Trigger pr comments

insecure-api/main-2.py

@@ -0,0 +1,214 @@
+from fastapi import FastAPI, HTTPException, Header, Request
+from typing import Optional
+from models import VideoGame, User
+from database import video_games, users
+import sqlite3
+import os
+import requests
+from fastapi.responses import RedirectResponse
+
+app = FastAPI(
+    title="Intentionally Insecure Video Game API",
+    description="An API designed for security education, demonstrating common vulnerabilities.",
+    version="1.0.0",
+    contact={
+        "name": "Your Name",
+        "email": "[email protected]",
+    },
+)
+
+# Initialize the SQLite database
+def init_db():
+    if not os.path.exists('videogames.db'):
+        conn = sqlite3.connect('videogames.db')
+        cursor = conn.cursor()
+        # Create table
+        cursor.execute('''
+            CREATE TABLE video_games (
+                id INTEGER PRIMARY KEY,
+                title TEXT NOT NULL,
+                developer TEXT NOT NULL,
+                publisher TEXT NOT NULL,
+                year_published INTEGER NOT NULL,
+                sales INTEGER NOT NULL
+            )
+        ''')
+        # Insert data
+        for game in video_games:
+            cursor.execute('''
+                INSERT INTO video_games (id, title, developer, publisher, year_published, sales)
+                VALUES (?, ?, ?, ?, ?, ?)
+            ''', (game.id, game.title, game.developer, game.publisher, game.year_published, game.sales))
+        conn.commit()
+        conn.close()
+
+# Call the init_db function when the app starts
+@app.on_event("startup")
+def startup_event():
+    init_db()
+
+# Public endpoint to get basic video game info
+@app.get("/games")
+def get_games():
+    return video_games
+
+# Vulnerable endpoint: No authentication required to get sensitive sales data
+@app.get("/games/{game_id}/sales")
+def get_game_sales(game_id: int):
+    # Vulnerability: No authentication or authorization checks (API1:2019 - Broken Object Level Authorization)
+    for game in video_games:
+        if game.id == game_id:
+            return {"title": game.title, "sales": game.sales}
+    raise HTTPException(status_code=404, detail="Game not found")
+
+# Vulnerable endpoint: Weak authentication and improper authorization
+@app.post("/games")
+def add_game(game: VideoGame, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: Token sent in Authorization header without proper validation (API2:2019 - Broken Authentication)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+
+    # Vulnerability: Insecure token handling and authorization (API5:2019 - Broken Function Level Authorization)
+    for user in users:
+        if user.token == token:
+            if user.is_admin:
+                video_games.append(game)
+                return {"message": "Game added"}
+            else:
+                raise HTTPException(status_code=403, detail="Not authorized")
+    raise HTTPException(status_code=401, detail="Invalid token")
+
+# Vulnerable endpoint: Exposes sensitive user data
+@app.get("/users")
+def get_users():
+    # Vulnerability: Exposes tokens and admin status (API3:2019 - Excessive Data Exposure)
+    return users
+
+# Additional vulnerable endpoint: No rate limiting implemented
+@app.post("/login")
+def login(username: str):
+    # Vulnerability: No rate limiting allows brute-force attacks (API4:2019 - Lack of Resources & Rate Limiting)
+    for user in users:
+        if user.username == username:
+            return {"token": user.token}
+    raise HTTPException(status_code=404, detail="User not found")
+
+# Additional vulnerable endpoint: Mass assignment
+@app.put("/games/{game_id}")
+def update_game(game_id: int, updated_game: VideoGame):
+    # Vulnerability: Mass assignment allows overwriting of unintended fields (API6:2019 - Mass Assignment)
+    for i, game in enumerate(video_games):
+        if game.id == game_id:
+            video_games[i] = updated_game
+            return {"message": "Game updated"}
