# rajesh-sangepu/webgoat architecture

> Architecture diagram of the GitHub repository rajesh-sangepu/webgoat, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rajesh-sangepu/webgoat
- Repository: https://github.com/rajesh-sangepu/webgoat

## Overview

WebGoat is an intentionally vulnerable web application for learning web security and penetration testing. A learner registers or logs in, browses a lesson menu, submits exercise requests, receives feedback, and tracks completion. The source tree also shows WebWolf, a companion application, and lessons spanning authentication, access control, injection, cryptography, and other security topics. The graph highlights the lesson runtime and progress/reporting layers; most lesson-to-container wiring is not shown in the excerpts, so those relationships are omitted or marked unverified.

Main entry points: [`src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java) (Lesson menu), [`src/main/java/org/owasp/webgoat/container/report/ReportCardController.java`](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/report/ReportCardController.java) (Progress report), [`src/main/java/org/owasp/webgoat/webwolf/WebWolf.java`](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/WebWolf.java) (WebWolf app), [`src/main/java/org/owasp/webgoat/container/session/Course.java`](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/session/Course.java) (Course catalog)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Identity and access"]
  node_registration["Registration"]
  node_user_service["User service<br/>[UserService.java]"]
  node_user_repository[("User repository")]
  node_webgoat_user["WebGoat user<br/>[WebGoatUser.java]"]
end

subgraph group_learning["Lesson experience"]
  node_course["Course catalog<br/>[Course.java]"]
  node_category["Lesson categories<br/>[Category.java]"]
  node_lesson["Lesson model<br/>[Lesson.java]"]
  node_lesson_name["Lesson identifier<br/>[LessonName.java]"]
  node_menu_service["Lesson menu"]
  node_lesson_progress["Lesson progress"]
  node_user_progress["User progress<br/>[UserProgress.java]"]
  node_progress_repository[("Progress repository")]
  node_report_card["Progress report"]
  node_plugin_messages["Lesson messages"]
end

subgraph group_lessons["Security exercises"]
  node_assignment_endpoint["Assignment endpoints"]
  node_attack_result["Exercise feedback<br/>[AttackResult.java]"]
  node_challenge["Flag challenges"]
  node_injection["SQL injection"]
  node_security_lessons["Security lesson set"]
end

subgraph group_companion["WebWolf companion"]
  node_webwolf["WebWolf app<br/>[WebWolf.java]"]
  node_mailbox["Mailbox"]
  node_jwt_service["JWT service<br/>[JWTController.java]"]
  node_file_server["File server<br/>[FileServer.java]"]
end

node_learner(("Learner"))

node_learner -.->|"registers"| node_registration
node_registration -->|"adds user"| node_user_service
node_user_service -->|"reads and saves"| node_user_repository
node_user_service -->|"creates progress"| node_progress_repository
node_learner -.->|"requests menu"| node_menu_service
node_menu_service -->|"reads catalog"| node_course
node_menu_service -->|"reads progress"| node_progress_repository
node_course -->|"uses categories"| node_category
node_course -->|"provides lessons"| node_lesson
node_menu_service -->|"builds menu from"| node_lesson
node_menu_service -->|"checks completion"| node_lesson_progress
node_progress_repository -->|"stores"| node_user_progress
node_user_progress -->|"tracks lessons"| node_lesson_progress
node_learner -.->|"submits exercise"| node_injection
node_learner -.->|"submits flag"| node_challenge
node_challenge -->|"returns feedback"| node_attack_result
node_learner -.->|"views results"| node_report_card
node_report_card -->|"reads progress"| node_progress_repository
node_report_card -->|"reads course totals"| node_course
node_report_card -->|"localizes lessons"| node_plugin_messages
node_learner -.->|"uses companion"| node_webwolf
node_webwolf -.->|"offers mailbox"| node_mailbox
node_webwolf -.->|"offers JWT tools"| node_jwt_service
node_webwolf -.->|"offers file service"| node_file_server

