Hey there. Welcome to this lesson.
Before we get started, you should have already watched
the overview and resources video for this course.
So be sure to do that if you haven't done so.
This video lesson explains how to import
WebGoat into your integrated development environment,
commonly referred to as IDE.
Now, I'm going to be using IntelliJ as my IDE,
and I will demonstrate how to do that.
You may be using a different IDE,
maybe Eclipse, NetBeans, or whatever,
and that's perfectly fine.
You can use whatever IDE you like.
Just make sure that you have Maven support in it.
Other than that, we will not do anything
that is specific to any specific IDE.
If you're very comfortable in another tool,
please feel free to try it,
and if you get it working,
be sure to share it with everyone
else in the discussion area.
After this lesson, you should be able
to import WebGoat into your IDE.
We will be using our IDE throughout the course.
So it's really important to get that done.
Let me show you how I do it,
then you can try it yourself.
So I'll show you quickly how to do it in IntelliJ.
Simply import the project,
pick the pom XML file that's at the root
of the directory that we cloned from GitHub,
the UC Davis version of GitHub.
This is essentially a Maven file
that will explain all of the project structure,
and all the files, and all the modules,
and all the dependencies that this project has.
In intelliJ, I only made two modifications.
I'll check this box that said,
search for projects recursively,
as well as import Maven project automatically.
And hitting ''Next'' will start the process.
I'm not going to do that because I've already done that,
and that process takes a little bit a time.
So after your project has been imported,
and make sure you have active Internet connection,
since it has to go and download a bunch of packages.
After your project has been imported,
it'll look something like this.
You'll have your root folder.
It'll either be called Web 1062, or WebGoat,
or whatever you Git tool cloned it over as,
and it'll have several folders underneath it
as well as that pom XML file that we imported.
So I'm going to show you quickly how to run this project.
We have several ways of running this projects.
We can run it from the command line
using our own application server like Tomcat.
You can deploy it to an actual Tomcat application server,
but I definitely don't recommend that since this is
a bondable application and you don't want
to be serving it anywhere publicly.
The way to run it from inside
your IDE is actually really simple.
In the root folder you will see
a folder called 'Web goat server',
and if you expand that,
underneath that you'll see 'source',
underneath that you'll see 'main',
and underneath that you'll see 'Java'.
So far the directory structure that you see is
pretty common within all of
the modules that we're going to be going through.
So get comfortable opening
these and nesting through them.
We have a package called owasp.webgoat,
org.owasp.webgoat, and in there is
a 'start web goat' file.
It essentially has the public static void main,
and it will start our spring application,
and it'll run our project for us.
So I'm going to right-click on it,
and I'm going to hit 'start web goat'.
My IDE now is going to start
building it and launching the spring application,
getting the dependencies it needs.
It should only take about 10 seconds to do this,
but depending on your internet connection and
the speed of the processor in your computer,
it might take you a little bit
longer or a little bit shorter,
but without having made any modifications to the project,
this should launch automatically.
So if you can't get to this point,
maybe pause and go back and see if you can
re-import your project and
work through the errors
that your specific IDE is giving you.
So with that, I'll go ahead and refresh this page.
So on your computer,
if you go to localhost:8080,
this is the port our IDE
opened and it's running our application in it.
Then WebGoat. Remember, it's
camel-case capital W and capital G, WebGoat.
You don't need a login part. It'll automatically add it.
It'll bring you to a login page.
If it's your first time here, you're
going to have to make a new user.
Simply click the 'register' user,
type in the username and the password you want,
agree to the terms and conditions and sign up.
Now, this is going to fail for me because I already
have a user that I've already created.
So I'm just going to go back and login with
it, and that's it.
As you can see, we're seeing this,
what is WebGoat page,
and it's the introduction to this.
At the end it says the WebGoat team
thanks you for your interests.
So we're going to modify this page
just to show that we can make modifications to the code.
So I'll go back to my IDE.
So the first thing we need to do is,
we need to find that introduction page
so that we can make modifications to it.
So if you expand the WebGoat lessons,
these are all the various insecure lessons
that we're going to be working
through throughout this course,
but we're specifically interested
in the introduction part.
So we're going to expand WebGoat-introduction,
source, main, Java.
This looks pretty familiar.
It's what we've done before with our start WebGoat page,
and as you can see, this module has
a slightly different name, org.owasp.webgoat.plugin.
It's not too important right now.
The way the structure of these projects,
the way they are set up is,
typically there is a Java file
that is loading in HTML file,
and the HTML files reference adoc files.
So if I double-click on this,
this looks very similar to the page that we just saw,
they thank us with the WebGoat team,
and we're going to simply add UC Davis Web 1062 here.
Actually, let's not the spaces on that.
As you can see, it'll make a bolded version of this.
My IDE automatically renders
these pages for me, yours may not.
All I'm going to do now is restart it.
So you can either stop it
and hit 'play again' on that page,
on the start WebGoat page that we looked at earlier,
or I'm just going to hit 'Refresh'.
It'll kill my session,
it'll run through the spring, upload again.
As long as I didn't break any code,
it shouldn't have to do anything special.
It'll take about another 10 seconds and as you can see,
it says started web goat.
As you can see it says, started web goat,
and if I simply go to my browser and refresh this page,
you can now see UC Davis Web 1062 was added to this.
So I hope you enjoyed that.
We can now show that we've made a change to WebGoat.
Obviously, the changes we're going to be
making throughout the course are going to
be very much more interesting
in patching the insecurities in here,
but that should give you
a small starter on how to work on this WebGoat project.