Skip to content

Commit 7113952

Browse files
authored
Update readme.md with draft of dotTEST capabilities
1 parent 2e6d986 commit 7113952

1 file changed

Lines changed: 56 additions & 20 deletions

File tree

readme.md

Lines changed: 56 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,71 @@
1-
# WebGoat.NET version 0.3
1+
# dotTEST WebGoat.NET Example
22

3-
## Build status
3+
This example shows the following dotTEST capabilities:
4+
5+
- static analysis and flow analysis capabilities
6+
- integration with GitHub pipelines via [Run dotTEST Action](https://github.com/parasoft/run-dottest-action)
7+
- integration with Aider to perform static analysis fixes in GitHub pipelines (dotTEST Autofix feature)
8+
9+
## Table of contents
10+
11+
- [dotTEST capabilities](#dotTEST-capabilities)
12+
- [WebGoat.NET](#WebGoat.NET-version-0.3)
13+
14+
## dotTEST capabilities
15+
16+
### Static Analysis
17+
18+
TODO: Shortly describe static/Flow Analysis
19+
TODO: Add link to official dotTEST documentation
20+
21+
### Run dotTEST GitHub Action
22+
23+
TODO: Describe shortly the capabilities of the dotTEST Action
24+
TODO: Prepare shot yaml example / add link to example
25+
26+
[Run dotTEST Action project](https://github.com/parasoft/run-dottest-action)
27+
[Run dotTEST Action @ GitHub Marketplace](https://github.com/marketplace/actions/run-parasoft-dottest)
28+
29+
30+
### Autofix in CI/CD with Aider
31+
32+
TODO: Describe shortly what is the Autofix feature
33+
TODO: Add short yaml script snippet
34+
TODO: Add link to official documentation describing this feature
35+
36+
## WebGoat.NET version 0.3
37+
38+
### Build status
439

540
![build .NET 8](https://github.com/tobyash86/WebGoat.NET/workflows/build%20.NET%208/badge.svg)
641

7-
## The next generation of the WebGoat example project to demonstrate OWASP TOP 10 vulnerabilities
42+
### The next generation of the WebGoat example project to demonstrate OWASP TOP 10 vulnerabilities
843

944
This is a re-implementation of the original [WebGoat project for .NET](https://github.com/rappayne/WebGoat.NET).
1045

1146
This web application is a learning platform that attempts to teach about
1247
common web security flaws. It contains generic security flaws that apply to
13-
most web applications. It also contains lessons that specifically pertain to
48+
most web applications. It also includes lessons that specifically pertain to
1449
the .NET framework. The exercises in this app are intended to teach about
1550
web security attacks and how developers can overcome them.
1651

17-
### WARNING!:
52+
#### WARNING!:
1853
THIS WEB APPLICATION CONTAINS NUMEROUS SECURITY VULNERABILITIES
1954
WHICH WILL RENDER YOUR COMPUTER VERY INSECURE WHILE RUNNING! IT IS HIGHLY
2055
RECOMMENDED TO COMPLETELY DISCONNECT YOUR COMPUTER FROM ALL NETWORKS WHILE
2156
RUNNING!
2257

23-
### Notes:
58+
#### Notes:
2459
- Google Chrome performs filtering for reflected XSS attacks. These attacks
25-
will not work unless chrome is run with the argument
60+
will not work unless Chrome is run with the argument
2661
`--disable-xss-auditor`.
2762

28-
## Requirements
63+
### Requirements
2964
- .NET 8 SDK
3065

31-
## How to build and run
66+
### How to build and run
3267

33-
### 1. Running in a Docker container
68+
#### 1. Running in a Docker container
3469

3570
The provided Dockerfile is compatible with both Linux and Windows containers.
3671
To build a Docker image, execute the following command:
@@ -39,19 +74,19 @@ To build a Docker image, execute the following command:
3974
docker build --pull --rm -t webgoat.net .
4075
```
4176

42-
Please note that Linux image is already built by pipeline and can be pulled from [here](https://github.com/users/tobyash86/packages?repo_name=WebGoat.NET).
77+
Please note that the Linux image is already built by the pipeline and can be pulled from [here](https://github.com/users/tobyash86/packages?repo_name=WebGoat.NET).
4378

44-
#### Linux containers
79+
##### Linux containers
4580

4681
To run the `webgoat.net` image, execute the following command:
4782

4883
```sh
4984
docker run --rm -d -p 5000:80 --name webgoat.net webgoat.net
5085
```
5186

52-
WebGoat.NET website should be accessible at http://localhost:5000.
87+
The WebGoat.NET website should be accessible at http://localhost:5000.
5388

54-
#### Windows containers
89+
##### Windows containers
5590

5691
To run `webgoat.net` image, execute the following command:
5792

@@ -78,15 +113,15 @@ Ethernet adapter Ethernet:
78113

79114
In the above example, you can access the WebGoat.NETCore website at http://172.29.245.43.
80115

81-
#### Stopping Docker container
116+
##### Stopping Docker container
82117

83118
To stop the `webgoat.net` container, execute the following command:
84119

85120
```sh
86121
docker stop webgoat.net
87122
```
88123

89-
### 2. Run locally using dotnet.exe (Kestrel)
124+
#### 2. Run locally using dotnet.exe (Kestrel)
90125

91126
1. Build and publish WebGoat.NET with the following command:
92127

@@ -102,18 +137,19 @@ The web application will be deployed to the `app` folder in the current director
102137
dotnet ./app/WebGoat.NET.dll --urls=http://localhost:5000
103138
```
104139

105-
The the WebGoat.NET website will be accessible at the URL specified with the `--urls` parameter: http://localhost:5000.
140+
The WebGoat.NET website will be accessible at the URL specified with the `--urls` parameter: http://localhost:5000.
106141

107-
### 3. Run using a script
108-
The WebGoat.NET projects ships with scripts that allow you to conveniently run the web application. The following scripts are located in the the "script" directory in the root of the project:
142+
#### 3. Run using a script
143+
The WebGoat.NET project ships with scripts that allow you to conveniently run the web application. The following scripts are located in the "script" directory in the root of the project:
109144
- runInDocker.bat - Runs the application in a Docker container on Windows.
110145
- runInDocker.sh - Runs the application in a Docker container on Linux.
111146
- runLocal.bat - Runs the application locally on Windows.
112147
- runLocal.sh - Runs the application locally on Linux.
113148

114-
## Known issues:
149+
### Known issues:
115150

116151
1. The latest OWASP Top 10 is not covered. The uncovered vulnerabilities need to be added to the code base.
117152
2. Educational documents/trainings for any categories of the latest OWASP Top 10 are not available.
118153

119154

155+

0 commit comments

Comments
 (0)