From 03e7db58e6f0cc51a0b5895db6c663a6f235ff57 Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 01/17] Patched introduction/static/js/a9.js --- introduction/static/js/a9.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/introduction/static/js/a9.js b/introduction/static/js/a9.js index 9c58b8a..738109d 100644 --- a/introduction/static/js/a9.js +++ b/introduction/static/js/a9.js @@ -37,9 +37,9 @@ event3 = function(){ document.getElementById("a9_d3").style.display = 'flex'; for (var i = 0; i < data.logs.length; i++) { var li = document.createElement("li"); - li.innerHTML = data.logs[i]; + li.textContent = data.logs[i]; document.getElementById("a9_d3").appendChild(li); } }) .catch(error => console.log('error', error)); - } \ No newline at end of file + } From 6a8904e7e22ca0a3922d385912971702fe94cdc0 Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 02/17] Patched introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html --- .../A1_BrokenAccessControl/broken_access_lab_2.html | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html index cce8b6e..7940ed9 100644 --- a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html +++ b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html @@ -9,12 +9,10 @@

Can you log in as an admin and get the secretkey?

- + {% csrf_token %}

- -
@@ -50,4 +48,4 @@

Please Provide Credentials

-{% endblock %} \ No newline at end of file +{% endblock %} From abeef1490a5920b2c7c279fdc460e014d8b06d0a Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 03/17] Patched introduction/templates/Lab/XSS/xss_lab_3.html --- introduction/templates/Lab/XSS/xss_lab_3.html | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/introduction/templates/Lab/XSS/xss_lab_3.html b/introduction/templates/Lab/XSS/xss_lab_3.html index a550b9a..7fa512e 100644 --- a/introduction/templates/Lab/XSS/xss_lab_3.html +++ b/introduction/templates/Lab/XSS/xss_lab_3.html @@ -17,9 +17,11 @@

Welcome to XSS Challenge


{{code}}

+{% json_script code as code_json %}
From 1f857309286b6f70eecb6c5170d6b68cf0cd6ebc Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 04/17] Patched introduction/templates/Lab/A9/a9_lab.html --- introduction/templates/Lab/A9/a9_lab.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/introduction/templates/Lab/A9/a9_lab.html b/introduction/templates/Lab/A9/a9_lab.html index 5a70b46..7145c34 100644 --- a/introduction/templates/Lab/A9/a9_lab.html +++ b/introduction/templates/Lab/A9/a9_lab.html @@ -8,6 +8,7 @@

Yaml To Json Converter

+ {% csrf_token %}

@@ -34,4 +35,4 @@
Here is your output:

-{% endblock %} \ No newline at end of file +{% endblock %} From fd1aa75c27067ceb4d3fd228ecf9a0d49152980e Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 05/17] Patched introduction/templates/Lab/BrokenAuth/otp.html --- introduction/templates/Lab/BrokenAuth/otp.html | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/introduction/templates/Lab/BrokenAuth/otp.html b/introduction/templates/Lab/BrokenAuth/otp.html index 3d12cda..9676786 100644 --- a/introduction/templates/Lab/BrokenAuth/otp.html +++ b/introduction/templates/Lab/BrokenAuth/otp.html @@ -9,13 +9,12 @@
Login Through Otp

-
-
+ {% csrf_token %}

@@ -29,9 +28,6 @@

Your 3 Digit Verification Code:{{otp}}

{% if email %}

Login Successful as user : {{email}}

{% endif %} - - -
-{% endblock %} \ No newline at end of file +{% endblock %} From 4326b3c04d3f64dd09dc02eb91c1e0e413feb18b Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 06/17] Patched introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html --- .../A1_BrokenAccessControl/broken_access_lab_1.html | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html index 1fa4c91..18c4c67 100644 --- a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html +++ b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html @@ -9,12 +9,10 @@

