diff --git a/IAC/ec2.tf b/IAC/ec2.tf deleted file mode 100644 index ef6cf82..0000000 --- a/IAC/ec2.tf +++ /dev/null @@ -1,32 +0,0 @@ -resource "aws_instance" "web_host" { - # ec2 have plain text secrets in user data - ami = "${var.ami}" - instance_type = "t2.nano" - - vpc_security_group_ids = [ - "${aws_security_group.web-node.id}"] - subnet_id = "${aws_subnet.web_subnet.id}" - user_data = <Deployed via Terraform" | sudo tee /var/www/html/index.html -EOF - tags = merge({ - Name = "${local.resource_prefix.value}-ec2" - }, { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/ec2.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6" - }) -} diff --git a/IAC/s3.tf b/IAC/s3.tf deleted file mode 100644 index 45afe45..0000000 --- a/IAC/s3.tf +++ /dev/null @@ -1,141 +0,0 @@ -resource "aws_s3_bucket" "data" { - # bucket is public - # bucket is not encrypted - # bucket does not have access logs - # bucket does not have versioning - bucket = "${local.resource_prefix.value}-data" - force_destroy = true - tags = merge({ - Name = "${local.resource_prefix.value}-data" - Environment = local.resource_prefix.value - }, { - git_commit = "4d57f83ca4d3a78a44fb36d1dcf0d23983fa44f5" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2022-05-18 07:08:06" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "34870196+LironElbaz/nimrod/nimrodkor/jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "0874007d-903a-4b4c-945f-c9c233e13243" - }) -} - -resource "aws_s3_bucket_object" "data_object" { - bucket = aws_s3_bucket.data.id - key = "customer-master.xlsx" - source = "resources/customer-master.xlsx" - tags = merge({ - Name = "${local.resource_prefix.value}-customer-master" - Environment = local.resource_prefix.value - }, { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "njmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "a7f01cc7-63c2-41a8-8555-6665e5e39a64" - }) -} - -resource "aws_s3_bucket" "financials" { - # bucket is not encrypted - # bucket does not have access logs - # bucket does not have versioning - bucket = "${local.resource_prefix.value}-financials" - acl = "private" - force_destroy = true - tags = merge({ - Name = "${local.resource_prefix.value}-financials" - Environment = local.resource_prefix.value - }, { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "0e012640-b597-4e5d-9378-d4b584aea913" - }) - -} - -resource "aws_s3_bucket" "operations" { - # bucket is not encrypted - # bucket does not have access logs - bucket = "${local.resource_prefix.value}-operations" - acl = "private" - versioning { - enabled = true - } - force_destroy = true - tags = merge({ - Name = "${local.resource_prefix.value}-operations" - Environment = local.resource_prefix.value - }, { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "29efcf7b-22a8-4bd6-8e14-1f55b3a2d743" - }) -} - -resource "aws_s3_bucket" "data_science" { - # bucket is not encrypted - bucket = "${local.resource_prefix.value}-data-science" - acl = "private" - versioning { - enabled = true - } - logging { - target_bucket = "${aws_s3_bucket.logs.id}" - target_prefix = "log/" - } - force_destroy = true - tags = { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "9a7c8788-5655-4708-bbc3-64ead9847f64" - } -} - -resource "aws_s3_bucket" "logs" { - bucket = "${local.resource_prefix.value}-logs" - acl = "log-delivery-write" - versioning { - enabled = true - } - server_side_encryption_configuration { - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - kms_master_key_id = "${aws_kms_key.logs_key.arn}" - } - } - } - force_destroy = true - tags = merge({ - Name = "${local.resource_prefix.value}-logs" - Environment = local.resource_prefix.value - }, { - git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0" - git_file = "terraform/aws/s3.tf" - git_last_modified_at = "2020-06-16 14:46:24" - git_last_modified_by = "jmagee@paloaltonetworks.com" - git_modifiers = "jmagee" - git_org = "bridgecrewio" - git_repo = "terragoat" - yor_trace = "01946fe9-aae2-4c99-a975-e9b0d3a4696c" - }) -} diff --git a/IAC/s3bucket.yaml b/IAC/s3bucket.yaml deleted file mode 100644 index 5a22548..0000000 --- a/IAC/s3bucket.yaml +++ /dev/null @@ -1,24 +0,0 @@ -AWSTemplateFormatVersion: '2010-09-09' -Metadata: - License: Apache-2.0 -Description: 'AWS CloudFormation Sample Template S3_Website_Bucket_With_Retain_On_Delete: - Sample template showing how to create a publicly accessible S3 bucket configured - for website access with a deletion policy of retain on delete. **WARNING** This - template creates an S3 bucket that will NOT be deleted when the stack is deleted. - You will be billed for the AWS resources used if you create a stack from this template.' -Resources: - S3Bucket: - Type: AWS::S3::Bucket - Properties: - AccessControl: PublicRead - WebsiteConfiguration: - IndexDocument: index.html - ErrorDocument: error.html - DeletionPolicy: Retain -Outputs: - WebsiteURL: - Value: !GetAtt [S3Bucket, WebsiteURL] - Description: URL for website hosted on S3 - S3BucketSecureURL: - Value: !Join ['', ['https://', !GetAtt [S3Bucket, DomainName]]] - Description: Name of S3 bucket to hold website content \ No newline at end of file diff --git a/IAC/storage.bicep b/IAC/storage.bicep deleted file mode 100644 index 9dd77d4..0000000 --- a/IAC/storage.bicep +++ /dev/null @@ -1,49 +0,0 @@ -@description('Name of environment') -param env string = 'dev' - -@description('Default location for all resources.') -param location string = resourceGroup().location - -var name = 'bicepgoat' - -resource datadisk 'Microsoft.Compute/disks@2021-12-01' = { - name: '${name}-disk-${env}' - location: location - sku: { - name: 'Standard_LRS' - } - - properties: { - diskSizeGB: 10 - encryptionSettingsCollection: { - enabled: false - } - } -} - -resource storageAccount 'Microsoft.Storage/storageAccounts@2021-01-01' = { - name: '${name}-sa-${env}' - location: location - kind: 'StorageV2' - sku: { - name: 'Standard_GRS' - } - - properties: { - supportsHttpsTrafficOnly: false - - networkAcls: { - bypass: 'None' - defaultAction: 'Deny' - } - } - - resource configWeb 'config' = { - name: 'web' - - properties: { - minTlsVersion: '1.1' - remoteDebuggingEnabled: true - } - } -} \ No newline at end of file diff --git a/SCA/pom.xml b/SCA/pom.xml deleted file mode 100644 index c245fb2..0000000 --- a/SCA/pom.xml +++ /dev/null @@ -1,128 +0,0 @@ - - 4.0.0 - com.checkmarx.app - sca-big-goat - jar - 1.0-SNAPSHOT - sca-big-goat - http://maven.apache.org - - - - ${org.checkerframework:jdk8:jar} - - - - - commons-httpclient - commons-httpclient - 3.1 - - - commons-collections - commons-collections - 3.2.2 - - - dom4j - dom4j - 1.6.1 - - - axis - axis - 1.4 - - - org.apache.httpcomponents - httpasyncclient - 4.1.4 - - - ca.juliusdavies - not-yet-commons-ssl - 0.3.9 - - - org.bouncycastle - bcprov-jdk15 - 1.46 - - - org.webjars - jquery - 3.5.1 - - - org.beanshell - bsh - 2.0b5 - - - org.codehaus.jackson - jackson-core-asl - 1.9.13 - - - org.mortbay.jetty - jetty-util - 6.1.26 - - - io.netty - netty - 3.10.6.Final - - - log4j - log4j - 1.2.17 - - - net.sf.dozer - dozer - 5.5.1 - - - org.beanshell - bsh - 2.0b4 - - - org.codehaus.jackson - jackson-mapper-asl - 1.9.13 - - - taglibs - standard - 1.1.2 - - - org.simpleframework - simple-xml - 2.7.1 - - - ant - ant - 1.6.5 - - - org.apache.spark - spark-core_2.11 - 2.4.7 - - - org.mortbay.jetty - jetty - 6.1.26 - - - org.apache.hadoop - hadoop-yarn-server-nodemanager - 3.3.0 - - - diff --git a/SCA/requirements.txt b/SCA/requirements.txt deleted file mode 100644 index 6ecc4ce..0000000 --- a/SCA/requirements.txt +++ /dev/null @@ -1,38 +0,0 @@ -parso==0.8.1 -pycrypto==2.6.1 -oauth2==1.9.0.post1 -httplib2==0.17.4 -Django==1.11.1 -PyYAML==3.13 -urllib3==1.23 -requests==2.2.1 -PyYAML==5.1 -Django==1.7.1 -ansible==2.8.8 -Werkzeug==0.15.3 -urllib3==1.25.2 -Jinja2==2.10.1 -Pygments==2.0.2 -pandas==0.24.2 -python-gnupg==0.4.3 -PyJWT==0.4.2 -rsa==3.4.2 -requests==2.19.1 -urllib3==1.24.2 -Django==3.1 -Pillow==7.1.0 -pycrypto==2.4 -tensorflow==1.14.0 -Jinja2==2.7.2 -Flask==0.11.1 -feedparser==5.1.1 -mercurial==4.8.2 -buildbot==0.7.11 -notebook==5.7.10 -httplib2==0.12.0 -lodash==3.10.1 -sphinx==3.0.3 -sphinx-py3doc-enhanced-theme==2.4.0 -docutils==0.16 --e . - diff --git a/Secrets/app1.js b/Secrets/app1.js deleted file mode 100644 index 7490c8a..0000000 --- a/Secrets/app1.js +++ /dev/null @@ -1,2 +0,0 @@ -const SEC_1 = "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" -const SEC_3 = "dsapi45202d12abdce73c004a9e0be24a21b2" \ No newline at end of file diff --git a/Secrets/config.js b/Secrets/config.js deleted file mode 100644 index 430f192..0000000 --- a/Secrets/config.js +++ /dev/null @@ -1,2 +0,0 @@ -const CIRCLE_CI = "2065ae463be5e534bb1d074a366d44e7a776d472" -const JIRA = "5FP0NmFYz81U32XdjNb42762" \ No newline at end of file diff --git a/introduction/__init__.py b/introduction/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/introduction/admin.py b/introduction/admin.py new file mode 100644 index 0000000..ac46364 --- /dev/null +++ b/introduction/admin.py @@ -0,0 +1,13 @@ +from django.contrib import admin +from .models import FAANG,info,login,comments,otp,tickits,CF_user,AF_admin,AF_session_id + +# Register your models here. +admin.site.register(FAANG) +admin.site.register(info) +admin.site.register(login) +admin.site.register(comments) +admin.site.register(otp) +admin.site.register(tickits) +admin.site.register(CF_user) +admin.site.register(AF_admin) +admin.site.register(AF_session_id) \ No newline at end of file diff --git a/introduction/apis.py b/introduction/apis.py new file mode 100644 index 0000000..2880832 --- /dev/null +++ b/introduction/apis.py @@ -0,0 +1,45 @@ +from django.http import JsonResponse +from django.shortcuts import redirect +from introduction.playground.ssrf import main +from django.contrib.auth import login,authenticate +from .utility import * +from django.views.decorators.csrf import csrf_exempt +import time +# steps --> +# 1. covert input code to corrosponding code and write in file +# 2. extract inputs form 2nd code +# 3. Run the code +# 4. get the result +@csrf_exempt +def ssrf_code_checker(request): + if request.user.is_authenticated: + if request.method == 'POST': + python_code = request.POST['python_code'] + html_code = request.POST['html_code'] + if not (ssrf_code_converter(python_code)): + return JsonResponse({"status": "error", "message": "Invalid code"}) + test_bench1 = ssrf_html_input_extractor(html_code) + + if (len(test_bench1) >4): + return JsonResponse({'message':'too many inputs in Html\n Try again'},status = 400) + test_bench2 = ['secret.txt'] + correct_output1 = [{"blog": "blog1-passed"}, {"blog": "blog2-passed"}, {"blog": "blog3-passed"}, {"blog": "blog4-passed"}] + outputs = [] + for inputs in test_bench1: + outputs.append(main.ssrf_lab(inputs)) + if outputs == correct_output1: + outputs = [] + else: + return JsonResponse({'message':'Testbench failed, Code is not working\n Try again'},status = 200) + + correct_output2 = [{"blog": "No blog found"}] + for inputs in test_bench2: + outputs.append(main.ssrf_lab(inputs)) + if outputs == correct_output2: + return JsonResponse({'message':'Congratulation, you have written a secure code.', 'passed':1}, status = 200) + + return JsonResponse({'message':'Test bench passed but the code is not secure'}, status = 200,safe = False) + else: + return JsonResponse({'message':'method not allowed'},status = 405) + else: + return JsonResponse({'message':'UnAuthenticated User'},status = 401) \ No newline at end of file diff --git a/introduction/apps.py b/introduction/apps.py new file mode 100644 index 0000000..1710c5b --- /dev/null +++ b/introduction/apps.py @@ -0,0 +1,5 @@ +from django.apps import AppConfig + + +class IntroductionConfig(AppConfig): + name = 'introduction' diff --git a/introduction/forms.py b/introduction/forms.py new file mode 100644 index 0000000..e69de29 diff --git a/introduction/lab_code/test.py b/introduction/lab_code/test.py new file mode 100644 index 0000000..71eda68 --- /dev/null +++ b/introduction/lab_code/test.py @@ -0,0 +1,29 @@ +''' +import subprocess, json + + +cmd_str = "pwd; ls" +process = subprocess.Popen( + cmd_str, + shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE) +stdout, stderr = process.communicate() +data = stdout.decode('utf-8') +stderr = stderr.decode('utf-8') +# res = json.loads(data) +# print("Stdout\n" + data) +print(data + stderr) +''' +import yaml, subprocess +stream = open('/home/fox/test.yaml', 'r') +data = yaml.load(stream) + +''' +stdout, stderr = data.communicate() +stdout = stdout.decode('utf-8') +stderr = stderr.decode('utf-8') +''' +print(data + "\n") +# print(stdout + "\n") +# print(stderr + "\n") \ No newline at end of file diff --git a/introduction/migrations/0001_initial.py b/introduction/migrations/0001_initial.py new file mode 100644 index 0000000..6186a16 --- /dev/null +++ b/introduction/migrations/0001_initial.py @@ -0,0 +1,23 @@ +# Generated by Django 3.0.6 on 2021-04-13 18:32 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + initial = True + + dependencies = [ + ] + + operations = [ + migrations.CreateModel( + name='FAANG', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('company', models.CharField(max_length=200)), + ('ceo', models.CharField(max_length=200)), + ('about', models.CharField(max_length=200)), + ], + ), + ] diff --git a/introduction/migrations/0002_auto_20210414_1510.py b/introduction/migrations/0002_auto_20210414_1510.py new file mode 100644 index 0000000..0b3b7ee --- /dev/null +++ b/introduction/migrations/0002_auto_20210414_1510.py @@ -0,0 +1,31 @@ +# Generated by Django 3.0.6 on 2021-04-14 09:40 + +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0001_initial'), + ] + + operations = [ + migrations.RemoveField( + model_name='faang', + name='about', + ), + migrations.RemoveField( + model_name='faang', + name='ceo', + ), + migrations.CreateModel( + name='info', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('ceo', models.CharField(max_length=200)), + ('about', models.CharField(max_length=200)), + ('faang', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='introduction.FAANG')), + ], + ), + ] diff --git a/introduction/migrations/0003_password_user.py b/introduction/migrations/0003_password_user.py new file mode 100644 index 0000000..a78e9f2 --- /dev/null +++ b/introduction/migrations/0003_password_user.py @@ -0,0 +1,29 @@ +# Generated by Django 3.0.6 on 2021-04-15 10:50 + +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0002_auto_20210414_1510'), + ] + + operations = [ + migrations.CreateModel( + name='user', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('user', models.CharField(max_length=200)), + ], + ), + migrations.CreateModel( + name='password', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('password', models.CharField(max_length=300)), + ('username', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='introduction.user')), + ], + ), + ] diff --git a/introduction/migrations/0004_auto_20210415_1722.py b/introduction/migrations/0004_auto_20210415_1722.py new file mode 100644 index 0000000..075fb54 --- /dev/null +++ b/introduction/migrations/0004_auto_20210415_1722.py @@ -0,0 +1,22 @@ +# Generated by Django 3.0.6 on 2021-04-15 11:52 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0003_password_user'), + ] + + operations = [ + migrations.AddField( + model_name='user', + name='password', + field=models.CharField(default=0, max_length=300), + preserve_default=False, + ), + migrations.DeleteModel( + name='password', + ), + ] diff --git a/introduction/migrations/0005_auto_20210415_1748.py b/introduction/migrations/0005_auto_20210415_1748.py new file mode 100644 index 0000000..1dc836f --- /dev/null +++ b/introduction/migrations/0005_auto_20210415_1748.py @@ -0,0 +1,17 @@ +# Generated by Django 3.0.6 on 2021-04-15 12:18 + +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0004_auto_20210415_1722'), + ] + + operations = [ + migrations.RenameModel( + old_name='user', + new_name='login', + ), + ] diff --git a/introduction/migrations/0006_comments.py b/introduction/migrations/0006_comments.py new file mode 100644 index 0000000..e5f09f3 --- /dev/null +++ b/introduction/migrations/0006_comments.py @@ -0,0 +1,21 @@ +# Generated by Django 3.0.6 on 2021-04-17 08:29 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0005_auto_20210415_1748'), + ] + + operations = [ + migrations.CreateModel( + name='comments', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('name', models.CharField(max_length=200)), + ('comment', models.CharField(max_length=400)), + ], + ), + ] diff --git a/introduction/migrations/0007_auto_20210418_0022.py b/introduction/migrations/0007_auto_20210418_0022.py new file mode 100644 index 0000000..1208434 --- /dev/null +++ b/introduction/migrations/0007_auto_20210418_0022.py @@ -0,0 +1,18 @@ +# Generated by Django 3.0.6 on 2021-04-17 18:52 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0006_comments'), + ] + + operations = [ + migrations.AlterField( + model_name='comments', + name='comment', + field=models.CharField(max_length=600), + ), + ] diff --git a/introduction/migrations/0008_otp.py b/introduction/migrations/0008_otp.py new file mode 100644 index 0000000..b7b961c --- /dev/null +++ b/introduction/migrations/0008_otp.py @@ -0,0 +1,21 @@ +# Generated by Django 3.0.6 on 2021-04-24 06:40 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0007_auto_20210418_0022'), + ] + + operations = [ + migrations.CreateModel( + name='otp', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('email', models.CharField(max_length=200)), + ('otp', models.IntegerField(max_length=300)), + ], + ), + ] diff --git a/introduction/migrations/0009_auto_20210517_2047.py b/introduction/migrations/0009_auto_20210517_2047.py new file mode 100644 index 0000000..14cd525 --- /dev/null +++ b/introduction/migrations/0009_auto_20210517_2047.py @@ -0,0 +1,19 @@ +# Generated by Django 3.0.6 on 2021-05-17 15:17 + +import django.core.validators +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0008_otp'), + ] + + operations = [ + migrations.AlterField( + model_name='otp', + name='otp', + field=models.IntegerField(validators=[django.core.validators.MaxValueValidator(300)]), + ), + ] diff --git a/introduction/migrations/0010_authlogin.py b/introduction/migrations/0010_authlogin.py new file mode 100644 index 0000000..fe7a7d0 --- /dev/null +++ b/introduction/migrations/0010_authlogin.py @@ -0,0 +1,22 @@ +# Generated by Django 3.1.13 on 2022-02-10 08:58 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0009_auto_20210517_2047'), + ] + + operations = [ + migrations.CreateModel( + name='authLogin', + fields=[ + ('username', models.CharField(max_length=200, unique=True)), + ('name', models.CharField(max_length=200)), + ('password', models.CharField(max_length=200)), + ('userid', models.AutoField(primary_key=True, serialize=False)), + ], + ), + ] diff --git a/introduction/migrations/0011_tickits.py b/introduction/migrations/0011_tickits.py new file mode 100644 index 0000000..3279db0 --- /dev/null +++ b/introduction/migrations/0011_tickits.py @@ -0,0 +1,22 @@ +# Generated by Django 4.0.3 on 2022-03-19 11:21 + +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0010_authlogin'), + ] + + operations = [ + migrations.CreateModel( + name='tickits', + fields=[ + ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), + ('tickit', models.CharField(max_length=40, unique=True)), + ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='introduction.authlogin')), + ], + ), + ] diff --git a/introduction/migrations/0012_alter_tickits_user.py b/introduction/migrations/0012_alter_tickits_user.py new file mode 100644 index 0000000..76c0e0a --- /dev/null +++ b/introduction/migrations/0012_alter_tickits_user.py @@ -0,0 +1,21 @@ +# Generated by Django 4.0.3 on 2022-03-19 12:06 + +from django.conf import settings +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ('introduction', '0011_tickits'), + ] + + operations = [ + migrations.AlterField( + model_name='tickits', + name='user', + field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL), + ), + ] diff --git a/introduction/migrations/0013_alter_comments_id_alter_faang_id_alter_info_id_and_more.py b/introduction/migrations/0013_alter_comments_id_alter_faang_id_alter_info_id_and_more.py new file mode 100644 index 0000000..bb01a3e --- /dev/null +++ b/introduction/migrations/0013_alter_comments_id_alter_faang_id_alter_info_id_and_more.py @@ -0,0 +1,43 @@ +# Generated by Django 4.0.2 on 2022-03-21 21:06 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0012_alter_tickits_user'), + ] + + operations = [ + migrations.AlterField( + model_name='comments', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + migrations.AlterField( + model_name='faang', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + migrations.AlterField( + model_name='info', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + migrations.AlterField( + model_name='login', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + migrations.AlterField( + model_name='otp', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + migrations.AlterField( + model_name='tickits', + name='id', + field=models.AutoField(primary_key=True, serialize=False), + ), + ] diff --git a/introduction/migrations/0014_sql_lab_table.py b/introduction/migrations/0014_sql_lab_table.py new file mode 100644 index 0000000..1dbda83 --- /dev/null +++ b/introduction/migrations/0014_sql_lab_table.py @@ -0,0 +1,20 @@ +# Generated by Django 4.0.3 on 2022-04-23 09:41 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0013_alter_comments_id_alter_faang_id_alter_info_id_and_more'), + ] + + operations = [ + migrations.CreateModel( + name='sql_lab_table', + fields=[ + ('id', models.CharField(max_length=200, primary_key=True, serialize=False)), + ('password', models.CharField(max_length=200)), + ], + ), + ] diff --git a/introduction/migrations/0015_blogs.py b/introduction/migrations/0015_blogs.py new file mode 100644 index 0000000..9f9f2e9 --- /dev/null +++ b/introduction/migrations/0015_blogs.py @@ -0,0 +1,24 @@ +# Generated by Django 4.0.2 on 2022-06-07 12:40 + +from django.conf import settings +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ('introduction', '0014_sql_lab_table'), + ] + + operations = [ + migrations.CreateModel( + name='Blogs', + fields=[ + ('id', models.AutoField(primary_key=True, serialize=False)), + ('blog_id', models.CharField(max_length=15)), + ('author', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)), + ], + ), + ] diff --git a/introduction/migrations/0016_alter_blogs_blog_id.py b/introduction/migrations/0016_alter_blogs_blog_id.py new file mode 100644 index 0000000..55c7d6e --- /dev/null +++ b/introduction/migrations/0016_alter_blogs_blog_id.py @@ -0,0 +1,18 @@ +# Generated by Django 4.0.2 on 2022-06-07 12:42 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0015_blogs'), + ] + + operations = [ + migrations.AlterField( + model_name='blogs', + name='blog_id', + field=models.CharField(max_length=15, unique=True), + ), + ] diff --git a/introduction/migrations/0017_cf_user.py b/introduction/migrations/0017_cf_user.py new file mode 100644 index 0000000..2aee465 --- /dev/null +++ b/introduction/migrations/0017_cf_user.py @@ -0,0 +1,21 @@ +# Generated by Django 4.0.2 on 2022-06-15 09:53 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0016_alter_blogs_blog_id'), + ] + + operations = [ + migrations.CreateModel( + name='CF_user', + fields=[ + ('id', models.AutoField(primary_key=True, serialize=False)), + ('username', models.CharField(max_length=200)), + ('password', models.CharField(max_length=200)), + ], + ), + ] diff --git a/introduction/migrations/0018_cf_user_password2.py b/introduction/migrations/0018_cf_user_password2.py new file mode 100644 index 0000000..3ff76b2 --- /dev/null +++ b/introduction/migrations/0018_cf_user_password2.py @@ -0,0 +1,19 @@ +# Generated by Django 4.0.2 on 2022-06-17 07:16 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0017_cf_user'), + ] + + operations = [ + migrations.AddField( + model_name='cf_user', + name='password2', + field=models.CharField(default='ok', max_length=64), + preserve_default=False, + ), + ] diff --git a/introduction/migrations/0019_af_admin.py b/introduction/migrations/0019_af_admin.py new file mode 100644 index 0000000..2044375 --- /dev/null +++ b/introduction/migrations/0019_af_admin.py @@ -0,0 +1,27 @@ +# Generated by Django 4.0.4 on 2022-06-28 15:36 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0018_cf_user_password2'), + ] + + operations = [ + migrations.CreateModel( + name='AF_admin', + fields=[ + ('id', models.AutoField(primary_key=True, serialize=False)), + ('username', models.CharField(max_length=200)), + ('password', models.CharField(max_length=200)), + ('session_id', models.CharField(max_length=200)), + ('last_login', models.DateTimeField(blank=True, null=True)), + ('logged_in', models.BooleanField(default=False)), + ('is_locked', models.BooleanField(default=False)), + ('failattempt', models.IntegerField(default=0)), + ('lockout_cooldown', models.DateField(blank=True, null=True)), + ], + ), + ] diff --git a/introduction/migrations/0020_af_session_id_alter_af_admin_lockout_cooldown.py b/introduction/migrations/0020_af_session_id_alter_af_admin_lockout_cooldown.py new file mode 100644 index 0000000..d264a83 --- /dev/null +++ b/introduction/migrations/0020_af_session_id_alter_af_admin_lockout_cooldown.py @@ -0,0 +1,26 @@ +# Generated by Django 4.0.4 on 2022-06-30 13:22 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('introduction', '0019_af_admin'), + ] + + operations = [ + migrations.CreateModel( + name='AF_session_id', + fields=[ + ('id', models.AutoField(primary_key=True, serialize=False)), + ('session_id', models.CharField(max_length=200)), + ('user', models.CharField(max_length=200)), + ], + ), + migrations.AlterField( + model_name='af_admin', + name='lockout_cooldown', + field=models.DateTimeField(blank=True, null=True), + ), + ] diff --git a/introduction/migrations/__init__.py b/introduction/migrations/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/introduction/models.py b/introduction/models.py new file mode 100644 index 0000000..9efbd4f --- /dev/null +++ b/introduction/models.py @@ -0,0 +1,86 @@ +from django.db import models +from django.core.validators import MaxValueValidator +from django.conf import settings +# Create your models here. + +class FAANG (models.Model): + id = models.AutoField(primary_key=True) + company=models.CharField(max_length=200); + def __str__(self): + return self.company; + +class info(models.Model): + id = models.AutoField(primary_key=True) + faang=models.ForeignKey(to=FAANG,on_delete=models.CASCADE) + + ceo=models.CharField(max_length=200) + about=models.CharField(max_length=200) + +class login(models.Model): + id = models.AutoField(primary_key=True) + user=models.CharField(max_length=200) + password=models.CharField(max_length=300) + +class comments(models.Model): + id = models.AutoField(primary_key=True) + name=models.CharField(max_length=200) + comment=models.CharField(max_length=600) + +class authLogin(models.Model): + username=models.CharField(max_length=200, unique = True) + name=models.CharField(max_length=200) + password=models.CharField(max_length=200) + userid = models.AutoField(primary_key=True) + +class otp(models.Model): + id = models.AutoField(primary_key=True) + email=models.CharField(max_length=200) + otp=models.IntegerField(validators=[MaxValueValidator(300)]) + +class tickits(models.Model): + id = models.AutoField(primary_key=True) + user=models.ForeignKey(settings.AUTH_USER_MODEL,on_delete=models.CASCADE) + tickit=models.CharField(max_length=40, unique = True) + + def __str__(self): + return self.tickit+ " " + self.user.username; + +class sql_lab_table(models.Model): + id = models.CharField(primary_key = True, max_length=200) + password = models.CharField(max_length=200) + +class Blogs(models.Model): + id = models.AutoField(primary_key=True) + author = models.ForeignKey(settings.AUTH_USER_MODEL,on_delete=models.CASCADE) + blog_id = models.CharField(max_length=15, unique=True) + def __str__(self): + return self.blog_id + +class CF_user(models.Model): + id = models.AutoField(primary_key=True) + username = models.CharField(max_length=200) + password = models.CharField(max_length=200) + password2 = models.CharField(max_length=64) + def __str__(self): + return self.username + +class AF_admin(models.Model): + id = models.AutoField(primary_key=True) + username = models.CharField(max_length=200) + password = models.CharField(max_length=200) + session_id = models.CharField(max_length=200) + last_login = models.DateTimeField(blank= True, null = True) + logged_in = models.BooleanField(default=False) + is_locked = models.BooleanField(default=False) + failattempt = models.IntegerField(default=0) + lockout_cooldown = models.DateTimeField(blank= True, null = True) + + def __str__(self): + return self.username + +class AF_session_id(models.Model): + id = models.AutoField(primary_key=True) + session_id = models.CharField(max_length=200) + user = models.CharField(max_length=200) + def __str__(self): + return self.user \ No newline at end of file diff --git a/introduction/playground/__init__.py b/introduction/playground/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/introduction/playground/readme.md b/introduction/playground/readme.md new file mode 100644 index 0000000..e69de29 diff --git a/introduction/playground/ssrf/__init__.py b/introduction/playground/ssrf/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/introduction/playground/ssrf/main.py b/introduction/playground/ssrf/main.py new file mode 100644 index 0000000..f95edd8 --- /dev/null +++ b/introduction/playground/ssrf/main.py @@ -0,0 +1,10 @@ +import os +def ssrf_lab(file): + try: + dirname = os.path.dirname(__file__) + filename = os.path.join(dirname, file) + file = open(filename,"r") + data = file.read() + return {"blog":data} + except: + return {"blog": "No blog found"} \ No newline at end of file diff --git a/introduction/playground/ssrf/secret.txt b/introduction/playground/ssrf/secret.txt new file mode 100644 index 0000000..e4d7046 --- /dev/null +++ b/introduction/playground/ssrf/secret.txt @@ -0,0 +1 @@ +Failed \ No newline at end of file diff --git a/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog1.txt b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog1.txt new file mode 100644 index 0000000..d994caf --- /dev/null +++ b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog1.txt @@ -0,0 +1 @@ +blog1-passed \ No newline at end of file diff --git a/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog2.txt b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog2.txt new file mode 100644 index 0000000..9884fed --- /dev/null +++ b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog2.txt @@ -0,0 +1 @@ +blog2-passed \ No newline at end of file diff --git a/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog3.txt b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog3.txt new file mode 100644 index 0000000..df0152e --- /dev/null +++ b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog3.txt @@ -0,0 +1 @@ +blog3-passed \ No newline at end of file diff --git a/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog4.txt b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog4.txt new file mode 100644 index 0000000..de88946 --- /dev/null +++ b/introduction/playground/ssrf/templates/Lab/ssrf/blogs/blog4.txt @@ -0,0 +1 @@ +blog4-passed \ No newline at end of file diff --git a/introduction/playground/ssrf/test.py b/introduction/playground/ssrf/test.py new file mode 100644 index 0000000..5fbdffc --- /dev/null +++ b/introduction/playground/ssrf/test.py @@ -0,0 +1,33 @@ +## input +''' +def ssrf_lab(request): + if request.user.is_authenticated: + if request.method=="GET": + return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":"Read Blog About SSRF"}) + else: + file=request.POST["blog"] + try : + dirname = os.path.dirname(__file__) + filename = os.path.join(dirname, file) + file = open(filename,"r") + data = file.read() + return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":data}) + except: + return render(request, "Lab/ssrf/ssrf_lab.html", {"blog": "No blog found"}) + else: + return redirect('login')''' + +## output +''' +def ssrf_lab(file): + try : + dirname = os.path.dirname(__file__) + filename = os.path.join(dirname, file) + file = open(filename,"r") + data = file.read() + print(data) + return {"blog":data} + except: + return {"blog": "No blog found"} + +''' \ No newline at end of file diff --git a/introduction/static/Lab/icons/pygoat-mini.png b/introduction/static/Lab/icons/pygoat-mini.png new file mode 100644 index 0000000..0189bb0 Binary files /dev/null and b/introduction/static/Lab/icons/pygoat-mini.png differ diff --git a/introduction/static/Lab/icons/pygoat-mini.svg b/introduction/static/Lab/icons/pygoat-mini.svg new file mode 100644 index 0000000..47e5808 --- /dev/null +++ b/introduction/static/Lab/icons/pygoat-mini.svg @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/introduction/static/Lab/icons/pygoat-small.png b/introduction/static/Lab/icons/pygoat-small.png new file mode 100644 index 0000000..a26ce35 Binary files /dev/null and b/introduction/static/Lab/icons/pygoat-small.png differ diff --git a/introduction/static/Lab/icons/pygoat-small.svg b/introduction/static/Lab/icons/pygoat-small.svg new file mode 100644 index 0000000..f64e636 --- /dev/null +++ b/introduction/static/Lab/icons/pygoat-small.svg @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/introduction/static/Lab/icons/pygoat.png b/introduction/static/Lab/icons/pygoat.png new file mode 100644 index 0000000..5637dcc Binary files /dev/null and b/introduction/static/Lab/icons/pygoat.png differ diff --git a/introduction/static/Lab/icons/pygoat.svg b/introduction/static/Lab/icons/pygoat.svg new file mode 100644 index 0000000..990c010 --- /dev/null +++ b/introduction/static/Lab/icons/pygoat.svg @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/introduction/static/Lab/image/xxe.jpg b/introduction/static/Lab/image/xxe.jpg new file mode 100644 index 0000000..08ec4e5 Binary files /dev/null and b/introduction/static/Lab/image/xxe.jpg differ diff --git a/introduction/static/Lab/ssrf.css b/introduction/static/Lab/ssrf.css new file mode 100644 index 0000000..18acafc --- /dev/null +++ b/introduction/static/Lab/ssrf.css @@ -0,0 +1,148 @@ +@import url('https://fonts.googleapis.com/css2?family=Ubuntu+Mono&display=swap'); + +.playground{ + background-color: rgb(214, 252, 255); + padding: 10px; + padding-top: 20px; + padding-bottom: 20px; + border-radius: 10px; + /* visibility: hidden; */ +} + +#ssrf-progress-bar { + margin-top : 30px; + position: relative; + width: 100%; + height: 30px; + background-color: #d5ecff; + display: none; + flex-direction: row; + border-radius: 15px; + border: 2px solid #4B8BBE; +} + + +.circle{ + /* width: 5%; */ + border: 5px solid #033157; + border-radius: 100px; + height: auto; + width : 26px +} +.ssrf-progress-element{ + width: 30%; + background-color: #d5ecee; + border-radius: 15px; +} + +.ssrf-bar-status{ + height: 90%; + background-color: #033157; + border-radius: 15px; + margin: 1px; +} + +#ssrf-frame-1{ + display: flex; + flex-direction: row; + justify-content: space-between; +} +#ssrf-frame-2{ + display: none; + margin-top: 20px; + flex-direction: column; + align-items: center; +} + +.code{ + background-color: #fafafa; + border-radius: 10px; + padding: 0; +} + +.code-bar{ + background-color: #d5ecee; + width: 100%; + height: 30px; + border-radius: 10px 10px 0px 0px; + display: flex; + justify-content: space-between +} + +.code form { + margin: 30px; + margin-top: 10px; + margin-bottom: 10px; + font-family: 'Ubuntu Mono', monospace; +} + +.code-circle { + height: 18px; + width: 18px; + border-radius: 10px; + border : 0px solid; + margin: 5px; +} +.red { + background-color: red; +} +.green{ + background-color: green; +} +.yellow{ + background-color: yellow; +} + +#ssrf-frame-3{ + display: none; + margin-top: 20px; + flex-direction: column; + align-items: center; +} + +/* frame 4 */ + +#ssrf-frame-4{ + display: none; + margin-top: 20px; + flex-direction: column; + align-items: center; +} + +textarea { + min-height: 250px; + overflow: scroll; + margin: 20px; + display: inline-block; + background: #f4f4f9; + outline: none; + font-family: Courier, sans-serif; + min-width: 500px; + height: 500px; + border-radius: 10px; + font-size: 13px; + padding: 10px; + + } +#textarea-container{ + display: flex; + flex-direction: row; + margin : 10px; + flex-wrap: wrap +} + +#textarea1{ + display: flex; + flex-direction: column; +} +.problem-Statement-desc{ + margin-left: 50px; + margin-right: 50px; +} + +#ssrf-frame-5{ + display: none; + margin-top: 20px; + flex-direction: column; + align-items: center; +} \ No newline at end of file diff --git a/introduction/static/Lab/ssrf.js b/introduction/static/Lab/ssrf.js new file mode 100644 index 0000000..63aae84 --- /dev/null +++ b/introduction/static/Lab/ssrf.js @@ -0,0 +1,84 @@ + +function frame1to2(){ + // frame 1 to 2 + document.getElementById('ssrf-frame-1').style.display = 'none'; + document.getElementById('ssrf-frame-2').style.display = 'flex'; + document.getElementById('ssrf-progress-bar').style.display = 'flex'; +} + +function frame2to3(){ + var markedCheckbox = document.querySelectorAll('input[type="checkbox"]:checked'); + var arr = []; + for (var checkbox of markedCheckbox){ + arr.push(parseInt(checkbox.value)); + } + var score = 0; + var result = [8,9,10,11,12]; + for (var items of arr){ + if(result.includes(items)){ + score++; + } + else{ + score--; + } + } + if( score >= 4 ){ + document.getElementById('ssrf-frame-2').style.display = 'none'; + document.getElementById('ssrf-bar-status1').classList.add('ssrf-bar-status') + alert('Congratulation! You have figure this out !!'); + document.getElementById('ssrf-frame-3').style.display = 'flex'; + } +} + +function frame3to4(){ + var markedCheckbox = document.querySelectorAll('input[name="form2"]:checked'); + var arr = []; + for (var checkbox of markedCheckbox){ + arr.push(parseInt(checkbox.value)); + } + var score = 0; + var result = [3,7,11,15]; + for (var items of arr){ + if(result.includes(items)){ + score++; + } + else{ + score--; + } + } + if( score >=4 ){ + document.getElementById('ssrf-frame-3').style.display = 'none'; + document.getElementById('ssrf-bar-status2').classList.add('ssrf-bar-status') + alert('Congratulation! you have detected defective codes in html'); + document.getElementById('ssrf-frame-4').style.display = 'flex'; + } +} + + +function checkcode(){ + var python_code = document.getElementById('python').value + var html_code = document.getElementById('html').value + + var formdata = new FormData(); + formdata.append('python_code', python_code); + formdata.append('html_code', html_code); + var requestOptions = { + method: 'POST', + body: formdata, + redirect: 'follow' + }; + + fetch("api/ssrf", requestOptions) + .then(response => response.text()) + .then((result) => { + console.log(result); + var obj = JSON.parse(result); + alert(obj.message); + if (obj.passed == 1 ){ + document.getElementById('ssrf-frame-4').style.display = 'none'; + document.getElementById('ssrf-bar-status3').classList.add('ssrf-bar-status') + document.getElementById('ssrf-frame-5').style.display = 'flex'; + } + }) + .catch(error => console.log('error', error)); +} \ No newline at end of file diff --git a/introduction/static/Lab/ssti.css b/introduction/static/Lab/ssti.css new file mode 100644 index 0000000..57136c4 --- /dev/null +++ b/introduction/static/Lab/ssti.css @@ -0,0 +1,26 @@ +.container{align-items: center; +max-width: 720px; +display: flex; +flex-direction: column;} + +#ssti-inner-div2{ + display: flex; + flex-direction: column; + align-items: center; +} + +.ssti-form{ + display: flex; + flex-direction: column; + align-items: center; +} +ul{ + padding: 5px; +} +li{ + list-style-type: none; +} + +.code{ + background-color: #fafafaaa; +} \ No newline at end of file diff --git a/introduction/static/Lab/xss.js b/introduction/static/Lab/xss.js new file mode 100644 index 0000000..99d0a09 --- /dev/null +++ b/introduction/static/Lab/xss.js @@ -0,0 +1,40 @@ +var coll = document.getElementsByClassName("coll"); +var coll2 = document.getElementsByClassName("coll2"); +var i; + +for (i = 0; i < coll.length; i++) { + coll[i].addEventListener("click", function() { + this.classList.toggle("active"); + var content = this.nextElementSibling; + if (content.style.display === "block") { + content.style.display = "none"; + } else { + content.style.display = "block"; + } + }); +} +for (i = 0; i < coll2.length; i++) { + coll2[i].addEventListener("click", function() { + this.classList.toggle("active"); + var content = this.nextElementSibling; + if (content.style.display === "block") { + content.style.display = "none"; + } else { + content.style.display = "block"; + } + }); +} +function SendToServer(){ + + comment=document.getElementById("comment").value; + + + var xhr; + xhr = new XMLHttpRequest(); + xml=""+""+""+comment+""+""; + var url = $("#Url").attr("data-url"); + xhr.open("POST", url, true); + xhr.setRequestHeader("Content-Type", "text/xml"); + xhr.send(xml); + +} \ No newline at end of file diff --git a/introduction/static/css/common.css b/introduction/static/css/common.css new file mode 100644 index 0000000..e69de29 diff --git a/introduction/static/css/dark-theme.css b/introduction/static/css/dark-theme.css new file mode 100644 index 0000000..98292b5 --- /dev/null +++ b/introduction/static/css/dark-theme.css @@ -0,0 +1,510 @@ +/* + DEMO STYLE +*/ + +@import "https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700"; +body { + font-family: "Poppins", sans-serif; + background: #000000; +} + +body::-webkit-scrollbar { + display: none; +} +body { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +p { + font-family: "Poppins", sans-serif; + font-size: 1.1em; + font-weight: 300; + line-height: 1.7em; + color: #999; +} + +a, +a:hover, +a:focus { + color: inherit; + text-decoration: none; + transition: all 0.3s; +} + +.navbar { + padding: 15px 10px; + background-image: linear-gradient(45deg, hsl(0, 0%, 25.9%), #80a9c9); + border: 0px solid; + border-radius: 0px 10px 0px 0px; + margin-bottom: 40px; + /* box-shadow: 1px 1px 3px rgba(0, 0, 0, 0.1); */ +} + +.navbar-btn { + box-shadow: none; + outline: none !important; + border: none; +} + +.line { + width: 100%; + height: 1px; + border-bottom: 1px dashed #ddd; + margin: 40px 0; +} + +i, +span { + display: inline-block; +} +.login-form { + margin-left: 10px; + margin-right: 10px; +} +.card { + border: #306998; + border-radius: 10px; +} +/* --------------------------------------------------- + SIDEBAR STYLE +----------------------------------------------------- */ +.sidebar-list-items { + background-color: #79a9cf40; +} +.wrapper { + display: flex; + align-items: stretch; + margin: 10px; + background-color: #424242; + height: 97vh; + border-radius: 20px; +} + +#sidebar { + height: 97vh; + overflow: scroll; + min-width: 315px; + max-width: 315px; + background: #373c40; + color: #fff; + transition: all 0.3s; + border-radius: 20px 0px 20px 0px; +} + +.sidebarClass::-webkit-scrollbar { + display: none; +} +.sidebarClass { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +#sidebar.active { + min-width: 80px; + max-width: 80px; + text-align: center; + height: 97vh; + overflow: scroll; +} + +#sidebar.active .sidebar-header div h3, +#sidebar.active .sidebar-header div img, +#sidebar.active .CTAs { + display: none; +} + +#sidebar.active .sidebar-header strong { + display: block; +} + +#sidebar.active ul li a { + padding: 20px 10px; + text-align: center; + font-size: 0.85em; +} + +#sidebar.active ul li a i { + margin-right: 0; + display: block; + font-size: 1.8em; + /* margin-bottom: 5px; */ +} + +#sidebar.active ul ul a { + padding: 10px !important; +} + +#sidebar.active .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); +} + +#sidebar .sidebar-header { + padding: 20px; + background: #283036; +} + +#sidebar .sidebar-header strong { + display: none; + font-size: 1.8em; +} + +#sidebar ul.components { + padding: 20px 0; + border-bottom: 1px solid #4b8bbe; +} + +#sidebar ul li a { + padding: 10px; + font-size: 1.1em; + display: block; +} + +#sidebar ul li a:hover { + color: #306998; + background: #fff; +} + +#sidebar ul li a i { + margin-right: 10px; +} + +#sidebar ul li.active > a, +a[aria-expanded="true"] { + color: #fff; + background: #4b8bbe; +} + +a[data-toggle="collapse"] { + position: relative; +} + +.dropdown-toggle::after { + display: block; + position: absolute; + top: 50%; + right: 20px; + transform: translateY(-50%); +} + +ul ul a { + font-size: 0.9em !important; + padding-left: 30px !important; + background: #ffd43b; +} + +ul.CTAs { + padding: 20px; +} + +ul.CTAs a { + text-align: center; + font-size: 0.9em !important; + display: block; + border-radius: 5px; + margin-bottom: 5px; +} + +/* a.download { + background: #fff; + color: #7386D5; +} */ + +/* a.article, +a.article:hover { + background: #6d7fcc !important; + color: #fff !important; +} */ + +/* --------------------------------------------------- + CONTENT STYLE +----------------------------------------------------- */ + +#content { + width: 100%; + padding: 20px; + /* min-height: cal(100vh -20px); */ + transition: all 0.3s; + overflow: scroll; + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; +} + +#content::-webkit-scrollbar { + display: none; +} + +.box { + margin-top: 2rem; + border-radius: 10px; + padding: 2rem; + background-color: #f8ede345; + color: aliceblue; +} +.bp { + font-size: 1em; + font-height: 1.2em; + color: black; +} +.coll { + background-color: #159c80; + color: black; + cursor: pointer; + padding: auto; + width: auto; + margin-bottom: 20px; + text-align: center; + outline: none; + font-size: 20px; +} + +/* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */ +.active, +.coll:hover { + background-color: #bfb051; +} + +/* Style the collapsible content. Note: hidden by default */ +.lab { + padding: 18px; + display: none; + overflow: hidden; + background-color: #f1f1f199; + border-radius: 1rem; +} +.display { + padding: 20px; +} +code { + padding: 2px 4px; + font-size: 90%; + color: #c7254e; + background-color: #f9f2f4; + border-radius: 4px; +} +.img { + border-radius: 8px; + display: block; + margin-left: auto; + margin-right: auto; + width: 50%; +} +.pg{ + display: none; +} +/* --------------------------------------------------- + MEDIAQUERIES +----------------------------------------------------- */ + +@media (max-width: 768px) { + #sidebar { + min-width: 242px; + } + .pg{ + display: block; + position: fixed; + font-size: 35px; + z-index: 1000; + color: #fff; + font-weight: 500; + left: 29px; + top: 36px; + } + .pg.active{ + display: none; + } + .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); + } + #sidebar.active { + margin-left: -95px !important; + } + #sidebar .sidebar-header{ + display: flex; + flex-direction: row; + align-items: center; + } + + #sidebar .sidebar-header h3, + #sidebar .CTAs { + display: none; + } + #sidebar .sidebar-header strong { + display: block; + } + #sidebar ul li a { + padding: 20px 10px; + } + #sidebar ul li a span { + font-size: 0.85em; + } + #sidebar ul li a i { + margin-right: 0; + display: block; + } + #sidebar ul ul a { + padding: 10px !important; + } + #sidebar ul li a i { + font-size: 1.3em; + } + #sidebar { + margin-left: 0; + } + #sidebarCollapse span { + display: none; + } + .navbar{ + margin-right: -17px; + } +} + +code { + padding: 2px 4px; + font-size: 90%; + color: #033157; + border-radius: 4px; + background-color: #159c8100; +} + +.code { + /* background-image: linear-gradient(to right, #000000, #30989a); */ + background-color: #8dc2ed; + padding: 30px; + margin-top: 30px; +} + +#sidebarCollapse { + display: none; +} + +.h2, +h2 { + font-size: 4rem; +} + +#owasp10_2021 { + width: 90%; + background: #283036; + margin-top: 15px; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} +#owasp10_2017 { + width: 90%; + margin-top: 15px; + background: #283036; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#sidebar li ul a #owasp10_2021 { + padding: 13% 0 0 0; +} + +#OWASP10_2021 { + width: 95%; + padding-left: 5%; +} +#OWASP10_2017 { + width: 95%; + padding-left: 5%; +} + +#sidebar-home { + width: 90%; + margin-top: 15px; + background: #283036; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#homeSubmenu { + width: 95%; + padding-left: 5%; +} + +.active, +.coll:hover { + background-color: #bfb05100; +} + +#challengeMenu { + width: 90%; + margin-top: 15px; + background: #283036; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#challengeSubmenu { + width: 95%; + padding-left: 5%; +} +#Mitre25 { + width: 95%; + padding-left: 5%; +} +#sans25 { + width: 95%; + padding-left: 5%; +} + +#help { + width: 90%; + margin-top: 15px; + background: #283036; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#mitre25 { + width: 90%; + margin-top: 15px; + background: #283036; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} + +#stylesheet-toggle{ + background: #f0f8ff8a; + border: 0px; + border-radius: 2px; + margin-right: 5px; +} + +.Mitigation li { + list-style-type: disc; +} \ No newline at end of file diff --git a/introduction/static/css/home.css b/introduction/static/css/home.css new file mode 100644 index 0000000..96fa7fe --- /dev/null +++ b/introduction/static/css/home.css @@ -0,0 +1,12 @@ + +#home-section1 { + display: flex; + flex-direction: column; + align-items: center; + justify-content: center; + flex-wrap: wrap; +} +#home-section1-img{ + opacity: .25; + width: 400px; +} diff --git a/introduction/static/css/light.css b/introduction/static/css/light.css new file mode 100644 index 0000000..652349f --- /dev/null +++ b/introduction/static/css/light.css @@ -0,0 +1,524 @@ +/* + DEMO STYLE +*/ + +@import "https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700"; +body { + font-family: "Poppins", sans-serif; + /* background: #000000; */ + background: #fff; +} + +body::-webkit-scrollbar { + display: none; +} +body { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +p{ + font-family: "Poppins", sans-serif; + font-size: 1.1em; + font-weight: 300; + line-height: 1.7em; + color: #999; +} + +a, +a:hover, +a:focus { + color: inherit; + text-decoration: none; + transition: all 0.3s; +} + +.navbar { + padding: 15px 10px; + background-image: linear-gradient(45deg, hsl(0deg 0% 95%), #80a9c9); + border: 0px solid; + border-radius: 0px 10px 0px 0px; + margin-bottom: 40px; + /* box-shadow: 1px 1px 3px rgba(0, 0, 0, 0.1); */ +} + +.navbar-btn { + box-shadow: none; + outline: none !important; + border: none; +} + +.line { + width: 100%; + height: 1px; + border-bottom: 1px dashed #ddd; + margin: 40px 0; +} + +i, +span { + display: inline-block; +} +.login-form { + margin-left: 10px; + margin-right: 10px; +} +.card { + border: #306998; + border-radius: 10px; +} +/* --------------------------------------------------- + SIDEBAR STYLE +----------------------------------------------------- */ +.sidebar-list-items { + background-color: #79a9cf40; + color : #0b446e; +} +.wrapper { + display: flex; + align-items: stretch; + margin: 10px; + background-color: #424242; + background-color: #f1f1f1; + height: 97vh; + border-radius: 20px; +} + +#sidebar { + height: 97vh; + overflow: scroll; + min-width: 315px; + max-width: 315px; + background: #373c40; + background: #c5cfd7; + color: #fff; + transition: all 0.3s; + border-radius: 20px 0px 20px 0px; +} + +.sidebarClass::-webkit-scrollbar { + display: none; +} +.sidebarClass { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +#sidebar.active { + min-width: 80px; + max-width: 80px; + text-align: center; + height: 97vh; + overflow: scroll; +} + +#sidebar.active .sidebar-header div h3, +#sidebar.active .sidebar-header div img, +#sidebar.active .CTAs { + display: none; +} + +#sidebar.active .sidebar-header strong { + display: block; +} + +#sidebar.active ul li a { + padding: 20px 10px; + text-align: center; + font-size: 0.85em; +} + +#sidebar.active ul li a i { + margin-right: 0; + display: block; + font-size: 1.8em; + /* margin-bottom: 5px; */ +} + +#sidebar.active ul ul a { + padding: 10px !important; +} + +#sidebar.active .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); +} + +#sidebar .sidebar-header { + padding: 20px; + /* background: #283036; */ + background: #4e93c7 +} + +#sidebar .sidebar-header strong { + display: none; + font-size: 1.8em; +} + +#sidebar ul.components { + padding: 20px 0; + border-bottom: 1px solid #4b8bbe; +} + +#sidebar ul li a { + padding: 10px; + font-size: 1.1em; + display: block; +} + +#sidebar ul li a:hover { + color: #306998; + background: #fff; +} + +#sidebar ul li a i { + margin-right: 10px; +} + +#sidebar ul li.active > a, +a[aria-expanded="true"] { + color: #fff; + background: #4b8bbe; +} + +a[data-toggle="collapse"] { + position: relative; +} + +.dropdown-toggle::after { + display: block; + position: absolute; + top: 50%; + right: 20px; + transform: translateY(-50%); +} + +ul ul a { + font-size: 0.9em !important; + padding-left: 30px !important; + background: #ffd43b; +} + +ul.CTAs { + padding: 20px; +} + +ul.CTAs a { + text-align: center; + font-size: 0.9em !important; + display: block; + border-radius: 5px; + margin-bottom: 5px; +} + +/* a.download { + background: #fff; + color: #7386D5; +} */ + +/* a.article, +a.article:hover { + background: #6d7fcc !important; + color: #fff !important; +} */ + +/* --------------------------------------------------- + CONTENT STYLE +----------------------------------------------------- */ + +#content { + width: 100%; + padding: 20px; + /* min-height: cal(100vh -20px); */ + transition: all 0.3s; + overflow: scroll; + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; +} + +#content::-webkit-scrollbar { + display: none; +} + +.box { + margin-top: 2rem; + border-radius: 10px; + padding: 2rem; + background-color: #f8ede345; + color: #20303e +} +.bp { + font-size: 1em; + font-height: 1.2em; + color: black; +} +.coll { + background-color: #159c80; + color: black; + cursor: pointer; + padding: auto; + width: auto; + margin-bottom: 20px; + text-align: center; + outline: none; + font-size: 20px; +} + +/* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */ +.active, +.coll:hover { + background-color: #bfb051; +} + +/* Style the collapsible content. Note: hidden by default */ +.lab { + padding: 18px; + display: none; + overflow: hidden; + background-color: #f1f1f1; + border-radius: 1rem; +} +.display { + padding: 20px; +} +code { + padding: 2px 4px; + font-size: 90%; + color: #c7254e; + background-color: #f9f2f4; + border-radius: 4px; +} +.img { + border-radius: 8px; + display: block; + margin-left: auto; + margin-right: auto; + width: 50%; +} + +.pg{ + display: none; +} +/* --------------------------------------------------- + MEDIAQUERIES +----------------------------------------------------- */ + +@media (max-width: 768px) { + #sidebar { + min-width: 242px; + } + + .pg{ + display: block; + position: fixed; + font-size: 35px; + z-index: 1000; + color: #397aab; + font-weight: 500; + left: 29px; + top: 36px; + } + .pg.active{ + display: none; + } + + .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); + } + #sidebar.active { + margin-left: -95px !important; + } + #sidebar .sidebar-header{ + display: flex; + flex-direction: row; + align-items: center; + } + + #sidebar .sidebar-header h3, + #sidebar .CTAs { + display: none; + } + #sidebar .sidebar-header strong { + display: block; + } + #sidebar ul li a { + padding: 20px 10px; + } + #sidebar ul li a span { + font-size: 0.85em; + } + #sidebar ul li a i { + margin-right: 0; + display: block; + } + #sidebar ul ul a { + padding: 10px !important; + } + #sidebar ul li a i { + font-size: 1.3em; + } + #sidebar { + margin-left: 0; + } + #sidebarCollapse span { + display: none; + } + .navbar{ + margin-right: -17px; + } +} + +code { + padding: 2px 4px; + font-size: 90%; + color: #033157; + border-radius: 4px; + background-color: #159c8100; +} + +.code { + /* background-image: linear-gradient(to right, #000000, #30989a); */ + background-color: #8dc2ed; + padding: 30px; + margin-top: 30px; +} + +#sidebarCollapse { + display: none; +} + +.h2, +h2 { + font-size: 4rem; +} + +#owasp10_2021 { + width: 90%; + background: #283036; + background: #4e93c7; + margin-top: 15px; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} +#owasp10_2017 { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#sidebar li ul a #owasp10_2021 { + padding: 13% 0 0 0; +} + +#OWASP10_2021 { + width: 95%; + padding-left: 5%; +} +#OWASP10_2017 { + width: 95%; + padding-left: 5%; +} + +#sidebar-home { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#homeSubmenu { + width: 95%; + padding-left: 5%; +} + +.active, +.coll:hover { + background-color: #bfb05100; +} + +#challengeMenu { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#challengeSubmenu { + width: 95%; + padding-left: 5%; +} +#Mitre25 { + width: 95%; + padding-left: 5%; +} +#sans25 { + width: 95%; + padding-left: 5%; +} + +#help { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#mitre25 { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} + +#stylesheet-toggle{ + background: #f0f8ff8a; + border: 0px; + border-radius: 2px; + margin-right: 5px; +} + +.Mitigation li { + list-style-type: disc; +} \ No newline at end of file diff --git a/introduction/static/css/style.css b/introduction/static/css/style.css new file mode 100644 index 0000000..62a37d5 --- /dev/null +++ b/introduction/static/css/style.css @@ -0,0 +1,491 @@ +/* + DEMO STYLE +*/ + +@import "https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700"; +body { + font-family: "Poppins", sans-serif; + /* background: #000000; */ + background: #fff; +} + +body::-webkit-scrollbar { + display: none; +} +body { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +p { + font-family: "Poppins", sans-serif; + font-size: 1.1em; + font-weight: 300; + line-height: 1.7em; + color: #999; +} + +a, +a:hover, +a:focus { + color: inherit; + text-decoration: none; + transition: all 0.3s; +} + +.navbar { + padding: 15px 10px; + background-image: linear-gradient(45deg, hsl(0deg 0% 95%), #80a9c9); + border: 0px solid; + border-radius: 0px 10px 0px 0px; + margin-bottom: 40px; + /* box-shadow: 1px 1px 3px rgba(0, 0, 0, 0.1); */ +} + +.navbar-btn { + box-shadow: none; + outline: none !important; + border: none; +} + +.line { + width: 100%; + height: 1px; + border-bottom: 1px dashed #ddd; + margin: 40px 0; +} + +i, +span { + display: inline-block; +} +.login-form { + margin-left: 10px; + margin-right: 10px; +} +.card { + border: #306998; + border-radius: 10px; +} +/* --------------------------------------------------- + SIDEBAR STYLE +----------------------------------------------------- */ +.sidebar-list-items { + background-color: #79a9cf40; + color : #0b446e; +} +.wrapper { + display: flex; + align-items: stretch; + margin: 10px; + background-color: #424242; + background-color: #f1f1f1; + height: 97vh; + border-radius: 20px; +} + +#sidebar { + height: 97vh; + overflow: scroll; + min-width: 315px; + max-width: 315px; + background: #373c40; + background: #c5cfd7; + color: #fff; + transition: all 0.3s; + border-radius: 20px 0px 20px 0px; +} + +.sidebarClass::-webkit-scrollbar { + display: none; +} +.sidebarClass { + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; /* Firefox */ +} + +#sidebar.active { + min-width: 80px; + max-width: 80px; + text-align: center; + height: 97vh; + overflow: scroll; +} + +#sidebar.active .sidebar-header div h3, +#sidebar.active .sidebar-header div img, +#sidebar.active .CTAs { + display: none; +} + +#sidebar.active .sidebar-header strong { + display: block; +} + +#sidebar.active ul li a { + padding: 20px 10px; + text-align: center; + font-size: 0.85em; +} + +#sidebar.active ul li a i { + margin-right: 0; + display: block; + font-size: 1.8em; + /* margin-bottom: 5px; */ +} + +#sidebar.active ul ul a { + padding: 10px !important; +} + +#sidebar.active .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); +} + +#sidebar .sidebar-header { + padding: 20px; + /* background: #283036; */ + background: #4e93c7 +} + +#sidebar .sidebar-header strong { + display: none; + font-size: 1.8em; +} + +#sidebar ul.components { + padding: 20px 0; + border-bottom: 1px solid #4b8bbe; +} + +#sidebar ul li a { + padding: 10px; + font-size: 1.1em; + display: block; +} + +#sidebar ul li a:hover { + color: #306998; + background: #fff; +} + +#sidebar ul li a i { + margin-right: 10px; +} + +#sidebar ul li.active > a, +a[aria-expanded="true"] { + color: #fff; + background: #4b8bbe; +} + +a[data-toggle="collapse"] { + position: relative; +} + +.dropdown-toggle::after { + display: block; + position: absolute; + top: 50%; + right: 20px; + transform: translateY(-50%); +} + +ul ul a { + font-size: 0.9em !important; + padding-left: 30px !important; + background: #ffd43b; +} + +ul.CTAs { + padding: 20px; +} + +ul.CTAs a { + text-align: center; + font-size: 0.9em !important; + display: block; + border-radius: 5px; + margin-bottom: 5px; +} + +/* a.download { + background: #fff; + color: #7386D5; +} */ + +/* a.article, +a.article:hover { + background: #6d7fcc !important; + color: #fff !important; +} */ + +/* --------------------------------------------------- + CONTENT STYLE +----------------------------------------------------- */ + +#content { + width: 100%; + padding: 20px; + /* min-height: cal(100vh -20px); */ + transition: all 0.3s; + overflow: scroll; + -ms-overflow-style: none; /* IE and Edge */ + scrollbar-width: none; +} + +#content::-webkit-scrollbar { + display: none; +} + +.box { + margin-top: 2rem; + border-radius: 10px; + padding: 2rem; + background-color: #f8ede345; + color: #20303e +} +.bp { + font-size: 1em; + font-height: 1.2em; + color: black; +} +.coll { + background-color: #159c80; + color: black; + cursor: pointer; + padding: auto; + width: auto; + margin-bottom: 20px; + text-align: center; + outline: none; + font-size: 20px; +} + +/* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */ +.active, +.coll:hover { + background-color: #bfb051; +} + +/* Style the collapsible content. Note: hidden by default */ +.lab { + padding: 0 18px; + display: none; + overflow: hidden; + background-color: #f1f1f1; + border-radius: 1rem; +} +.display { + padding: 20px; +} +code { + padding: 2px 4px; + font-size: 90%; + color: #c7254e; + background-color: #f9f2f4; + border-radius: 4px; +} +.img { + border-radius: 8px; + display: block; + margin-left: auto; + margin-right: auto; + width: 50%; +} +/* --------------------------------------------------- + MEDIAQUERIES +----------------------------------------------------- */ + +@media (max-width: 768px) { + #sidebar { + min-width: 80px; + max-width: 80px; + text-align: center; + margin-left: -95px !important; + height: 100vh; + overflow: scroll; + } + .dropdown-toggle::after { + top: auto; + bottom: 10px; + right: 50%; + -webkit-transform: translateX(50%); + -ms-transform: translateX(50%); + transform: translateX(50%); + } + #sidebar.active { + margin-left: 0 !important; + } + #sidebar .sidebar-header h3, + #sidebar .CTAs { + display: none; + } + #sidebar .sidebar-header strong { + display: block; + } + #sidebar ul li a { + padding: 20px 10px; + } + #sidebar ul li a span { + font-size: 0.85em; + } + #sidebar ul li a i { + margin-right: 0; + display: block; + } + #sidebar ul ul a { + padding: 10px !important; + } + #sidebar ul li a i { + font-size: 1.3em; + } + #sidebar { + margin-left: 0; + } + #sidebarCollapse span { + display: none; + } +} + +code { + padding: 2px 4px; + font-size: 90%; + color: #033157; + border-radius: 4px; + background-color: #159c8100; +} + +.code { + /* background-image: linear-gradient(to right, #000000, #30989a); */ + background-color: #8dc2ed; + padding: 30px; + margin-top: 30px; +} + +#sidebarCollapse { + display: none; +} + +.h2, +h2 { + font-size: 4rem; +} + +#owasp10_2021 { + width: 90%; + background: #283036; + background: #4e93c7; + margin-top: 15px; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} +#owasp10_2017 { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#sidebar li ul a #owasp10_2021 { + padding: 13% 0 0 0; +} + +#OWASP10_2021 { + width: 95%; + padding-left: 5%; +} +#OWASP10_2017 { + width: 95%; + padding-left: 5%; +} + +#sidebar-home { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0 0 0; +} + +#homeSubmenu { + width: 95%; + padding-left: 5%; +} + +.active, +.coll:hover { + background-color: #bfb05100; +} + +#challengeMenu { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#challengeSubmenu { + width: 95%; + padding-left: 5%; +} +#Mitre25 { + width: 95%; + padding-left: 5%; +} +#sans25 { + width: 95%; + padding-left: 5%; +} + +#help { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} +#mitre25 { + width: 90%; + margin-top: 15px; + background: #283036; + background: #4e93c7; + left: 5%; + height: 110px; + padding: 17px; + border-radius: 10px; + text-align: center; + padding: 13% 0% 0% 0%; +} + diff --git a/introduction/static/fake.txt b/introduction/static/fake.txt new file mode 100644 index 0000000..a709404 --- /dev/null +++ b/introduction/static/fake.txt @@ -0,0 +1 @@ +this is malicious file \ No newline at end of file diff --git a/introduction/static/google.jpg b/introduction/static/google.jpg new file mode 100644 index 0000000..caf2e87 Binary files /dev/null and b/introduction/static/google.jpg differ diff --git a/introduction/static/real.txt b/introduction/static/real.txt new file mode 100644 index 0000000..bcfe693 --- /dev/null +++ b/introduction/static/real.txt @@ -0,0 +1 @@ +This is real file \ No newline at end of file diff --git a/introduction/templates/Lab/A10/a10.html b/introduction/templates/Lab/A10/a10.html new file mode 100644 index 0000000..6780344 --- /dev/null +++ b/introduction/templates/Lab/A10/a10.html @@ -0,0 +1,68 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Insufficient Logging & Monitoring +{% endblock %} +
+

Insufficient Logging & Monitoring

+
+

What does Insufficient Logging & Monitoring means?

+

+ Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely + on the lack of monitoring and timely response to achieve their goals without being detected.
+ Most successful attacks start with vulnerability probing. Allowing such probes to continue can raise the + likelihood of successful exploit to nearly 100%.
+ In 2016, identifying a breach took an average of 191 days – plenty of time for damage to be inflicted. +

+ +
+

+ This lab helps you to get an idea of how sometimes improper logging can result in information disclosure. + + The user on accessing the lab is given with a login page which tells us that the logs have been leaked. + The user needs to find the leak and try to gain the credentials that have been leaked in the logs. + +
Finding the Log +

    +
  • The log has been exposed in /debug route
    • +
  • This can be found out with subdomain brute-forcing or just by guess
    • +
  • On seeing the Log try to get the required login details as there is a leak and the logging is improperly + handled.
    • + +
+ +

+
+
+
+ +
+

+ It seems this application is logging every action performed in this logging page. + But is there a way to inject some fake logs to the application? + +
+ Login credentials are same as lab1 +

+
+
+
+

Mitigation

+

+

    +
  • Ensure that logs are created in a format that can be easily used by central log management tools.
    • +
  • High-value transactions should have an audit trail with integrity controls to prevent manipulation or + deletion.
    • +
  • Effective monitoring and alerting should be established so that suspicious activities can be detected and + responded to in a timely manner.
    • +
  • Make sure that there aren't any sensitive information like passwords are being logged
    • +
+

+
+
+ + + + {% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/A10/a10_lab.html b/introduction/templates/Lab/A10/a10_lab.html new file mode 100644 index 0000000..d4e905c --- /dev/null +++ b/introduction/templates/Lab/A10/a10_lab.html @@ -0,0 +1,44 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Insufficient Logging & Monitoring +{% endblock %} + + +
+

The Logs have been Leaked.

+ + + +
+ +
+ {% if name %} +

Success! Logged in as + 
{{name}}
+

+ {% else %} +

+ 
{{error}}
+

+ {% endif %} + +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/A10/a10_lab2.html b/introduction/templates/Lab/A10/a10_lab2.html new file mode 100644 index 0000000..d0acadb --- /dev/null +++ b/introduction/templates/Lab/A10/a10_lab2.html @@ -0,0 +1,78 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Insufficient Logging & Monitoring +{% endblock %} + + +
+

Logs are strickty monitored

+ + + +
+ +
+ {% if name %} +

Success! Logged in as + 
{{name}}
+

+ {% else %} +

+ 
{{error}}
+

+ {% endif %} + +
+ +
+ +
+ + logging.basicConfig(level=logging.DEBUG,filename='app.log')
+
+ @authentication_decorator
+ def a10_lab2(request):
+  now = datetime.datetime.now()
+  if request.method == "GET":
+   x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+
+   if x_forwarded_for:
+    ip = x_forwarded_for.split(',')[0]
+   else:
+    ip = request.META.get('REMOTE_ADDR')
+   logging.info(f"{now}:{ip}")
+   return render (request,"Lab/A10/a10_lab2.html")
+  else:
+   user=request.POST.get("name")
+   password=request.POST.get("pass")
+   x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+
+   if x_forwarded_for:
+    ip = x_forwarded_for.split(',')[0]
+   else:
+    ip = request.META.get('REMOTE_ADDR')
+
+   if login.objects.filter(user=user,password=password):
+    if ip != '127.0.0.1':
+     logging.warning(f"{now}:{ip}:{user}")
+    logging.info(f"{now}:{ip}:{user}")
+    return render(request,"Lab/A10/a10_lab2.html",{"name":user})
+   else:
+    logging.error(f"{now}:{ip}:{user}")
+    return render(request, "Lab/A10/a10_lab2.html", {"error": " Wrong username or Password"})
+ +

+
+
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/A10/debug.log b/introduction/templates/Lab/A10/debug.log new file mode 100644 index 0000000..7e28b53 --- /dev/null +++ b/introduction/templates/Lab/A10/debug.log @@ -0,0 +1,317 @@ +INFO "GET /static/admin/css/dashboard.css HTTP/1.1" 304 0 +INFO "GET /static/admin/css/base.css HTTP/1.1" 304 0 +INFO "GET /static/admin/css/responsive.css HTTP/1.1" 304 0 +INFO "GET /static/admin/css/fonts.css HTTP/1.1" 304 0 +INFO "GET /static/admin/img/icon-addlink.svg HTTP/1.1" 304 0 +INFO "GET /static/admin/img/icon-changelink.svg HTTP/1.1" 304 0 +INFO "GET /static/admin/fonts/Roboto-Light-webfont.woff HTTP/1.1" 304 0 +INFO "GET /static/admin/fonts/Roboto-Regular-webfont.woff HTTP/1.1" 304 0 +INFO "GET /static/admin/fonts/Roboto-Bold-webfont.woff HTTP/1.1" 304 0 +INFO "GET /admin/logout/ HTTP/1.1" 200 1207 +INFO "GET /admin/logout/ HTTP/1.1" 302 0 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 1913 +INFO "GET /static/admin/css/login.css HTTP/1.1" 304 0 +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET /static/introduction/style4.css HTTP/1.1" 304 0 +WARNING Not Found: /favicon.ico +WARNING "GET /favicon.ico HTTP/1.1" 404 9350 +INFO "GET /login HTTP/1.1" 301 0 +INFO "GET /login/ HTTP/1.1" 200 7978 +INFO "GET /a10_lab?username=Hacker&password=Hacker HTTP/1.1" 301 0 +INFO "GET /logout HTTP/1.1" 301 0 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /static/admin/css/base.css HTTP/1.1" 304 0 +INFO "GET /static/admin/css/responsive.css HTTP/1.1" 304 0 +INFO "GET /static/admin/css/fonts.css HTTP/1.1" 200 423 +INFO "GET /static/admin/fonts/Roboto-Regular-webfont.woff HTTP/1.1" 200 85876 +INFO "GET /static/admin/fonts/Roboto-Light-webfont.woff HTTP/1.1" 200 85692 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 1913 +INFO "GET /static/admin/css/login.css HTTP/1.1" 200 1233 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /login/ HTTP/1.1" 200 7978 +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\urls.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +ERROR Internal Server Error: /register +Traceback (most recent call last): + File "A:\wsl\Pygoat\venv\lib\site-packages\django\core\handlers\exception.py", line 34, in inner + response = get_response(request) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\core\handlers\base.py", line 124, in _get_response + raise ValueError( +ValueError: The view introduction.views.register didn't return an HttpResponse object. It returned None instead. +ERROR "GET /register HTTP/1.1" 500 63038 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /register HTTP/1.1" 200 18 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /register HTTP/1.1" 200 9207 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /register HTTP/1.1" 200 9341 +INFO "POST /register HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 7978 +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET /admin HTTP/1.1" 301 0 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\settings.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\settings.py changed, reloading. +INFO Watching for file changes with StatReloader +ERROR Internal Server Error: /register +Traceback (most recent call last): + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\backends\django.py", line 61, in render + return self.template.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 171, in render + return self._render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 163, in _render + return self.nodelist.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 936, in render + bit = node.render_annotated(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 903, in render_annotated + return self.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\loader_tags.py", line 150, in render + return compiled_parent._render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 163, in _render + return self.nodelist.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 936, in render + bit = node.render_annotated(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 903, in render_annotated + return self.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\loader_tags.py", line 62, in render + result = block.nodelist.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 936, in render + bit = node.render_annotated(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 903, in render_annotated + return self.render(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 986, in render + output = self.filter_expression.resolve(context) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\base.py", line 697, in resolve + new_obj = func(obj, *arg_vals) + File "A:\wsl\Pygoat\venv\lib\site-packages\crispy_forms\templatetags\crispy_forms_filters.py", line 61, in as_crispy_form + template = uni_form_template(template_pack) + File "A:\wsl\Pygoat\venv\lib\site-packages\crispy_forms\templatetags\crispy_forms_filters.py", line 22, in uni_form_template + return get_template("%s/uni_form.html" % template_pack) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\loader.py", line 19, in get_template + raise TemplateDoesNotExist(template_name, chain=chain) +django.template.exceptions.TemplateDoesNotExist: boostrap4/uni_form.html + +The above exception was the direct cause of the following exception: + +Traceback (most recent call last): + File "A:\wsl\Pygoat\venv\lib\site-packages\django\core\handlers\exception.py", line 34, in inner + response = get_response(request) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\core\handlers\base.py", line 115, in _get_response + response = self.process_exception_by_middleware(e, request) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\core\handlers\base.py", line 113, in _get_response + response = wrapped_callback(request, *callback_args, **callback_kwargs) + File "A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py", line 32, in register + return render(request,"registration/register.html",{"form":form}) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\shortcuts.py", line 19, in render + content = loader.render_to_string(template_name, context, request, using=using) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\loader.py", line 62, in render_to_string + return template.render(context, request) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\backends\django.py", line 63, in render + reraise(exc, self.backend) + File "A:\wsl\Pygoat\venv\lib\site-packages\django\template\backends\django.py", line 84, in reraise + raise new from exc +django.template.exceptions.TemplateDoesNotExist: boostrap4/uni_form.html +ERROR "GET /register HTTP/1.1" 500 176529 +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\settings.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /register HTTP/1.1" 200 9946 +INFO "GET /register HTTP/1.1" 200 9928 +INFO "GET /register HTTP/1.1" 200 9928 +INFO "GET /login HTTP/1.1" 301 0 +INFO "GET /login/ HTTP/1.1" 200 8931 +INFO "POST /login/ HTTP/1.1" 302 0 +WARNING Not Found: /accounts/profile/ +WARNING "GET /accounts/profile/ HTTP/1.1" 404 9497 +INFO "GET /login/ HTTP/1.1" 200 8931 +INFO "POST /login/ HTTP/1.1" 200 9120 +INFO "GET /login/ HTTP/1.1" 200 8993 +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "GET /register HTTP/1.1" 200 9928 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /register HTTP/1.1" 200 9928 +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET /logout HTTP/1.1" 301 0 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 1913 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET / HTTP/1.1" 200 8303 +INFO "GET / HTTP/1.1" 200 8303 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "GET /register HTTP/1.1" 200 9928 +INFO "GET / HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "POST /login/ HTTP/1.1" 302 0 +WARNING Not Found: /accounts/profile/ +WARNING "GET /accounts/profile/ HTTP/1.1" 404 9497 +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\settings.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "POST /login/ HTTP/1.1" 302 0 +WARNING Not Found: /home +WARNING "GET /home HTTP/1.1" 404 9458 +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET / HTTP/1.1" 200 8157 +INFO A:\wsl\Pygoat\pygoat\pygoat\pygoat\settings.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 1913 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 1913 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET / HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9004 +INFO "POST /login/ HTTP/1.1" 302 0 +INFO "GET / HTTP/1.1" 200 8157 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET /register HTTP/1.1" 200 9941 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /register HTTP/1.1" 200 9941 +INFO "POST /register HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "POST /login/ HTTP/1.1" 302 0 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET /admin/ HTTP/1.1" 302 0 +INFO "GET /admin/login/?next=/admin/ HTTP/1.1" 200 2069 +INFO "POST /admin/login/?next=/admin/ HTTP/1.1" 302 0 +INFO "GET /admin/ HTTP/1.1" 200 8514 +INFO "GET /admin/auth/user/ HTTP/1.1" 200 7858 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO "POST /admin/auth/user/ HTTP/1.1" 200 3468 +INFO "GET /static/admin/js/cancel.js HTTP/1.1" 200 409 +INFO "GET /static/admin/js/cancel.js HTTP/1.1" 200 409 +INFO "POST /admin/auth/user/ HTTP/1.1" 302 0 +INFO "GET /admin/auth/user/ HTTP/1.1" 200 7147 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO "GET /admin/auth/user/1/change/ HTTP/1.1" 200 15887 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO "GET /admin/jsi18n/ HTTP/1.1" 200 3223 +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 200 8170 +WARNING Not Found: /favicon.ico +WARNING "GET /favicon.ico HTTP/1.1" 404 9479 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET / HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /bau HTTP/1.1" 200 13044 +INFO "GET /bau_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /register HTTP/1.1" 200 9941 +INFO "GET /sec_mis HTTP/1.1" 200 10652 +INFO "GET /sec_mis_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /a10 HTTP/1.1" 200 8674 +INFO "GET /a10_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9017 +INFO "GET /login/ HTTP/1.1" 200 9072 +INFO "GET / HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9072 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET /login/ HTTP/1.1" 200 9072 +INFO "GET / HTTP/1.1" 200 8170 +INFO "GET /cmd HTTP/1.1" 200 11401 +INFO "GET /cmd_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9072 +INFO "GET /register HTTP/1.1" 200 9941 +INFO "GET /sql HTTP/1.1" 200 11784 +INFO "GET /sql HTTP/1.1" 200 11876 +INFO "GET /sql HTTP/1.1" 200 11876 +INFO "GET /data_exp HTTP/1.1" 200 9800 +INFO "GET / HTTP/1.1" 200 8262 +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 200 8262 +INFO "GET /register HTTP/1.1" 200 10033 +INFO "GET /login/ HTTP/1.1" 200 9164 +INFO "GET /xxe HTTP/1.1" 200 13098 +INFO "GET /xxe_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9164 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 200 8255 +INFO A:\wsl\Pygoat\pygoat\pygoat\introduction\views.py changed, reloading. +INFO Watching for file changes with StatReloader +INFO "GET / HTTP/1.1" 200 8255 +INFO "GET /sql HTTP/1.1" 200 11869 +INFO "GET /sql_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "GET /register HTTP/1.1" 200 10026 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "GET /register HTTP/1.1" 200 10026 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "GET /register HTTP/1.1" 200 10026 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "GET /register HTTP/1.1" 200 10026 +INFO "GET /sql HTTP/1.1" 200 11869 +INFO "GET /sql_lab HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "POST /login/ HTTP/1.1" 200 9350 +INFO "GET /register HTTP/1.1" 200 10026 +INFO "POST /register HTTP/1.1" 302 0 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "POST /login/ HTTP/1.1" 302 0 +INFO "GET / HTTP/1.1" 200 8081 +INFO "GET /sql HTTP/1.1" 200 11695 +INFO "GET /bau HTTP/1.1" 200 12955 +INFO "GET /data_exp HTTP/1.1" 200 9619 +INFO "GET /xxe HTTP/1.1" 200 12917 +INFO "GET /ba HTTP/1.1" 200 10505 +INFO "GET /sec_mis HTTP/1.1" 200 10563 +INFO "GET /sql HTTP/1.1" 200 11695 +INFO "GET /bau HTTP/1.1" 200 12955 +INFO "GET /data_exp HTTP/1.1" 200 9619 +INFO "GET /sql HTTP/1.1" 200 11695 +INFO "GET /logout/ HTTP/1.1" 200 1207 +INFO "GET /sql HTTP/1.1" 200 11869 +INFO "GET /login/ HTTP/1.1" 200 9157 +INFO "POST /login/ HTTP/1.1" 302 0 +INFO "GET / HTTP/1.1" 200 8081 diff --git a/introduction/templates/Lab/A11/a11.html b/introduction/templates/Lab/A11/a11.html new file mode 100644 index 0000000..075e9cd --- /dev/null +++ b/introduction/templates/Lab/A11/a11.html @@ -0,0 +1,57 @@ +{% extends 'introduction/base.html' %} {% block content %} {% block title %} +Insecure Design +{% endblock %} +
+

Insecure Design

+
+

What is Insecure Design

+

+ Insecure design is a broad category representing different weaknesses, + expressed as “missing or ineffective control design.” Insecure design is + not the source for all other Top 10 risk categories. There is a difference + between insecure design and insecure implementation. We differentiate + between design flaws and implementation defects for a reason, they have + different root causes and remediation. A secure design can still have + implementation defects leading to vulnerabilities that may be exploited. + An insecure design cannot be fixed by a perfect implementation as by + definition, needed security controls were never created to defend against + specific attacks. One of the factors that contribute to insecure design is + the lack of business risk profiling inherent in the software or system + being developed, and thus the failure to determine what level of security + design is required. +

+ +
+

+ This lab helps you to get an idea of how Insecure Design can result in major Security flaw. + + In the next page,user can get 5 free tickets for a Movie. But he/she have to wait untill all the tickets are sold out. + For this particular situation, we can get advantage of the Insecure Design and somehow get all the tickets for the movie. + +

    Hint
+
    Logout and then think.
+ +
+
+
+
+
+

Mitigation

+

+

    +
  • Establish and use a secure development lifecycle with AppSec professionals to help evaluate and design security and privacy-related controls
    • +
  • Establish and use a library of secure design patterns or paved road ready to use components
    • +
  • Use threat modeling for critical authentication, access control, business logic, and key flows
    • +
  • Integrate security language and controls into user stories
    • +
  • Integrate plausibility checks at each tier of your application (from frontend to backend)
    • +
  • Write unit and integration tests to validate that all critical flows are resistant to the threat model. Compile use-cases and misuse-cases for each tier of your application.s
    • +
  • Segregate tier layers on the system and network layers depending on the exposure and protection needs
    • +
  • Segregate tenants robustly by design throughout all tiers
    • +
  • Limit resource consumption by user or service
    • +
+

+
+
+ +{% endblock %} diff --git a/introduction/templates/Lab/A11/a11_lab.html b/introduction/templates/Lab/A11/a11_lab.html new file mode 100644 index 0000000..7e7543f --- /dev/null +++ b/introduction/templates/Lab/A11/a11_lab.html @@ -0,0 +1,53 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Insecure Design Lab +{% endblock %} +{% block header %} + +{% endblock %} +
+
+
+

My Tickets

+ +
+
+
+
+ {{error}} +
+
+
+

Claim Upto 5 Free Tickits

+ +
+
+
+

Watch Movie

+ +
+
+
+ +
+ +{% endblock %} diff --git a/introduction/templates/Lab/A9/a9.html b/introduction/templates/Lab/A9/a9.html new file mode 100644 index 0000000..840fedc --- /dev/null +++ b/introduction/templates/Lab/A9/a9.html @@ -0,0 +1,94 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Using Components with Known Vulnerabilities +{% endblock %} +
+

Using Components with Known Vulnerabilities

+
+ +

What does Using Components with Know Vulnerability means?

