmHqLjQknlHs' when decoded is 'superuser'.
145111e80400e4fd48bd3aa5aca382e9c5640793.solution = To complete this challenge a user must deobfusticate the javascript found in /couponCheck.js and extract the relevent cryptoinformation to manually decrypt a javascript array of encrypted coupons, or to manipulate the javascript so that it returns the decrypted coupons. The Coupon code for free trolls is e!c!3etZoumo@Stu4rU176
-adc845f9624716eefabcc90d172bab4096fa2ac4.solution = To complete this challenge, a SQL Injection Flaw must be exploited to learn the name of the super admin. The injection is performed through the BASE64 encoded cookie named 'currentPerson'. a simple "or"1"!="0 vector will work. take the super admin's name and submit it encoded for BASE64 as the currentPerson cookie value in the request that is submitted when the Admin button is clicked. This will return the result key for the challenge.
+adc845f9624716eefabcc90d172bab4096fa2ac4.solution = To complete this challenge, a SQL Injection Flaw must be exploited to learn the name of the super admin in a request described in the module's javascript. This function is not used by the presented HTML. You must manually craft this request and include an injection attack through the BASE64 encoded cookie named 'currentPerson'. a simple "or"1"!="0 vector will work. Take the super admin's name and submit it encoded for BASE64 as the currentPerson cookie value in the request that is submitted when the Admin button is clicked. This will return the result key for the challenge.
64070f5aec0593962a29a141110b9239d73cd7b3.solution = To complete this challenge, a SQL injection flaw must be exploited. The vulnerable paramater is 'subUserEmail'. It must be mostly well formed as an email address to get past the validation process. The following vector, which is URL encoded, will sign the user in as user 1.
'or'1'='1'union%0aselect%0auserName%0afrom%0ausers%0awhere''!='%40v
1e3c02ad49fa9a9e396a3b268d7da8f0b647d8f9.solution = To complete this challenge, connect the android debug bridge to the VM and run adb logcat –d \ to dump logs to a text file. Trigger the key log by pressing the lotto button
f40b0cd5d45327c9426675313f581cf70c7c7c28.solution = To complete this challenge, start the app, go to the command line of the VM using ALT F1 and then navigate to /sdcard/, pictorial logs are places there. Connect adb to the device and run the adb pull command on the logs.
diff --git a/SecurityShepherdCore/src/i18n/lessons/m_content_provider_leakage/4d41997b5b81c88f7eb761c1975481c4ce397b80291d99307cfad69662277d39.properties b/SecurityShepherdCore/src/i18n/lessons/m_content_provider_leakage/4d41997b5b81c88f7eb761c1975481c4ce397b80291d99307cfad69662277d39.properties
index a9640d4b8..db9113e87 100644
--- a/SecurityShepherdCore/src/i18n/lessons/m_content_provider_leakage/4d41997b5b81c88f7eb761c1975481c4ce397b80291d99307cfad69662277d39.properties
+++ b/SecurityShepherdCore/src/i18n/lessons/m_content_provider_leakage/4d41997b5b81c88f7eb761c1975481c4ce397b80291d99307cfad69662277d39.properties
@@ -2,6 +2,7 @@ title.question.content_provider_leak = What is Content Provider Leakage?
paragraph.info.1 = A Content Provider is used by Android to provide access to a structured set of data within a central repository. Content Providers are intended to be accessed by other applications, however with the Android Debug Bridge, they can be accessed by anyone with access to a device.
paragraph.info.2 = In order to query a Content Provider without an App, perform the following adb commands
+paragraph.info.3 = Without knowing the URI, an attacker can do a few things to figure it out.
challenge.description = The Key can be attained by querying the Content Provider. The URI is : content://com.somewhere.hidden.SecretProvider/data
diff --git a/SecurityShepherdCore/src/i18n/moduleGenerics/mobileGenericStrings.properties b/SecurityShepherdCore/src/i18n/moduleGenerics/mobileGenericStrings.properties
new file mode 100644
index 000000000..cf929bc08
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/moduleGenerics/mobileGenericStrings.properties
@@ -0,0 +1,2 @@
+mobileBlurb.vmLink.1 = To complete this challenge you'll need to use the
+mobileBlurb.vmLink.2 = app found in the Security Shepherd Android Virtual Machine.
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectBank.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectBank.properties
new file mode 100644
index 000000000..a485435f8
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectBank.properties
@@ -0,0 +1,31 @@
+login.authFailedMessage.1 = ERROR: User
+login.authFailedMessage.2 = could not be logged in
+login.error.couldNotGetBalance = Could not get Balance!
+
+bankForm.yourAccount = Your Account
+bankForm.yourAccount.balance = Your account balance is currently:
+bankForm.transferFunds = Transfer Funds
+bankForm.transferFunds.whatToDo = Use this form to send money to other accounts in this bank. All you need to do is enter their account number and the amount you want to send!
+bankForm.recieverNumber = Receiver Account Number:
+bankForm.amountToSend = Amount to Send:
+bankForm.loading = Loading...
+bankForm.refreshBalance = Refresh Balance
+bankForm.refreshBalance.whatToDo = Use this form to refresh your balance above. That way you can see if any money came in recently!
+bankForm.logoutOfAccount = Logout of Account
+bankForm.logoutOfAccount.whatToDo = Use this form to sign out of your bank account when your done giving your money away.
+bankForm.logoutFromBankAccount = Log Out Of Bank Account
+
+result.complete = Challenge Complete
+result.wellDone = Congratulations, you have successfully completed this challenge. Use the following result key at the top of the page to mark this level as complete in the system.
+result.theKeyIs = The result key for this challenge is
+
+logout.loggedOut = Logged Out
+
+register.accountCreated = User account has been registered! Please Sign in!
+register.error = Could not create account!
+
+transfer.error.couldNotTransfer = Could not get Transfer Funds!
+transfer.error.notEnoughCash = Your account does not have the necessary funds to transfer that amount.
+transfer.error.moreThanZero = The amount being transfered must be greater than zero.
+transfer.error.occurred = An Error Occured:
+transfer.success = Funds have been transfered sucessfully!
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef1.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef1.properties
new file mode 100644
index 000000000..ef746d2a9
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef1.properties
@@ -0,0 +1,4 @@
+response.message = Message
+response.notFound = User: 404 - User Not Found
+response.notFoundMessage.1 = User
+response.notFoundMessage.2 = could not be found or does not exist.
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef2.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef2.properties
new file mode 100644
index 000000000..ef746d2a9
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/directObject/directObjectRef2.properties
@@ -0,0 +1,4 @@
+response.message = Message
+response.notFound = User: 404 - User Not Found
+response.notFoundMessage.1 = User
+response.notFoundMessage.2 = could not be found or does not exist.
