forked from SasanLabs/VulnerableApp
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request SasanLabs#254 from SasanLabs/spotless
Immediate release for testing
- Loading branch information
Showing
17 changed files
with
164 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 3 additions & 0 deletions
3
src/main/java/org/sasanlabs/service/vulnerability/openRedirect/ClientSideInjection.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| package org.sasanlabs.service.vulnerability.openRedirect; | ||
|
|
||
| public class ClientSideInjection {} |
2 changes: 1 addition & 1 deletion
2
...tion/Http3xxStatusCodeBasedInjection.java → ...rect/Http3xxStatusCodeBasedInjection.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
68 changes: 68 additions & 0 deletions
68
src/main/java/org/sasanlabs/service/vulnerability/openRedirect/MetaTagBasedInjection.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package org.sasanlabs.service.vulnerability.openRedirect; | ||
|
|
||
| /** | ||
| * This class contains the vulnerabilities related to Open Redirects. Redirects implemented by this | ||
| * class are based on {@code Meta Tag}. <br> | ||
| * Important Links: <br> | ||
| * 1. <a href= "http://projects.webappsec.org/w/page/13246981/URL%20Redirector%20Abuse">WASC-38</a> | ||
| * <br> | ||
| * 2. <a href="https://cwe.mitre.org/data/definitions/601.html">CWE-601</a><br> | ||
| * 3. <a href= "https://portswigger.net/kb/issues/00500100_open-redirection-reflected">Port | ||
| * Swigger's vulnerability documentation</a><br> | ||
| * 4. <a href="https://en.wikipedia.org/wiki/URL_redirection">Wiki link for describing the purpose | ||
| * of URL Redirection</a><br> | ||
| * 5. <a href="https://github.com/payloadbox/open-redirect-payload-list">Payloads for Open | ||
| * Redirect</a><br> | ||
| * 6. <a href="https://www.seroundtable.com/google-meta-refresh-redirects-work-25335.html">Meta tag | ||
| * based Redirects vs 3XX redirects</a><br> | ||
| * <br> | ||
| * Some myths: <a href= | ||
| * "https://security.stackexchange.com/questions/59517/are-url-shorteners-vulnerable-due-to-open-redirects">Are | ||
| * URL shorteners “vulnerable” due to open redirects? </a><br> | ||
| * <br> | ||
| * Note: as we have implemented entire architecture around the Ajax calls hence there is no direct | ||
| * way to provide the User Interface for URL Redirect Vulnerability hence these will be exposed as | ||
| * an API and user can follow instructions suggested in UI for exploiting this Vulnerability. | ||
| * | ||
| * @author [email protected] KSASAN | ||
| */ | ||
| // @VulnerableAppRestController( | ||
| // descriptionLabel = "OPEN_REDIRECTION_VULNERABILITY_META_TAG_BASED", | ||
| // value = "MetaTagBasedInjection", | ||
| // type = {VulnerabilityType.OPEN_REDIRECT}) | ||
| public class MetaTagBasedInjection { | ||
|
|
||
| // private static final String META_TAG_PAYLOAD = | ||
| // "<html><head><meta http-equiv=\"refresh\" content=\"10;%s\" /></head><body> | ||
| // VulnerableApp Job is Running %s </body></html>"; | ||
| // | ||
| // private static final String STATUS = "status"; | ||
| // | ||
| // @VulnerableAppRequestMapping( | ||
| // value = LevelConstants.LEVEL_1, | ||
| // descriptionLabel = "URL_REDIRECTION_URL_PARAMETER_INJECTION_INTO_META_TAG") | ||
| // public ResponseEntity<String> getVulnerablePayloadLevel1( | ||
| // @RequestParam(value = STATUS, required = false) String statusUrl) { | ||
| // return new ResponseEntity<>( | ||
| // String.format( | ||
| // META_TAG_PAYLOAD, statusUrl == null ? "" : "url=" + statusUrl, new | ||
| // Date()), | ||
| // HttpStatus.OK); | ||
| // } | ||
| // | ||
| // @VulnerableAppRequestMapping( | ||
| // value = LevelConstants.LEVEL_2, | ||
