HomeLab Headaches Ep.9

I think I got this working now, the Webscarab that is.  I read the configuration part over and over and OVER AGAIN
"
During the actual tutorial at the conference, you will be in a dedicated wireless network where 
no such HTTP proxy is needed; accordingly, please delete the proxy settings in WebScarab at 
the start of the tutorial. However, to test WebScarab at your current location, you will need to 
enter the HTTP proxy settings that apply to you there (the instructor cannot help you to find 
out these settings; please ask a colleague or your help desk if you don’t know these settings). 
Here is an example for the HTTP proxy settings (do not copy: these are valid only within the 
instructor’s company network): 
"

Between that and reading the error message on the terminal window where I start the Webscarab I figured it out.  At first I started Googling the error messages on the page on Firefox errors below

WebScarab encountered an error trying to retrieve

GET http://127.0.0.1:8080/WebGoat/attack HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Cookie: JSESSIONID=608FFA0267805397313D8AB48E491DB6
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=

The error was :

proxy.proxy.com
at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:175)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:384)
at java.net.Socket.connect(Socket.java:546)
at org.owasp.webscarab.httpclient.URLFetcher.connect(URLFetcher.java:368)
at org.owasp.webscarab.httpclient.URLFetcher.fetchResponse(URLFetcher.java:229)
at org.owasp.webscarab.plugin.proxy.RevealHidden$Plugin.fetchResponse(RevealHidden.java:100)
at org.owasp.webscarab.plugin.proxy.ManualEdit$Plugin.fetchResponse(ManualEdit.java:243)
at org.owasp.webscarab.plugin.proxy.ConnectionHandler.run(ConnectionHandler.java:233)
at java.lang.Thread.run(Thread.java:679)

I couldn't find a straight answer but everything kept stating "Creates a socket and connects it to the specified address on the specified port" so I start thinking "WTF! Am I? ME!? Going to have to setup and configure a local proxy on this machine for it to work?"  I go back to the Configuration instructions and something stuck out


During the actual tutorial at the conference, you will be in a dedicated wireless network where 
no such HTTP proxy is needed; accordingly, please delete the proxy settings in WebScarab at 
the start of the tutorial


A thought came to mind "Maybe, just maybe I DON'T have to setup a proxt in Webscarab.  My server is not connected to the internet or any network for that matter."  So I deleted the proxy settings in Webscarab and once again try to browse to http://127.0.0.1:8080/WebGoat/attack.  Webcarab opens as it does in intercept mode and then I hit "Accept Changes" and BAM! I get the Webgoat login prompt. YAY!!!!!!!!!!!

That's it for now, until I run into another issue to document. PEACE! (^__^)v

HomeLab Headaches Ep.8

Oh Webgoat, you have tricked me once again.  Monday night I thought I had it all done since I got the login prompt and was able to login.  I called it a night at around 0030 and went to sleep.  Last night I was excited to start learning what Webgoat had instored to teach me.  I get started on the General section and I get down to useful tools and come across Webscarab.  I know it was one of the required tools for Webgoat and had it downloaded and I had even tried running it once to make sure it was working(to the extent of my knowledge it was).

I read something about a proxy, which is Webscarab and it has a intercept mode, which if I understand this correctly all the http traffic goes through Webscarab and I can analyze it and edit it and\or pass it through.

First problem was setting up the proxy, I was setting proxy as proxy.proxy.com using port 1337.  Set Firefox to use proxy for http to the same and it would not allowed traffic through.  I played around with different settings and still couldn't get it to work or Webcarab to see the traffic either.  So I know it was something I was doing wrong with the proxy.  I kept going back to the OWASP page trying to find clues to what I am doing wrong.  The install for linux was simple just run

java -jar ./webscarab-selfcontained-[numbers].jar

Which to me just does look like an install, its just telling java to run this particular .jar file.  So I decided to look in the Windows installation instructions.  On there I got a clue as to what I was doing wrong, which was to proxy settings in Firefox.  I was setting the proxy to proxy.proxy.com but it looks like I'm suppose to set it to localhost, but I set the port to 1337 which is the port I set on the Webscarab. DIDN'T WORK.  I looked at the Terminal window and I saw "Listenner something something: 8008".  I thought "Why is Webscarab listenning to port 8008.  If Webscarab is suppose to intercept my http traffic then I should send it to that port"

So I did, I set the Firefox proxy to localhost port 8008.  YAY! That worked for Webscarab to intercept the traffic, but when I hit accept changes to let the traffic through to the server it vomits some java errors at me.

I toyed with some of the settings and can't get the traffic to pass through to the Webgoat server.  Tonight I shall do some more Googling to see if I can figure this out.

The hardest part of all of this is that I'm doing all of this by myself.  I have no one but Google to depend on for help.  Which is cool because it just helps me figure things out on my own which I like because I learn more that way, but when I get frustrated and get lost trying to figure something out or I fix something or find a fix but don't know how it actually fixed or what it does it sucks because then I'm not really learning.  I wish I had someone that I could bounce ideas off of or ask how and why.  MEH! Nothing I can do but keep on going.

One thing I created myself was a .sh to run the java command above so I can start Webscarab easier.  It was nothing special at all, all I did was put that command in the text editor and name it run_webscarab.sh.  To me I got excited because I've only created simple .bat scripts at work so for me to create something like this, in linux, on my own just by thinking about it and trying and it actually working on the first try, was pretty cool.  I didn't even know if it was going to work and if the correct file type that I had to save was .sh but I tried it anyways and BAM it worked. YAY!!!!