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/insecureCryptoStorage/insecureCryptoStorage.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/insecureCryptoStorage/insecureCryptoStorage.properties
new file mode 100644
index 000000000..3d7895c5d
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/insecureCryptoStorage/insecureCryptoStorage.properties
@@ -0,0 +1,8 @@
+insecureCyrptoStorage.3.plaintextResult = Plain text Result:
+insecureCyrptoStorage.3.plaintextResult.message = Your cipher text was decrypted to the following:
+
+insecureCyrptoStorage.4.orderComplete = Order Complete
+insecureCyrptoStorage.4.orderShipped = Your order has been made and has been sent to our magic shipping department that knows where you want this to be delivered via brain wave sniffing techniques.
+insecureCyrptoStorage.4.totalCost = Your order comes to a total of
+insecureCyrptoStorage.4.freeTrolls = Trolls were free, Well Done
+insecureCyrptoStorage.4.orderFailed = Order Failed - Please try again later
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/poorValidation/poorValidationStrings.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/poorValidation/poorValidationStrings.properties
new file mode 100644
index 000000000..b52bdd206
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/poorValidation/poorValidationStrings.properties
@@ -0,0 +1,5 @@
+poorValidation.orderComplete = Order Complete
+poorValidation.orderComplete.message = Your order has been made and has been sent to our magic shipping department that knows where you want this to be delivered via brain wave sniffing techniques.
+poorValidation.orderTotal = Your order comes to a total of
+poorValidation.freeTrolls = Trolls were free, Well Done
+poorValidation.badOrder = Order Failed - Please try again later
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/securityMisconfig/stealTokens.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/securityMisconfig/stealTokens.properties
new file mode 100644
index 000000000..742799d70
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/securityMisconfig/stealTokens.properties
@@ -0,0 +1,5 @@
+securityMisconfig.servlet.stealTokens.notComplete = Challenge NOT Complete
+securityMisconfig.servlet.stealTokens.notComplete.message = You cannot complete this securityMisconfig.servlet.stealTokens with your cookie value. You must get the cookie from another user.
+securityMisconfig.servlet.stealTokens.notComplete.yourToken = You muse submit a valid token of another user to complete this securityMisconfig.servlet.stealTokens.
+securityMisconfig.servlet.stealTokens.complete = Challenge Complete
+securityMisconfig.servlet.stealTokens.youDidIt = Congratulations! Your result key is as follows
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/servlets/challenges/sqli/sqli6.properties b/SecurityShepherdCore/src/i18n/servlets/challenges/sqli/sqli6.properties
index b57103fd3..02b33d747 100644
--- a/SecurityShepherdCore/src/i18n/servlets/challenges/sqli/sqli6.properties
+++ b/SecurityShepherdCore/src/i18n/servlets/challenges/sqli/sqli6.properties
@@ -1,5 +1,5 @@
response.welcomeBack = Welcome back
response.authNumber = Your authentication number is now
-response.incorrectCreds = Incorrect Password / User name
+response.incorrectCreds = Incorrect Pin Number
response.carefulNow = Careful now!
response.badRequest = Bad Request? Please be careful!
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/text.properties b/SecurityShepherdCore/src/i18n/text.properties
index 72fad5cdb..33994bb70 100644
--- a/SecurityShepherdCore/src/i18n/text.properties
+++ b/SecurityShepherdCore/src/i18n/text.properties
@@ -1,106 +1,105 @@
-generic.text.aboutSecShep = About Security Shepherd
-generic.text.admin = Admin
-generic.text.cheat = Cheat
-generic.text.challenges = Challenges
-generic.text.commentMessage.1 = You are currently looking at the core server.
-generic.text.commentMessage.2 = Nothing related to the levels in Security Shepherd will be found in here.
-generic.text.commentMessage.3 = You might be looking for the iframe embedded in the page.
-generic.text.commentMessage.4 = Try a tool like Firebug to make this stuff easier.
-generic.text.configuration = Configuration
-generic.text.configureShepherd = Configure Shepherd
-generic.text.confirmPasswd = Confirm Password
-generic.text.confirmEmailAddr = Confirm Email
-generic.text.emailAddr = Email Address
-generic.text.lessons = Lessons
-generic.text.login = Login
-generic.text.logout = Logout
-generic.text.loading = Loading...
-generic.text.ssRegister = OWASP Security Shepherd - Register
-generic.text.password = Password
-generic.text.pleaseWait = Please Wait!
-generic.text.register = Register
-generic.text.scoreboard = Scoreboard
-generic.text.searchModules = Search Modules
-generic.text.shepherdVersion = Security Shepherd Version: 2.4
-generic.text.sorryError = Sorry but there was an error
-generic.text.submitResult = Submit Result Key Here
-generic.text.submit = Submit
-generic.text.username = Username
-generic.text.welcome = Welcome
-
-getter.button.completed = Completed
-getter.button.nextChallenge = Get Next Challenge
-getter.button.finished = You've Finished!
-getter.button.noModulesFound = No Modules Found
-getter.tournamentRank.1 = Field Training
-getter.tournamentRank.2 = Private
-getter.tournamentRank.3 = Corporal
-getter.tournamentRank.4 = Sergeant
-getter.tournamentRank.5 = Lieutenant
-getter.tournamentRank.6 = Major
-getter.tournamentRank.7 = Admiral
-
-getStarted.text.lets_start = Let's Get Started
-getStarted.button.openLevels.all = Open All Levels
-getStarted.button.openLevels.web = Open Web App Levels Only
-getStarted.button.openLevels.mobile = Open Mobile Levels Only
-getStarted.button.closeLevels = Close All Levels
-blockedMessage.text.heading.levelBlocked = Level Currently Blocked
-index.link.admin.cheatSheet.manage = Cheat Sheet Management
-index.link.admin.cheatSheet.manage.create = Create New Cheat Sheet
-index.link.admin.cheatSheet.manage.disable = Disable Cheat Sheets
-index.link.admin.cheatSheet.manage.enable = Enable Cheat Sheets
-index.link.admin.config.change = Change Module Layout
-index.link.admin.config.feedback = Feedback Configuration
-index.link.admin.config.openClose = Open/Close Registration
-index.link.admin.config.scoreboard = Scoreboard Configuration
-index.link.admin.config.coreDb = Set Core Database
-index.link.admin.moduleManage = Module Management
-index.link.admin.moduleManage.block = Module Block Setup
-index.link.admin.moduleManage.openClose = Open and Close Modules
-index.link.admin.moduleManage.openCloseCategory = Open or Close by Category
-index.link.admin.moduleManage.feedback = View Feedback
-index.link.admin.moduleManage.progress = View Progress
-index.link.admin.userMange = User Management
-index.link.admin.userMange.addPlayer = Add Players
-index.link.admin.userMange.addPoints = Add / Deduct Player Points
-index.link.admin.userMange.assignPlayer = Assign Players to Class
-index.link.admin.userMange.createClass = Create Class
-index.link.admin.userMange.createAdmin = Create New Admin
-index.link.admin.userMange.resetPass = Reset Password
-index.link.admin.userMange.setDefaultPlayerClass = Set Default Player Class
-index.link.admin.userMange.suspendPlayer = Suspend Player
-index.link.admin.userMange.unsuspendPlayer = Undo Suspend Player
-index.link.admin.userMange.upgradeToAdmin = Upgrade Player to Admin
-login.text.sponsers = Project Sponsors
-readyToPlay.title.readyToPlay = Security Shepherd - Ready to Go?
