Auditing WebGoat with the Rochester OWASP folks
I drove down to Henrietta today after work to the Bryant and Stratton Building to attend a meeting of the Rochester Chapter of OWASP (The Open Web Application Security Project).
Ralf led 5 of us through the first 6 lessons provided by WebGoat, an insecure J2EE web application that was designed to illustrate roughly 14 classes of web app vulnerabilities. We used a Java MITM HTTP Proxy called Paros Proxy which let us intercept HTTP requests and modify them before passing them on to WebGoat. Paros has a pretty slick UI and a GPL-compatible license.
They meet on the third Monday of every month – come check it out if you’re interested in Web Security.
