From 117443d1e86782a6ad690ee68827d8d14fe415b6 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 01/17] Patched
 introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html

---
 .../Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html
index 1fa4c91..e7dc04e 100644
--- a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html
+++ b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html
@@ -9,7 +9,7 @@
     <h4 style="text-align:center"> Admins Have the Secretkey</h4>
     <div class="login">
         <form method="post" action="/broken_access_lab_1">
-
+            {% csrf_token %}
             <input id="input" type="text" name="name" placeholder="User Name"><br>
             <input id="input" type="password" name="pass" placeholder="Password"><br>
             <button style="margin-top:20px" class="btn btn-info" type="submit"> Log in</button>
@@ -43,4 +43,4 @@ <h2>Please Provide Credentials</h2>
 
 </p>
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From ce31b11c7a2e5a7bbebd7735b95751b2cd39c454 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 02/17] Patched
 introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html

---
 .../Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html
index cce8b6e..c1aafed 100644
--- a/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html
+++ b/introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html
@@ -9,7 +9,7 @@
     <h4 style="text-align:center"> Can you log in as an admin and get the secretkey?</h4>
     <div class="login">
         <form method="post" action="/broken_access_lab_2">
-
+        {% csrf_token %}
             <input id="input" type="text" name="name" placeholder="User Name"><br>
             <input id="input" type="password" name="pass" placeholder="Password"><br>
             <button style="margin-top:20px" class="btn btn-info" type="submit"> Log in</button>
@@ -50,4 +50,4 @@ <h2>Please Provide Credentials</h2>
 <!--Admins don't use Browsers like Google Chrome or Firefox etc-->
 <!--Admins only use pygoat_admin browser-->
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From 48c28d350296d4f2aea4e1b0352f54208b5f03cf Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 03/17] Patched introduction/views.py

---
 introduction/views.py | 108 +++++++++++++++++++-----------------------
 1 file changed, 50 insertions(+), 58 deletions(-)

diff --git a/introduction/views.py b/introduction/views.py
index 0f550c4..709fd03 100644
--- a/introduction/views.py
+++ b/introduction/views.py
@@ -142,7 +142,6 @@ def sql(request):
         return  render(request,'Lab/SQL/sql.html')
     else:
         return redirect('login')
-
 def sql_lab(request):
     if request.user.is_authenticated:
 
@@ -154,11 +153,8 @@ def sql_lab(request):
 
             if login.objects.filter(user=name):
 
-                sql_query = "SELECT * FROM introduction_login WHERE user='"+name+"'AND password='"+password+"'"
-                print(sql_query)
                 try:
-                    print("\nin try\n")
-                    val=login.objects.raw(sql_query)
+                    val = login.objects.filter(user=name, password=password)
                 except:
                     print("\nin except\n")
                     return render(
@@ -187,6 +183,7 @@ def sql_lab(request):
     else:
         return redirect('login')
 
+
 #***************** INSECURE DESERIALIZATION***************************************************************#
 
 def insec_des(request):
@@ -198,9 +195,9 @@ def insec_des(request):
 @dataclass
 class TestUser:
     admin: int = 0
+
 pickled_user = pickle.dumps(TestUser())
 encoded_user = base64.b64encode(pickled_user)
-
 def insec_des_lab(request):
     if request.user.is_authenticated:
         response = render(request,'Lab/insec_des/insec_des_lab.html', {"message":"Only Admins can see this page"})
@@ -209,9 +206,14 @@ def insec_des_lab(request):
             token = encoded_user
             response.set_cookie(key='token',value=token.decode('utf-8'))
         else:
-            token = base64.b64decode(token)
-            admin = pickle.loads(token)
-            if admin.admin == 1:
+            # token = base64.b64decode(token)
+            # admin = pickle.loads(token)
+            # if admin.admin == 1:
+            #     response = render(request,'Lab/insec_des/insec_des_lab.html', {"message":"Welcome Admin, SECRETKEY:ADMIN123"})
+            #     return response
+            # Securely handle user information here, e.g., using a secure hash function
+            # ...
+            if is_admin(token): # Implement a secure check to verify admin status
                 response = render(request,'Lab/insec_des/insec_des_lab.html', {"message":"Welcome Admin, SECRETKEY:ADMIN123"})
                 return response
 
@@ -219,6 +221,7 @@ def insec_des_lab(request):
     else:
         return redirect('login')
 
+
 #****************************************************XXE********************************************************#
 
 
@@ -234,8 +237,6 @@ def xxe_lab(request):
         return render(request,'Lab/XXE/xxe_lab.html')
     else:
         return redirect('login')
-
-@csrf_exempt
 def xxe_see(request):
     if request.user.is_authenticated:
 
@@ -245,8 +246,6 @@ def xxe_see(request):
     else:
         return redirect('login')
 