-readyToPlay.header.notReady = You are not ready!
-readyToPlay.title.enteredGame = You have entered the game!
-login.text.proxy_question = Do you need a Proxy?
-login.text.download_proxy = Download a HTTP Proxy here
-
-
-login.link.zap_win = ZAP for Windows
-login.link.zap_lin = ZAP for Linux
-login.link.zap_mac = ZAP for Mac
-
-
-blockedMessage.text.info.levelBlocked = Your doing very well! An administrator has currently marked this level as closed. To find out when this level will be available, your going to have to ask the person who is in charge on the application!
-getStarted.text.moduleInfo.openFloor = Now that you've signed in, lets get started with some Security Shepherd modules! To start a module, click on the list headers, Lessons or Modules, in the side menu to see what modules are currently available!
-getStarted.text.moduleInfo.incrementalFloor = Now that you've signed in, lets get started with some Security Shepherd challenges! To start one, click the "Get Next Challenge" button on the left!
-getStarted.text.moduleInfo = Now that you've signed in, lets get started with some Security Shepherd modules! To start a module, click on the list headers, such as Field Training or Corporal, in the side menu to see what modules are currently available! The lower down in the side menu that the module is listed, the more points it is worth!
-getStarted.text.configureShepherd.asAnAdmin = As you are an Administrator you can define the scope of Security Shepherd. You can quickly change the game layout to Web or Mobile Application focused with the following buttons, or you can open the Admin Module Management menu, at the top left of the page, to open or close specific topics.
-getStarted.text.checkShepConfigMsg = If you cannot see the message below this paragraph, please ensure that the Security Shepherd instance is correctly configured.
-getStarted.text.info.changePassword = Your password is a temporary password. This means that somebody else knows it! Lets keep things secure and change your password now!
-login.text.info = Use your Security Shepherd Credentials to Login.
-login.text.regInfo = Register a Security Shepherd Account here!
-login.text.about_blurb = The OWASP Security Shepherd project has been designed and implemented with the aim of fostering and improving application security awareness among a varied skill-set demographic.This project enables users to learn or to improve upon existing manual penetration testing skills. This is accomplished through lesson and challenge techniques. A lesson provides a user with a lot of help in completing that module, where a challenge puts what the user learned in the lesson to use.
The OWASP Security Shepherd project covers the OWASP Top Ten web app risks and also covers the OWASP Top Ten Mobile risks as well. Using these risks as a challenge test bed, common security vulnerabilities can be explored and their impact on a system understood. Many of these levels include insufficient mitigations and protections to these risks, such as blacklist filters, atrocious encoding schemes, barbaric security mechanisms and poor security configuration. The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well.
-login.text.sponsers_blurb = The OWASP Security Shepherd project would like to acknowledge and thank the generous support of our sponsors. Please check out their web pages and follow them on twitter.
-login.text.thanks = The OWASP Security Shepherd Project would also like to thank Dr. Anthony Keane and the ITB Security Research Lab for hosting the public https://owasp.securityShepherd.eu
-readyToPlay.text.info.notReady = Refresh the home page! If this error persists; Log out and back in! If this error continues to persist, please contact an Administrator!
-readyToPlay.text.info.enteredGame = Now that you can see this, you're good to go! Get cracking on lessons and challenges!
Remember, the levels you are playing are sub applications. Keep the game play in these applications! Stay away from your session ID's! You'll just log yourself out of you change them!
If you havn't already configured a web proxy, you better! It makes things much easier!
-
-
-
-
-
+generic.text.aboutSecShep = About Security Shepherd
+generic.text.admin = Admin
+generic.text.cheat = Cheat
+generic.text.challenges = Challenges
+generic.text.commentMessage.1 = You are currently looking at the core server.
+generic.text.commentMessage.2 = Nothing related to the levels in Security Shepherd will be found in here.
+generic.text.commentMessage.3 = You might be looking for the iframe embedded in the page.
+generic.text.commentMessage.4 = Try a tool like Firebug to make this stuff easier.
+generic.text.configuration = Configuration
+generic.text.configureShepherd = Configure Shepherd
+generic.text.confirmPasswd = Confirm Password
+generic.text.confirmEmailAddr = Confirm Email
+generic.text.emailAddr = Email Address
+generic.text.lessons = Lessons
+generic.text.login = Login
+generic.text.logout = Logout
+generic.text.loading = Loading...
+generic.text.ssRegister = OWASP Security Shepherd - Register
+generic.text.password = Password
+generic.text.pleaseWait = Please Wait!
+generic.text.register = Register
+generic.text.scoreboard = Scoreboard
+generic.text.searchModules = Search Modules
+generic.text.shepherdVersion = Security Shepherd Version: 3.0
+generic.text.sorryError = Sorry but there was an error
+generic.text.submitResult = Submit Result Key Here
+generic.text.submit = Submit
+generic.text.username = Username
+generic.text.welcome = Welcome
+
+getter.button.completed = Completed
+getter.button.nextChallenge = Get Next Challenge
+getter.button.finished = You've Finished!
+getter.button.noModulesFound = No Modules Found
+getter.tournamentRank.1 = Field Training
+getter.tournamentRank.2 = Private
+getter.tournamentRank.3 = Corporal
+getter.tournamentRank.4 = Sergeant
+getter.tournamentRank.5 = Lieutenant
+getter.tournamentRank.6 = Major
+getter.tournamentRank.7 = Admiral
+
+getStarted.text.lets_start = Let's Get Started
+getStarted.button.openLevels.all = Open All Levels
+getStarted.button.openLevels.web = Open Web App Levels Only
+getStarted.button.openLevels.mobile = Open Mobile Levels Only
+getStarted.button.closeLevels = Close All Levels
+blockedMessage.text.heading.levelBlocked = Level Currently Blocked
+index.link.admin.cheatSheet.manage = Cheat Sheet Management
+index.link.admin.cheatSheet.manage.create = Create New Cheat Sheet
+index.link.admin.cheatSheet.manage.disable = Disable Cheat Sheets
+index.link.admin.cheatSheet.manage.enable = Enable Cheat Sheets
+index.link.admin.config.change = Change Module Layout
+index.link.admin.config.feedback = Feedback Configuration
+index.link.admin.config.openClose = Open/Close Registration
+index.link.admin.config.scoreboard = Scoreboard Configuration
+index.link.admin.config.coreDb = Set Core Database
+index.link.admin.moduleManage = Module Management
+index.link.admin.moduleManage.block = Module Block Setup
+index.link.admin.moduleManage.openClose = Open and Close Modules
+index.link.admin.moduleManage.openCloseCategory = Open or Close by Category
+index.link.admin.moduleManage.feedback = View Feedback
+index.link.admin.moduleManage.progress = View Progress
+index.link.admin.userMange = User Management
+index.link.admin.userMange.addPlayer = Add Players
+index.link.admin.userMange.addPoints = Add / Deduct Player Points
+index.link.admin.userMange.assignPlayer = Assign Players to Class
+index.link.admin.userMange.createClass = Create Class
+index.link.admin.userMange.createAdmin = Create New Admin
+index.link.admin.userMange.resetPass = Reset Password
+index.link.admin.userMange.setDefaultPlayerClass = Set Default Player Class
+index.link.admin.userMange.suspendPlayer = Suspend Player
+index.link.admin.userMange.unsuspendPlayer = Undo Suspend Player
+index.link.admin.userMange.upgradeToAdmin = Upgrade Player to Admin
+login.text.sponsers = Project Sponsors
+readyToPlay.title.readyToPlay = Security Shepherd - Ready to Go?
