For this chapter, we'll be using Burp Suite and its hidden content features, as well as Chrome (66.0.3359.139). We'll also be using WebGoat, an intentionally vulnerable app created by OWASP that you can download and practice against.
Please clone or download the repository to your local system (https://github.com/WebGoat/WebGoat).
There are several ways you can set up WebGoat. You can download and run it as a jar executable (as we've been doing with Burp Suite), you can download a Docker image, or you can build it directly from source. Although using jvm to manage Java dependencies works for Burp, I prefer to use Docker when it's available, since there's so much great tooling around it.
There is one concern: if you're running the Burp Suite proxy and using the default proxy ports (localhost:8080), you'll need to make sure...