-
-@csrf_exempt
 def xxe_parse(request):
 
     parser = make_parser()
@@ -263,6 +262,7 @@ def xxe_parse(request):
 
     return render(request, 'Lab/XXE/xxe_lab.html')
 
+
 def auth_home(request):
     return render(request,'Lab/AUTH/auth_home.html')
 
@@ -289,14 +289,12 @@ def auth_lab_signup(request):
                 render(request,'Lab/AUTH/auth_lab_signup.html',{'err_msg':'Cookie cannot be set'})
         except:
             return render(request,'Lab/AUTH/auth_lab_signup.html',{'err_msg':'Username already exists'})
-
 def auth_lab_login(request):
     if request.method == 'GET':
         try:
             obj = authLogin.objects.filter(userid=request.COOKIES['userid'])[0]
-            rendered = render_to_string('Lab/AUTH/auth_success.html', {'username': obj.username,'userid':obj.userid,'name':obj.name, 'err_msg':'Login Successful'})
-            response = HttpResponse(rendered)
-            response.set_cookie('userid', obj.userid, max_age=31449600, samesite=None, secure=False)
+            response = render(request, 'Lab/AUTH/auth_success.html', {'username': obj.username,'userid':obj.userid,'name':obj.name, 'err_msg':'Login Successful'})
+            response.set_cookie('userid', obj.userid, max_age=31449600, samesite='Lax', secure=True, httponly=True)
             print('Login successful')
             return response
         except:
@@ -308,30 +306,29 @@ def auth_lab_login(request):
             print(user_name,passwd)
             obj = authLogin.objects.filter(username=user_name,password=passwd)[0]
             try:
-                rendered = render_to_string('Lab/AUTH/auth_success.html', {'username': obj.username,'userid':obj.userid,'name':obj.name, 'err_msg':'Login Successful'})
-                response = HttpResponse(rendered)
-                response.set_cookie('userid', obj.userid, max_age=31449600, samesite=None, secure=False)
+                response = render(request, 'Lab/AUTH/auth_success.html', {'username': obj.username,'userid':obj.userid,'name':obj.name, 'err_msg':'Login Successful'})
+                response.set_cookie('userid', obj.userid, max_age=31449600, samesite='Lax', secure=True, httponly=True)
                 print('Login successful')
                 return response
             except:
-                render(request,'Lab/AUTH/auth_lab_login.html',{'err_msg':'Cookie cannot be set'})
+                return render(request,'Lab/AUTH/auth_lab_login.html',{'err_msg':'Cookie cannot be set'})
         except:
             return render(request,'Lab/AUTH/auth_lab_login.html',{'err_msg':'Check your credentials'})
 
+
 def auth_lab_logout(request):
     rendered = render_to_string('Lab/AUTH/auth_lab.html',context={'err_msg':'Logout successful'})
     response = HttpResponse(rendered)    
     response.delete_cookie('userid')
     return response
-
 #***************************************************************Broken Access Control************************************************************#
 
-@csrf_exempt
 def ba(request):
     if request.user.is_authenticated:
         return render(request,"Lab/BrokenAccess/ba.html")
     else:
         return redirect('login')
+
 @csrf_exempt
 def ba_lab(request):
     if request.user.is_authenticated:
@@ -562,8 +559,6 @@ def a9_lab(request):
         return redirect('login')
 def get_version(request):
       return render(request,"Lab/A9/a9_lab.html",{"version":"pyyaml v5.1"})
-
-@csrf_exempt
 def a9_lab2(request):
     if not request.user.is_authenticated:
         return redirect('login')
@@ -598,6 +593,7 @@ def a9_lab2(request):
             return render(request, "Lab/A9/a9_lab2.html", {"data":"Please Upload a file", "error":True})
 
 
+
 @authentication_decorator
 def A9_discussion(request):
     return render(request, "playground/A9/index.html")
@@ -721,22 +717,17 @@ def insec_desgine_lab(request):
             pass
     else:
         return redirect('login')
-
-
 #-------------------------------------------------------------------------------------------------------------------------
 #-------------------------------------------------------------------------------------------------------------------------
 
 ###################################################### 2021 A1: Broken Access
 
-@csrf_exempt
 def a1_broken_access(request):
     if not request.user.is_authenticated:
         return redirect('login')
     
     return render(request,"Lab_2021/A1_BrokenAccessControl/broken_access.html")
 
-
-@csrf_exempt
 def a1_broken_access_lab_1(request):
     if request.user.is_authenticated:
         pass
@@ -772,7 +763,6 @@ def a1_broken_access_lab_1(request):
     else:
         return render(request,'Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html',{"no_creds":True})
 
-@csrf_exempt
 def a1_broken_access_lab_2(request):
     if request.user.is_authenticated:
         pass
@@ -812,6 +802,7 @@ def a1_broken_access_lab_2(request):
     else:
         return render(request,'Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html',{"no_creds":True})
 