+readyToPlay.header.notReady = You're not ready!
+readyToPlay.title.enteredGame = You have entered the game!
+login.text.proxy_question = Do you need a Proxy?
+login.text.download_proxy = Download a HTTP Proxy here
+
+
+login.link.zap_win = ZAP for Windows
+login.link.zap_lin = ZAP for Linux
+login.link.zap_mac = ZAP for Mac
+
+
+blockedMessage.text.info.levelBlocked = Your doing very well! An administrator has currently marked this level as closed. To find out when this level will be available, your going to have to ask the person who is in charge on the application!
+getStarted.text.moduleInfo.openFloor = Now that you have signed in, lets get started with some Security Shepherd modules! To start a module, click on the list headers, Lessons or Modules, in the side menu to see what modules are currently available!
+getStarted.text.moduleInfo.incrementalFloor = Now that you have signed in, lets get started with some Security Shepherd challenges! To start one, click the "Get Next Challenge" button on the left!
+getStarted.text.moduleInfo = Now that you have signed in, lets get started with some Security Shepherd modules! To start a module, click on the list headers, such as Field Training or Corporal, in the side menu to see what modules are currently available! The lower down in the side menu that the module is listed, the more points it is worth!
+getStarted.text.configureShepherd.asAnAdmin = As you are an Administrator you can define the scope of Security Shepherd. You can quickly change the game layout to Web or Mobile Application focused with the following buttons, or you can open the Admin Module Management menu, at the top left of the page, to open or close specific topics.
+getStarted.text.checkShepConfigMsg = If you cannot see the message below this paragraph, please ensure that the Security Shepherd instance is correctly configured.
+getStarted.text.info.changePassword = Your password is a temporary password. This means that somebody else knows it! Lets keep things secure and change your password now!
+login.text.info = Use your Security Shepherd Credentials to Login.
+login.text.regInfo = Register a Security Shepherd Account here!
+login.text.about_blurb = The OWASP Security Shepherd project has been designed and implemented with the aim of fostering and improving application security awareness among a varied skill-set demographic.This project enables users to learn or to improve upon existing manual penetration testing skills. This is accomplished through lesson and challenge techniques. A lesson provides a user with a lot of help in completing that module, where a challenge puts what the user learned in the lesson to use.
The OWASP Security Shepherd project covers the OWASP Top Ten web app risks and also covers the OWASP Top Ten Mobile risks as well. Using these risks as a challenge test bed, common security vulnerabilities can be explored and their impact on a system understood. Many of these levels include insufficient mitigations and protections to these risks, such as blacklist filters, atrocious encoding schemes, barbaric security mechanisms and poor security configuration. The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well.
+login.text.sponsers_blurb = The OWASP Security Shepherd project would like to acknowledge and thank the generous support of our sponsors. Please check out their web pages and follow them on twitter.
+login.text.thanks = The OWASP Security Shepherd Project would also like to thank Dr. Anthony Keane and the ITB Security Research Lab for hosting the public https://owasp.securityShepherd.eu
+readyToPlay.text.info.notReady = Refresh the home page! If this error persists; Log out and back in! If this error continues to persist, please contact an Administrator!
+readyToPlay.text.info.enteredGame = Now that you can see this, you're good to go! Get cracking on lessons and challenges!
Remember, the levels you are playing are sub applications. Keep the game play in these applications! Stay away from your session ID's! You'll just log yourself out of you change them!
If you havn't already configured a web proxy, you better! It makes things much easier!
+
+sponsorship.title = Project Sponsors
+sponsorship.message.1 = The OWASP Security Shepherd project would like to acknowledge and thank the generous support of our sponsors. Please check out their web pages and follow them on twitter.
+sponsorship.message.2 = The OWASP Security Shepherd Project would also like to thank Dr. Anthony Keane and the ITB Security Research Lab for hosting the public https://owasp.securityShepherd.eu!
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/i18n/text_es.properties b/SecurityShepherdCore/src/i18n/text_es.properties
index 6c41857e1..3d1aad04b 100644
--- a/SecurityShepherdCore/src/i18n/text_es.properties
+++ b/SecurityShepherdCore/src/i18n/text_es.properties
@@ -1,11 +1,11 @@
generic.text.aboutSecShep = Sobre Security Shepherd
generic.text.admin = Administración
-generic.text.cheat = Engañar
+generic.text.cheat = Hacer trampas
generic.text.challenges = Desafíos
-generic.text.commentMessage.1 = You are currently looking at the core server. (Translation Required)
-generic.text.commentMessage.2 = Nothing related to the levels in Security Shepherd will be found in here. (Translation Required)
-generic.text.commentMessage.3 = You might be looking for the iframe embedded in the page. (Translation Required)
-generic.text.commentMessage.4 = Try a tool like Firebug to make this stuff easier.(Translation Required)
+generic.text.commentMessage.1 = Estás mirando en el servidor central.
+generic.text.commentMessage.2 = Aquí no hay nada relacionado con los niveles de Security Sheperd.
+generic.text.commentMessage.3 = Puede que estés buscando el iframe incorporado (embedded iframe) en la página.
+generic.text.commentMessage.4 = Prueba una herramienta como Firebug para hacer esto más fácil.
generic.text.configuration = Configuración
generic.text.configureShepherd = Configure Shepherd
generic.text.confirmPasswd = Confirmar Contraseña
@@ -14,16 +14,16 @@ generic.text.emailAddr = Direcci
generic.text.lessons = Lecciones
generic.text.login = Acceder
generic.text.logout = Cerrar Sesión
-generic.text.loading = Cargando...
