Security Lab Notes · OWASP WebGoat

Web Application Security Lab

An authorized OWASP WebGoat lab using Burp Suite to investigate exposed information, weak input handling, and controlled page changes.

View Pentesting Lab Back to Projects

Overview

What I worked through

I inspected WebGoat requests and responses with Burp Suite to trace how server-side weaknesses affected the application.

The exercises covered exposed application logic, request trust boundaries, SQL injection, and a controlled page modification. Exploit strings and credentials are omitted.

Learning Flow

How the lab developed

01

Inspect application traffic

Captured and reviewed HTTP requests in Burp Suite to understand how the application handled client input and session data.

02

Identify exposed logic

Located application behavior that exposed sensitive implementation details, showing why source-code and error handling matter.

03

Validate input handling weakness

Used the authorized lab to demonstrate how unsafe database input handling can expose protected records.

04

Confirm impact safely

Verified the effect through controlled application behavior and captured evidence for the written analysis.

Key Findings

Security concepts reinforced

  • Client-controlled data is untrusted. Cookies, URL parameters, and form values must be validated on the server.
  • Authentication secrets must never be embedded in accessible code. Exposure of credentials or sensitive logic can lead directly to account compromise.
  • Database queries must be parameterized. Concatenating user input into SQL statements creates preventable injection risk.
  • HTTP responses can reveal too much. Error messages, source endpoints, and verbose debugging output can help an attacker map an application.

Defender View

What to monitor and improve

  • Repeated malformed parameters, unusual cookie values, and abnormal request patterns.
  • Unexpected application changes or content modifications following suspicious requests.
  • Database errors, authentication failures, and server logs showing input-validation exceptions.
  • Use of secure code review, parameterized queries, secret management, least privilege, and web application firewall controls.

Evidence

Selected lab screenshots

Burp Suite request analysis in the WebGoat lab
Request and response inspection in Burp Suite after refreshing the WebGoat challenge page.
Controlled source discovery evidence in the WebGoat lab
Controlled source and application-logic discovery through the WebGoat source endpoint.
Controlled WebGoat input validation test evidence
Intercepted POST request used to examine how WebGoat processed submitted input during the controlled page-modification exercise.
Controlled web page modification evidence in the WebGoat lab
Controlled page-modification result in the isolated WebGoat lab.

Reflection

What this added to my security practice

The exercises showed how information exposure, weak input handling, and poor access controls can combine. Server-side validation, parameterized queries, and useful logs address different parts of that chain.