+
 def a1_broken_access_lab_3(request):
     if not request.user.is_authenticated:
         return redirect('login')
@@ -832,19 +823,14 @@ def a1_broken_access_lab3_secret(request):
         return redirect('login')
     # no checking applied here
     return render(request, 'Lab_2021/A1_BrokenAccessControl/secret.html')
-
-
 ###################################################### 2021 A3: Injection
 
-@csrf_exempt
 def injection(request):
     if not request.user.is_authenticated:
         return redirect('login')
     
     return render(request,"Lab_2021/A3_Injection/injection.html")
 
-
-@csrf_exempt
 def injection_sql_lab(request):
     if request.user.is_authenticated:
 
@@ -854,7 +840,7 @@ def injection_sql_lab(request):
         print(password)
 
         if name:
-            sql_query = "SELECT * FROM introduction_sql_lab_table WHERE id='"+name+"'AND password='"+password+"'"
+            # sql_query = "SELECT * FROM introduction_sql_lab_table WHERE id='"+name+"'AND password='"+password+"'"
 
             sql_instance = sql_lab_table(id="admin", password="65079b006e85a7e798abecb99e47c154")
             sql_instance.save()
@@ -865,11 +851,12 @@ def injection_sql_lab(request):
             sql_instance = sql_lab_table(id="bloke", password="f8d1ce191319ea8f4d1d26e65e130dd5")
             sql_instance.save()
 
-            print(sql_query)
+            # print(sql_query)
 
             try:
-                user = sql_lab_table.objects.raw(sql_query)
-                user = user[0].id
+                # user = sql_lab_table.objects.raw(sql_query)
+                user = sql_lab_table.objects.get(id=name, password=password)
+                user = user.id
                 print(user)
 
             except:
@@ -897,6 +884,7 @@ def injection_sql_lab(request):
         return redirect('login')
 
 
+
 ##----------------------------------------------------------------------------------------------------------
 ##----------------------------------------------------------------------------------------------------------
 
@@ -907,7 +895,6 @@ def ssrf(request):
         return render(request,"Lab/ssrf/ssrf.html")
     else:
         return redirect('login')
-
 def ssrf_lab(request):
     if request.user.is_authenticated:
         if request.method=="GET":
@@ -917,6 +904,7 @@ def ssrf_lab(request):
             try :
                 dirname = os.path.dirname(__file__)
                 filename = os.path.join(dirname, file)
+                filename = os.path.abspath(filename)
                 file = open(filename,"r")
                 data = file.read()
                 return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":data})
@@ -925,6 +913,7 @@ def ssrf_lab(request):
     else:
         return redirect('login')
 
+
 def ssrf_discussion(request):
     if request.user.is_authenticated:
         return render(request,"Lab/ssrf/ssrf_discussion.html")
@@ -944,7 +933,6 @@ def ssrf_target(request):
         return render(request,"Lab/ssrf/ssrf_target.html")
     else:
         return render(request,"Lab/ssrf/ssrf_target.html",{"access_denied":True})
-
 @authentication_decorator
 def ssrf_lab2(request):
     if request.method == "GET":
@@ -952,10 +940,15 @@ def ssrf_lab2(request):
 
     elif request.method == "POST":
         url = request.POST["url"]
-        try:
-            response = requests.get(url)
-            return render(request, "Lab/ssrf/ssrf_lab2.html", {"response": response.content.decode()})
-        except:
+        allowed_schemes = ["http", "https"]
+        allowed_hosts = ["example.com"]
+        if url.split("://")[0] in allowed_schemes and url.split("://")[1].split("/")[0] in allowed_hosts:
+            try:
+                response = requests.get(url, verify=True, auth=("user", "password"))
+                return render(request, "Lab/ssrf/ssrf_lab2.html", {"response": response.content.decode()})
+            except:
+                return render(request, "Lab/ssrf/ssrf_lab2.html", {"error": "Invalid URL"})
+        else:
             return render(request, "Lab/ssrf/ssrf_lab2.html", {"error": "Invalid URL"})
 #--------------------------------------- Server-side template injection --------------------------------------#
 
@@ -964,7 +957,6 @@ def ssti(request):
         return render(request,"Lab_2021/A3_Injection/ssti.html")
     else:
         return redirect('login')
-
 def ssti_lab(request):
     if request.user.is_authenticated:
         if request.method=="GET":
@@ -986,13 +978,14 @@ def ssti_lab(request):
             dirname = os.path.dirname(__file__)
             filename = os.path.join(dirname, f"templates/Lab_2021/A3_Injection/Blogs/{id}.html")
             file = open(filename, "w+") 
-            file.write(blog)
+            file.write(escape(blog))
             file.close()
             return redirect(f'blog/{id}')
     else:
         return redirect('login')
 