+generic.text.loading = Cargando...Engañar
generic.text.ssRegister = OWASP Security Shepherd - Registro
generic.text.password = Contraseña
generic.text.pleaseWait = Por favor, espera!
generic.text.register = Registro
generic.text.scoreboard = Marcador
-generic.text.searchModules = Search Modules (Translation Required)
-generic.text.shepherdVersion = Security Shepherd Version: 2.4 (Translation Required)
-generic.text.sorryError = Sorry but there was an error (Translation Required)
-generic.text.submitResult = Submit Result Key Here (Translation Required)
+generic.text.searchModules = Buscar módulos
+generic.text.shepherdVersion = Security Shepherd Version: 3.0
+generic.text.sorryError = Sorry but there was an error
+generic.text.submitResult = Submit Result Key Here
generic.text.username = Nombre de usario
generic.text.welcome = Bienvenida
diff --git a/SecurityShepherdCore/src/i18n/text_ga.properties b/SecurityShepherdCore/src/i18n/text_ga.properties
index 5dea63f6e..ecd6ba01f 100644
--- a/SecurityShepherdCore/src/i18n/text_ga.properties
+++ b/SecurityShepherdCore/src/i18n/text_ga.properties
@@ -21,9 +21,9 @@ generic.text.pleaseWait = D
generic.text.register = Cláraigh
generic.text.scoreboard = Scórchlár
generic.text.searchModules = Search Modules (Translation Required)
-generic.text.shepherdVersion = Security Shepherd Version: 2.4 (Translation Required)
-generic.text.sorryError = Sorry but there was an error (Translation Required)
-generic.text.submitResult = Submit Result Key Here (Translation Required)
+generic.text.shepherdVersion = Security Shepherd Version: 3.0
+generic.text.sorryError = Sorry but there was an error
+generic.text.submitResult = Submit Result Key Here
generic.text.submit = Cúir Isteach
generic.text.username = Ainm Úsáideora
generic.text.welcome = Fáilte
diff --git a/SecurityShepherdCore/src/i18n/text_hi.properties b/SecurityShepherdCore/src/i18n/text_hi.properties
new file mode 100644
index 000000000..99ceeb414
--- /dev/null
+++ b/SecurityShepherdCore/src/i18n/text_hi.properties
@@ -0,0 +1,107 @@
+generic.text.aboutSecShep = About Security Shepherd
+generic.text.admin = Admin
+generic.text.cheat = Cheat
+generic.text.challenges = Chunauti
+generic.text.commentMessage.1 = Aap currently core server per dekh rahe ho.
+generic.text.commentMessage.2 = Yaha pe tumhare liye Security Shepherd par koi level related mahiti nahi he!.
+generic.text.commentMessage.3 = Tum Shayad is page par embedded iframe khoj rahe ho.
+generic.text.commentMessage.4 = Is tool ko firebug ki tarah use kro aur simple banao.
+generic.text.configuration = Configuration
+generic.text.configureShepherd = Configure Shepherd
+generic.text.confirmPasswd = Confirm Password
+generic.text.confirmEmailAddr = Confirm Email
+generic.text.emailAddr = Email Address
+generic.text.lessons = Lessons
+generic.text.login = Login
+generic.text.logout = Logout
+generic.text.loading = Loading...
+generic.text.ssRegister = OWASP Security Shepherd - Register
+generic.text.password = Password
+generic.text.pleaseWait = Please Wait!
+generic.text.register = Register
+generic.text.scoreboard = Scoreboard
+generic.text.searchModules = Search Modules
+generic.text.shepherdVersion = Security Shepherd Version: 2.4
+generic.text.sorryError = Sorry yahape error payi gayi he
+generic.text.submitResult = Result Key yaha pe submit karo
+generic.text.submit = Submit
+generic.text.username = Username
+generic.text.welcome = Welcome
+
+getter.button.completed = Completed
+getter.button.nextChallenge = Get Next Challenge
+getter.button.finished = Tumhne pura kiya!
+getter.button.noModulesFound = Koi Modules Mil nahi rahe
+getter.tournamentRank.1 = Field Training
+getter.tournamentRank.2 = Private
+getter.tournamentRank.3 = Corporal
+getter.tournamentRank.4 = Sergeant
+getter.tournamentRank.5 = Lieutenant
+getter.tournamentRank.6 = Major
+getter.tournamentRank.7 = Admiral
+
+getStarted.text.lets_start = Let's Get Started
+getStarted.button.openLevels.all = Open All Levels
+getStarted.button.openLevels.web = Open Web App Levels Only
+getStarted.button.openLevels.mobile = Open Mobile Levels Only
+getStarted.button.closeLevels = Close All Levels
+blockedMessage.text.heading.levelBlocked = Level Currently Blocked
+index.link.admin.cheatSheet.manage = Cheat Sheet Management
+index.link.admin.cheatSheet.manage.create = Create New Cheat Sheet
+index.link.admin.cheatSheet.manage.disable = Disable Cheat Sheets
+index.link.admin.cheatSheet.manage.enable = Enable Cheat Sheets
+index.link.admin.config.change = Change Module Layout
+index.link.admin.config.feedback = Feedback Configuration
+index.link.admin.config.openClose = Open/Close Registration
+index.link.admin.config.scoreboard = Scoreboard Configuration
+index.link.admin.config.coreDb = Set Core Database
+index.link.admin.moduleManage = Module Management
+index.link.admin.moduleManage.block = Module Block Setup
+index.link.admin.moduleManage.openClose = Open and Close Modules
+index.link.admin.moduleManage.openCloseCategory = Open or Close by Category
+index.link.admin.moduleManage.feedback = View Feedback
+index.link.admin.moduleManage.progress = View Progress
+index.link.admin.userMange = User Management
+index.link.admin.userMange.addPlayer = Add Players
+index.link.admin.userMange.addPoints = Add / Deduct Player Points
+index.link.admin.userMange.assignPlayer = Assign Players to Class
+index.link.admin.userMange.createClass = Create Class
+index.link.admin.userMange.createAdmin = Create New Admin
+index.link.admin.userMange.resetPass = Reset Password
+index.link.admin.userMange.setDefaultPlayerClass = Set Default Player Class
+index.link.admin.userMange.suspendPlayer = Suspend Player
+index.link.admin.userMange.unsuspendPlayer = Undo Suspend Player
+index.link.admin.userMange.upgradeToAdmin = Upgrade Player to Admin
+login.text.sponsers = Project k Sponsors
+readyToPlay.title.readyToPlay = Security Shepherd - Tum Taiyar ho?
+readyToPlay.header.notReady = Tum taiyar nahi ho!
+readyToPlay.title.enteredGame = tum game me enter ho gaye!
+login.text.proxy_question = Tumhe proxy chahiye?
+login.text.download_proxy = Download HTTP Proxy yahase
+
+
+login.link.zap_win = ZAP Windows k liye
+login.link.zap_lin = ZAP Linux k liye
+login.link.zap_mac = ZAP Mac k liye
+
+
+blockedMessage.text.info.levelBlocked = Tumh Acche ja rahe ho! Administrator ne currently is level ko closedkiya he. To ye level kab available hoga ye janne k liye,jo is application ka in charge hai usse puccho!
