Setting up WebGoat

Webgoat is an application that is designed to be vulnerable to hacking so that it can serve as a resource for users to practice hacking and learn how to prevent being hacked. Webgoat is created for ethical hackers so they can stay up to date on newer methods of hacking. It is also an excellent introduction tool for hacking web applications. 

Go to the webgoat download page: https://code.google.com/p/webgoat/downloads/list

Download the top link (zip file) for Windows operating system:

Once the zip has finished downloading extract the files whereveer you want, and they should appear as shown below. Click on the webgoat_8080 Batch file.

This will start the Apache Tomcat server which will be run on localhost and use port 8080 by default, and you should see content in your terminal window that has opened as shown below. 

 You can visit the local web goat application by opening a browser and navigating to: http://127.0.0.1:8080/WebGoat/attack
Once you arrive there you will be asked for login credentials you can use one the following to login information:
Username: guest
Password: guest

Then you should see an interface as shown below, you can click on 'Start WebGoat' to begin the lessons:

 Now you have access to WebGoat's various tools and lessons for you to explore.