 
+
 def ssti_view_blog(request,blog_id):
     if request.user.is_authenticated:
         if request.method=="GET":
@@ -1007,7 +1000,7 @@ def crypto_failure(request):
         return render(request,"Lab_2021/A2_Crypto_failur/crypto_failure.html",{"success":False,"failure":False})
     else:
         redirect('login')
-
+import hashlib
 def crypto_failure_lab(request):
     if request.user.is_authenticated:
         if request.method=="GET":
@@ -1016,7 +1009,7 @@ def crypto_failure_lab(request):
             username = request.POST["username"]
             password = request.POST["password"]
             try:
-                password = md5(password.encode()).hexdigest()
+                password = hashlib.scrypt(password.encode(), salt=b'your_salt', n=2**14, r=8, p=1).hex()
                 user = CF_user.objects.get(username=username,password=password)
                 return render(request,"Lab_2021/A2_Crypto_failur/crypto_failure_lab.html",{"user":user, "success":True,"failure":False})
             except:
@@ -1024,6 +1017,7 @@ def crypto_failure_lab(request):
     else :
         return redirect('login')
 
+
 def crypto_failure_lab2(request):
     if request.user.is_authenticated:
         if request.method == "GET":
@@ -1037,7 +1031,6 @@ def crypto_failure_lab2(request):
                 return render(request,"Lab_2021/A2_Crypto_failur/crypto_failure_lab2.html",{"user":user, "success":True,"failure":False})
             except:
                 return render(request,"Lab_2021/A2_Crypto_failur/crypto_failure_lab2.html",{"success":False, "failure":True})
-
 # based on CWE-319
 def crypto_failure_lab3(request):
     if request.user.is_authenticated:
@@ -1066,7 +1059,7 @@ def crypto_failure_lab3(request):
                     expire = datetime.datetime.now() + datetime.timedelta(minutes=60)
                     cookie = f"{username}|{expire}"
                     response = render(request,"Lab_2021/A2_Crypto_failur/crypto_failure_lab3.html",{"success":True, "failure":False , "admin":False})
-                    response.set_cookie("cookie", cookie)
+                    response.set_cookie("cookie", cookie, secure=True, httponly=True, samesite='Lax')
                     response.status_code = 200
                     return response
                 else:
@@ -1076,10 +1069,9 @@ def crypto_failure_lab3(request):
             except:
                 return render(request,"Lab_2021/A2_Crypto_failur/crypto_failure_lab2.html",{"success":False, "failure":True})
 
+
 #-----------------------------------------------SECURITY MISCONFIGURATION -------------------
 from pygoat.settings import SECRET_COOKIE_KEY
-
-
 def sec_misconfig_lab3(request):
     if not request.user.is_authenticated:
         return redirect('login')
@@ -1099,9 +1091,10 @@ def sec_misconfig_lab3(request):
 
         cookie = jwt.encode(payload, SECRET_COOKIE_KEY, algorithm='HS256')
         response = render(request,"Lab/sec_mis/sec_mis_lab3.html", {"admin":False} )
-        response.set_cookie(key = "auth_cookie", value = cookie)
+        response.set_cookie(key = "auth_cookie", value = cookie, secure=True, httponly=True, samesite='Lax')
         return response
 
+
 # - ------------------------Identification and Authentication Failures--------------------------------
 @authentication_decorator
 def auth_failure(request):    
@@ -1159,7 +1152,6 @@ def auth_failure_lab2(request):
     "User3":{"userid":"3", "username":"User3", "password": "5a91a66f0c86b5435fe748706b99c17e6e54a17e03c2a3ef8d0dfa918db41cf6"},
     "User4":{"userid":"4", "username":"User4", "password": "6046bc3337728a60967a151ee584e4fd7c53740a49485ebdc38cac42a255f266"}
 }
-
 # USER_A7_LAB3 = {
 #     "User1":{"userid":"1", "username":"User1", "password": "Hash1"},
 #     "User2":{"userid":"2", "username":"User2", "password": "Hash2"},
@@ -1168,7 +1160,6 @@ def auth_failure_lab2(request):
 # }
 
 @authentication_decorator
-@csrf_exempt
 def auth_failure_lab3(request):
     if request.method == "GET":
         try:
@@ -1194,9 +1185,10 @@ def auth_failure_lab3(request):
             session_data = AF_session_id.objects.create(session_id=token, user=USER_A7_LAB3[username]['username'])
             session_data.save()
             response = render(request, "Lab_2021/A7_auth_failure/lab3.html", {"success":True, "failure":False, "username":username})
-            response.set_cookie("session_id", token)
+            response.set_cookie("session_id", token, secure=True, httponly=True, samesite='Lax')
             return response
 