+getStarted.text.moduleInfo.openFloor = Ab tum signed in ho, lets get started with some Security Shepherd modules! To start a module, click on the list headers, Lessons or Modules, in the side menu to see what modules are currently available!
+getStarted.text.moduleInfo.incrementalFloor = Ab tum signed in ho, lets get started with some Security Shepherd challenges! To start one, click the "Get Next Challenge" button on the left!
+getStarted.text.moduleInfo = Ab tum signed in ho, lets get started with some Security Shepherd modules! To start a module, click on the list headers, such as Field Training or Corporal, in the side menu to see what modules are currently available! The lower down in the side menu that the module is listed, the more points it is worth!
+getStarted.text.configureShepherd.asAnAdmin = Administrator k taur pe tum Security Shepherd ke scope ko set kar sakte ho. tum turant game layout ko Web or Mobile Application change kar sakate ho,
+or you can open the Admin Module Management menu, at the top left of the page,specific topics ko open ya close krne k liye.
+getStarted.text.checkShepConfigMsg = agar tum paragraph k bad message nahi dekh pate to please ensure Security Shepherd instance sahi configured hua hai.
+getStarted.text.info.changePassword = tumhara password is a temporary password. so koi aur bhi janta hai aapke password ko! Pahele apne password ko change kar k secure bano!
+login.text.info = Use your Security Shepherd Credentials to Login.
+login.text.regInfo = Register a Security Shepherd Account here!
+login.text.about_blurb = The OWASP Security Shepherd project ko isi liye banaya gaya hai ki application security awareness ko support mile or sudhar ho,sari tarike ki skill-set vale demographic people k liye.Is project users ko manual penetration testing skills sikhata hai aur sudhar bhi lata hai.Sare lesson aur challenge techniques se ye sabit hota hai.Ye lesson user ko module complete karne me sabhi help karega, ki jaha ye challenge user is lesson se kya sikha vo use kar shakta hai.
The OWASP Security Shepherd project covers the OWASP Top Ten web app risks and also covers the OWASP Top Ten Mobile risks as well. Using these risks as a challenge test bed, common security muskeliyo ko explre karta hai aur system par uske impact ko bhi samajata hai. Is me se kai levels pahechan or fix nahi pane vale uplabdh workaround aur risks jaise ki blacklist filters, atrocious encoding schemes, barbaric security mechanisms and poor security configuration.The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well.
+login.text.sponsers_blurb = The OWASP Security Shepherd project would like to acknowledge and thank the generous support of our sponsors. Please check out their web pages and follow them on twitter.
+login.text.thanks = The OWASP Security Shepherd Project would also like to thank Dr. Anthony Keane and the ITB Security Research Lab for hosting the public https://owasp.securityShepherd.eu
+readyToPlay.text.info.notReady = Refresh the home page! If this error persists; Log out and back in! If this error continues to persist, please contact an Administrator!
+readyToPlay.text.info.enteredGame = Now that you can see this, you're good to go! Get cracking on lessons and challenges!
Remember, the levels you are playing are sub applications. Keep the game play in these applications! Stay away from your session ID's! You'll just log yourself out of you change them!
If you havn't already configured a web proxy, you better! It makes things much easier!
+
+
+
+
+
diff --git a/SecurityShepherdCore/src/i18n/text_pt.properties b/SecurityShepherdCore/src/i18n/text_pt.properties
index d3550413a..f08d9c3dc 100644
--- a/SecurityShepherdCore/src/i18n/text_pt.properties
+++ b/SecurityShepherdCore/src/i18n/text_pt.properties
@@ -21,7 +21,7 @@ generic.text.pleaseWait = Esperar por favor
generic.text.register = Registrar
generic.text.scoreboard = Placar
generic.text.searchModules = Busca liçãos
-generic.text.shepherdVersion = Security Shepherd Versão: 2.4
+generic.text.shepherdVersion = Security Shepherd Versão: 3.0
generic.text.sorryError = Descupla, mas havia um erro
generic.text.submitResult = Enviar seu chave resultado aqui
generic.text.submit = Enviar
diff --git a/SecurityShepherdCore/src/i18n/text_zh.properties b/SecurityShepherdCore/src/i18n/text_zh.properties
index 902c0b15f..f33979090 100644
--- a/SecurityShepherdCore/src/i18n/text_zh.properties
+++ b/SecurityShepherdCore/src/i18n/text_zh.properties
@@ -21,7 +21,7 @@ generic.text.pleaseWait = \u8BF7\u7A0D\u4FAF!
generic.text.register = \u6CE8\u518C
generic.text.scoreboard = \u8BB0\u5206\u677F
generic.text.searchModules = Search Modules
-generic.text.shepherdVersion = Security Shepherd \u7248\u672C: 2.4
+generic.text.shepherdVersion = Security Shepherd \u7248\u672C: 3.0
generic.text.sorryError = Sorry but there was an error
generic.text.submitResult = \u5728\u8FD9\u63D0\u4EA4\u7ED3\u679C\u94A5\u5319
generic.text.submit = \u63D0\u4EA4
diff --git a/SecurityShepherdCore/src/jsp/admin/config/aboutShepherd.jsp b/SecurityShepherdCore/src/jsp/admin/config/aboutShepherd.jsp
index bb3560969..ca319659d 100644
--- a/SecurityShepherdCore/src/jsp/admin/config/aboutShepherd.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/config/aboutShepherd.jsp
@@ -1,4 +1,4 @@
-<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*,java.io.*,java.net.*,org.owasp.esapi.ESAPI, org.owasp.esapi.Encoder, dbProcs.*, utils.*" errorPage="" %>
+<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.util.Locale, java.util.ResourceBundle, java.sql.*,java.io.*,java.net.*,org.owasp.esapi.ESAPI, org.owasp.esapi.Encoder, dbProcs.*, utils.*" errorPage="" %>
<%
ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG: aboutShepherd.jsp *************************");
@@ -52,14 +52,14 @@ String ApplicationRoot = getServletContext().getRealPath("");
%>
The OWASP Security Shepherd Project
- You are currently using Security Shepherd Version 2.4
+ You are currently using Security Shepherd Version 3.0
The OWASP Security Shepherd project is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen their penetration testing skill set to security expert status.
