I am using https://github.com/WebGoat/WebGoat, trying to change couple of configs below but none works. I am not expert in Java so hope to have some insights what's wrong in my config.
For example, when I access http://127.0.0.1:8080/WebGoat
, there should be http code 302 with a redirect. Or when I refresh on http://127.0.0.1:8080/login, there should be http code 200 like what I got from curl -i http://127.0.0.1:8080/login
What I did: i have updated the application.properties
file logging sections to DEBUG level
logging.level.org.thymeleaf=DEBUG
logging.level.org.thymeleaf.TemplateEngine.CONFIG=DEBUG
logging.level.org.thymeleaf.TemplateEngine.TIMER=DEBUG
logging.level.org.thymeleaf.TemplateEngine.cache.TEMPLATE_CACHE=DEBUG
logging.level.org.springframework.web=DEBUG
logging.level.org.springframework=DEBUG
logging.level.org.springframework.boot.devtools=DEBUG
logging.level.org.owasp=DEBUG
logging.level.org.owasp.webgoat=DEBUG
logging.level.org.owasp.webgoat=DEBUG
However none of these appear when I access the page from browser. The logs merely shows actions of initialization, further refresh or accessing the page doesn't log any status code:
2023-04-13 17:02:30.794 INFO 69552 --- [ main]
o.s.b.w.e.undertow.UndertowWebServer : Undertow started on port(s) 9090 (http)
2023-04-13 17:02:30.804 INFO 69552 --- [ main] org.owasp.webgoat.server.StartWebGoat : Started StartWebGoat in 0.653 seconds (JVM running for 10.763)
2023-04-13 17:02:30.805 INFO 69552 --- [ main] org.owasp.webgoat.server.StartupMessage : Please browse to http://127.0.0.1:8080/WebGoat to get started...
2023-04-13 17:02:59.997 INFO 69552 --- [ XNIO-1 task-2] io.undertow.servlet : Initializing Spring DispatcherServlet 'dispatcherServlet'
2023-04-13 17:02:59.997 INFO 69552 --- [ XNIO-1 task-2] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet'
2023-04-13 17:03:00.000 INFO 69552 --- [ XNIO-1 task-2] o.s.web.servlet.DispatcherServlet : Completed initialization in 3 ms
When I inspect the network on browser, I can see the status code (image) . What is missing here? If I need to add logging action log.debug
somewhere, any guidance on that?
I have searched through those files in the main webgoat application, but a bit confused as where should i add further. I thought the application.properties file did configure logging with logging.level.org.owasp=DEBUG
stated.
https://github.com/WebGoat/WebGoat/tree/main/src/main/java/org/owasp/webgoat
Figured out - to add http code status logging, just add a logback.xml
file with configuration:
<configuration>
<include resource="org/springframework/boot/logging/logback/base.xml"/>
<logger name="org.springframework.web" level="DEBUG"/>
</configuration>
For the specific example with this https://github.com/WebGoat/WebGoat app, the location of the logback.xml
file will be in the src/main/resources/
folder.
(Note: some test cases will fail, but just proceed to reinstall and containerize it to execute after that as stated in the github steps :
# On Linux/Mac:
./mvnw clean install
# On Windows:
./mvnw.cmd clean install
# Using docker or podman, you can than build the container locally
docker build -f Dockerfile . -t webgoat/webgoat
Now we are ready to run the project. WebGoat is using Spring Boot.
# On Linux/Mac:
./mvnw spring-boot:run
# On Windows:
./mvnw.cmd spring-boot:run
And you will see the http code status logged after that when u run it locally or in chosen path.