+
 #-- coding playground for lab2
 @authentication_decorator
 def A7_discussion(request):

From b66df994780f01f292262f5f011dfc7876ecf6a2 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 04/17] Patched introduction/mitre.py

---
 introduction/mitre.py | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/introduction/mitre.py b/introduction/mitre.py
index c899c21..3a830c8 100644
--- a/introduction/mitre.py
+++ b/introduction/mitre.py
@@ -150,7 +150,6 @@ def mitre_top24(request):
 def mitre_top25(request):
     if request.method == 'GET':
         return render(request, 'mitre/mitre_top25.html')
-
 @authentication_decorator
 def csrf_lab_login(request):
     if request.method == 'GET':
@@ -158,7 +157,7 @@ def csrf_lab_login(request):
     elif request.method == 'POST':
         password = request.POST.get('password')
         username = request.POST.get('username')
-        password = md5(password.encode()).hexdigest()
+        password = hashlib.scrypt(password.encode(), salt=os.environ.get('SALT').encode(), n=16384, r=8, p=1).hex()
         User = CSRF_user_tbl.objects.filter(username=username, password=password)
         if User:
             payload ={
@@ -166,15 +165,14 @@ def csrf_lab_login(request):
                 'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=300),
                 'iat': datetime.datetime.utcnow()
             }
-            cookie = jwt.encode(payload, 'csrf_vulneribility', algorithm='HS256')
+            cookie = jwt.encode(payload, os.environ.get('JWT_SECRET'), algorithm='HS256')
             response = redirect("/mitre/9/lab/transaction")
-            response.set_cookie('auth_cookiee', cookie)
+            response.set_cookie('auth_cookiee', cookie, secure=True, httponly=True, samesite='Lax')
             return response
         else :
             return redirect('/mitre/9/lab/login')
 
 @authentication_decorator
-@csrf_exempt
 def csrf_transfer_monei(request):
     if request.method == 'GET':
         try:
@@ -188,6 +186,7 @@ def csrf_transfer_monei(request):
         except:
             return redirect('/mitre/9/lab/login')
 
+
 def csrf_transfer_monei_api(request,recipent,amount):
     if request.method == "GET":
         cookie = request.COOKIES['auth_cookiee']
@@ -208,19 +207,20 @@ def csrf_transfer_monei_api(request,recipent,amount):
         return redirect('/mitre/9/lab/transaction') 
     else:
         return redirect ('/mitre/9/lab/transaction')
-
-
 # @authentication_decorator
-@csrf_exempt
 def mitre_lab_25_api(request):
     if request.method == "POST":
         expression = request.POST.get('expression')
-        result = eval(expression)
+        try:
+            result = ast.literal_eval(expression)
+        except (SyntaxError, ValueError):
+            return JsonResponse({'error': 'Invalid expression'}, status=400)
         return JsonResponse({'result': result})
     else:
         return redirect('/mitre/25/lab/')
 
 
+
 @authentication_decorator
 def mitre_lab_25(request):
     return render(request, 'mitre/mitre_lab_25.html')
@@ -228,13 +228,11 @@ def mitre_lab_25(request):
 @authentication_decorator
 def mitre_lab_17(request):
     return render(request, 'mitre/mitre_lab_17.html')
-
 def command_out(command):
-    process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    process = subprocess.Popen(command, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
     return process.communicate()
     
 
-@csrf_exempt
 def mitre_lab_17_api(request):
     if request.method == "POST":
         ip = request.POST.get('ip')
@@ -244,4 +242,4 @@ def mitre_lab_17_api(request):
         err = err.decode()
         pattern = "STATE SERVICE.*\\n\\n"
         ports = re.findall(pattern, res,re.DOTALL)[0][14:-2].split('\n')
-        return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports})
\ No newline at end of file
+        return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports})

From 2dfeb8ad3f383c12e2f6c27359c00a4ccefaeda6 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 05/17] Patched introduction/templates/Lab/A9/a9_lab2.html

---
 introduction/templates/Lab/A9/a9_lab2.html | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/A9/a9_lab2.html b/introduction/templates/Lab/A9/a9_lab2.html
index cace076..6912a21 100644
--- a/introduction/templates/Lab/A9/a9_lab2.html
+++ b/introduction/templates/Lab/A9/a9_lab2.html
@@ -19,11 +19,13 @@ <h4>Some Example</h4>
     </ul>
     
     <form enctype="multipart/form-data" id="a9_form2" method="POST" style="display: flex;flex-direction: column;align-items: center;margin-bottom: 50px;">
+        {% csrf_token %}
         <input type="file" name="file" id="a9_file" />
         <input type="text" name="function" id="a9_function" placeholder="function"/>
         <button type="submit" id="a9_submit" >Submit</button>
     </form><br><br>
 
