Before we install WebGoat we need java you can download it in here
and if you want to download WebGoat you can download in here
After that you can extract the file with terminal


p7zip -d WebGoat-OWASP_Standard-5.3_RC1.7z


if you don't have p7zip you can download from terminal


apt-get install p7zip


Then if you want to make your dekstop clean you can move it inside /pentest/web/webgoat you can do it form terminal


mkdir /pentest/web/webgoat
mv WebGoat-5.3_RC1/* /pentest/web/webgoat


now make /pentest/web/webgoat/webgoat.sh executable with

chmod +x /pentest/web/webgoat/webgoat.sh


Now you can run webgoat on port 80 or 8080 running

sh /pentest/web/webgoat/webgoat.sh start80 or sh /pentest/web/webgoat/webgoat.sh start8080

and to stop tomcat and webgoat use

sh /pentest/web/webgoat/webgoat.sh stop


Open up firefox and connect to http://127.0.0.1/webgoat/attack or http://127.0.0.1:8080/webgoat/attack according to the port you use to run tomcat. 



username : guest
password : guest



after that you can use WebGoat