diff --git a/docker-compose.yml b/docker-compose.yml index 3d39f83..f08a550 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,6 +9,9 @@ services: - POSTGRES_DB=postgres - POSTGRES_USER=postgres - POSTGRES_PASSWORD=postgres + read_only: true + security_opt: + - no-new-privileges:true web: build: . image: pygoat/pygoat @@ -20,6 +23,9 @@ services: depends_on: - migration - db + read_only: true + security_opt: + - no-new-privileges:true migration: image: pygoat/pygoat command: python pygoat/manage.py migrate --noinput @@ -27,3 +33,6 @@ services: - .:/app depends_on: - db + read_only: true + security_opt: + - no-new-privileges:true diff --git a/introduction/apis.py b/introduction/apis.py index 7926708..c0c61e8 100644 --- a/introduction/apis.py +++ b/introduction/apis.py @@ -12,14 +12,6 @@ from .utility import * from .views import authentication_decorator - - -# steps --> -# 1. covert input code to corrosponding code and write in file -# 2. extract inputs form 2nd code -# 3. Run the code -# 4. get the result -@csrf_exempt def ssrf_code_checker(request): if request.user.is_authenticated: if request.method == 'POST': @@ -52,17 +44,15 @@ def ssrf_code_checker(request): return JsonResponse({'message':'method not allowed'},status = 405) else: return JsonResponse({'message':'UnAuthenticated User'},status = 401) +from django.utils.html import escape -# Insufficient Logging & Monitoring - - -@csrf_exempt +# @csrf_exempt # @authentication_decorator def log_function_checker(request): if request.method == 'POST': csrf_token = request.POST.get("csrfmiddlewaretoken") - log_code = request.POST.get('log_code') - api_code = request.POST.get('api_code') + log_code = escape(request.POST.get('log_code')) + api_code = escape(request.POST.get('api_code')) dirname = os.path.dirname(__file__) log_filename = os.path.join(dirname, "playground/A9/main.py") api_filename = os.path.join(dirname, "playground/A9/api.py") @@ -88,9 +78,10 @@ def log_function_checker(request): return JsonResponse({"message":"success", "logs": lines},status = 200) else: return JsonResponse({"message":"method not allowed"},status = 405) - #a7 codechecking api -@csrf_exempt +from django.views.decorators.csrf import csrf_protect + +@csrf_protect def A7_disscussion_api(request): if request.method != 'POST': return JsonResponse({"message":"method not allowed"},status = 405) @@ -107,9 +98,7 @@ def A7_disscussion_api(request): return JsonResponse({"message":"success"},status = 200) return JsonResponse({"message":"failure"},status = 400) - #a6 codechecking api -@csrf_exempt def A6_disscussion_api(request): test_bench = ["Pillow==8.0.0","PyJWT==2.4.0","requests==2.28.0","Django==4.0.4"] @@ -121,13 +110,16 @@ def A6_disscussion_api(request): return JsonResponse({"message":"failure"},status = 400) except Exception as e: return JsonResponse({"message":"failure"},status = 400) +from django.views.decorators.csrf import csrf_protect +import html -@csrf_exempt +@csrf_protect def A6_disscussion_api_2(request): if request.method != 'POST': return JsonResponse({"message":"method not allowed"},status = 405) try: code = request.POST.get('code') + code = html.escape(code) dirname = os.path.dirname(__file__) filename = os.path.join(dirname, "playground/A6/utility.py") f = open(filename,"w") @@ -135,4 +127,4 @@ def A6_disscussion_api_2(request): f.close() except: return JsonResponse({"message":"missing code"},status = 400) - return JsonResponse({"message":"success"},status = 200) \ No newline at end of file + return JsonResponse({"message":"success"},status = 200) diff --git a/introduction/mitre.py b/introduction/mitre.py index c899c21..e522597 100644 --- a/introduction/mitre.py +++ b/introduction/mitre.py @@ -150,6 +150,8 @@ def mitre_top24(request): def mitre_top25(request): if request.method == 'GET': return render(request, 'mitre/mitre_top25.html') +import os +from django.http import JsonResponse @authentication_decorator def csrf_lab_login(request): @@ -158,23 +160,24 @@ def csrf_lab_login(request): elif request.method == 'POST': password = request.POST.get('password') username = request.POST.get('username') - password = md5(password.encode()).hexdigest() + + password = hashlib.scrypt(password.encode(), salt=os.urandom(16), n=16384, r=8, p=1).hex() User = CSRF_user_tbl.objects.filter(username=username, password=password) if User: + secret = os.environ.get('JWT_SECRET_KEY', 'default_key') payload ={ 'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=300), 'iat': datetime.datetime.utcnow() } - cookie = jwt.encode(payload, 'csrf_vulneribility', algorithm='HS256') + cookie = jwt.encode(payload, secret, algorithm='HS256') response = redirect("/mitre/9/lab/transaction") - response.set_cookie('auth_cookiee', cookie) + response.set_cookie('auth_cookiee', cookie, secure=True, httponly=True, samesite='Lax') return response else : return redirect('/mitre/9/lab/login') @authentication_decorator -@csrf_exempt def csrf_transfer_monei(request): if request.method == 'GET': try: @@ -208,14 +211,16 @@ def csrf_transfer_monei_api(request,recipent,amount): return redirect('/mitre/9/lab/transaction') else: return redirect ('/mitre/9/lab/transaction') +from ast import literal_eval - -# @authentication_decorator -@csrf_exempt +@authentication_decorator def mitre_lab_25_api(request): if request.method == "POST": expression = request.POST.get('expression') - result = eval(expression) + try: + result = literal_eval(expression) + except (SyntaxError, ValueError): + return JsonResponse({'error': 'Invalid expression'}) return JsonResponse({'result': result}) else: return redirect('/mitre/25/lab/') @@ -228,13 +233,10 @@ def mitre_lab_25(request): @authentication_decorator def mitre_lab_17(request): return render(request, 'mitre/mitre_lab_17.html') - def command_out(command): - process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + command = command.split() + process = subprocess.Popen(command, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE) return process.communicate() - - -@csrf_exempt def mitre_lab_17_api(request): if request.method == "POST": ip = request.POST.get('ip') @@ -244,4 +246,4 @@ def mitre_lab_17_api(request): err = err.decode() pattern = "STATE SERVICE.