+
     {% if success %}
     <div id="img_container" style="margin-bottom : 50px">
         <img src='data:image/jpeg;base64,{{img_str_ref}}' style="width: 48%"/>
@@ -88,7 +90,11 @@ <h4>Some Example</h4>
         form.submit();
     }
     {% if error %}
-    alert("{{ data }}");
+    <div id="data">{{ data }}</div>
+    <script>
+        alert(document.getElementById("data").textContent);
+    </script>
+
     {% endif %}
 
 </script>

From a0dd6e3deb378989f24ac7370bd7c2d98a84db9c Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 06/17] Patched introduction/static/js/a9.js

---
 introduction/static/js/a9.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/introduction/static/js/a9.js b/introduction/static/js/a9.js
index 9c58b8a..738109d 100644
--- a/introduction/static/js/a9.js
+++ b/introduction/static/js/a9.js
@@ -37,9 +37,9 @@ event3 = function(){
         document.getElementById("a9_d3").style.display = 'flex';
         for (var i = 0; i < data.logs.length; i++) {
             var li = document.createElement("li");
-            li.innerHTML = data.logs[i];
+            li.textContent = data.logs[i];
             document.getElementById("a9_d3").appendChild(li);
         }
     })
     .catch(error => console.log('error', error));
-    }
\ No newline at end of file
+    }

From d42be73160e83ff9f79d0c66276cebcf70c42b63 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 07/17] Patched introduction/templates/Lab/BrokenAuth/otp.html

---
 introduction/templates/Lab/BrokenAuth/otp.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/BrokenAuth/otp.html b/introduction/templates/Lab/BrokenAuth/otp.html
index 3d12cda..31c4158 100644
--- a/introduction/templates/Lab/BrokenAuth/otp.html
+++ b/introduction/templates/Lab/BrokenAuth/otp.html
@@ -16,6 +16,7 @@ <h5 align="center">Login Through Otp</h5><br>
 </div>
 <div class="container">
     <form method="post" action="/otp">
+        {% csrf_token %}
         <label for='enter'>Enter Your OTP:</label>
         <input id="enter" type="number" maxlength="3" name="otp"><br><br>
         <button class="btn btn-info" type="submit">Log in</button>
@@ -34,4 +35,4 @@ <h3 align="center">Login Successful as user : <code>{{email}}</code></h3>
 
 </div>
 <!-- In case any issue with the code please mail the administrator through this mail id : "admin@pygoat.com" -->
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From 0ac5a7fa734d0975f7918916715503610da4990e Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 08/17] Patched introduction/templates/Lab/CMD/cmd_lab.html

---
 introduction/templates/Lab/CMD/cmd_lab.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/CMD/cmd_lab.html b/introduction/templates/Lab/CMD/cmd_lab.html
index 2998cd3..6175ff5 100644
--- a/introduction/templates/Lab/CMD/cmd_lab.html
+++ b/introduction/templates/Lab/CMD/cmd_lab.html
@@ -7,6 +7,7 @@
     <div class="container">
         <h3 align="center">Name Server Lookup </h3>
         <form method="post" action="/cmd_lab">
+            {% csrf_token %}
             <input type="text" name="domain" placeholder="Enter Domain Here"><br><br>
             <input type="radio" id="linux" name="os" value="linux">
             <label for="linux">Linux</label>
@@ -33,4 +34,4 @@ <h6><b>Output</b></h6><br>
 </p>
 
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From 64d4144b692c42511d79949624600817e3004b6c Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 09/17] Patched
 introduction/templates/Lab/ssrf/ssrf_discussion.html

---
 introduction/templates/Lab/ssrf/ssrf_discussion.html | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/introduction/templates/Lab/ssrf/ssrf_discussion.html b/introduction/templates/Lab/ssrf/ssrf_discussion.html
index 7dc6678..5b9dc25 100644
--- a/introduction/templates/Lab/ssrf/ssrf_discussion.html
+++ b/introduction/templates/Lab/ssrf/ssrf_discussion.html
@@ -123,25 +123,29 @@ <h6>ssrf_lab.html</h6>
                     <textarea id="html">
 <div style="display:flex;flex-direction:row;align-items:center;margin:15px">
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog1.txt">
         <button type="submit" class="btn btn-info"> Blog1 </button>
     </form>
+
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog2.txt">
         <button type="submit" class="btn btn-info"> Blog2 </button>
     </form>
+
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog3.txt">
         <button type="submit" class="btn btn-info"> Blog3 </button>
     </form>
+
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog4.txt">
         <button type="submit" class="btn btn-info"> Blog4 </button>
     </form>
+
 </div></textarea> 
                 </div>
             </div>

From a889dae9f377049ac021bb5a4c344f5d44c3f155 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:48 +0800
Subject: [PATCH 10/17] Patched
 introduction/templates/Lab/BrokenAccess/ba_lab.html