Admins Have the Secretkey

- + {% csrf_token %}

- -
@@ -43,4 +41,4 @@

Please Provide Credentials

-{% endblock %} \ No newline at end of file +{% endblock %} From c3f4a223580f91dfebfc0f742505718d88f8f3b7 Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 07/17] Patched docker-compose.yml --- docker-compose.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 3d39f83..e061b14 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,6 +9,10 @@ services: - POSTGRES_DB=postgres - POSTGRES_USER=postgres - POSTGRES_PASSWORD=postgres + security_opt: + - no-new-privileges:true + read_only: true + web: build: . image: pygoat/pygoat @@ -20,6 +24,10 @@ services: depends_on: - migration - db + security_opt: + - no-new-privileges:true + read_only: true + migration: image: pygoat/pygoat command: python pygoat/manage.py migrate --noinput @@ -27,3 +35,6 @@ services: - .:/app depends_on: - db + security_opt: + - no-new-privileges:true + read_only: true From c6106cc5965dccd912a6a760650c90ba18b53ca4 Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 08/17] Patched introduction/playground/A9/archive.py --- introduction/playground/A9/archive.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/introduction/playground/A9/archive.py b/introduction/playground/A9/archive.py index c9db8fc..fe2b7e0 100644 --- a/introduction/playground/A9/archive.py +++ b/introduction/playground/A9/archive.py @@ -1,10 +1,8 @@ from django.http import JsonResponse -from django.views.decorators.csrf import csrf_exempt from .main import Log -@csrf_exempt def log_function_target(request): L = Log(request) if request.method == "GET": From 79b9c17be8ecc951064f5c66ed33ec2681a77cbd Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 09/17] Patched introduction/playground/A9/api.py --- introduction/playground/A9/api.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/introduction/playground/A9/api.py b/introduction/playground/A9/api.py index 35e1bd2..eae79e8 100644 --- a/introduction/playground/A9/api.py +++ b/introduction/playground/A9/api.py @@ -1,10 +1,6 @@ from django.http import JsonResponse -from django.views.decorators.csrf import csrf_exempt - from .main import Log - -@csrf_exempt def log_function_target(request): L = Log(request) if request.method == "GET": @@ -30,4 +26,4 @@ def log_function_target(request): return JsonResponse({"message":"success", "method":"patch"},status = 200) if request.method == "UPDATE": return JsonResponse({"message":"success", "method":"update"},status = 200) - return JsonResponse({"message":"method not allowed"},status = 403) \ No newline at end of file + return JsonResponse({"message":"method not allowed"},status = 403) From 444e95fda468ab91cfda1d5122399eb4d518173b Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 10/17] Patched introduction/apis.py --- introduction/apis.py | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/introduction/apis.py b/introduction/apis.py index 7926708..3ea45ec 100644 --- a/introduction/apis.py +++ b/introduction/apis.py @@ -12,14 +12,11 @@ from .utility import * from .views import authentication_decorator - - # steps --> # 1. covert input code to corrosponding code and write in file # 2. extract inputs form 2nd code # 3. Run the code # 4. get the result -@csrf_exempt def ssrf_code_checker(request): if request.user.is_authenticated: if request.method == 'POST': @@ -55,14 +52,15 @@ def ssrf_code_checker(request): # Insufficient Logging & Monitoring +from django.views.decorators.csrf import csrf_protect -@csrf_exempt +@csrf_protect # @authentication_decorator def log_function_checker(request): if request.method == 'POST': csrf_token = request.POST.get("csrfmiddlewaretoken") - log_code = request.POST.get('log_code') - api_code = request.POST.get('api_code') + log_code = sanitize_input(request.POST.get('log_code')) + api_code = sanitize_input(request.POST.get('api_code')) dirname = os.path.dirname(__file__) log_filename = os.path.join(dirname, "playground/A9/main.py") api_filename = os.path.join(dirname, "playground/A9/api.py") @@ -89,8 +87,11 @@ def log_function_checker(request): else: return JsonResponse({"message":"method not allowed"},status = 405) +def sanitize_input(data): + if data: + return data.replace('<', '<').replace('>', '>') + return data #a7 codechecking api -@csrf_exempt def A7_disscussion_api(request): if request.method != 'POST': return JsonResponse({"message":"method not allowed"},status = 405) @@ -107,9 +108,6 @@ def A7_disscussion_api(request): return JsonResponse({"message":"success"},status = 200) return JsonResponse({"message":"failure"},status = 400) - -#a6 codechecking api -@csrf_exempt def A6_disscussion_api(request): test_bench = ["Pillow==8.0.0","PyJWT==2.4.0","requests==2.28.0","Django==4.0.4"] @@ -121,18 +119,20 @@ def A6_disscussion_api(request): return JsonResponse({"message":"failure"},status = 400) except Exception as e: return JsonResponse({"message":"failure"},status = 400) +from django.views.decorators.csrf import csrf_protect +import html -@csrf_exempt +@csrf_protect def A6_disscussion_api_2(request): if request.method != 'POST': return JsonResponse({"message":"method not allowed"},status = 405) try: code = request.POST.get('code') + sanitized_code = html.escape(code) dirname = os.path.dirname(__file__) filename = os.path.join(dirname, "playground/A6/utility.py") - f = open(filename,"w") - f.write(code) - f.close() + with open(filename, "w") as f: + f.write(sanitized_code) except: return JsonResponse({"message":"missing code"},status = 400) - return JsonResponse({"message":"success"},status = 200) \ No newline at end of file + return JsonResponse({"message":"success"},status = 200) From 3d7a33656aeaf36bcd1ec849a7fc8405214d7c1d Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:29 +0800 Subject: [PATCH 11/17] Patched introduction/mitre.py --- introduction/mitre.py | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/introduction/mitre.py b/introduction/mitre.py index c899c21..3ac74fc 100644 --- a/introduction/mitre.py +++ b/introduction/mitre.py @@ -150,6 +150,9 @@ def mitre_top24(request): def mitre_top25(request): if request.method == 'GET': return render(request, 'mitre/mitre_top25.html') +import os +from hashlib import scrypt +from base64 import urlsafe_b64encode @authentication_decorator def csrf_lab_login(request): @@ -158,23 +161,23 @@ def csrf_lab_login(request): elif request.method == 'POST': password = request.POST.get('password') username = request.POST.get('username') - password = md5(password.encode()).hexdigest() + salt = b'some_salt' # Ideally, use a unique salt for each password and store it securely with the password hash. + password = urlsafe_b64encode(scrypt(password.encode(), salt=salt, n=16384, r=8, p=1, maxmem=0, dklen=32)) User = CSRF_user_tbl.objects.filter(username=username, password=password) if User: - payload ={ + payload = { 'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=300), 'iat': datetime.datetime.utcnow() } - cookie = jwt.encode(payload, 'csrf_vulneribility', algorithm='HS256') + jwt_secret = os.getenv('JWT_SECRET') + cookie = jwt.encode(payload, jwt_secret, algorithm='HS256') response = redirect("/mitre/9/lab/transaction") - response.set_cookie('auth_cookiee', cookie) + response.set_cookie('auth_cookiee', cookie, secure=True, httponly=True, samesite='Lax') return response - else : + else: return redirect('/mitre/9/lab/login') - @authentication_decorator -@csrf_exempt def csrf_transfer_monei(request): if request.method == 'GET': try: @@ -188,6 +191,7 @@ def csrf_transfer_monei(request): except: return redirect('/mitre/9/lab/login') + def csrf_transfer_monei_api(request,recipent,amount): if request.method == "GET": cookie = request.COOKIES['auth_cookiee'] @@ -211,16 +215,20 @@ def csrf_transfer_monei_api(request,recipent,amount): # @authentication_decorator -@csrf_exempt def mitre_lab_25_api(request): if request.method == "POST": - expression = request.POST.get('expression') - result = eval(expression) - return JsonResponse({'result': result}) + try: + import ast + expression = request.POST.get('expression') + result = ast.literal_eval(expression) + return JsonResponse({'result': result}) + except (ValueError, SyntaxError): + return JsonResponse({'error': 'Invalid expression'}, status=400) else: return redirect('/mitre/25/lab/') + @authentication_decorator def mitre_lab_25(request): return render(request, 'mitre/mitre_lab_25.html') @@ -228,13 +236,11 @@ def mitre_lab_25(request): @authentication_decorator def mitre_lab_17(request): return render(request, 'mitre/mitre_lab_17.html') +import subprocess def command_out(command): - process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE) return process.communicate() - - -@csrf_exempt def mitre_lab_17_api(request): if request.method == "POST": ip = request.POST.get('ip') @@ -244,4 +250,4 @@ def mitre_lab_17_api(request): err = err.decode() pattern = "STATE SERVICE.*\\n\\n" ports = re.findall(pattern, res,re.DOTALL)[0][14:-2].split('\n') - return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports}) \ No newline at end of file + return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports}) From b1cd62057621dbb42b76df772d8237ecb3c562f0 Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:30 +0800 Subject: [PATCH 12/17] Patched introduction/templates/Lab/CMD/cmd_lab.html --- introduction/templates/Lab/CMD/cmd_lab.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/introduction/templates/Lab/CMD/cmd_lab.html b/introduction/templates/Lab/CMD/cmd_lab.html index 2998cd3..6175ff5 100644 --- a/introduction/templates/Lab/CMD/cmd_lab.html +++ b/introduction/templates/Lab/CMD/cmd_lab.html @@ -7,6 +7,7 @@

Name Server Lookup

+ {% csrf_token %}

@@ -33,4 +34,4 @@
Output

-{% endblock %} \ No newline at end of file +{% endblock %} From 5e28554a5b846e764cae5c517e5085f3e79eadca Mon Sep 17 00:00:00 2001 From: "patched.codes[bot]" <298395+patched.codes[bot]@users.noreply.github.com> Date: Tue, 28 May 2024 12:12:30 +0800 Subject: [PATCH 13/17] Patched introduction/templates/Lab/ssrf/ssrf_discussion.html --- introduction/templates/Lab/ssrf/ssrf_discussion.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/introduction/templates/Lab/ssrf/ssrf_discussion.html b/introduction/templates/Lab/ssrf/ssrf_discussion.html index 7dc6678..2eb5868 100644 --- a/introduction/templates/Lab/ssrf/ssrf_discussion.html +++ b/introduction/templates/Lab/ssrf/ssrf_discussion.html @@ -123,22 +123,22 @@
ssrf_lab.html