*\\n\\n" ports = re.findall(pattern, res,re.DOTALL)[0][14:-2].split('\n') - return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports}) \ No newline at end of file + return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports}) diff --git a/introduction/playground/A9/api.py b/introduction/playground/A9/api.py index 35e1bd2..156280a 100644 --- a/introduction/playground/A9/api.py +++ b/introduction/playground/A9/api.py @@ -1,33 +1,29 @@ from django.http import JsonResponse -from django.views.decorators.csrf import csrf_exempt - from .main import Log - -@csrf_exempt def log_function_target(request): L = Log(request) if request.method == "GET": L.info("GET request") - return JsonResponse({"message":"normal get request", "method":"get"},status = 200) + return JsonResponse({"message":"normal get request", "method":"get"}, status=200) if request.method == "POST": username = request.POST['username'] password = request.POST['password'] L.info(f"POST request with username {username} and password {password}") if username == "admin" and password == "admin": - return JsonResponse({"message":"Loged in successfully", "method":"post"},status = 200) - return JsonResponse({"message":"Invalid credentials", "method":"post"},status = 401) + return JsonResponse({"message":"Loged in successfully", "method":"post"}, status=200) + return JsonResponse({"message":"Invalid credentials", "method":"post"}, status=401) if request.method == "PUT": L.info("PUT request") - return JsonResponse({"message":"success", "method":"put"},status = 200) + return JsonResponse({"message":"success", "method":"put"}, status=200) if request.method == "DELETE": if request.user.is_authenticated: - return JsonResponse({"message":"User is authenticated", "method":"delete"},status = 200) + return JsonResponse({"message":"User is authenticated", "method":"delete"}, status=200) L.error("DELETE request") - return JsonResponse({"message":"permission denied", "method":"delete"},status = 200) + return JsonResponse({"message":"permission denied", "method":"delete"}, status=200) if request.method == "PATCH": L.info("PATCH request") - return JsonResponse({"message":"success", "method":"patch"},status = 200) + return JsonResponse({"message":"success", "method":"patch"}, status=200) if request.method == "UPDATE": - return JsonResponse({"message":"success", "method":"update"},status = 200) - return JsonResponse({"message":"method not allowed"},status = 403) \ No newline at end of file + return JsonResponse({"message":"success", "method":"update"}, status=200) + return JsonResponse({"message":"method not allowed"}, status=403) diff --git a/introduction/playground/A9/archive.py b/introduction/playground/A9/archive.py index c9db8fc..d6f4be7 100644 --- a/introduction/playground/A9/archive.py +++ b/introduction/playground/A9/archive.py @@ -1,10 +1,7 @@ from django.http import JsonResponse -from django.views.decorators.csrf import csrf_exempt - from .main import Log -@csrf_exempt def log_function_target(request): L = Log(request) if request.method == "GET": @@ -33,12 +30,6 @@ def log_function_target(request): return JsonResponse({"message":"method not allowed"},status = 403) -# ====================================== - -import datetime - - -# f = open('test.log', 'a') --> use this file to log class Log: def __init__(self,request): self.request = request diff --git a/introduction/static/js/a9.js b/introduction/static/js/a9.js index 9c58b8a..738109d 100644 --- a/introduction/static/js/a9.js +++ b/introduction/static/js/a9.js @@ -37,9 +37,9 @@ event3 = function(){ document.getElementById("a9_d3").style.display = 'flex'; for (var i = 0; i < data.logs.length; i++) { var li = document.createElement("li"); - li.innerHTML = data.logs[i]; + li.textContent = data.logs[i]; document.getElementById("a9_d3").appendChild(li); } }) .catch(error => console.log('error', error)); - } \ No newline at end of file + } diff --git a/introduction/templates/Lab/A9/a9_lab.html b/introduction/templates/Lab/A9/a9_lab.html index 5a70b46..7145c34 100644 --- a/introduction/templates/Lab/A9/a9_lab.html +++ b/introduction/templates/Lab/A9/a9_lab.html @@ -8,6 +8,7 @@

Yaml To Json Converter

+ {% csrf_token %}

@@ -34,4 +35,4 @@
Here is your output:

-{% endblock %} \ No newline at end of file +{% endblock %} diff --git a/introduction/templates/Lab/A9/a9_lab2.html b/introduction/templates/Lab/A9/a9_lab2.html index cace076..33b3a91 100644 --- a/introduction/templates/Lab/A9/a9_lab2.html +++ b/introduction/templates/Lab/A9/a9_lab2.html @@ -19,6 +19,7 @@

Some Example

+ {% csrf_token %} @@ -88,7 +89,11 @@

Some Example

form.submit(); } {% if error %} - alert("{{ data }}"); + {{ data }} + {% endif %} diff --git a/introduction/templates/Lab/BrokenAccess/ba_lab.html b/introduction/templates/Lab/BrokenAccess/ba_lab.html index d45da9b..d8f3ae9 100644 --- a/introduction/templates/Lab/BrokenAccess/ba_lab.html +++ b/introduction/templates/Lab/BrokenAccess/ba_lab.html @@ -9,7 +9,7 @@

Admins Have the Secretkey