---
 introduction/templates/Lab/BrokenAccess/ba_lab.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/introduction/templates/Lab/BrokenAccess/ba_lab.html b/introduction/templates/Lab/BrokenAccess/ba_lab.html
index d45da9b..5248d56 100644
--- a/introduction/templates/Lab/BrokenAccess/ba_lab.html
+++ b/introduction/templates/Lab/BrokenAccess/ba_lab.html
@@ -9,7 +9,7 @@
     <h4 style="text-align:center"> Admins Have the Secretkey</h4>
     <div class="login">
         <form method="post" action="/ba_lab">
-
+        {% csrf_token %}
             <input id="input" type="text" name="name" placeholder="User Name"><br>
             <input id="input" type="password" name="pass" placeholder="Password"><br>
             <button style="margin-top:20px" class="btn btn-info" type="submit"> Log in</button>
@@ -43,4 +43,4 @@ <h2>Please Provide Credentials</h2>
 
 </p>
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From fc414c68823d457ab8353251b524943d4a7a066a Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 11/17] Patched introduction/templates/Lab/CMD/cmd_lab2.html

---
 introduction/templates/Lab/CMD/cmd_lab2.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/CMD/cmd_lab2.html b/introduction/templates/Lab/CMD/cmd_lab2.html
index a71a605..7319130 100644
--- a/introduction/templates/Lab/CMD/cmd_lab2.html
+++ b/introduction/templates/Lab/CMD/cmd_lab2.html
@@ -7,6 +7,7 @@
     <div class="container">
         <h3 align="center">Evaluate any expression!</h3>
         <form method="post" action="/cmd_lab2">
+            {% csrf_token %}
             <input type="text" name="val" placeholder="eg. 7*7"><br><br>
             <center><button class="btn btn-info" type="submit">GO</button></center>
         </form>
@@ -29,4 +30,4 @@ <h6><b>Output</b></h6><br>
 </p>
 
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From d55f3c934babf927645a51d0056abab806dbc178 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 12/17] Patched introduction/apis.py

---
 introduction/apis.py | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/introduction/apis.py b/introduction/apis.py
index 7926708..a3b90e6 100644
--- a/introduction/apis.py
+++ b/introduction/apis.py
@@ -12,14 +12,6 @@
 
 from .utility import *
 from .views import authentication_decorator
-
-
-# steps --> 
-# 1. covert input code to corrosponding code and write in file
-# 2. extract inputs form 2nd code 
-# 3. Run the code 
-# 4. get the result
-@csrf_exempt
 def ssrf_code_checker(request):
     if request.user.is_authenticated:
         if request.method == 'POST':
@@ -55,8 +47,6 @@ def ssrf_code_checker(request):
 
 # Insufficient Logging & Monitoring
 
-
-@csrf_exempt
 # @authentication_decorator
 def log_function_checker(request):
     if request.method == 'POST':
@@ -67,10 +57,10 @@ def log_function_checker(request):
         log_filename = os.path.join(dirname, "playground/A9/main.py")
         api_filename = os.path.join(dirname, "playground/A9/api.py")
         f = open(log_filename,"w")
-        f.write(log_code)
+        f.write(escape(log_code))
         f.close()
         f = open(api_filename,"w")
-        f.write(api_code)
+        f.write(escape(api_code))
         f.close()
         # Clearing the log file before starting the test
         f = open('test.log', 'w')
@@ -90,7 +80,6 @@ def log_function_checker(request):
         return JsonResponse({"message":"method not allowed"},status = 405)
 
 #a7 codechecking api
-@csrf_exempt
 def A7_disscussion_api(request):
     if request.method != 'POST':
         return JsonResponse({"message":"method not allowed"},status = 405)
@@ -109,7 +98,6 @@ def A7_disscussion_api(request):
     return JsonResponse({"message":"failure"},status = 400)
 
 #a6 codechecking api
-@csrf_exempt
 def A6_disscussion_api(request):
     test_bench = ["Pillow==8.0.0","PyJWT==2.4.0","requests==2.28.0","Django==4.0.4"]
     
@@ -122,7 +110,6 @@ def A6_disscussion_api(request):
     except Exception as e:
         return JsonResponse({"message":"failure"},status = 400)
 
-@csrf_exempt
 def A6_disscussion_api_2(request):
     if request.method != 'POST':
         return JsonResponse({"message":"method not allowed"},status = 405)
@@ -131,8 +118,8 @@ def A6_disscussion_api_2(request):
         dirname = os.path.dirname(__file__)
         filename = os.path.join(dirname, "playground/A6/utility.py")
         f = open(filename,"w")
-        f.write(code)
+        f.write(escape(code))
         f.close()
     except:
         return JsonResponse({"message":"missing code"},status = 400)
-    return JsonResponse({"message":"success"},status = 200)
\ No newline at end of file
+    return JsonResponse({"message":"success"},status = 200)