For More information, please visit the OWASP Security Shepherd Wiki Page.
diff --git a/SecurityShepherdCore/src/jsp/admin/config/configCheats.jsp b/SecurityShepherdCore/src/jsp/admin/config/configCheats.jsp
index afe3cc0d5..b2dc93f9b 100644
--- a/SecurityShepherdCore/src/jsp/admin/config/configCheats.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/config/configCheats.jsp
@@ -109,9 +109,6 @@ if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
}
//Show Disable Dialog
$("#disableCheats").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
@@ -144,9 +141,6 @@ if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
}
//Show Disable Dialog
$("#disableCheats").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
@@ -178,9 +172,6 @@ if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
}
//Show Enable Dialog
$("#enableCheats").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
diff --git a/SecurityShepherdCore/src/jsp/admin/config/configFeedback.jsp b/SecurityShepherdCore/src/jsp/admin/config/configFeedback.jsp
index 4cfda7d5a..e2fd6aa5e 100644
--- a/SecurityShepherdCore/src/jsp/admin/config/configFeedback.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/config/configFeedback.jsp
@@ -105,9 +105,6 @@ if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
}
//Show Disable Dialog
$("#disableFeedback").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
@@ -139,9 +136,6 @@ if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
}
//Show Enable Dialog
$("#enableFeedback").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/changeLevelLayout.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/changeLevelLayout.jsp
index 7533fa14d..5dd12173d 100644
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/changeLevelLayout.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/moduleManagement/changeLevelLayout.jsp
@@ -99,6 +99,7 @@ if (request.getSession() != null) //Session If
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/incrementalModules.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/incrementalModules.jsp
deleted file mode 100644
index 0454af48a..000000000
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/incrementalModules.jsp
+++ /dev/null
@@ -1,109 +0,0 @@
-<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*,java.io.*,java.net.*,org.owasp.esapi.ESAPI, org.owasp.esapi.Encoder, dbProcs.*, utils.*" errorPage="" %>
-
-<%
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG: incrementalModules.jsp *************************");
-
-/**
- * This file is part of the Security Shepherd Project.
- *
- * The Security Shepherd project is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * The Security Shepherd project is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with the Security Shepherd project. If not, see .
- *
- * @author Mark Denihan
- */
-
-if (request.getSession() != null)
-{
-HttpSession ses = request.getSession();
-Getter get = new Getter();
-//Getting CSRF Token from client
-Cookie tokenCookie = null;
-try
-{
- tokenCookie = Validate.getToken(request.getCookies());
-}
-catch(Exception htmlE)
-{
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG(incrementalModules.jsp): tokenCookie Error:" + htmlE.toString());
-}
-// validateAdminSession ensures a valid session, and valid administrator credentials
-// Also, if tokenCookie != null, then the page is good to continue loading
-// Token is now validated when accessing admin pages to stop attackers causing other users to tigger logs of access attempts
-Object tokenParmeter = request.getParameter("csrfToken");
-if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
-{
- //Logging Username
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "Accessed by: " + ses.getAttribute("userName").toString(), ses.getAttribute("userName"));
-// Getting Session Variables
-//This encoder should escape all output to prevent XSS attacks. This should be performed everywhere for safety
-Encoder encoder = ESAPI.encoder();
-String csrfToken = encoder.encodeForHTMLAttribute(tokenCookie.getValue());
-String ApplicationRoot = getServletContext().getRealPath("");
-%>
-
- <%
-}
-else
-{
-response.sendRedirect("../../loggedOutSheep.html");
-}
-}
-else
-{
-response.sendRedirect("../../loggedOutSheep.html");
-}
-%>
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/moduleBlock.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/moduleBlock.jsp
index 7475336e8..6d8f1b7bf 100644
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/moduleBlock.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/moduleManagement/moduleBlock.jsp
@@ -127,9 +127,6 @@ String ApplicationRoot = getServletContext().getRealPath("");
$("#badData").show("slow");
}
$("#enableBlockForm").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
@@ -161,9 +158,6 @@ String ApplicationRoot = getServletContext().getRealPath("");
$("#badData").show("slow");
}
$("#removeModuleBlockDiv").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
});
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/openCloseByCategory.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/openCloseByCategory.jsp
index 9bda5d1be..6241856f8 100644
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/openCloseByCategory.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/moduleManagement/openCloseByCategory.jsp
@@ -111,11 +111,11 @@ String ApplicationRoot = getServletContext().getRealPath("");
}
console.log('Showing Form');
$("#submitButton").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
});
});
+ var theRefreshError = "Could not Refresh Menu";
+ //Refresh the Side Menu
+ refreshSideMenu(theCsrfToken, theRefreshError);
});
$("#openCategories").click(function(){
@@ -143,6 +143,8 @@ String ApplicationRoot = getServletContext().getRealPath("");
//Now output Result Div and Show
$("#resultDiv").html(ajaxCall.responseText);
$("#resultDiv").show("fast");
+ //Refresh the Side Menu
+ refreshSideMenu(theCsrfToken, theRefreshError);
}
else
{
@@ -156,6 +158,7 @@ String ApplicationRoot = getServletContext().getRealPath("");
}, 1000);
});
});
+ var theRefreshError = "Could not Refresh Menu";
});
<% if(Analytics.googleAnalyticsOn) { %><%= Analytics.googleAnalyticsScript %><% } %>
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/openFloor.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/openFloor.jsp
deleted file mode 100644
index 236b7857c..000000000
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/openFloor.jsp
+++ /dev/null
@@ -1,109 +0,0 @@
-<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*,java.io.*,java.net.*,org.owasp.esapi.ESAPI, org.owasp.esapi.Encoder, dbProcs.*, utils.*" errorPage="" %>
-
-<%
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG: openFloor.jsp *************************");
-
-/**
- * This file is part of the Security Shepherd Project.
- *
- * The Security Shepherd project is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * The Security Shepherd project is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with the Security Shepherd project. If not, see .
- *
- * @author Mark Denihan
- */
-
-if (request.getSession() != null)
-{
-HttpSession ses = request.getSession();
-Getter get = new Getter();
-//Getting CSRF Token from client
-Cookie tokenCookie = null;
-try
-{
- tokenCookie = Validate.getToken(request.getCookies());
-}
-catch(Exception htmlE)
-{
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG(openFloor.jsp): tokenCookie Error:" + htmlE.toString());
-}
-// validateAdminSession ensures a valid session, and valid administrator credentials
-// Also, if tokenCookie != null, then the page is good to continue loading
-// Token is now validated when accessing admin pages to stop attackers causing other users to tigger logs of access attempts
-Object tokenParmeter = request.getParameter("csrfToken");
-if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
-{
- //Logging Username
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "Accessed by: " + ses.getAttribute("userName").toString(), ses.getAttribute("userName"));
-// Getting Session Variables
-//This encoder should escape all output to prevent XSS attacks. This should be performed everywhere for safety
-Encoder encoder = ESAPI.encoder();
-String csrfToken = encoder.encodeForHTMLAttribute(tokenCookie.getValue());
-String ApplicationRoot = getServletContext().getRealPath("");
-%>
-
- <%
-}
-else
-{
- response.sendRedirect("../../loggedOutSheep.html");
-}
-}
-else
-{
- response.sendRedirect("../../loggedOutSheep.html");
-}
-%>
\ No newline at end of file
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/setStatus.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/setStatus.jsp
index 6aaff6b58..4c7e3cb64 100644
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/setStatus.jsp
+++ b/SecurityShepherdCore/src/jsp/admin/moduleManagement/setStatus.jsp
@@ -109,9 +109,8 @@ String ApplicationRoot = getServletContext().getRealPath("");
$("#badData").show("slow");
}
$("#formDiv").slideDown("slow");
- $('html, body').animate({
- scrollTop: $("#resultDiv").offset().top
- }, 1000);
+ //Refresh the Side Menu
+ refreshSideMenu(theCsrfToken, theRefreshError);
});
});
});
diff --git a/SecurityShepherdCore/src/jsp/admin/moduleManagement/tournamentFloor.jsp b/SecurityShepherdCore/src/jsp/admin/moduleManagement/tournamentFloor.jsp
deleted file mode 100644
index e7758400b..000000000
--- a/SecurityShepherdCore/src/jsp/admin/moduleManagement/tournamentFloor.jsp
+++ /dev/null
@@ -1,109 +0,0 @@
-<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*,java.io.*,java.net.*,org.owasp.esapi.ESAPI, org.owasp.esapi.Encoder, dbProcs.*, utils.*" errorPage="" %>
-
-<%
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG: tournyFloor.jsp *************************");
-
-/**
- * This file is part of the Security Shepherd Project.
