Creating a OWASP WebGoat Ubuntu-based VM

I wanted to play with OWASP's WebGoat. So I created a Ubuntu Desktop VM, and installed Java and WebGoat. You also need a web proxy to do the lessons, so I installed WebScarab along with the FoxyProxy extension for FireFox to make using it easy. This post details all the steps I went through.

I did find these directions for doing this similar. They are outdated, but kudos to them for some basic concepts I followed.

[Update 11/30/2011: And there is now apparently a new version of my directions.]

I started with a fresh copy of a Ubuntu 8.0.4 Desktop image (I made my own, but you should be able to use an existing image). Fire up the image, login in, fire up a terminal (Applications, Accessories, Terminal) and become root ("sudo -i").

The first step was to install java:

# apt-get-install sun-java6-bin sun-java6-jdk

Note that tomcat is now included with WebGoat, so there is no need to install it separately. The next step is to download WebGoat:

# wget http://webgoat.googlecode.com/files/WebGoat-OWASP_Standard-5.2.zip
# unzip WebGoat-OWASP_Standard-5.2.zip
# mv WebGoat-5.2/ /usr/local
# cd /usr/local/WebGoat-5.2/

You will need to edit the webgoat.sh file to set JAVA_HOME and change the java version from 1.5 to 1.6. I use 'vi', you can use your favorite editor.

# chmod 755 webgoat.sh
# cp webgoat.sh webgoat.sh.orig
# vi webgoat.sh

Add "export JAVA_HOME=/usr/lib/jvm/java-6-sun" at the start of file, after the line with CATALINA_HOME. And then change the "1.5" on lines 17, 19, and 23 to "1.6".

Next step was to install WebScarab, which is a proxy you'll need for WebGoat lessons. Download and install as follows:

# cd /tmp
# wget http://dawes.za.net/rogan/webscarab/webscarab-current.zip
# unzip webscarab-current.zip
# mv webscarab-* /usr/local/webscarab

Now, to make it easy to use WebScarab from FireFox, I installed FoxyProxy into FireFox. Visit the FoxyProxy web page, install it and restart FireFox.

When FireFox starts back up, configure FireProxy as follows:

1. Click on FoxyProxy icon in lower right and select Add New Proxy. The FireProxy window should appear.
2. On the General tab, under Proxy Name enter "WebScarab".
3. On the Proxy Details tab, select Manual Proxy Configuration.
4. For Host or IP Address enter "127.0.0.1"
5. For Port enter "8008"
6. On the URL Patterns tab select Add New Pattern
7. For Pattern Name enter "WebGoat"
8. For Pattern URL enter "http://*127.0.0.1/WebGoat/*" (The first "*" here matches the "guest:guest" string for authentication.)
   
9. Click OK
10. Close Proxy Settings
11. Under Mode select Use proxies based on their pre-defined patterns and priorites.
12. Close FoxyProxy Options
    

Now you probably want to open a couple of terminal windows (or tabs) one for WebScarab and one for WebGoat. In the first window fire up WebScarab:

# java -jar /usr/local/webscarab/webscarab.jar

You should see a WebScarab window open after a moment.

Then, in the other window, fire up WebGoat:

# cd /usr/local/WebGoat-5.2
# ./webgoat.sh start80

WebGoat will churn for a little bit, but then you should eventually see a message like "INFO: Server startup in 3546 ms". At this point you are ready to go by pointing your browser at http://guest:guest@127.0.0.1/WebGoat/attack

At this point you should see not only WebGoat appear in your browser, but WebScarab should start displaying bunch of requests. Click on the image at the top of this post for what things should look like.

That's as far as I've gotten. Next step will be to dive into WebGoat.