OWASP WebGoat Warning Meaning

Question

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted:

WARNING 1: While running this program your machine will be 
extremely vulnerable to attack. You should to disconnect
from the Internet while using this program. [sic]

What does this mean? My naive understanding says that this is run on a localhost, then where lies the vulnerability?

P.S.: It could be better if you could explain this for one just trying to get off the surface, or anyway, I am looking forward to learn, so please enlighten me. Any advice for one starting off is also most welcome. Thank you all!

score 5 · Accepted Answer · answered Jun 16 '15 at 04:14

5

WebGoat is an application that is designed to be susceptible to network attacks. Theoretically, your computer becomes vulnerable to a network attack when you're running WebGoat. Imagine if an attacker were to leverage the WebGoat vulnerability for the lesson about performing code injections, This would allow the attacker to execute commands on your computer. Very bad.

An attacker will need network access to your computer to execute the attack. You likely have a firewall on your network that will limit attackers to your local network. That said, you are still reducing the safety of your computer by running WebGoat. Especially as firewalls sometimes are misconfigured or have vulnerabilities that can cause them to let packets from the internet into the local network.

WebGoat's recommendation is to disconnect your computer from the internet which will remove the risk of a network attack. That means unplugging your network cable and/or disconnecting your WiFi connection. It seems like a reasonable protection to me.

answered Jun 16 '15 at 04:14

Neil Smithline

14,621
4
38
55

Thank you, but I can't even vote-up you :) – devautor Jun 16 '15 at 04:32
@KumarGaurav - you can accept the answer if you want. See https://security.stackexchange.com/help/someone-answers – Neil Smithline Jun 16 '15 at 04:39
Yeah, I know that, and I sure will. I just feel like waiting for more inputs, that's why :) – devautor Jun 16 '15 at 04:43
Sounds great. I'm glad my answer was helpful. – Neil Smithline Jun 16 '15 at 04:47
1

And machines behind the same firewall can access your machine; so don't do it when on a network with people you don't fully trust. – Jun 16 '15 at 07:41
Oh, I see! I guess, I need to learn more about localhost and its access constraints. Thanks. – devautor Jun 16 '15 at 08:56

OWASP WebGoat Warning Meaning

1 Answers1