+    raise HTTPException(status_code=404, detail="Game not found")
+
+# Additional vulnerable endpoint: SQL Injection
+@app.get("/search")
+def search_games(query: str):
+    # Vulnerability: User input is not sanitized (API8:2019 - Injection)
+    conn = sqlite3.connect('videogames.db')
+    cursor = conn.cursor()
+    try:
+        sql_query = f"SELECT * FROM video_games WHERE title = '{query}'"
+        cursor.execute(sql_query)
+        rows = cursor.fetchall()
+    except Exception as e:
+        # Return the exception message for educational purposes (not recommended in production)
+        return {"error": str(e)}
+    finally:
+        conn.close()
+    # Convert rows to list of dictionaries
+    results = []
+    for row in rows:
+        results.append({
+            "id": row[0],
+            "title": row[1],
+            "developer": row[2],
+            "publisher": row[3],
+            "year_published": row[4],
+            "sales": row[5],
+        })
+    return results
+
+# Additional vulnerable endpoint: Improper assets management
+@app.get("/.env")
+def get_env():
+    # Vulnerability: Sensitive files are exposed (API9:2019 - Improper Assets Management)
+    return {"SECRET_KEY": "supersecretkey"}
+
+# Additional vulnerable endpoint: Insufficient logging and monitoring
+@app.post("/admin/delete_game")
+def delete_game(game_id: int, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: Actions are not logged (API10:2019 - Insufficient Logging & Monitoring)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+
+    for user in users:
+        if user.token == token and user.is_admin:
+            for i, game in enumerate(video_games):
+                if game.id == game_id:
+                    deleted_game = video_games.pop(i)
+                    # No logging of the deletion action
+                    return {"message": f"Game '{deleted_game.title}' deleted"}
+            raise HTTPException(status_code=404, detail="Game not found")
+    raise HTTPException(status_code=403, detail="Not authorized")
+
+@app.post("/feedback")
+def submit_feedback(feedback: str):
+    # Vulnerability: User input is not sanitized before rendering (API7:2019 - Security Misconfiguration)
+    response = HTMLResponse(content=f"<html><body><h1>Feedback Received</h1><p>{feedback}</p></body></html>")
+    return response
+
+# Additional vulnerable endpoint: Insecure Direct Object References (IDOR)
+@app.get("/user_profile")
+def get_user_profile(user_id: int):
+    # Vulnerability: No authorization checks (API1:2019 - Broken Object Level Authorization)
+    for user in users:
+        if user.username == f"user{user_id}":
+            return user
+    raise HTTPException(status_code=404, detail="User not found")
+
+# Additional vulnerable endpoint: Cross-Site Request Forgery (CSRF)
+@app.post("/update_profile")
+def update_profile(username: str, email: str, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: No CSRF protection (API5:2019 - Broken Function Level Authorization)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+    # Simulate updating user profile
+    for user in users:
+        if user.token == token:
+            user.username = username
+            user.email = email  # Assuming 'email' field exists in User model
+            return {"message": "Profile updated"}
+    raise HTTPException(status_code=401, detail="Invalid token")
+
+# Additional vulnerable endpoint: Server-Side Request Forgery (SSRF)
+@app.get("/fetch_url")
+def fetch_url_content(url: str):
+    # Vulnerability: No validation of the URL (API10:2019 - Unsafe Consumption of APIs)
+    try:
+        response = requests.get(url)
+        return {"content": response.text}
+    except Exception as e:
+        return {"error": str(e)}
+
+# Additional vulnerable endpoint: Unvalidated Redirects and Forwards
+@app.get("/redirect")
+def unsafe_redirect(next: str):
+    # Vulnerability: Unvalidated redirect (API10:2019 - Unsafe Consumption of APIs)
+    return RedirectResponse(url=next)