+

When a developer uses a piece of code or library which already has a known vulnerability, then + this may result in compromise of the entire application. This occurs when the components such as libraries + and frameworks used within the app mostly execute with full privileges. If a vulnerable component is + exploited, it makes the hacker’s job easier to cause a serious data loss or server takeover. + +

+

+ +
+

+ This lab helps us to understand why components with known vulnerabilities can be a serious issue. +
+ The user on accessing the lab is provided with a feature to convert yaml files into json objects. + A yaml file needs to be chosen and uploaded to get the json data. + There is also a get version feature which tells the user the version of the library the app uses. + + Exploiting the vulnerability. +

    +
  • The app uses pyyaml 5.1 Which is vulnerable to code execution.
    • +
  • You can google the library with the version to get the poc and vulnerability details
    • +
  • Libraries known for the infamous code injection vulnerabilities are PyYAML 5.4 and Log4J
    • +
  • Create An yaml file with this payload:
    • + !!python/object/apply:subprocess.Popen
    + - ls +     +
  • On Uploading this file the user should be able to see the output of the command executed in the + Terminal running Django.
    • + +
+ +

+

+ +
+
+ +

+
+ +
+

+ This lab helps us to understand why components with known vulnerabilities can be a serious issue. +
+ This is website for some image manupulation. + + Exploiting the vulnerability. +

    +
  • The app uses Pillow 8.0.0 Which is vulnerable to code execution.
    • +
  • You can google the library with the version to get the poc and vulnerability details
    • +
+ +

+
+
+ +

+
+
+

Mitigation

+

+

    +
  • Remove unused dependencies, unnecessary features, components, files, and documentation.
    • +
  • Only obtain components from official sources over secure links. Prefer signed packages to reduce the + chance of including a modified, malicious component.
    • +
  • Monitor for libraries and components that are unmaintained or do not create security patches for older + versions. If patching is not possible, consider deploying a virtual patch to monitor, detect, or protect + against the discovered issue.
    • +
  • Use Library scanners to test for Vulnerabilities in packages.
    • + + + +
+

+ + + +
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/A9/a9_lab.html b/introduction/templates/Lab/A9/a9_lab.html new file mode 100644 index 0000000..5a70b46 --- /dev/null +++ b/introduction/templates/Lab/A9/a9_lab.html @@ -0,0 +1,37 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +A9 +{% endblock %} + +
+

Yaml To Json Converter

+
+
+
+ +
+

+
+
+ {% if data %} +
Here is your output:

+ 
{{data}}

+ Check Django Terminal for Command's output + {% endif %} +
+
+
+ {{version}} + +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/A9/a9_lab2.html b/introduction/templates/Lab/A9/a9_lab2.html new file mode 100644 index 0000000..cace076 --- /dev/null +++ b/introduction/templates/Lab/A9/a9_lab2.html @@ -0,0 +1,96 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +A9 +{% endblock %} + +
+

In this page you can upload a image and apply different math equation on it's rgb layer



+

Varriable reffernence

+ img --> actual image file | r --> red chennel | g --> green chennel + b --> blue chennel | g --> green chennel

+ +

Some Example

+
    +
  • convert(r, '1')
    • +
  • convert(r+g+b, 'L')
    • +
  • convert(r-g, '1')
    • +
+ +
+ + + +


+ + {% if success %} +
+ + +
+ {% endif %} + +
+ + +
+ This lab uses pillow==8.0.0 package, google for vulnerability +
+ + + +
+ + def a9_lab2(request):
+  if not request.user.is_authenticated:
+   return redirect('login')
+  
+  if request.method == "GET":
+   return render (request,"Lab/A9/a9_lab2.html")
+  elif request.method == "POST":
+   try :
+    file=request.FILES["file"]
+    function_str = request.POST.get("function")
+    img = Image.open(file)
+    img = img.convert("RGB")
+    r,g,b = img.split()
+    output = ImageMath.eval(function_str,img = img, b=b, r=r, g=g)
+ +    # saving the image
+    buffered = BytesIO()
+    output.save(buffered, format="JPEG")
+    img_str = base64.b64encode(buffered.getvalue()).decode("utf-8")
+ +    bufferd_ref = BytesIO()
+    img.save(bufferd_ref, format="JPEG")
+    img_str_ref = base64.b64encode(bufferd_ref.getvalue()).decode("utf-8")
+    try :
+     return render(request,"Lab/A9/a9_lab2.html",{"img_str": img_str,"img_str_ref":img_str_ref, "success": True})
+    except Exception as e:
+     print(e)
+     return render(request, "Lab/A9/a9_lab2.html", {"data": "Error", "error": True})
+   except Exception as e:
+    print(e)
+    return render(request, "Lab/A9/a9_lab2.html", {"data":"Please Upload a file", "error":True})
+ + +
+
+ +
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/AUTH/auth_home.html b/introduction/templates/Lab/AUTH/auth_home.html new file mode 100644 index 0000000..28422e3 --- /dev/null +++ b/introduction/templates/Lab/AUTH/auth_home.html @@ -0,0 +1,54 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Broken Authentication +{% endblock %} +
+

Description

+
+ +

What is Broken Authentication

+

+ Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to impersonate + legitimate users online. Broadly, broken authentication refers to weaknesses in two areas: session management + and credential management. Both are classified as broken authentication because attackers can use either + avenue to masquerade as a user: hijacked session IDs or stolen login credentials. +
+

Broken Authentication errors occur when:

+
    +
  • Permits automated attacks such as credential stuffing, where the attacker has a list of valid usernames + and passwords.
    • +
  • Permits brute force or other automated attacks.
    • +
  • Permits default, weak, or well-known passwords, such as “Password1” or “admin/admin“.
    • +
  • Uses weak or ineffective credential recovery and forgot-password processes, such as “knowledge-based + answers”, which cannot be made safe.
    • +
  • Uses plain text, encrypted, or weakly hashed passwords.
    • +
  • Has missing or ineffective multi-factor authentication.
    • +
  • Exposes Session IDs in the URL (e.g., URL rewriting).
    • +
  • Does not rotate Session IDs after successful login.
    • +
  • Does not properly invalidate Session IDs. User sessions or authentication tokens (particularly single + sign-on (SSO) tokens) aren’t properly invalidated during logout or a period of inactivity.
    • +
+
+

The main consequences are: +
    +
  • Unauthorized users can acess the system.
    • +
  • User information is leaked
    • +
+ +
+
+

+

+

Mitigation

+

Try thinking about cookies and how they can expose secrets !!!!

+ + + +

+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/AUTH/auth_lab.html b/introduction/templates/Lab/AUTH/auth_lab.html new file mode 100644 index 0000000..7bde3b8 --- /dev/null +++ b/introduction/templates/Lab/AUTH/auth_lab.html @@ -0,0 +1,20 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +BROKEN AUTH LAB +{% endblock %} + +
+

Can You Log in as other user?

+ +
+
+ + 
{{ err_msg }}
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/AUTH/auth_lab_login.html b/introduction/templates/Lab/AUTH/auth_lab_login.html new file mode 100644 index 0000000..6b57460 --- /dev/null +++ b/introduction/templates/Lab/AUTH/auth_lab_login.html @@ -0,0 +1,23 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +BROKEN AUTH LAB +{% endblock %} + +
+ +
+
+ +
+
+ +{{ err_msg }} +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/AUTH/auth_lab_signup.html b/introduction/templates/Lab/AUTH/auth_lab_signup.html new file mode 100644 index 0000000..b9de6c9 --- /dev/null +++ b/introduction/templates/Lab/AUTH/auth_lab_signup.html @@ -0,0 +1,25 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +BROKEN AUTH LAB +{% endblock %} + +
+ +
+
+ +
+
+ +{{ err_msg }} + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/AUTH/auth_success.html b/introduction/templates/Lab/AUTH/auth_success.html new file mode 100644 index 0000000..2f19e7f --- /dev/null +++ b/introduction/templates/Lab/AUTH/auth_success.html @@ -0,0 +1,24 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +BROKEN AUTH LAB +{% endblock %} + +
+

Your Information

+ +
+
+ +
+
+ + 
{{err_msg}}
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/BrokenAccess/ba.html b/introduction/templates/Lab/BrokenAccess/ba.html new file mode 100644 index 0000000..5f0dc37 --- /dev/null +++ b/introduction/templates/Lab/BrokenAccess/ba.html @@ -0,0 +1,66 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Broken Access Control +{% endblock %} +
+

Broken Access Control

+
+ +

What is Broken Access Control

+

Access control, sometimes called authorization, is how a web application grants access to content + and functions to some users and not others. These checks are performed after authentication, and govern what + ‘authorized’ users are allowed to do. A web application’s access control model is closely tied to the + content and functions that the site provides. In addition, the users may fall into a number of groups or + roles with different abilities or privileges. + +

+ +
+

+

+ This lab helps us to understand one of the authentication flaws which leads to an attacker gaining + unauthorized control of an account. + On accessing the lab the user is provided with a simple login in page which requires a username and + password. +
The credentials for the user Jack is jack:jacktheripper. +
Use the above info to log in.
+ The main aim of this lab is to login with admin privileges to get the secret key. + +

Exploiting the Broken Access +

    +
  • Every time a valid user logs in,the user session is set with a cookie called admin +
    • +
  • When you notice the cookie value when logged in as jack it is set to 0
    • +
  • Use BurpSuite to intercept the request change the value of the admin cookie from 0 to 1
    • +
  • This should log you in as a admin user and display the secret key
    • + +
+

+

+ +
+
+ +

+
+

Mitigation

+

+

    +
  • Using proper Session management techniques
    • +
  • Using Tokens such as JWT to authorize the users.
    • +
  • Unless a resource is intended to be publicly accessible, deny access by default
    • +
  • Thoroughly audit and test access controls to ensure they are working as designed
    • + +
+

+ + + +
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/BrokenAccess/ba_lab.html b/introduction/templates/Lab/BrokenAccess/ba_lab.html new file mode 100644 index 0000000..d45da9b --- /dev/null +++ b/introduction/templates/Lab/BrokenAccess/ba_lab.html @@ -0,0 +1,46 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Broken Access Control. +{% endblock %} + +
+

Admins Have the Secretkey

+ +
+
+ {% if username %} +

Logged in as user: {{username}}

+ {% endif %} + + {% if data %} +

Your Secret Key is {{data}}

+ {% endif %} + + {% if not_admin %} +

{{not_admin}}

+ {% endif %} + + {% if no_creds %} +

Please Provide Credentials

+ {% endif %} + +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/BrokenAuth/bau.html b/introduction/templates/Lab/BrokenAuth/bau.html new file mode 100644 index 0000000..9d5af43 --- /dev/null +++ b/introduction/templates/Lab/BrokenAuth/bau.html @@ -0,0 +1,104 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Command Injection +{% endblock %} +
+

Broken Authentication

+
+ +

What is Broken Authentication

+

Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to + impersonate legitimate users online. Broadly, broken authentication refers to weaknesses in two areas: + session management and credential management. Both are classified as broken authentication because attackers + can use either avenue to masquerade as a user: hijacked session IDs or stolen login credentials. + + Attackers employ a wide variety of strategies to take advantage of these weaknesses, ranging from huge + credential stuffing attacks to highly targeted schemes aimed at gaining access to a specific person’s + credentials. +

+ +
+

+ + +

+ The lab consists of a login page, which request users for their username and password. + If you don't know the password ,there is also a feature for login with otp! + When the users clicks the login with otp feature, user is directed to a page, which asks + users email id to send the otp. + When the user provides an email id , you can see that the 3 digit opt is sent back to the page itself. + This is not the general scenario , usually the code is sent to the registered email of the user. +
The user on receiving the 3 digit code can now enter the code in the input box that says + Enter your OTP + On entering the valid OTP the user gets a page which says Login Successful as user : email + . + If the Otp is wrong then the user gets a message saying Invalid OTP +

+ + + The Bug + +

+ The main aim of this lab is to login as admin, for that you are gonna exploit the lack of rate + limiting feature in the otp verification flow. + You can see that the otp is only of 3 digit(for demo purposes) and the application doesnt have any + captcha (To disallow any automated scripts or bots) or any restrictionds on the number of + tries for the otp. +

+ +

Now to send the otp to the admin's mail you need to figure out the admins mail id. + Luckily the admin has left his email id for the developers in the page source. + Admins email id admin@pygoat.com + After entering this email in the send otp input box and hit send, you can see that the page says that + otp has been sent to the email id of the admin. + In order to exploit the lack of rate limiting , we can try to Brute-force the 3 digit otp. +

+ +

+ Steps to Brute force: +

    +
  • Open Burpsuite and configure your browser to intercept the web trafic, but dont turn intercept on. +
    • +
  • Send the otp to the admins mail id with the help of send otp feature.
    • +
  • In the enter the otp box enter a random 3 digit number.
    • +
  • Before your press login , turn intercept on on Burp suite and then press log in
    • +
  • Now you can see that the traffic is captured in Burpsuite.
    • +
  • Now use the send to intruder feature and send this request to the intruder.
    • +
  • Set the position of the payload to the otp= parameter.
    • +
  • Go to the payloads session and choose the payload type to number list
    • +
  • Fill the range to 100 to 999 with step 1.
    • +
  • Now click attack and you can see that the burp suite tries different combinations of otp and + collects it response.
    • +
  • You can figure out if it has guessed the correct opt by seeing the difference in length of the + response for each request.
    • +
  • The correct otp will have a small response length .
    • +
+

+ +

Using this otp you will be able to login into admins account.

+

+ +
+
+ +

+

+
+

Mitigation

+

+ This type of authentication flaw can be mitigated by: +

    +
  • Using captcha
    • +
  • Rate Limiting by reducing the number of tries for a particular user, based on session or ip
    • +
  • Blocking multiple request form the same IP
    • +
+

+ +
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/BrokenAuth/bau_lab.html b/introduction/templates/Lab/BrokenAuth/bau_lab.html new file mode 100644 index 0000000..c92736b --- /dev/null +++ b/introduction/templates/Lab/BrokenAuth/bau_lab.html @@ -0,0 +1,36 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +Broken Authentication Lab +{% endblock %} + +
+

Login as Admin

+ +
+ +
+ {% if wrongpass %} +

Wrong Password Try Using Login With OTP

+ {% endif %} + + +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/BrokenAuth/otp.html b/introduction/templates/Lab/BrokenAuth/otp.html new file mode 100644 index 0000000..3d12cda --- /dev/null +++ b/introduction/templates/Lab/BrokenAuth/otp.html @@ -0,0 +1,37 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +Broken Authentication Lab +{% endblock %} +
+
+
Login Through Otp

+
+ + + +
+ +
+
+
+
+ +

+ +
+

+
+ {% if otp %} +

Your 3 Digit Verification Code:{{otp}}

+ {% endif %} + + {% if email %} +

Login Successful as user : {{email}}

+ {% endif %} + + + +
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/CMD/cmd.html b/introduction/templates/Lab/CMD/cmd.html new file mode 100644 index 0000000..43886a3 --- /dev/null +++ b/introduction/templates/Lab/CMD/cmd.html @@ -0,0 +1,104 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Command Injection +{% endblock %} +
+

Command Injection

+
+ +

What is Command Injection

+

Command injection is an attack where the goal is execution of arbitrary commands on the host + operating system via a vulnerable application. Command injection attacks are possible when an application + passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the + attacker-supplied operating system commands are usually executed with the privileges of the vulnerable + application. Command injection attacks are possible largely due to insufficient input validation. +

+ +
+

+ This lab helps us to understand how command injection is exploitable in scenarios where inputs are sent + to exec,eval,sys etc. + +
+ + The user on accessing the lab is provided with a feature to perform a name server lookup on the given + domain. + A domain name has to be provided after which the server would perform a ns lookup and return back to the + client. + If the user is running the lab, based on the OS they can select Windows or Linux. + +
+ +
Exploiting the Bug +

    +
  1. Method 1
    2. +
      +
    • The user can cause the server to execute commands ,because of the lack of input validation.
      • +
    • The user can give a domain say domain && [any cmd]
      • +
    • In This case lets give google.com && dir and choose windows.
      • +
    • This should give you the output for both ns lookup as well as for the dir
      • +
    +
  2. Method 2
    3. +
      +
    • The user can give a domain say domain; [any cmd]
      • +
    • In This case lets give google.com; dir and choose windows.
      • +
    • This should give you the output for both ns lookup as well as for the dir
      • +
    +
+
+ Understanding the cause
+

+ Lets first see how the name server lookup is performed +
+ command="nslookup {}".format(domain) +
+ Here the domain is the user input domain. This command variable is then sent to exec function and the + output is displayed. + If the user inputs google.com the command variable will hold nslookup google.com. + +

+ How CMD injection works + Method 1 + Now when the user enters google.com && dir The command variable will hold + nslookup google.com && dir. + The && means and.
The system will execute nslookup google.com + first and then dir
+ + Method 2 + When the user enters google.com ; dir The command variable will hold + nslookup google.com ; dir. + The ; implies the completion of the command before it, in this case the nslookup + command.
The system will execute nslookup google.com first and then dir
+ +

+ +

+ +
+
+ +

+
+
+

Mitigation


+

+

    +
  • Input validation
    • +
  • Parameterization of user input
    • +
  • Do not call os commands directly.
    • +
  • Validating against a whitelist of permitted values.
    • + + +
+

+ + + +
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/CMD/cmd_lab.html b/introduction/templates/Lab/CMD/cmd_lab.html new file mode 100644 index 0000000..2998cd3 --- /dev/null +++ b/introduction/templates/Lab/CMD/cmd_lab.html @@ -0,0 +1,36 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +Command Injection +{% endblock %} +
+
+

Name Server Lookup

+
+

+ + + +
+ +
+
+
+
+ {% if output %} +
Output

+ + 
{{output}}
+ + {% endif %} +
+ + +
+
+ +

+ + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/DataExp/data_exp.html b/introduction/templates/Lab/DataExp/data_exp.html new file mode 100644 index 0000000..8dc0ccc --- /dev/null +++ b/introduction/templates/Lab/DataExp/data_exp.html @@ -0,0 +1,49 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Sensitive Data Exposure +{% endblock %} +
+

Senstive Data Exposure

+
+ +

What is Sensitive Data Exposure

+

+ Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive + information to its users. Depending on the context, websites may leak all kinds of information to a potential + attacker, including: +

    +
  • Data about other users, such as usernames or financial information
    • +
  • Sensitive commercial or business data
    • +
  • Technical details about the website and its infrastructure
    • +
+

+ +
+

+ One of the features of having DEBUG=True is dumping lots of metadata from your environment, including the whole + settings.py configurations, when a exception occurs. +

+ +
+
+
+

Mitigation

+

Even though you will never be using DEBUG=True, you need extra care when naming the configurations in + the settings.py module. Make sure all sensitive variables use one of the keywords: +

    +
  • API
    • +
  • KEY
    • +
  • PASS
    • +
  • SECRET
    • +
  • SIGNATURE
    • +
  • TOKEN
    • +
+

+
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/DataExp/data_exp_lab.html b/introduction/templates/Lab/DataExp/data_exp_lab.html new file mode 100644 index 0000000..1e8e0c8 --- /dev/null +++ b/introduction/templates/Lab/DataExp/data_exp_lab.html @@ -0,0 +1,21 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Sensitive Data Exposure +{% endblock %} + +
+

Sensitive Data Exposure

+
+
+ Can you find a page to trigger 500 error? Can you find 'SENSITIVE_DATA'? +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/DataExp/robots.txt b/introduction/templates/Lab/DataExp/robots.txt new file mode 100644 index 0000000..507e78f --- /dev/null +++ b/introduction/templates/Lab/DataExp/robots.txt @@ -0,0 +1,3 @@ +User-Agent: * + +Disallow: /500error \ No newline at end of file diff --git a/introduction/templates/Lab/SQL/sql.html b/introduction/templates/Lab/SQL/sql.html new file mode 100644 index 0000000..e486ab3 --- /dev/null +++ b/introduction/templates/Lab/SQL/sql.html @@ -0,0 +1,100 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +SQL Injection +{% endblock %} +
+

Sql Injection

+
+ +

What is SQL Injection

+

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data + from the client to the application. A successful SQL injection exploit can read sensitive data from the + database, modify database data (Insert/Update/Delete), execute administration operations on the database + (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some + cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which + SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands. + +

+ +
+

+ + SQL injection errors occur when: + + Data enters a program from an untrusted source. + The data used to dynamically construct a SQL query + The main consequences are: + +

+ This lab helps you to exploit the common type of sql injection vulnerability, caused due to the lack of + input validation and directly exposing input into the query.
+ + The user on accessing the lab is given a log in page . The user has to try to login in as admin. + SQL Injection vulnerability can be identified by injecting a ' in any of the fields. If it + results in an SQL error, SQL injection vulnerability is identified +
+ + Exploiting SQL Injection Vulnerability +

    +
  • Enter the user name as admin
    • +
  • Enter the password as anything' OR '1' ='1
    • +
  • This should log you in as admin, without knowing the admins password.
    • +

+ Understanding the Exploit
+
+

+ The website logs a user in by checking the entered username and password against the ones stored in the + database. If they match, the user is logged in. + Lets first analyse the sql query used to compare the username and password in the database. +
"SELECT * FROM introduction_login WHERE user='"+name+"'AND password='"+password+"'"
+ The name and password parameters are the ones you give as input, which is directly inserted into the + query.
+ +
Why the error?

+ + When we inserted a ' in the input it threw an error , this is because the sql query was not + balanced and it threw an error. +
SELECT * FROM introduction_login WHERE user='admin' AND password='''
+ The query quotes in the password field are unbalanced, this can be balanced by adding another quote to + it. + +

Lets just plug our payload into the query and see what it looks like. +
SELECT * FROM introduction_login WHERE user='admin' AND password='anything' OR '1' ='1'
+ + Now the query means select username = admin where password is anything OR '1'='1' .
+ '1'='1' will always result in TRUE and the query fetches the user with name admin and + password=TRUE. + +
Thus allowing us to login in as admin. + +

+

+

+ +
+
+ +

+
+
+

Mitigation

+

+

    +
  • Use of Prepared Statements (with Parameterized Queries)
    • +
  • Use of Stored Procedures
    • +
  • Allow-list Input Validation
    • +
  • Escaping All User Supplied Input.
    • +
+ +

+ + + +
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/SQL/sql_lab.html b/introduction/templates/Lab/SQL/sql_lab.html new file mode 100644 index 0000000..43af47a --- /dev/null +++ b/introduction/templates/Lab/SQL/sql_lab.html @@ -0,0 +1,48 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +SQL LAB +{% endblock %} + +
+

Can You Log in as Admin

+ +
+ +
+ {% if user1 %} +

Logged in as: + 
{{user1}}
+

+ + {% elif wrongpass %} +

The password you have entered doesnt match the username!

+

The SQL query being submitted is + 
{{ sql_error }}
+

+ + {% elif no %} +

User Not Found

+ {% else %} + + {% endif %} + + +
+ +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/XSS/xss.html b/introduction/templates/Lab/XSS/xss.html new file mode 100644 index 0000000..6a602af --- /dev/null +++ b/introduction/templates/Lab/XSS/xss.html @@ -0,0 +1,170 @@ +{% extends "introduction/base.html" %} +{% block content %} + +
+

Cross Site Scripting

+
+ +

What is Cross Site Scripting or XSS?

+

+ Cross site scripting or XSS is a form of client side code injection.
In this type of attack the attacker + tries to inject malicious script into a trusted site. The malicious script is usually a piece of javascript + code, which helps the attacker to perform malicious activities, like redirecting the victim to an attacker + site, stealing cookies etc. Some times XSS vulnerability can be chained with other vulnerabilities to create + great impact . + Talking about XSS, we have 3 different types:

+
    +
  • Reflected XSS
    • +
  • Stored XSS
    • +
  • DOM XSS
    • +
+ +

Reflected XSS

+

Reflected XSS occurs when user input is immediately returned by a web application in an error + message, search result, or any other response that includes some or all of the input provided by the user as + part of the request, without that data being made safe to render in the browser, and without permanently + storing the user provided data.

+ +

Stored XSS

+

Stored XSS generally occurs when user input is stored on the target server, such as in a database, + in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data + from the web application without that data being made safe to render in the browser.Blog comments sessions + are places which can be vulnerable to stored xss , once a vulnerable xss payload is posted then every user + that visits the blog comment session would have the impact of the vulnerability.

+ +

DOM XSS

+

This type of XSS is possible when javascript takes in an user controllable code and passes it to a + sink ,for code execution . Examples of sinks are window.location , innerhtml , document.write .When the + attacker tries to inject malicious code into a sink , then this type of XSS is called the DOM Xss

+ + + + +
+

+ This lab will help you to understand the Reflective Type of XSS. + +

The lab consists of a Search page called FAANG IT.Which helps you to get some + information about Facebook, Apple ,Amazon ,Netflix, Google. The user can input one of the + companies into the search bar and see the information related to it.

+

If a user searches for something else , he can see a message saying that the search term is + not part of the Company.

+ +

What can go wrong Here? Yes, this html page reflects the search query back to the page when + the user enters something which is not part of the FAANG.

+

Exploiting the Reflection of the search query

+
    +
  • Instead of giving a search term try giving a html tag, <h4 >Hello </h4>.
    • +
  • Now you can see that the word Hello has been parsed as a Heading in the page.
    • +
  • This shows that the page is able to render the user given html tags.
    • +
  • In order to get an xss , the user needs to execute javascript code in the browser.
    • +
  • This can be acheived by using a script tag and malicious javascript code.
    • +
  • For now let's just use a basic javascript code to alert a text to prove that xss is possible .
    • + +
    <script >alert(“xss”) </script >
    + + +
  • Now when a search query is performed with the above payload you can see that the browser is able to + render the script tag and execute the javascript , thus alerting “xss” with a pop up.
    • + + +
+ + + + +

+ +
+
+ +

+

+
+

Mitigation


+

First let's analyse what part of the code has resulted in this vulnerability. + + +
#code in views.py
+ return render(request,'Lab/XSS/xss_lab.html',{'query': q})
+
#code in html template
+ <h3> The company '{query|safe}' You searched for is not Part of FAANG </h3> +

+ +

In the above code the q variable holds the users input . This input is stored in a variable called + ‘query’ , which is sent to a html template which renders a html along with the value of the query. +

+

The query received from the user is considered to be safe which resulted in the template rendering + the user input without escaping the input. This can be seen by using the keyword 'safe' in the html + template.

+ +
+

+

What happens without the safe keyword?


+ + +

Without the safe keyword Django would automatically escape the malicious string in the query + context variable.

+ +

It does this by passing all string data through Python’s html.escape() function. This + function will:

+
    +
  • Replace any & with an & amp; ampersand HTML character-reference
    • +
  • Replace any < or> with an & lt; or & gt; HTML character-reference
    • +
  • Replace any " with an escaped \"
    • +
  • Replace any ' with an escaped \'
    • + + +
+ +

+

+ + +
+

Now talking about the mitigation

+ +
+
    +
  1. Encode the following characters with HTML entity encoding to prevent switching into any execution + context, such as script, style, or event handlers. Using hex entities is recommended in the spec. The 5 + characters significant in XML. + +
      +
    • & --> & amp;
      • +
    • + < --> & lt; +
      • +
    • --> & gt;
      • +
    • " --> & quot;
      • +
    • ' --> &# x27;
      • +
    +
    2. + +
  2. CSS Encode And Strictly Validate Before Inserting Untrusted Data into HTML Style Property Values
    3. +
  3. JavaScript Encode Before Inserting Untrusted Data into JavaScript Data Values
    4. + + +
  4. HTML Encode JSON values in an HTML context and read the data with JSON.parse
    5. + +
  5. URL Encode Before Inserting Untrusted Data into HTML URL Parameter Values
    6. +
  6. Implement Content Security Policy
    7. +
  7. Use HTTPOnly cookie flag
    8. + + +
+ +

+ + + + + +
+
+ + + + +{% endblock content %} \ No newline at end of file diff --git a/introduction/templates/Lab/XSS/xss_lab.html b/introduction/templates/Lab/XSS/xss_lab.html new file mode 100644 index 0000000..0309cc0 --- /dev/null +++ b/introduction/templates/Lab/XSS/xss_lab.html @@ -0,0 +1,41 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +XSS LAB +{% endblock %} + + + +
+
+

FAANG IT

+
+ + + + +
+

+
+ {% if company %} +

Company Name : {{company}}

+

Ceo Name : {{ceo}}

+

About : {{about}}

+ {% elif query %} +

The company '{{query|safe}}' You searched for is not Part of FAANG

+ {% else %} + + {% endif %} + + +
+ +
+
+ +

+ +{% endblock content %} \ No newline at end of file diff --git a/introduction/templates/Lab/XXE/xxe.html b/introduction/templates/Lab/XXE/xxe.html new file mode 100644 index 0000000..a59d478 --- /dev/null +++ b/introduction/templates/Lab/XXE/xxe.html @@ -0,0 +1,98 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +XXE Injection +{% endblock %} +
+

XXE Injection

+
+ +

What is XML External Entity Injection

+

XML External Entity injection (also known as XXE) is a web security vulnerability that allows an + attacker to interfere with an application's processing of XML data. It is a type of attack against an + application that parses XML input. This attack occurs when XML input containing a reference to an external + entity is processed by a weakly configured XML parser.
+ It often allows an attacker to view files on the application server filesystem, and to interact with any + back-end or external systems that the application itself can access.
+ In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other + back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) + attacks. +

+ +
+

+ +

+ This lab helps us to understand how xxe vulnerabilities can be exploited in the wild. + The lab consists of a commenting feature which asks the user to enter his/her thoughts about a picture + show! + Once he enters his comments, he is also given a feature to see how his comments are stored in the + database. + This can be done by clicking the click here button . +

+

+ What could go wrong here?
+ When the user clicks the button to save his comments, the data is sent to the server in the from of xml + post request. + This can be seen by intercepting the request done to the server by that button using BurpSuite.
+ Sending data to the server in the form of XML is not actually vulnerable, the vulnerability lies in the + way the xml is being parsed. + An xml parser which allows the DTD retrival is vulnerable to XXE injection if there aren't any input + validations done on the xml data. + +

+

+ Exploiting the XML Parser +

    +
  • Open Burpsuite and make sure it is ready to capture the web traffic.
    • +
  • Enter your comments in the input box provided.
    • +
  • Before hiting the Let the world see button go to burpsuite and turn on intercept.
    • +
  • Now you should be able to see a post request containing a xml data with your comment inside your the + text tag.
    • +
  • Now we need to introduce a DTD, which tries to fetch files from its server.
    • +
  • This can be done by using the document tag and defining the Entity.
    • +
  • The Payload

    • + + <?xml version='1.0'?>
    + <!DOCTYPE comm [
    + <!ELEMENT comm (#PCDATA)>
    + <!ENTITY xxe SYSTEM "File_Path_Here">
    + ]>
    + <comm>
    + <text>&xxe;</text>
    + </comm>
    +
    +
  • Incase if the server is runnning linux then use file path file:///etc/passwd and if its + running windows, use C:\windows\system32\drivers\etc\hosts. This will dump sensitive + data about all users
    • +
  • Forward the request and turn of intercept.
    • +
  • Go to the see comments option and click view comments this should show you the requested files in + your payload if the vulnerability exists.
    • +
+

+ + +

+ +
+
+ +

+
+

Mitigation

+

+

    +
  • DTD and XML external entity features must be disabled.
    • +
  • All XML processors and libraries used in the application must be patched and updated always.
    • +
  • Ensure that the user inputs are validated before being parsed
    • +
  • Make use of a good xml parsers, which arent vulnerable by default.
    • +
+

+
+
+ + + +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/XXE/xxe_lab.html b/introduction/templates/Lab/XXE/xxe_lab.html new file mode 100644 index 0000000..6153c1f --- /dev/null +++ b/introduction/templates/Lab/XXE/xxe_lab.html @@ -0,0 +1,37 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +XXE LAB +{% endblock %} + + + +
+ +

+ + +
+ + + + +
+
+
+

To see your comments

+

+
+
Your comments :
+ 
{{com}}
+
+ + +
+
+ +

+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/insec_des/insec_des.html b/introduction/templates/Lab/insec_des/insec_des.html new file mode 100644 index 0000000..3712c38 --- /dev/null +++ b/introduction/templates/Lab/insec_des/insec_des.html @@ -0,0 +1,82 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Insecure Deserialization +{% endblock %} +
+

Insecure Deserialization

+
+

What is Insecure Deserialization

+

+ Exploitation of deserialization is somewhat difficult, as off the shelf exploits rarely work without changes or + tweaks to the underlying exploit code. + This issue is included in the Top 10 based on an industry survey and not on quantifiable data. + Some tools can discover deserialization flaws, but human assistance is frequently needed to validate the problem. + It is expected that prevalence data for deserialization flaws will increase as tooling is developed to help + identify and address it. + The impact of deserialization flaws cannot be overstated. These flaws can lead to remote code execution attacks, + one of the most serious attacks possible. + The business impact depends on the protection needs of the application and data. +