click node_registration "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/RegistrationController.java"
click node_user_service "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserService.java"
click node_user_repository "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserRepository.java"
click node_webgoat_user "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/WebGoatUser.java"
click node_course "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/session/Course.java"
click node_category "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/Category.java"
click node_lesson "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/Lesson.java"
click node_lesson_name "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/LessonName.java"
click node_menu_service "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java"
click node_lesson_progress "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/LessonProgress.java"
click node_user_progress "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserProgress.java"
click node_progress_repository "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserProgressRepository.java"
click node_report_card "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/report/ReportCardController.java"
click node_assignment_endpoint "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/assignments/AssignmentEndpoint.java"
click node_attack_result "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/assignments/AttackResult.java"
click node_challenge "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java"
click node_injection "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionAdvanced.java"
click node_security_lessons "https://github.com/rajesh-sangepu/webgoat/tree/main/src/main/java/org/owasp/webgoat/lessons"
click node_plugin_messages "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/i18n/PluginMessages.java"
click node_webwolf "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/WebWolf.java"
click node_mailbox "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/mailbox/MailboxController.java"
click node_jwt_service "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/jwt/JWTController.java"
click node_file_server "https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/FileServer.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_registration,node_user_service,node_user_repository,node_webgoat_user toneBlue
class node_course,node_category,node_lesson,node_lesson_name,node_menu_service,node_lesson_progress,node_user_progress,node_progress_repository,node_report_card,node_plugin_messages toneAmber
class node_assignment_endpoint,node_attack_result,node_challenge,node_injection,node_security_lessons toneMint
class node_webwolf,node_mailbox,node_jwt_service,node_file_server toneRose
class node_learner toneIndigo
```

## Components

### Identity and access

- [Registration](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/RegistrationController.java): `src/main/java/org/owasp/webgoat/container/users/RegistrationController.java`
- [User service](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserService.java): `src/main/java/org/owasp/webgoat/container/users/UserService.java`
- [User repository](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserRepository.java): `src/main/java/org/owasp/webgoat/container/users/UserRepository.java`
- [WebGoat user](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/WebGoatUser.java): `src/main/java/org/owasp/webgoat/container/users/WebGoatUser.java`

### Lesson experience

- [Course catalog](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/session/Course.java): `src/main/java/org/owasp/webgoat/container/session/Course.java`
- [Lesson categories](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/Category.java): `src/main/java/org/owasp/webgoat/container/lessons/Category.java`
- [Lesson model](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/Lesson.java): `src/main/java/org/owasp/webgoat/container/lessons/Lesson.java`
- [Lesson identifier](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/lessons/LessonName.java): `src/main/java/org/owasp/webgoat/container/lessons/LessonName.java`
- [Lesson menu](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java): `src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`
- [Lesson progress](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/LessonProgress.java): `src/main/java/org/owasp/webgoat/container/users/LessonProgress.java`
- [User progress](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserProgress.java): `src/main/java/org/owasp/webgoat/container/users/UserProgress.java`
- [Progress repository](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/users/UserProgressRepository.java): `src/main/java/org/owasp/webgoat/container/users/UserProgressRepository.java`
- [Progress report](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/report/ReportCardController.java): `src/main/java/org/owasp/webgoat/container/report/ReportCardController.java`
- [Lesson messages](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/i18n/PluginMessages.java): `src/main/java/org/owasp/webgoat/container/i18n/PluginMessages.java`

### Security exercises

- [Assignment endpoints](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/assignments/AssignmentEndpoint.java): `src/main/java/org/owasp/webgoat/container/assignments/AssignmentEndpoint.java`
- [Exercise feedback](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/container/assignments/AttackResult.java): `src/main/java/org/owasp/webgoat/container/assignments/AttackResult.java`
- [Flag challenges](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java): `src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java`
- [SQL injection](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionAdvanced.java): `src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionAdvanced.java`
- [Security lesson set](https://github.com/rajesh-sangepu/webgoat/tree/main/src/main/java/org/owasp/webgoat/lessons): `src/main/java/org/owasp/webgoat/lessons`

### WebWolf companion

- [WebWolf app](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/WebWolf.java): `src/main/java/org/owasp/webgoat/webwolf/WebWolf.java`
- [Mailbox](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/mailbox/MailboxController.java): `src/main/java/org/owasp/webgoat/webwolf/mailbox/MailboxController.java`
- [JWT service](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/jwt/JWTController.java): `src/main/java/org/owasp/webgoat/webwolf/jwt/JWTController.java`
- [File server](https://github.com/rajesh-sangepu/webgoat/blob/main/src/main/java/org/owasp/webgoat/webwolf/FileServer.java): `src/main/java/org/owasp/webgoat/webwolf/FileServer.java`

### Other components

- **Learner**

## Connections

- Learner → Registration: registers
- Registration → User service: adds user (evidence: `src/main/java/org/owasp/webgoat/container/users/RegistrationController.java`)
- User service → User repository: reads and saves (evidence: `src/main/java/org/owasp/webgoat/container/users/UserService.java`)
- User service → Progress repository: creates progress (evidence: `src/main/java/org/owasp/webgoat/container/users/UserService.java`)
- Learner → Lesson menu: requests menu
- Lesson menu → Course catalog: reads catalog (evidence: `src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`)
- Lesson menu → Progress repository: reads progress (evidence: `src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`)
- Course catalog → Lesson categories: uses categories (evidence: `src/main/java/org/owasp/webgoat/container/session/Course.java`)
- Course catalog → Lesson model: provides lessons (evidence: `src/main/java/org/owasp/webgoat/container/session/Course.java`)
- Lesson menu → Lesson model: builds menu from (evidence: `src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`)
- Lesson menu → Lesson progress: checks completion (evidence: `src/main/java/org/owasp/webgoat/container/service/LessonMenuService.java`)
- Progress repository → User progress: stores (evidence: `src/main/java/org/owasp/webgoat/container/users/UserProgressRepository.java`)
- User progress → Lesson progress: tracks lessons (evidence: `src/main/java/org/owasp/webgoat/container/users/UserProgress.java`)
- Learner → SQL injection: submits exercise
- Learner → Flag challenges: submits flag
- Flag challenges → Exercise feedback: returns feedback (evidence: `src/main/java/org/owasp/webgoat/lessons/challenges/FlagController.java`)
- Learner → Progress report: views results
- Progress report → Progress repository: reads progress (evidence: `src/main/java/org/owasp/webgoat/container/report/ReportCardController.java`)
- Progress report → Course catalog: reads course totals (evidence: `src/main/java/org/owasp/webgoat/container/report/ReportCardController.java`)
- Progress report → Lesson messages: localizes lessons (evidence: `src/main/java/org/owasp/webgoat/container/report/ReportCardController.java`)
- Learner → WebWolf app: uses companion
- WebWolf app → Mailbox: offers mailbox
- WebWolf app → JWT service: offers JWT tools
- WebWolf app → File server: offers file service