insecure-app/app2.py

@@ -0,0 +1,168 @@
+from flask import Flask, request, render_template_string, jsonify
+import subprocess
+import os
+import sqlite3
+import requests
+from lxml import etree
+
+# Example hardcoded AWS credentials (sensitive data leakage)
+aws_access_key_id = 'AKIA2JAPX77RGLB664VE'
+aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'
+
+app = Flask(__name__)
+
+@app.route('/', methods=['GET', 'POST'])
+def index():
+    output = ''
+    # 1 - SQL Injection
+    db = sqlite3.connect("tutorial.db")
+    cursor = db.cursor()
+    username = ''
+    password = ''
+    try:
+        cursor.execute("SELECT * FROM users WHERE username = '%s' AND password = '%s'" % (username, password))
+    except:
+        pass
+
+    if request.method == 'POST':
+        # 2 - Command Injection
+        if 'command' in request.form:
+            cmd = request.form['command']
+            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            stdout, stderr = process.communicate()
+            if process.returncode == 0:
+                output = stdout.decode('utf-8')
+            else:
+                output = f"Error (Exit Code: {process.returncode}):\n{stderr.decode('utf-8')}"
+
+        # 3 - File Upload with no restrictions, and path traversal
+        elif 'file' in request.files:
+            uploaded_file = request.files['file']
+            uploaded_file.save(os.path.join('/uploads', uploaded_file.filename))
+            output = f"File {uploaded_file.filename} uploaded successfully!"
+
+        # 4 - SQL Injection via input
+        elif 'sql' in request.form:
+            sql = request.form['sql']
+            try:
+                # Execute the user's SQL query
+                cursor.execute(sql)
+                # Fetch all rows from the query result
+                rows = cursor.fetchall()
+                # Format the results for display
+                if rows:
+                    output = "Results:\n" + "\n".join(str(row) for row in rows)
+                else:
+                    output = "Query executed successfully, but no results found."
+            except Exception as e:
+                output = f"SQL Error: {e}"
+
+        # 5 - Cross-Site Scripting (XSS)
+        elif 'xss' in request.form:
+            xss_input = request.form['xss']
+            output = f"Reflected XSS result: {xss_input}"
+
+        # 6 - XML External Entity (XXE) Injection
+        elif 'xml' in request.form:
+            xml_data = request.form['xml']
+            try:
+                # Use lxml to parse the XML data
+                parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
+                tree = etree.fromstring(xml_data.encode(), parser)
+                output = f"Parsed XML: {etree.tostring(tree, encoding='unicode')}"
+            except Exception as e:
+                output = f"XML Parsing Error: {e}"
+
+        # 7 - Server-Side Request Forgery (SSRF)
+        elif 'url' in request.form:
+            url = request.form['url']
+            try:
+                response = requests.get(url)
+                output = f"SSRF Response: {response.text[:200]}"
+            except Exception as e:
+                output = f"SSRF Error: {e}"
+
+            # 8 - SQL injection with parameter instead of whole query
+        if 'username' in request.form:
+            username = request.form['username']
+            try:
+                # Vulnerable SQL query using string interpolation
+                query = "SELECT password FROM users WHERE username = '{}'".format(username)
+                cursor.execute(query)
+                result = cursor.fetchone()
+                if result:
+                    output = f"Password for {username}: {result[0]}"
+                else:
+                    output = "User not found."
+            except Exception as e:
+                output = f"SQL Error: {e}"
+
+    return render_template_string("""
+        <h1>Intentionally Insecure App</h1>
+        <hr>
+
+        <!-- Command Injection -->
+        <form action="/" method="post">
+            <h2>Command Injection</h2>
+            <input type="text" name="command" value="ls -la">
+            <input type="submit" value="Run">
+        </form>
+        <br>
+
+        <!-- File Upload -->
+        <form action="/" method="post" enctype="multipart/form-data">
+            <h2>Path Traversal via File Upload</h2>
+            <input type="file" name="file">
+            <input type="submit" value="Upload">
+        </form>
+        <p>Try uploading a file named: <code>../../../../etc/passwd</code></p>
+        <br>
+
+        <!-- SQL Injection -->
+        <form action="/" method="post">
+            <h2>SQL Injection</h2>
+            <input type="text" name="sql" value="SELECT * FROM users WHERE username = 'admin' OR '1'='1'">
+            <input type="submit" value="Run">
+        </form>
+        <br>
+
+        <!-- Cross-Site Scripting (XSS) -->
+        <form action="/" method="post">
+            Enter XSS payload: <input type="text" name="xss" value="<script>alert('XSS');</script>">
+            <input type="submit" value="Run">
+        </form>
+        <br>
+
+        <!-- XML External Entity (XXE) Injection -->
+        <form action="/" method="post">
+            <h2>XML External Entity (XXE) Injection</h2>
+            <textarea name="xml" rows="5" cols="50">
+<?xml version="1.0"?>
+<!DOCTYPE root [
+<!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<root>&xxe;</root>
+            </textarea>
+            <input type="submit" value="Parse XML">
+        </form>
+        <br>
+
+        <!-- Server-Side Request Forgery (SSRF) -->
+        <form action="/" method="post">
+            <h2>Server-Side Request Forgery (SSRF)</h2>
+            <input type="text" name="url" value="http://localhost:8080/">
+            <input type="submit" value="Request">
+        </form>
+        <br>
+        <!-- SQL Injection 2 -->
+        <h2>SQL Injection 2</h2>
+        <form action="/" method="post">
+            Enter Username: <input type="text" name="username" value="' UNION SELECT username || ' : ' || password FROM users --">
+            <input type="submit" value="Lookup">
+        </form>
+        <hr>
+        <pre>{{ output|safe }}</pre>
+    """, output=output)
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=8080, debug=True)

insecure-app/requirements.txt

@@ -1,4 +1,4 @@
 requests == 2.19.1
-cryptography==3.3.2
+#cryptography==3.3.2
 flask==3.0.2
-#cryptograpy==3.3.2
+cryptograpy==3.3.2