+ + +
+

+ This Lab consists of a Page that has some content only available to for the admin to see, How can we access that + page as admin? How is our role defined? +

+

If we check the cookie we see that it is base64 encoded, on decoding we realise it is pickle + serialised and we can see some attributes, can you change the attributes to make the page readable? +

+

Hint: try to flip the bit of the admin from ...admin\x94K\x00... to ...admin\x94K\x00... +

+
+
+ +
+
+

Insecure Deserialization

+

+ Applications and APIs will be vulnerable if they deserialize hostile or tampered objects supplied by an attacker. + This can result in two primary types of attacks: +

+
    +
  • Object and data structure related attacks where the attacker modifies application logic or achieves arbitrary + remote code execution if there are classes available to the application that can change behavior during or after + deserialization.
    • +
  • Typical data tampering attacks such as access-control-related attacks where existing data structures are used + but the content is changed.
    • +
+

+ Serialization may be used in applications for: +

+
    +
  • Remote- and inter-process communication (RPC/IPC)
    • +
  • Wire protocols, web services, message brokers
    • +
  • Caching/Persistence
    • +
  • Databases, cache servers, file systems
    • +
  • HTTP cookies, HTML form parameters, API authentication tokens
    • +
+

+ How to Prevent +

+

The only safe architectural pattern is not to accept serialized objects from untrusted sources or to + use serialization mediums that only permit primitive data types. If that is not possible, consider one of more of + the following: +

+
    +
  • Implementing integrity checks such as digital signatures on any serialized objects to prevent hostile object + creation or data tampering.
    • +
  • Enforcing strict type constraints during deserialization before object creation as the code typically expects + a definable set of classes. Bypasses to this technique have been demonstrated, so reliance solely on this is not + advisable.
    • +
  • Isolating and running code that deserializes in low privilege environments when possible.
    • +
  • Log deserialization exceptions and failures, such as where the incoming type is not the expected type, or the + deserialization throws exceptions.
    • +
  • Restricting or monitoring incoming and outgoing network connectivity from containers or servers that + deserialize. + Monitoring deserialization, alerting if a user deserializes constantly.
    • +
+
+
+{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/insec_des/insec_des_lab.html b/introduction/templates/Lab/insec_des/insec_des_lab.html new file mode 100644 index 0000000..43900ec --- /dev/null +++ b/introduction/templates/Lab/insec_des/insec_des_lab.html @@ -0,0 +1,19 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +INSECURE DESERIALIZATION LAB +{% endblock %} + +
+
+ 
{{message}}
+
+
+ +
+
+ +

+ +{% endblock content %} \ No newline at end of file diff --git a/introduction/templates/Lab/sec_mis/sec_mis.html b/introduction/templates/Lab/sec_mis/sec_mis.html new file mode 100644 index 0000000..b90e19c --- /dev/null +++ b/introduction/templates/Lab/sec_mis/sec_mis.html @@ -0,0 +1,85 @@ +{% extends 'introduction/base.html' %} +{% block content %} +{% block title %} +Security Misconfiguration +{% endblock %} +
+

+
+

What is Security Misconfiguration

+

+ Security misconfiguration can happen at any level of an application stack, including the network services, + platform, web server, application server, database, frameworks, custom code, and pre-installed virtual machines, + containers, or storage. Automated scanners are useful for detecting misconfigurations, use of default accounts or + configurations, unnecessary services, legacy options, etc. +

+

+ Such flaws frequently give attackers unauthorized access to some system data or functionality. Occasionally, such + flaws result in a complete system compromise. + The business impact depends on the protection needs of the application and data. +

+ + +
+

+ This lab has a Security misconfiguration. It has a button which reveal the secret key but it is only accessible + if the admin is accessing it. How to checkin as admin? Is there a cookie, OR A request header? + + Hint: +

    +
  • Clicking on the Secret Key button gives an error message, try using the hint to change the request.
    • +
+

+
+
+ +
+
+ + +
+

+ One of the features of having DEBUG=True is dumping lots of metadata from your environment, including the whole settings.py configurations, when a exception occurs. +
Can u trigger a 500 error and get the SENSITIVE_DATA ? +

+
+
+ +
+
+ + +
+

+ Solve lab2 before solving this.
+

Can you login as admin ?

+
For hint you can see the code in the lab page.. +

+
+
+ +
+
+ + +

Security Misconfiguration

+

+ The application might be vulnerable if the application is: +

    +
  • Missing appropriate security hardening across any part of the application stack, or improperly configured + permissions on cloud services.
    • +
  • Unnecessary features are enabled or installed (e.g. unnecessary ports, services, pages, accounts, or + privileges).
    • +
  • Default accounts and their passwords still enabled and unchanged.
    • +
  • Error handling reveals stack traces or other overly informative error messages to users.
    • +
  • For upgraded systems, latest security features are disabled or not configured securely.
    • +
  • The security settings in the application servers, application frameworks (e.g. Struts, Spring, ASP.NET), + libraries, databases, etc. not set to secure values.
    • +
  • The server does not send security headers or directives or they are not set to secure values.
    • +
  • The software is out of date or vulnerable (see A9:2017-Using Components with Known Vulnerabilities). + Without a concerted, repeatable application security configuration process, systems are at a higher risk.
    • +
+

+
+
+{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/sec_mis/sec_mis_lab.html b/introduction/templates/Lab/sec_mis/sec_mis_lab.html new file mode 100644 index 0000000..25b410b --- /dev/null +++ b/introduction/templates/Lab/sec_mis/sec_mis_lab.html @@ -0,0 +1,32 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Security Misconfiguration +{% endblock %} + + +
+

+ + + {% if secret %} +

Success. You have the secret + 
{{secret}}
+

+ {% endif %} + + {% if no_secret %} +

{{no_secret}}

+ {% endif %} + +
+ + +
+
+ +

+ +{% endblock content %} \ No newline at end of file diff --git a/introduction/templates/Lab/sec_mis/sec_mis_lab3.html b/introduction/templates/Lab/sec_mis/sec_mis_lab3.html new file mode 100644 index 0000000..5e1b2d4 --- /dev/null +++ b/introduction/templates/Lab/sec_mis/sec_mis_lab3.html @@ -0,0 +1,53 @@ +{% extends "introduction/base.html" %} +{% load static %} +{% block content %} +{% block title %} +Security Misconfiguration +{% endblock %} +
+ {% if admin %} +

loggedin as Admin +

+ {% else %} + +

+ User Not allowed. [ Admin Only ] +

+ {% endif %} + +
+ + + +
+ + from pygoat.settings import SECRET_COOKIE_KEY

+def sec_misconfig_lab3(request):
+ if not request.user.is_authenticated:
+  return redirect('login')
+ try:
+  cookie = request.COOKIES["auth_cookie"]
+  payload = jwt.decode(cookie, SECRET_COOKIE_KEY, algorithms=['HS256'])
+  if payload['user'] == 'admin':
+   return render(request,"Lab/sec_mis/sec_mis_lab3.html", {"admin":True} )
+ except:
+  payload = {
+   'user':'not_admin',
+   'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=60),
+   'iat': datetime.datetime.utcnow(),
+  }
+
+  cookie = jwt.encode(payload, SECRET_COOKIE_KEY, algorithm='HS256')
+  response = render(request,"Lab/sec_mis/sec_mis_lab3.html", {"admin":False} )
+  response.set_cookie(key = "auth_cookie", value = cookie)
+  return response
+ + +
+ +
+ +

+ +{% endblock content %} \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/blogs/blog1.txt b/introduction/templates/Lab/ssrf/blogs/blog1.txt new file mode 100644 index 0000000..87940b7 --- /dev/null +++ b/introduction/templates/Lab/ssrf/blogs/blog1.txt @@ -0,0 +1,9 @@ +Overview + +This category is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage and above-average Exploit and Impact potential ratings. As new entries are likely to be a single or small cluster of Common Weakness Enumerations (CWEs) for attention and awareness, the hope is that they are subject to focus and can be rolled into a larger category in a future edition. + +Description + +SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL). + +As modern web applications provide end-users with convenient features, fetching a URL becomes a common scenario. As a result, the incidence of SSRF is increasing. Also, the severity of SSRF is becoming higher due to cloud services and the complexity of architectures. \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/blogs/blog2.txt b/introduction/templates/Lab/ssrf/blogs/blog2.txt new file mode 100644 index 0000000..d214055 --- /dev/null +++ b/introduction/templates/Lab/ssrf/blogs/blog2.txt @@ -0,0 +1,28 @@ +How to Prevent ? +Developers can prevent SSRF by implementing some or all the following defense in depth controls: + +From Network layer +Segment remote resource access functionality in separate networks to reduce the impact of SSRF + +Enforce “deny by default” firewall policies or network access control rules to block all but essential intranet traffic. +Hints: +~ Establish an ownership and a lifecycle for firewall rules based on applications. +~ Log all accepted and blocked network flows on firewalls (see A09:2021-Security Logging and Monitoring Failures). + +From Application layer: +Sanitize and validate all client-supplied input data + +Enforce the URL schema, port, and destination with a positive allow list + +Do not send raw responses to clients + +Disable HTTP redirections + +Be aware of the URL consistency to avoid attacks such as DNS rebinding and “time of check, time of use” (TOCTOU) race conditions + +Do not mitigate SSRF via the use of a deny list or regular expression. Attackers have payload lists, tools, and skills to bypass deny lists. + +Additional Measures to consider: +Don't deploy other security relevant services on front systems (e.g. OpenID). Control local traffic on these systems (e.g. localhost) + +For frontends with dedicated and manageable user groups use network encryption (e.g. VPNs) on independent systems to consider very high protection needs \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/blogs/blog3.txt b/introduction/templates/Lab/ssrf/blogs/blog3.txt new file mode 100644 index 0000000..13ef764 --- /dev/null +++ b/introduction/templates/Lab/ssrf/blogs/blog3.txt @@ -0,0 +1,28 @@ +How to Prevent +Developers can prevent SSRF by implementing some or all the following defense in depth controls: + +From Network layer +Segment remote resource access functionality in separate networks to reduce the impact of SSRF + +Enforce “deny by default” firewall policies or network access control rules to block all but essential intranet traffic. +Hints: +~ Establish an ownership and a lifecycle for firewall rules based on applications. +~ Log all accepted and blocked network flows on firewalls (see A09:2021-Security Logging and Monitoring Failures). + +From Application layer: +Sanitize and validate all client-supplied input data + +Enforce the URL schema, port, and destination with a positive allow list + +Do not send raw responses to clients + +Disable HTTP redirections + +Be aware of the URL consistency to avoid attacks such as DNS rebinding and “time of check, time of use” (TOCTOU) race conditions + +Do not mitigate SSRF via the use of a deny list or regular expression. Attackers have payload lists, tools, and skills to bypass deny lists. + +Additional Measures to consider: +Don't deploy other security relevant services on front systems (e.g. OpenID). Control local traffic on these systems (e.g. localhost) + +For frontends with dedicated and manageable user groups use network encryption (e.g. VPNs) on independent systems to consider very high protection needs \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/blogs/blog4.txt b/introduction/templates/Lab/ssrf/blogs/blog4.txt new file mode 100644 index 0000000..01dc013 --- /dev/null +++ b/introduction/templates/Lab/ssrf/blogs/blog4.txt @@ -0,0 +1,2 @@ +The purpose is to give both developers and testers a platform for learning how to test applications and how to code securely. PyGoat is written in python and used Django web framework as a platform. It has both traditional web application vulnerabilities (i.e. XSS, SQLi) as well. +PyGoat also has an area where you can see the source code to determine where the mistake was made that caused the vulnerability and allows you to make changes to secure it. \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/secret.txt b/introduction/templates/Lab/ssrf/secret.txt new file mode 100644 index 0000000..58e6f9e --- /dev/null +++ b/introduction/templates/Lab/ssrf/secret.txt @@ -0,0 +1 @@ +bla bla \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/ssrf.html b/introduction/templates/Lab/ssrf/ssrf.html new file mode 100644 index 0000000..af73bb0 --- /dev/null +++ b/introduction/templates/Lab/ssrf/ssrf.html @@ -0,0 +1,65 @@ +{% extends 'introduction/base.html' %} {% block content %} {% block title %} +SSRF +{% endblock %} +
+

Server-Side Request Forgery

+
+

What is Server-Side Request Forgery (SSRF)

+

+ SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL). + + As modern web applications provide end-users with convenient features, fetching a URL becomes a common scenario. As a result, the incidence of SSRF is increasing. Also, the severity of SSRF is becoming higher due to cloud services and the complexity of architectures. +

+ +
+

+ This lab helps you to get an idea of how SSRF can result in major Security flaw. + + The next pages shows some blog, but can you figure out how the blogs are presented? + +
+

+
+ +
+

+ This website sends a request to the given url and displays the page withing the page. + now there is a page at /ssrf_target which only allowes request from localhost ( ie 127.0.0.1 ) +
+ now start the server using python manage.py runserver 0:8000
+ get your network ip using ifconfig or ipcofig(in windows)
+ now go to http://[your ip]/ssrf_target +
+ Now you can't access the page because it is not from localhost. + Try to get access to this page content now using the utility. +

+
+
+
+
+
+

Mitigation

+

+

    + From Network layer +
  • Segment remote resource access functionality in separate networks to reduce the impact of SSRF
    • +
  • Enforce “deny by default” firewall policies or network access control rules to block all but essential intranet traffic.
    • + From Application layer +
  • Sanitize and validate all client-supplied input data
    • +
  • Enforce the URL schema, port, and destination with a positive allow list
    • +
  • Do not send raw responses to clients
    • +
  • Disable HTTP redirections
    • +
  • Be aware of the URL consistency to avoid attacks such as DNS rebinding and “time of check, time of use” (TOCTOU) race conditions
    • + Additional Measures to consider +
  • Don't deploy other security relevant services on front systems (e.g. OpenID). Control local traffic on these systems (e.g. localhost)
    • +
  • For frontends with dedicated and manageable user groups use network encryption (e.g. VPNs) on independent systems to consider very high protection needs
    • +
+

+ +
+
+
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/ssrf_discussion.html b/introduction/templates/Lab/ssrf/ssrf_discussion.html new file mode 100644 index 0000000..7dc6678 --- /dev/null +++ b/introduction/templates/Lab/ssrf/ssrf_discussion.html @@ -0,0 +1,157 @@ +{% extends 'introduction/base.html' %} {% block content %} {% block title %} +SSRF +{% endblock %} + +

Discussion page

+
+
+

Lets fix the code in lab 1 of SSRF

+ +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
Choose the lines with insecure/defective code
+
+
+
+
+
+
+
+ +
+
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
+ +
+
+ + +
+
Some insecure codes in frontend side also ...
+
+
+
+
+
+
+
+ +
+
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+
  
+ +
+
+
+
+

Now Lets fix the code :)

+

+ Problem Statement : + We need to share file content ( not the file itself ) + Previous method had ssrf valuribility issue. Fix the code so that it can share file content securely. +

+
+
+
views.py
+ +
+
+
ssrf_lab.html
+ +
+
+ +
+
+

Congratulation you have secured the code.

+
+
+ +
+{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/ssrf_lab.html b/introduction/templates/Lab/ssrf/ssrf_lab.html new file mode 100644 index 0000000..ab6977e --- /dev/null +++ b/introduction/templates/Lab/ssrf/ssrf_lab.html @@ -0,0 +1,72 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +SSRF LAB +{% endblock %} + +
+
+

Read Blog

+
+
+
+
+ {% csrf_token %} + + +
+
+ {% csrf_token %} + + +
+
+ {% csrf_token %} + + +
+
+ {% csrf_token %} + + +
+
+
+ {{ blog }} +
+
+ + +
+ Try to find a .env file +
+ + + +
+ + def ssrf_lab(request):
+ if request.user.is_authenticated:
+  if request.method=="GET":
+   return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":"Read Blog About SSRF"})
+  else:
+   file=request.POST["blog"]
+   try :
+    dirname = os.path.dirname(__file__)
+    filename = os.path.join(dirname, file)
+    file = open(filename,"r")
+    data = file.read()
+    return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":data})
+   except:
+    return render(request, "Lab/ssrf/ssrf_lab.html", {"blog": "No blog found"})
+ else:
+  return redirect('login')
+ + +
+
+ +
+ +{% endblock %} \ No newline at end of file diff --git a/introduction/templates/Lab/ssrf/ssrf_lab2.html b/introduction/templates/Lab/ssrf/ssrf_lab2.html new file mode 100644 index 0000000..5245899 --- /dev/null +++ b/introduction/templates/Lab/ssrf/ssrf_lab2.html @@ -0,0 +1,52 @@ +{% extends "introduction/base.html" %} +{% block content %} +{% block title %} +SSRF LAB +{% endblock %} + +
+ {% if error %} +