add new vulns

Author: confusedcrib

insecure-app/app.py

@@ -1,8 +1,11 @@
-from flask import Flask, request, render_template_string, send_from_directory
+from flask import Flask, request, render_template_string, jsonify
 import subprocess
 import os
 import sqlite3
+import requests
+from lxml import etree
 
+# Example hardcoded AWS credentials (sensitive data leakage)
 aws_access_key_id = 'AKIA2JAPX77RGLB664VE'
 aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'
 
@@ -11,18 +14,18 @@
 @app.route('/', methods=['GET', 'POST'])
 def index():
     output = ''
-    # SQL Injection?
+    # 1 - SQL Injection
     db = sqlite3.connect("tutorial.db")
     cursor = db.cursor()
     username = ''
     password = ''
     try:
-        #the % is what makes it bad, instead of passing them in as parameters
-        #Example Exploit: SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '' OR '1'='1'
         cursor.execute("SELECT * FROM users WHERE username = '%s' AND password = '%s'" % (username, password))
     except:
         pass
+
     if request.method == 'POST':
+        # 2 - Command Injection
         if 'command' in request.form:
             cmd = request.form['command']
             process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@@ -31,34 +34,115 @@ def index():
                 output = stdout.decode('utf-8')
             else:
                 output = f"Error (Exit Code: {process.returncode}):\n{stderr.decode('utf-8')}"
+
+        # 3 - File Upload with no restrictions, and path traversal
         elif 'file' in request.files:
             uploaded_file = request.files['file']
             uploaded_file.save(os.path.join('/uploads', uploaded_file.filename))
             output = f"File {uploaded_file.filename} uploaded successfully!"
+
+        # 4 - SQL Injection via input
         elif 'sql' in request.form:
             sql = request.form['sql']
-            cursor.execute(sql)
-            output = 'SQL command executed successfully!'
+            try:
+                # Execute the user's SQL query
+                cursor.execute(sql)
+                # Fetch all rows from the query result
+                rows = cursor.fetchall()
+                # Format the results for display
+                if rows:
+                    output = "Results:\n" + "\n".join(str(row) for row in rows)
+                else:
+                    output = "Query executed successfully, but no results found."
+            except Exception as e:
+                output = f"SQL Error: {e}"
+
+        # 5 - Cross-Site Scripting (XSS)
+        elif 'xss' in request.form:
+            xss_input = request.form['xss']
+            output = f"Reflected XSS result: {xss_input}"
+
+        # 6 - XML External Entity (XXE) Injection
+        elif 'xml' in request.form:
+            xml_data = request.form['xml']
+            try:
+                # Use lxml to parse the XML data
+                parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
+                tree = etree.fromstring(xml_data.encode(), parser)
+                output = f"Parsed XML: {etree.tostring(tree, encoding='unicode')}"
+            except Exception as e:
+                output = f"XML Parsing Error: {e}"
+
+        # 7 - Server-Side Request Forgery (SSRF)
+        elif 'url' in request.form:
+            url = request.form['url']
+            try:
+                response = requests.get(url)
+                output = f"SSRF Response: {response.text[:200]}"
+            except Exception as e:
+                output = f"SSRF Error: {e}"
 
     return render_template_string("""
         <h1>Intentionally Insecure App</h1>
+        <hr>
+
+        <!-- Command Injection -->
         <form action="/" method="post">
-            Run a command: <input type="text" name="command">
+            <h2>Command Injection</h2>
+            <input type="text" name="command" value="ls -la">
             <input type="submit" value="Run">
         </form>
         <br>
+
+        <!-- File Upload -->
         <form action="/" method="post" enctype="multipart/form-data">
-            Upload a file: <input type="file" name="file">
+            <h2>Path Traversal via File Upload</h2>
+            <input type="file" name="file">
             <input type="submit" value="Upload">
         </form>
+        <p>Try uploading a file named: <code>../../../../etc/passwd</code></p>
         <br>
+
+        <!-- SQL Injection -->
         <form action="/" method="post">
-            Inject some SQL <input type="text" name="sql">
+            <h2>SQL Injection</h2>
+            <input type="text" name="sql" value="SELECT * FROM users WHERE username = 'admin' OR '1'='1'">
             <input type="submit" value="Run">
         </form>
-        <pre>{{output}}</pre>
-    """, output=output)
+        <br>
 
+        <!-- Cross-Site Scripting (XSS) -->
+        <form action="/" method="post">
+            Enter XSS payload: <input type="text" name="xss" value="<script>alert('XSS');</script>">
+            <input type="submit" value="Run">
+        </form>
+        <br>
+
+        <!-- XML External Entity (XXE) Injection -->
+        <form action="/" method="post">
+            <h2>XML External Entity (XXE) Injection</h2>
+            <textarea name="xml" rows="5" cols="50">
+<?xml version="1.0"?>
+<!DOCTYPE root [
+<!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<root>&xxe;</root>
+            </textarea>
+            <input type="submit" value="Parse XML">
+        </form>
+        <br>
+
+        <!-- Server-Side Request Forgery (SSRF) -->
+        <form action="/" method="post">
+            <h2>Server-Side Request Forgery (SSRF)</h2>
+            <input type="text" name="url" value="http://localhost:8080/">
+            <input type="submit" value="Request">
+        </form>
+        <br>
+
+        <hr>
+        <pre>{{ output|safe }}</pre>
+    """, output=output)
 
 if __name__ == '__main__':
     app.run(host='0.0.0.0', port=8080, debug=True)

insecure-app/init_db.py

@@ -0,0 +1,30 @@
+import sqlite3
+
+# Create the database file
+db = sqlite3.connect("tutorial.db")
+cursor = db.cursor()
+
+# Create the users table
+cursor.execute("""
+    CREATE TABLE IF NOT EXISTS users (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT NOT NULL,
+        password TEXT NOT NULL
+    )
+""")
+
+# Insert some sample data
+users = [
+    ('admin', 'password123'),
+    ('user1', 'letmein'),
+    ('user2', 'qwerty'),
+    ('jdoe', 'securepass'),
+]
+
+cursor.executemany("INSERT INTO users (username, password) VALUES (?, ?)", users)
+db.commit()
+
+print("Database initialized with sample data.")
+
+# Close the connection
+db.close()