Integrated SOAP web services into dojo-basic. The "services" directory should be found by Nikto, DirBuster or ZAP Forced Browse.

Fixed keys 13 and 14 in dojo-scavenger. A blank or arbitrary username no longer provides the access code. Removed the SQL dump from the comments. This requires students to use Sqlmap, which works well against the error-based boolean vulnerability.
Added username enumeration to key 19 in dojo-scavenger to give students an idea of what the username should be. There is no clue otherwise.
Added a SOAP web service to dojo-scavenger that responds with key 12 when properly invoked. This requires students to leverage SoapUI and invoke a web service.