From f60c23e3864bf93207910a86fde183de9c320345 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 13/17] Patched introduction/templates/Lab/A9/a9_lab.html

---
 introduction/templates/Lab/A9/a9_lab.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/A9/a9_lab.html b/introduction/templates/Lab/A9/a9_lab.html
index 5a70b46..7145c34 100644
--- a/introduction/templates/Lab/A9/a9_lab.html
+++ b/introduction/templates/Lab/A9/a9_lab.html
@@ -8,6 +8,7 @@
 <div class="jumbotron">
     <h4 style="text-align:center"> Yaml To Json Converter</h4>
     <form enctype="multipart/form-data" method="post" action="/a9_lab">
+        {% csrf_token %}
         <input type="file" name="file"><br>
         <br>
         <button class="btn btn-info" type="submit">Upload</button>
@@ -34,4 +35,4 @@ <h5>Here is your output:</h5><br>
 
 </p>
 
-{% endblock %}
\ No newline at end of file
+{% endblock %}

From dc74d1d5971ecc02304d27eddacb897f17cd1903 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 14/17] Patched introduction/playground/A9/api.py

---
 introduction/playground/A9/api.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/introduction/playground/A9/api.py b/introduction/playground/A9/api.py
index 35e1bd2..758fbb9 100644
--- a/introduction/playground/A9/api.py
+++ b/introduction/playground/A9/api.py
@@ -4,7 +4,6 @@
 from .main import Log
 
 
-@csrf_exempt
 def log_function_target(request):
     L = Log(request)
     if request.method == "GET":
@@ -30,4 +29,4 @@ def log_function_target(request):
         return JsonResponse({"message":"success", "method":"patch"},status = 200)
     if request.method == "UPDATE":
         return JsonResponse({"message":"success", "method":"update"},status = 200)
-    return JsonResponse({"message":"method not allowed"},status = 403)
\ No newline at end of file
+    return JsonResponse({"message":"method not allowed"},status = 403)

From ca7fba1235e7ae0ff6434ad3a576b8fa4abebdba Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 15/17] Patched introduction/playground/A9/archive.py

---
 introduction/playground/A9/archive.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/introduction/playground/A9/archive.py b/introduction/playground/A9/archive.py
index c9db8fc..1d99ead 100644
--- a/introduction/playground/A9/archive.py
+++ b/introduction/playground/A9/archive.py
@@ -4,7 +4,6 @@
 from .main import Log
 
 
-@csrf_exempt
 def log_function_target(request):
     L = Log(request)
     if request.method == "GET":
@@ -60,3 +59,4 @@ def error(self,msg):
         f = open('test.log', 'a')
         f.write(f"ERROR:{now}:{msg}\n")
         f.close()
+

From e561e8174fa69b5dabe490ac085b4a19b4f37c1d Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 16/17] Patched introduction/templates/Lab/XSS/xss_lab_3.html

---
 introduction/templates/Lab/XSS/xss_lab_3.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/introduction/templates/Lab/XSS/xss_lab_3.html b/introduction/templates/Lab/XSS/xss_lab_3.html
index a550b9a..af61751 100644
--- a/introduction/templates/Lab/XSS/xss_lab_3.html
+++ b/introduction/templates/Lab/XSS/xss_lab_3.html
@@ -19,10 +19,14 @@ <h1>Welcome to XSS Challenge</h1>
 <p>{{code}}</p>
 <script>
     // LAB 3 JS CODE
-    {{code}}
+    // Access the data from the HTML element
+    var codeElement = document.getElementById('code-data');
+    var code = codeElement.textContent;
 </script>
+<div id="code-data" style="display:none;">{{code}}</div>
 <br>
 <div align="right">
   <button class="btn btn-info" type="button" onclick="window.location.href='/xss'">Back to Lab Details</button>
 </div>
 {% endblock content %}
+

From 96c63f0e972a365df486e83f6be7fa14e0b6a3a5 Mon Sep 17 00:00:00 2001
From: "patched.codes[bot]"
 <298395+patched.codes[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:11:49 +0800
Subject: [PATCH 17/17] Patched docker-compose.yml

---
 docker-compose.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 3d39f83..8172fb0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,6 +9,9 @@ services:
       - POSTGRES_DB=postgres
       - POSTGRES_USER=postgres
       - POSTGRES_PASSWORD=postgres
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
   web:
     build: .
     image: pygoat/pygoat
@@ -20,6 +23,9 @@ services:
     depends_on:
       - migration
       - db
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
   migration:
     image: pygoat/pygoat
     command: python pygoat/manage.py migrate --noinput
@@ -27,3 +33,6 @@ services:
       - .:/app
     depends_on:
       - db
+    security_opt:
+      - no-new-privileges:true
+    read_only: true