- *
- * The Security Shepherd project is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * The Security Shepherd project is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with the Security Shepherd project. If not, see .
- *
- * @author Mark Denihan
- */
-
-if (request.getSession() != null)
-{
-HttpSession ses = request.getSession();
-Getter get = new Getter();
-//Getting CSRF Token from client
-Cookie tokenCookie = null;
-try
-{
- tokenCookie = Validate.getToken(request.getCookies());
-}
-catch(Exception htmlE)
-{
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "DEBUG(tournyFloor.jsp): tokenCookie Error:" + htmlE.toString());
-}
-// validateAdminSession ensures a valid session, and valid administrator credentials
-// Also, if tokenCookie != null, then the page is good to continue loading
-// Token is now validated when accessing admin pages to stop attackers causing other users to tigger logs of access attempts
-Object tokenParmeter = request.getParameter("csrfToken");
-if(Validate.validateAdminSession(ses, tokenCookie, tokenParmeter))
-{
- //Logging Username
- ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), "Accessed by: " + ses.getAttribute("userName").toString(), ses.getAttribute("userName"));
-// Getting Session Variables
-//This encoder should escape all output to prevent XSS attacks. This should be performed everywhere for safety
-Encoder encoder = ESAPI.encoder();
-String csrfToken = encoder.encodeForHTMLAttribute(tokenCookie.getValue());
-String ApplicationRoot = getServletContext().getRealPath("");
-%>
-
@@ -23,8 +24,15 @@
String levelName = "Mobile Reverse Engineer 1";
//Alphanumeric Only
String levelHash = "072a9e4fc888562563adf8a89fa55050e3e1cfbbbe1d597b0537513ac8665295.jsp";
-//Level blurb can be written here in HTML OR go into the HTML body and write it there. Nobody will update this but you
-String levelBlurb = "";
+
+//Translation Stuff
+Locale locale = new Locale(Validate.validateLanguage(request.getSession()));
+ResourceBundle bundle = ResourceBundle.getBundle("i18n.challenges.mobile.reverseEngineer.reverseEngineer", locale);
+ResourceBundle mobile = ResourceBundle.getBundle("i18n.moduleGenerics.mobileGenericStrings", locale);
+
+//Used more than once translations
+String i18nLevelName = bundle.getString("challenge1.challengeName");
+String paragraph1 = bundle.getString("challenge1.para1");
ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), levelName + " Accessed");
if (request.getSession() != null)
{
@@ -44,25 +52,28 @@ if (request.getSession() != null)
if (Validate.validateSession(ses) && tokenCookie != null)
{
ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), levelName + " has been accessed by " + ses.getAttribute("userName").toString(), ses.getAttribute("userName"));
+
%>
@@ -23,8 +24,14 @@
String levelName = "Mobile Insecure Data Storage 3";
//Alphanumeric Only
String levelHash = "11ccaf2f3b2aa4f88265b9cacb5e0ed26b11af978523e34528cf0bb9d32de851";
-//Level blurb can be written here in HTML OR go into the HTML body and write it there. Nobody will update this but you
-String levelBlurb = "";
+
+//Translation Stuff
+Locale locale = new Locale(Validate.validateLanguage(request.getSession()));
+ResourceBundle bundle = ResourceBundle.getBundle("i18n.challenges.mobile.insecureData.insecureDataStrings", locale);
+ResourceBundle mobile = ResourceBundle.getBundle("i18n.moduleGenerics.mobileGenericStrings", locale);
+//Used more than once translations
+String LevelName = bundle.getString("challenge3.challengeName");
+String paragraph1 = bundle.getString("challenge3.para1");
ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), levelName + " Accessed");
if (request.getSession() != null)
@@ -52,21 +59,23 @@ if (request.getSession() != null)
Security Shepherd - <%= levelName %>
-
+
+
+
<%= levelName %>
- Not all Apps will use sqlite to store user data, in some cases SharedPreferences is used. The key to this level can be gained once you log in as a legitimate user.
+ <%= paragraph1 %>
@@ -23,9 +24,13 @@
//No Quotes In level Name
String levelName = "Insecure Direct Object Reference Bank Challenge";
//Alphanumeric Only
-String levelHash = "1f0935baec6ba69d79cfb2eba5fdfa6ac5d77fadee08585eb98b130ec524d00c";
-//Level blurb can be writen here in HTML OR go into the HTML body and write it there. Nobody will update this but you
-String levelBlurb = "Not used - See Below";
+String levelHash = "1f0935baec6ba69d79cfb2eba5fdfa6ac5d77fadee08585eb98b130ec524d00c";
+
+//Translation Stuff
+Locale locale = new Locale(Validate.validateLanguage(request.getSession()));
+ResourceBundle bundle = ResourceBundle.getBundle("i18n.challenges.directObject." + levelHash, locale);
+//Used more than once translations
+String i18nChallengeName = bundle.getString("challenge.challengeName");
ShepherdLogManager.logEvent(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), levelName + " Accessed");
if (request.getSession() != null)
@@ -59,47 +64,50 @@ if (request.getSession() != null)
Security Shepherd - <%= levelName %>
-
+
-
+
+
+
+
<%= levelName %>
- To complete this challenge you must sign in to a bank account that has more than 5000000 euro in it. If you have more than this amount in your account, just sign out and back in again of the bank account to get the key, or open this level again.
+ <%= bundle.getString("challenge.whatToDo") %>
-
InsecureDirectBank
-
Hey new customers. We're up and coming in the banking sector and would like to give you a free account. Just create an account and sign in here: