diff --git a/Broken Access Control/hard/wierd-securitatis/Dockerfile b/Broken Access Control/hard/wierd-securitatis/Dockerfile index 37436f1..0d9ba00 100644 --- a/Broken Access Control/hard/wierd-securitatis/Dockerfile +++ b/Broken Access Control/hard/wierd-securitatis/Dockerfile @@ -1,12 +1,9 @@ FROM node:slim -WORKDIR /wierd-securitatis +WORKDIR /app COPY package*.json ./ RUN npm install COPY . . -EXPOSE 3555 RUN node initDB.js CMD [ "node", "index.js" ] - - diff --git a/Broken Access Control/hard/wierd-securitatis/bac-hard.yaml b/Broken Access Control/hard/wierd-securitatis/bac-hard.yaml new file mode 100644 index 0000000..f5183e2 --- /dev/null +++ b/Broken Access Control/hard/wierd-securitatis/bac-hard.yaml @@ -0,0 +1,48 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: my-ingress +spec: + rules: + - host: chall.nullvitap.tech + http: + paths: + - path: /bac-hard + pathType: Prefix + backend: + service: + name: bac-hard-service + port: + number: 80 +--- +apiVersion: v1 +kind: Service +metadata: + name: bac-hard-service +spec: + selector: + app: bac-hard + ports: + - name: http + port: 80 + targetPort: 3555 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: bac-hard-deployment +spec: + replicas: 1 # Set the desired number of replicas for Docker 1 + selector: + matchLabels: + app: bac-hard + template: + metadata: + labels: + app: bac-hard + spec: + containers: + - name: docker1-container + image: sanjay7178/hu-chall-23:bac-hard + ports: + - containerPort: 3555 diff --git a/Broken Access Control/hard/wierd-securitatis/dockerfile b/Broken Access Control/hard/wierd-securitatis/dockerfile deleted file mode 100644 index 49d78ef..0000000 --- a/Broken Access Control/hard/wierd-securitatis/dockerfile +++ /dev/null @@ -1,27 +0,0 @@ - -# Stage 1: Build Node.js application -FROM node:18 AS node_build - -# Set the working directory -WORKDIR /app - -# Copy the Node.js application files -COPY package*.json ./ - -# Install dependencies -RUN npm install - -# Copy the application code -COPY . . - -# Build the Node.js application -# RUN npm run build - - -# Set the working directory for the Node.js application -WORKDIR /app - -RUN node initDB.js -EXPOSE 3555 -# Run the Node.js application -CMD ["node", "index.js"] diff --git a/Identification and Authentication Failures (Broken Authentication)/easy/.env b/Identification and Authentication Failures (Broken Authentication)/easy/.env new file mode 100644 index 0000000..8ab0ef5 --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/easy/.env @@ -0,0 +1,4 @@ +PORT = 2279 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-identification-and-authentication-failures-easy \ No newline at end of file diff --git a/Identification and Authentication Failures (Broken Authentication)/easy/Dockerfile b/Identification and Authentication Failures (Broken Authentication)/easy/Dockerfile new file mode 100644 index 0000000..3f3593f --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/easy/Dockerfile @@ -0,0 +1,3 @@ +FROM php:apache + +COPY . /var/www/html \ No newline at end of file diff --git a/Identification and Authentication Failures (Broken Authentication)/easy/compose.yaml b/Identification and Authentication Failures (Broken Authentication)/easy/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/easy/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Identification and Authentication Failures (Broken Authentication)/hard/.env b/Identification and Authentication Failures (Broken Authentication)/hard/.env new file mode 100644 index 0000000..e1aa1ca --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/hard/.env @@ -0,0 +1,4 @@ +PORT = 2280 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-identification-and-authentication-failures-hard \ No newline at end of file diff --git a/Identification and Authentication Failures (Broken Authentication)/hard/Dockerfile b/Identification and Authentication Failures (Broken Authentication)/hard/Dockerfile new file mode 100644 index 0000000..fdbd059 --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/hard/Dockerfile @@ -0,0 +1,5 @@ +FROM php:apache + +ARG src="./4uth Xrack Que\$t/" +ARG dest="/var/www/html/" +COPY ${src} ${dest} \ No newline at end of file diff --git a/Identification and Authentication Failures (Broken Authentication)/hard/compose.yaml b/Identification and Authentication Failures (Broken Authentication)/hard/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Identification and Authentication Failures (Broken Authentication)/hard/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Injection (Cross-Site Scripting (XSS))/easy/.env b/Injection (Cross-Site Scripting (XSS))/easy/.env new file mode 100644 index 0000000..f15d463 --- /dev/null +++ b/Injection (Cross-Site Scripting (XSS))/easy/.env @@ -0,0 +1,6 @@ +PORT = 3000 +COOKIE_KEY = "SECRET" +FLAG = "NULL{C3rul3anSuns3t}" + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-injection-easy \ No newline at end of file diff --git a/Injection (Cross-Site Scripting (XSS))/easy/Dockerfile b/Injection (Cross-Site Scripting (XSS))/easy/Dockerfile index 4d243ac..418cd6c 100644 --- a/Injection (Cross-Site Scripting (XSS))/easy/Dockerfile +++ b/Injection (Cross-Site Scripting (XSS))/easy/Dockerfile @@ -1,6 +1,8 @@ -FROM node:18 +FROM node:slim WORKDIR /app -COPY package*.json . -RUN npm install + +COPY package*.json ./ +RUN npm install + COPY . . CMD [ "node", "index.js" ] \ No newline at end of file diff --git a/Injection (Cross-Site Scripting (XSS))/easy/compose.yaml b/Injection (Cross-Site Scripting (XSS))/easy/compose.yaml new file mode 100644 index 0000000..468bea5 --- /dev/null +++ b/Injection (Cross-Site Scripting (XSS))/easy/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:${PORT} + diff --git a/Injection (Cross-Site Scripting (XSS))/hard/.env b/Injection (Cross-Site Scripting (XSS))/hard/.env new file mode 100644 index 0000000..2f1eff8 --- /dev/null +++ b/Injection (Cross-Site Scripting (XSS))/hard/.env @@ -0,0 +1,10 @@ +PORT = 3001 +COOKIE_KEY = "secret" +BOT_USERNAME = "hi" +BOT_PASSWORD = 123 +FLAG = "NULL{R0ogue3lephan1}" +BOT_AUTH = "1234567890" +DB_URI = "mongodb://localhost:27017" + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-injection-hard \ No newline at end of file diff --git a/Injection (Cross-Site Scripting (XSS))/hard/Dockerfile b/Injection (Cross-Site Scripting (XSS))/hard/Dockerfile index 5bbbc9b..2686aa4 100644 --- a/Injection (Cross-Site Scripting (XSS))/hard/Dockerfile +++ b/Injection (Cross-Site Scripting (XSS))/hard/Dockerfile @@ -1,6 +1,8 @@ -FROM node:18 +FROM node:slim WORKDIR /app -COPY package*.json . -RUN npm install + +COPY package*.json ./ +RUN npm install + COPY . . CMD [ "node", "index.js", "&&", "node", "puppeteerBot.js" ] \ No newline at end of file diff --git a/Injection (Cross-Site Scripting (XSS))/hard/compose.yaml b/Injection (Cross-Site Scripting (XSS))/hard/compose.yaml new file mode 100644 index 0000000..6f7221f --- /dev/null +++ b/Injection (Cross-Site Scripting (XSS))/hard/compose.yaml @@ -0,0 +1,13 @@ +services: + db: + image: mongo:latest + restart: always + app: + build: . + ports: + - ${PORT}:${PORT} + depends_on: + db: + condition: service_started + environment: + DB_URI: mongodb://db:27017 diff --git a/Insecure Design/easy/.env b/Insecure Design/easy/.env new file mode 100644 index 0000000..5965ead --- /dev/null +++ b/Insecure Design/easy/.env @@ -0,0 +1,4 @@ +PORT = 2915 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-insecure-design-easy \ No newline at end of file diff --git a/Insecure Design/easy/Dockerfile b/Insecure Design/easy/Dockerfile new file mode 100644 index 0000000..5e254d6 --- /dev/null +++ b/Insecure Design/easy/Dockerfile @@ -0,0 +1,4 @@ +FROM httpd:alpine +WORKDIR /app + +COPY ./index.html /usr/local/apache2/htdocs/index.html \ No newline at end of file diff --git a/Insecure Design/easy/compose.yaml b/Insecure Design/easy/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Insecure Design/easy/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Insecure Design/hard/et_tu/Dockerfile b/Insecure Design/hard/et_tu/Dockerfile index 1408c82..3fe4d49 100644 --- a/Insecure Design/hard/et_tu/Dockerfile +++ b/Insecure Design/hard/et_tu/Dockerfile @@ -1,6 +1,5 @@ FROM python:3.10-slim-buster - -WORKDIR /et_tu +WORKDIR /app COPY requirements.txt ./ RUN pip install --no-cache-dir -r requirements.txt diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/.env b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/.env new file mode 100644 index 0000000..bd5e72e --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/.env @@ -0,0 +1,4 @@ +PORT = 3124 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-security-logging-and-monitoring-failures-easy \ No newline at end of file diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/Dockerfile b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/Dockerfile new file mode 100644 index 0000000..6a83a1d --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/Dockerfile @@ -0,0 +1,4 @@ +FROM httpd:alpine +WORKDIR /app + +COPY ./ /usr/local/apache2/htdocs/ \ No newline at end of file diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/compose.yaml b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.html b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.html index 56855dd..f3949d9 100644 --- a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.html +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.html @@ -92,26 +92,6 @@

Find IP of Attacker?

- + diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.php b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.php deleted file mode 100644 index a1be1ac..0000000 --- a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/easy/index.php +++ /dev/null @@ -1,160 +0,0 @@ - - - - Security Logging and Monitoring Failures Logs - - - - -

Security Logging and Monitoring Failures Challenge

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
StatusIP AddressUserDate/TimeEndpoint
200 OK16.54.21.88azkab2023-10-18T09:21:17/login
200 OK24.56.23.11voldemort2023-10-18T10:19:22/login
200 OK18.34.10.38hary2023-10-18T11:11:44/login
200 OK95.18.43.20eric2023-10-18T11:55:51/login
200 OK57.34.22.10Ron2023-10-18T13:08:59/login
200 OK24.55.11.14Albus2023-10-21T16:08:15/login
401 Unauthorised50.96.12.14admin2023-10-21T21:08:15/login
401 Unauthorised50.96.12.14administrator2023-10-21T21:08:20/login
401 Unauthorised50.96.12.14anonymous2023-10-21T21:08:25/login
401 Unauthorised50.96.12.14root2023-10-21T21:08:30/login
- -

Find Attack Performed?

-
- - -
- - - diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/.env b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/.env new file mode 100644 index 0000000..b92125a --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/.env @@ -0,0 +1,4 @@ +PORT = 3125 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-security-logging-and-monitoring-failures-hard \ No newline at end of file diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/Dockerfile b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/Dockerfile new file mode 100644 index 0000000..6a83a1d --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/Dockerfile @@ -0,0 +1,4 @@ +FROM httpd:alpine +WORKDIR /app + +COPY ./ /usr/local/apache2/htdocs/ \ No newline at end of file diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/compose.yaml b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.html b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.html index 2c7631e..12a951e 100644 --- a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.html +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.html @@ -92,28 +92,6 @@

Find Attack Performed?

- + diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.php b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.php deleted file mode 100644 index 594d95e..0000000 --- a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/index.php +++ /dev/null @@ -1,160 +0,0 @@ - - - - Security Logging and Monitoring Failures Logs - - - - -

Security Logging and Monitoring Failures Challenge

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
StatusIP AddressUserDate/TimeEndpoint
200 OK16.54.21.88azkab2023-10-18T09:21:17/login
200 OK24.56.23.11voldemort2023-10-18T10:19:22/login
200 OK18.34.10.38hary2023-10-18T11:11:44/login
200 OK95.18.43.20eric2023-10-18T11:55:51/login
200 OK57.34.22.10Ron2023-10-18T13:08:59/login
200 OK24.55.11.14Albus2023-10-21T16:08:15/login
401 Unauthorised50.96.12.14admin2023-10-21T21:08:15/login
401 Unauthorised50.96.12.14administrator2023-10-21T21:08:20/login
401 Unauthorised50.96.12.14anonymous2023-10-21T21:08:25/login
401 Unauthorised50.96.12.14root2023-10-21T21:08:30/login
- -

Find Attack Performed?

-
- - -
- - - diff --git a/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/script.js b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/script.js new file mode 100644 index 0000000..7ba52bd --- /dev/null +++ b/Security Logging and Monitoring Failures (Insufficient Logging and Monitoring)/hard/script.js @@ -0,0 +1,20 @@ +document.getElementById('checkButton').addEventListener('click', function() { + // Get the value entered by the user + var userKey = document.getElementById('keyInput').value; + + // Define the correct key + var correctKey = "Brute Force"; + + // Check if the entered key matches the correct key + if (userKey === correctKey) { + // If the keys match, display an alert with the message + alert("NULL{L@K&E#}"); + } else { + // If the keys do not match, display an error message + alert("IP is incorrect. Please try again."); + } +}); + +document.addEventListener('contextmenu', function(e) { +e.preventDefault(); +}); \ No newline at end of file diff --git a/Security Misconfiguration (XML External Entity (XXE))/easy/.env b/Security Misconfiguration (XML External Entity (XXE))/easy/.env new file mode 100644 index 0000000..edc3bea --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/easy/.env @@ -0,0 +1,4 @@ +PORT = 4359 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-security-misconfiguration-easy \ No newline at end of file diff --git a/Security Misconfiguration (XML External Entity (XXE))/easy/Dockerfile b/Security Misconfiguration (XML External Entity (XXE))/easy/Dockerfile new file mode 100644 index 0000000..9cc2efe --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/easy/Dockerfile @@ -0,0 +1,17 @@ +# Use Alpine Linux with PHP 7.4 +FROM php:7.4-alpine + +# Install necessary packages for XML support +RUN apk --update add libxml2 libxml2-dev && \ + apk add php-xml + +# Set the working directory to /app +WORKDIR /app + +# Copy the current directory contents into the container at /app +COPY . /app + +# Expose port 80 to the outside world +EXPOSE 80 +# Define the command to run your PHP script using the built-in server +CMD ["php", "-S", "0.0.0.0:80"] diff --git a/Security Misconfiguration (XML External Entity (XXE))/easy/compose.yaml b/Security Misconfiguration (XML External Entity (XXE))/easy/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/easy/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Security Misconfiguration (XML External Entity (XXE))/hard/.env b/Security Misconfiguration (XML External Entity (XXE))/hard/.env new file mode 100644 index 0000000..c012456 --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/hard/.env @@ -0,0 +1,4 @@ +PORT = 4360 + +# Docker +COMPOSE_PROJECT_NAME = challenges2023owasp10-security-misconfiguration-hard \ No newline at end of file diff --git a/Security Misconfiguration (XML External Entity (XXE))/hard/Dockerfile b/Security Misconfiguration (XML External Entity (XXE))/hard/Dockerfile new file mode 100644 index 0000000..f9c4bb1 --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/hard/Dockerfile @@ -0,0 +1,18 @@ +# Use Alpine Linux with PHP 7.4 +FROM php:7.4-alpine + +# Install necessary packages for XML support +RUN apk --update add libxml2 libxml2-dev && \ + apk add php-xml + +# Set the working directory to /app +WORKDIR /app + +# Copy the current directory contents into the container at /app +COPY . /app + +# Expose port 80 to the outside world +EXPOSE 80 + +# Define the command to run your PHP script using the built-in server +CMD ["php", "-S", "0.0.0.0:80" ] diff --git a/Security Misconfiguration (XML External Entity (XXE))/hard/compose.yaml b/Security Misconfiguration (XML External Entity (XXE))/hard/compose.yaml new file mode 100644 index 0000000..1a3ea97 --- /dev/null +++ b/Security Misconfiguration (XML External Entity (XXE))/hard/compose.yaml @@ -0,0 +1,6 @@ +services: + app: + build: . + ports: + - ${PORT}:80 + diff --git a/Vulnerable and Outdated Components (Using Components & Known Vulnerabilites)/hard/Dockerfile b/Vulnerable and Outdated Components (Using Components & Known Vulnerabilites)/hard/Dockerfile new file mode 100644 index 0000000..c66c5df --- /dev/null +++ b/Vulnerable and Outdated Components (Using Components & Known Vulnerabilites)/hard/Dockerfile @@ -0,0 +1,4 @@ +FROM openjdk:11 +WORKDIR /app +COPY ./ ./ +CMD java -jar ./package/package/target/king-of-pop-1.0-SNAPSHOT.jar