| // descriptionLabel = "URL_REDIRECTION_URL_PARAMETER_INJECTION_INTO_META_TAG") | ||
| // public ResponseEntity<String> getVulnerablePayloadLevel( | ||
| // @RequestParam Map<String, String> queryParams) { | ||
| // Iterator<Entry<String, String>> iterator = queryParams.entrySet().iterator(); | ||
| // String metaTag = ""; | ||
| // if (iterator.hasNext()) { | ||
| // Entry<String, String> entry = iterator.next(); | ||
| // metaTag = String.format(META_TAG_PAYLOAD, entry.getValue()); | ||
| // } | ||
| // return new ResponseEntity<>( | ||
| // GenericUtils.wrapPayloadInGenericVulnerableAppTemplate(metaTag), | ||
| // HttpStatus.OK); | ||
| // } | ||
| } |
3 changes: 3 additions & 0 deletions
3
...in/java/org/sasanlabs/service/vulnerability/openRedirect/RefreshHeaderBasedInjection.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| package org.sasanlabs.service.vulnerability.openRedirect; | ||
|
|
||
| public class RefreshHeaderBasedInjection {} |
3 changes: 0 additions & 3 deletions
3
src/main/java/org/sasanlabs/service/vulnerability/urlRedirection/ClientSideInjection.java
This file was deleted.
Oops, something went wrong.
38 changes: 0 additions & 38 deletions
38
src/main/java/org/sasanlabs/service/vulnerability/urlRedirection/MetaTagBasedInjection.java
This file was deleted.
Oops, something went wrong.
3 changes: 0 additions & 3 deletions
3
.../java/org/sasanlabs/service/vulnerability/urlRedirection/RefreshHeaderBasedInjection.java
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
src/main/resources/static/templates/MetaTagBasedInjection/LEVEL_1/MetaTagBasedInjection.css
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| #MetaTagBasedInjection { | ||
| color: black; | ||
| text-align: left; | ||
| font-size: 18px; | ||
| font-weight: normal; | ||
| } | ||
| #mindset { | ||
| font-weight: bold; | ||
| } |
21 changes: 21 additions & 0 deletions
21
src/main/resources/static/templates/MetaTagBasedInjection/LEVEL_1/MetaTagBasedInjection.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| <div id="MetaTagBasedInjection"> | ||
| <div> | ||
| Interaction between frontend and backend is done using Ajax calls and | ||
| this generic structure applies everywhere across Owasp VulnerableApp. | ||
| Because of that all the http status code or header based redirects | ||
| doesn't work out of the box and hence we had not implemented it. | ||
| <br /> <br /> | ||
| For Vulnerability scanning tools this might not be an issue as | ||
| scanning tools can work on Api calls but to illustrate this attack to | ||
| students/security enthusiasts we have provided a way to do the same. | ||
| Please Visit URL: <a id="placeholder"></a> | ||
| <br /><br /> To think on why redirection using meta tag is required or in other words the usecase | ||
| of url redirection functionality, consider a website which is having a functionality to show the | ||
| progress/status of any background job and to achieve this website is refreshing the web page | ||
| every 5 seconds. | ||
| <br /> | ||
| <div id="mindset"> | ||
| Now the URL given above can be considered as a url of the web page which is depicting the progress/status of the background job. | ||
| </div> | ||
| </div> | ||
| </div> |
7 changes: 7 additions & 0 deletions
7
src/main/resources/static/templates/MetaTagBasedInjection/LEVEL_1/MetaTagBasedInjection.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| function updatePlaceholderDiv() { | ||
| let placeholderAnchorElement = document.getElementById("placeholder"); | ||
| placeholderAnchorElement.href = getUrlForVulnerabilityLevel() + "?returnTo=/"; | ||
| placeholderAnchorElement.innerText = "Click here"; | ||
| } | ||
|
|
||
| updatePlaceholderDiv(); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters