├── vucsa-server ├── server │ └── challenge │ │ └── horizontalaccesscontrol │ │ └── document │ │ ├── 2222.txt │ │ ├── 8435.txt │ │ ├── 1.txt │ │ ├── 5406.txt │ │ ├── 12002.txt │ │ ├── 1001.txt │ │ └── 11011.txt ├── build.gradle └── src │ └── main │ └── java │ └── com │ └── warxim │ └── vucsa │ └── server │ ├── challenge │ ├── rcedeserialization │ │ ├── internal │ │ │ ├── advanced │ │ │ │ ├── Processor.java │ │ │ │ ├── BaseProcessor.java │ │ │ │ ├── ChainedProcessorOutputAsArgPlaceholder.java │ │ │ │ ├── ChainedProcessorDescriptor.java │ │ │ │ ├── ProcessorCommand.java │ │ │ │ ├── ClassProcessor.java │ │ │ │ ├── ObjectProcessor.java │ │ │ │ └── ChainedProcessors.java │ │ │ └── BasicCommand.java │ │ ├── RceDeserializationChallenge.java │ │ └── RceDeserializationHandler.java │ ├── enumeration │ │ ├── User.java │ │ ├── EnumerationChallenge.java │ │ └── EnumerationHandler.java │ ├── xml │ │ ├── XmlChallenge.java │ │ └── XmlHandler.java │ ├── bufferoverread │ │ ├── BufferOverreadChallenge.java │ │ └── BufferOverreadHandler.java │ ├── commandexecution │ │ └── CommandExecutionChallenge.java │ ├── horizontalaccesscontrol │ │ └── HorizontalAccessControlChallenge.java │ ├── verticalaccesscontrol │ │ ├── VerticalAccessControlChallenge.java │ │ ├── VerticalAccessControlSecretHandler.java │ │ └── VerticalAccessControlUserInfoHandler.java │ └── sqlinjection │ │ └── SqlInjectionChallenge.java │ ├── configuration │ ├── Configuration.java │ ├── ConfigurationException.java │ └── ConfigurationSaver.java │ ├── Main.java │ └── core │ ├── ServerConfig.java │ ├── ServerState.java │ ├── connection │ └── ServerConnection.java │ └── listener │ ├── ServerListener.java │ └── ServerListenerManager.java ├── .gitignore ├── settings.gradle ├── vucsa-client └── src │ └── main │ ├── resources │ ├── img │ │ └── Logo.png │ ├── fonts │ │ ├── NotoSans-Bold.ttf │ │ └── NotoSans-Regular.ttf │ ├── fxml │ │ ├── tab │ │ │ └── LogTab.fxml │ │ ├── Application.fxml │ │ └── challenge │ │ │ ├── horizontalaccesscontrol │ │ │ └── HorizontalAccessControlTab.fxml │ │ │ ├── commandexecution │ │ │ └── CommandExecutionTab.fxml │ │ │ ├── rcedeserialization │ │ │ └── RceDeserializationTab.fxml │ │ │ ├── bufferoverread │ │ │ └── BufferOverreadTab.fxml │ │ │ ├── sqlinjection │ │ │ └── SqlInjectionTab.fxml │ │ │ └── enumeration │ │ │ └── EnumerationTab.fxml │ └── css │ │ └── Main.css │ └── java │ └── com │ └── warxim │ └── vucsa │ └── client │ ├── core │ ├── ClientConfig.java │ └── Client.java │ ├── challenge │ ├── horizontalaccesscontrol │ │ ├── DocumentItem.java │ │ └── HorizontalAccessControlHandler.java │ ├── ChallengeWrapper.java │ ├── ChallengeController.java │ ├── commandexecution │ │ └── CommandExecutionHandler.java │ ├── xml │ │ └── XmlHandler.java │ ├── sqlinjection │ │ └── SqlInjectionHandler.java │ ├── bufferoverread │ │ └── BufferOverreadHandler.java │ ├── rcedeserialization │ │ └── RceDeserializationHandler.java │ ├── enumeration │ │ └── EnumerationHandler.java │ └── verticalaccesscontrol │ │ ├── VerticalAccessControlSecretHandler.java │ │ └── VerticalAccessControlUserInfoHandler.java │ ├── gui │ └── GuiConstant.java │ ├── Main.java │ ├── Bundle.java │ └── util │ └── GuiUtils.java ├── scripts ├── server.sh ├── client.sh ├── server.bat └── client.bat ├── vucsa-common ├── build.gradle └── src │ └── main │ └── java │ └── com │ └── warxim │ └── vucsa │ └── common │ ├── message │ ├── xml │ │ ├── StorageItem.java │ │ ├── StorageMessage.java │ │ └── StorageMessageSerializer.java │ ├── rcedeserialization │ │ ├── MessageContent.java │ │ ├── TextMessage.java │ │ ├── TextMessageDeserializer.java │ │ └── TextMessageSerializer.java │ ├── sqlinjection │ │ ├── FoodEntity.java │ │ ├── request │ │ │ ├── SearchRequestDeserializer.java │ │ │ ├── SearchRequest.java │ │ │ └── SearchRequestSerializer.java │ │ └── response │ │ │ ├── SearchResponse.java │ │ │ ├── SearchResponseSerializer.java │ │ │ └── SearchResponseDeserializer.java │ ├── MessageSerializer.java │ ├── MessageDeserializer.java │ ├── SerializedMessage.java │ ├── Message.java │ ├── verticalaccesscontrol │ │ ├── request │ │ │ ├── UserInfoRequest.java │ │ │ ├── SecretRequest.java │ │ │ ├── SecretRequestDeserializer.java │ │ │ ├── UserInfoRequestDeserializer.java │ │ │ ├── SecretRequestSerializer.java │ │ │ └── UserInfoRequestSerializer.java │ │ ├── response │ │ │ ├── SecretResponse.java │ │ │ ├── SecretResponseDeserializer.java │ │ │ ├── UserInfoResponse.java │ │ │ ├── SecretResponseSerializer.java │ │ │ └── UserInfoResponseSerializer.java │ │ └── UserRole.java │ ├── commandexecution │ │ ├── request │ │ │ ├── PingRequest.java │ │ │ ├── PingRequestDeserializer.java │ │ │ └── PingRequestSerializer.java │ │ └── response │ │ │ ├── PingResponse.java │ │ │ ├── PingResponseDeserializer.java │ │ │ └── PingResponseSerializer.java │ ├── plain │ │ ├── PlainMessage.java │ │ ├── PlainMessageDeserializer.java │ │ └── PlainMessageSerializer.java │ ├── MessageHandler.java │ ├── enumeration │ │ ├── LoginStatus.java │ │ ├── request │ │ │ ├── LoginRequest.java │ │ │ ├── LoginRequestDeserializer.java │ │ │ └── LoginRequestSerializer.java │ │ └── response │ │ │ ├── LoginResponse.java │ │ │ └── LoginResponseSerializer.java │ ├── horizontalaccesscontrol │ │ ├── request │ │ │ ├── DocumentContentRequest.java │ │ │ ├── DocumentContentRequestDeserializer.java │ │ │ └── DocumentContentRequestSerializer.java │ │ └── response │ │ │ ├── DocumentContentResponse.java │ │ │ ├── DocumentContentResponseDeserializer.java │ │ │ └── DocumentContentResponseSerializer.java │ ├── bufferoverread │ │ └── StringListMessage.java │ └── MessageQueue.java │ ├── connection │ ├── ConnectionState.java │ └── listener │ │ ├── ConnectionListener.java │ │ └── ConnectionListenerManager.java │ ├── Constant.java │ ├── ChallengeConstant.java │ └── util │ └── GsonUtils.java └── CHANGELOG.md /vucsa-server/server/challenge/horizontalaccesscontrol/document/2222.txt: -------------------------------------------------------------------------------- 1 | This is a super secret message! -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Gradle 2 | .gradle 3 | gradle** 4 | # Eclipse, Idea, ... 5 | .settings 6 | .idea 7 | bin 8 | build 9 | doc 10 | -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/8435.txt: -------------------------------------------------------------------------------- 1 | Mj csy xipp xli xvyxl, csy hsr'x lezi xs viqiqfiv ercxlmrk. -------------------------------------------------------------------------------- /settings.gradle: -------------------------------------------------------------------------------- 1 | rootProject.name = 'VuCSA' 2 | 3 | include 'vucsa-common' 4 | include 'vucsa-client' 5 | include 'vucsa-server' 6 | 7 | -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/img/Logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Warxim/vucsa/HEAD/vucsa-client/src/main/resources/img/Logo.png -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/1.txt: -------------------------------------------------------------------------------- 1 | Administrator's file! 2 | Important password, do not forget it: 123456789 -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/5406.txt: -------------------------------------------------------------------------------- 1 | All animals are equal, but some animals are more equal than others. 2 | -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/fonts/NotoSans-Bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Warxim/vucsa/HEAD/vucsa-client/src/main/resources/fonts/NotoSans-Bold.ttf -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/fonts/NotoSans-Regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Warxim/vucsa/HEAD/vucsa-client/src/main/resources/fonts/NotoSans-Regular.ttf -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/12002.txt: -------------------------------------------------------------------------------- 1 | Not a Real Book 2 | Book Which Was Never Written 3 | Almost Real Book Name 4 | Book About Books About Books -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/1001.txt: -------------------------------------------------------------------------------- 1 | Shopping list: 2 | - tofu 3 | - chickpeas 4 | - beans 5 | - bulgur 6 | - rice 7 | - apples 8 | - bananas 9 | - oranges 10 | - avocados 11 | - coffee -------------------------------------------------------------------------------- /vucsa-server/server/challenge/horizontalaccesscontrol/document/11011.txt: -------------------------------------------------------------------------------- 1 | I have to write this down, so I do not forget it... 2 | 3 | User: super-alien-farmer 4 | Password: AllAnimalsAreEqualButSomeAnimalsAreMoreEqualThanOthers 5 | -------------------------------------------------------------------------------- /scripts/server.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | JAVA="java" 4 | APP_HOME="`pwd`" 5 | DEFAULT_JVM_OPTS= 6 | CMD_LINE_ARGS=$@ 7 | CLASSPATH=$APP_HOME/lib/* 8 | MAIN_CLASS="com.warxim.vucsa.server.Main" 9 | LOG_FILE=server.log 10 | 11 | $JAVA -cp "$CLASSPATH" $MAIN_CLASS $CMD_LINE_ARGS 12 | -------------------------------------------------------------------------------- /scripts/client.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | JAVA="java" 4 | APP_HOME="`pwd`" 5 | DEFAULT_JVM_OPTS= 6 | CMD_LINE_ARGS=$@ 7 | CLASSPATH=$APP_HOME/lib/* 8 | MAIN_CLASS="com.warxim.vucsa.client.Main" 9 | LOG_FILE=client.log 10 | 11 | nohup $JAVA -cp "$CLASSPATH" $MAIN_CLASS $CMD_LINE_ARGS > $LOG_FILE & 12 | -------------------------------------------------------------------------------- /scripts/server.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | set JAVA_EXE=java.exe 3 | set JAVAW_EXE=javaw.exe 4 | set DIRNAME=%~dp0 5 | set APP_HOME=%DIRNAME% 6 | set CMD_LINE_ARGS=%* 7 | set DEFAULT_JVM_OPTS= 8 | set CLASSPATH=%APP_HOME%\lib\* 9 | set MAIN_CLASS="com.warxim.vucsa.server.Main" 10 | 11 | rem Start Vulnerable Server without GUI (let console open). 12 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% -classpath "%CLASSPATH%" %MAIN_CLASS% %CMD_LINE_ARGS% 13 | -------------------------------------------------------------------------------- /scripts/client.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | set JAVA_EXE=java.exe 3 | set JAVAW_EXE=javaw.exe 4 | set DIRNAME=%~dp0 5 | set APP_HOME=%DIRNAME% 6 | set CMD_LINE_ARGS=%* 7 | set DEFAULT_JVM_OPTS= 8 | set CLASSPATH=%APP_HOME%\lib\* 9 | set MAIN_CLASS="com.warxim.vucsa.client.Main" 10 | 11 | rem Start Vulnerable Client with GUI (without console). 12 | start "" /b "%JAVAW_EXE%" %DEFAULT_JVM_OPTS% -classpath "%CLASSPATH%" %MAIN_CLASS% %CMD_LINE_ARGS% 13 | -------------------------------------------------------------------------------- /vucsa-common/build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'java' 3 | } 4 | 5 | group 'com.warxim' 6 | version '1.1' 7 | 8 | repositories { 9 | mavenCentral() 10 | } 11 | 12 | dependencies { 13 | compileOnly 'org.projectlombok:lombok:1.18.24' 14 | annotationProcessor 'org.projectlombok:lombok:1.18.24' 15 | implementation 'com.google.code.gson:gson:2.9.0' 16 | 17 | testImplementation 'org.testng:testng:7.6.0' 18 | testImplementation 'org.assertj:assertj-core:3.23.1' 19 | testImplementation 'org.mockito:mockito-inline:4.6.1' 20 | } 21 | 22 | test { 23 | useTestNG() 24 | } 25 | -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # Changelog 2 | 3 | All notable changes to this project will are documented in this changelog file. 4 | 5 | ## [1.1.0] - 2023-09-09 6 | ### Added 7 | - added RCE Deserialization challenge 8 | 9 | ## [1.0.1] - 2023-06-02 10 | ### Added 11 | - fixed macOS icon 12 | - updated readme 13 | - fixed url 14 | 15 | ## [1.0.0] - 2022-01-01 16 | ### Added 17 | - common functionality 18 | - server and client implementation 19 | - 7 basic challenges 20 | - Buffer Over-read (simulated) 21 | - Command Execution 22 | - SQL Injection 23 | - Enumeration 24 | - XML 25 | - Horizontal Access Control 26 | - Vertical Access Control -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/fxml/tab/LogTab.fxml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | -------------------------------------------------------------------------------- /vucsa-server/build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'java' 3 | id 'application' 4 | } 5 | 6 | group 'com.warxim' 7 | version '1.1' 8 | mainClassName = 'com.warxim.vucsa.server.Main' 9 | 10 | repositories { 11 | mavenCentral() 12 | } 13 | 14 | dependencies { 15 | implementation project(':vucsa-common') 16 | 17 | compileOnly 'org.projectlombok:lombok:1.18.24' 18 | annotationProcessor 'org.projectlombok:lombok:1.18.24' 19 | implementation 'com.google.code.gson:gson:2.9.0' 20 | implementation 'org.xerial:sqlite-jdbc:3.36.0.3' 21 | 22 | testImplementation 'org.testng:testng:7.6.0' 23 | testImplementation 'org.assertj:assertj-core:3.23.1' 24 | } 25 | 26 | test { 27 | useTestNG() 28 | } 29 | 30 | application { 31 | executableDir = '' 32 | 33 | copy { 34 | from './server' 35 | into 'build/run/server' 36 | } 37 | } 38 | 39 | // Set run working directory to build/run 40 | File runningDir = new File('build/run') 41 | runningDir.mkdirs() 42 | tasks.run.workingDir = runningDir -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/advanced/Processor.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal.advanced; 18 | 19 | /** 20 | * Vulnerable interface, part of RCE Deserialization challenge 21 | */ 22 | public interface Processor { 23 | Object process(Object... args); 24 | } -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/xml/StorageItem.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.xml; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Storage item represents KEY-VALUE pair in storage. 24 | */ 25 | @Builder 26 | @Value 27 | public class StorageItem { 28 | String key; 29 | String value; 30 | } 31 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/enumeration/User.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.enumeration; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * User model 24 | */ 25 | @Builder 26 | @Value 27 | public class User { 28 | String username; 29 | String password; 30 | String secret; 31 | } 32 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/configuration/Configuration.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.configuration; 18 | 19 | import com.warxim.vucsa.server.core.ServerConfig; 20 | import lombok.Builder; 21 | import lombok.Data; 22 | 23 | /** 24 | * Configuration 25 | */ 26 | @Builder 27 | @Data 28 | public class Configuration { 29 | private ServerConfig network; 30 | } 31 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/rcedeserialization/MessageContent.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.rcedeserialization; 18 | 19 | import lombok.Value; 20 | 21 | import java.io.Serializable; 22 | 23 | /** 24 | * Serializable content of text message 25 | */ 26 | @Value 27 | public class MessageContent implements Serializable { 28 | String text; 29 | } 30 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/Main.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server; 18 | 19 | import com.warxim.vucsa.server.bootstrap.ConsoleBootstrap; 20 | 21 | /** 22 | * Main server application class. 23 | */ 24 | public final class Main { 25 | public static void main(String[] args) { 26 | new ConsoleBootstrap().start(); 27 | } 28 | 29 | private Main() {} 30 | } 31 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/advanced/BaseProcessor.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal.advanced; 18 | 19 | import java.io.Serializable; 20 | 21 | /** 22 | * Vulnerable class, part of RCE Deserialization challenge 23 | */ 24 | public abstract class BaseProcessor implements Processor, Serializable { 25 | } -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/sqlinjection/FoodEntity.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.sqlinjection; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Food entity representing result of search query. 24 | */ 25 | @Builder 26 | @Value 27 | public class FoodEntity { 28 | int id; 29 | String name; 30 | String description; 31 | double price; 32 | } 33 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/advanced/ChainedProcessorOutputAsArgPlaceholder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal.advanced; 18 | 19 | import java.io.Serializable; 20 | 21 | /** 22 | * Vulnerable class, part of RCE Deserialization challenge 23 | */ 24 | public class ChainedProcessorOutputAsArgPlaceholder implements Serializable { 25 | 26 | } -------------------------------------------------------------------------------- /vucsa-client/src/main/java/com/warxim/vucsa/client/core/ClientConfig.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.client.core; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Client configuration. 24 | */ 25 | @Value 26 | @Builder 27 | public class ClientConfig { 28 | /** 29 | * Server host (127.0.0.1, www.example.org, ...) 30 | */ 31 | String serverHost; 32 | 33 | /** 34 | * Server port (8765, ...) 35 | */ 36 | int serverPort; 37 | } 38 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/core/ServerConfig.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.core; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Server configuration. 24 | */ 25 | @Value 26 | @Builder 27 | public class ServerConfig { 28 | /** 29 | * Server host (127.0.0.1, www.example.org, ...) 30 | */ 31 | String serverHost; 32 | 33 | /** 34 | * Server port (8765, ...) 35 | */ 36 | int serverPort; 37 | } 38 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/core/ServerState.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.core; 18 | 19 | /** 20 | * State of server. 21 | */ 22 | public enum ServerState { 23 | /** 24 | * Server is starting 25 | */ 26 | STARTING, 27 | /** 28 | * Server is running 29 | */ 30 | STARTED, 31 | /** 32 | * Server is stopping 33 | */ 34 | STOPPING, 35 | /** 36 | * Server is offline 37 | */ 38 | STOPPED 39 | } 40 | -------------------------------------------------------------------------------- /vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/horizontalaccesscontrol/DocumentItem.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.client.challenge.horizontalaccesscontrol; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Document item for displaying user's documents overview. 24 | */ 25 | @Builder 26 | @Value 27 | public class DocumentItem { 28 | int id; 29 | String name; 30 | 31 | @Override 32 | public String toString() { 33 | return name; 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/connection/ConnectionState.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.connection; 18 | 19 | /** 20 | * State of connection. 21 | */ 22 | public enum ConnectionState { 23 | /** 24 | * Connection is starting 25 | */ 26 | STARTING, 27 | /** 28 | * Connection is running 29 | */ 30 | STARTED, 31 | /** 32 | * Connection is stopping 33 | */ 34 | STOPPING, 35 | /** 36 | * Connection is offline 37 | */ 38 | STOPPED 39 | } 40 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/Constant.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common; 18 | 19 | /** 20 | * Global constants. 21 | */ 22 | public final class Constant { 23 | public static final String VERSION = "1.1.0"; 24 | public static final String WEB = "https://vucsa.warxim.com"; 25 | 26 | public static final String DEFAULT_SERVER_HOST = "127.0.0.1"; 27 | public static final int DEFAULT_SERVER_PORT = 8765; 28 | 29 | public static final String SERVER_CONFIG_PATH = "server.json"; 30 | 31 | private Constant() {} 32 | } 33 | -------------------------------------------------------------------------------- /vucsa-client/src/main/java/com/warxim/vucsa/client/gui/GuiConstant.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.client.gui; 18 | 19 | public final class GuiConstant { 20 | /** 21 | * Path to main CSS file of the application 22 | */ 23 | public static final String MAIN_CSS_PATH = "/css/Main.css"; 24 | public static final String ICON_PATH = "/img/Logo.png"; 25 | 26 | public static final int LOG_TAB_ORDER = 1; 27 | public static final int SETTINGS_TAB_ORDER = 2; 28 | public static final int CHALLENGES_TAB_ORDER = 10; 29 | 30 | private GuiConstant() {} 31 | } 32 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/MessageSerializer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message; 18 | 19 | import java.util.Optional; 20 | 21 | /** 22 | * Message serializer for serializing message into bytes. 23 | */ 24 | public interface MessageSerializer { 25 | /** 26 | * Serializes message into deserialized message. 27 | * @param message Message to be serialized 28 | * @return Serialized message or empty optional if the serialization failed 29 | */ 30 | Optional serializeMessage(Message message); 31 | } 32 | -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/fxml/Application.fxml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/BasicCommand.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal; 18 | 19 | import java.io.ObjectInputStream; 20 | import java.io.Serializable; 21 | 22 | /** 23 | * Basic Command represents vulnerable class that can be exploited using RCE 24 | */ 25 | public class BasicCommand implements Serializable { 26 | public String cmd; 27 | 28 | private void readObject(ObjectInputStream in) throws Exception { 29 | in.defaultReadObject(); 30 | 31 | Runtime.getRuntime().exec(cmd); 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/MessageDeserializer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message; 18 | 19 | import java.util.Optional; 20 | 21 | /** 22 | * Message deserializer for deserializing bytes into specific message object. 23 | */ 24 | public interface MessageDeserializer { 25 | /** 26 | * Deserializes serialized message into specific message object. 27 | * @param serializedMessage Serialized message to be deserialized 28 | * @return Message or empty optional if the deserialization failed 29 | */ 30 | Optional deserializeMessage(SerializedMessage serializedMessage); 31 | } 32 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/configuration/ConfigurationException.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.configuration; 18 | 19 | /** 20 | * Configuration exception for configuration errors 21 | * (configuration does not exist, cannot be accessed, invalid fields, ...) 22 | */ 23 | public final class ConfigurationException extends Exception { 24 | private static final long serialVersionUID = 1L; 25 | 26 | public ConfigurationException(String message) { 27 | super(message); 28 | } 29 | 30 | public ConfigurationException(String message, Throwable cause) { 31 | super(message, cause); 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/SerializedMessage.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message; 18 | 19 | import lombok.Builder; 20 | import lombok.Value; 21 | 22 | /** 23 | * Serialized message used for transmitting the message over network. 24 | */ 25 | @Builder 26 | @Value 27 | public class SerializedMessage { 28 | /** 29 | * Type of the message 30 | */ 31 | MessageType type; 32 | 33 | /** 34 | * Target identifier of target handler 35 | */ 36 | int target; 37 | 38 | /** 39 | * Length of the payload 40 | */ 41 | int length; 42 | 43 | /** 44 | * Payload length 45 | */ 46 | byte[] payload; 47 | } 48 | -------------------------------------------------------------------------------- /vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/ChallengeWrapper.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.client.challenge; 18 | 19 | import com.warxim.vucsa.common.connection.listener.ConnectionListener; 20 | import javafx.scene.Node; 21 | import lombok.Builder; 22 | import lombok.Value; 23 | 24 | /** 25 | * Wrapper for keeping JavaFX node and controller of a challenge. 26 | */ 27 | @Value 28 | @Builder 29 | public class ChallengeWrapper implements ConnectionListener { 30 | /** 31 | * Challenge node, which is displayed in the tab. 32 | */ 33 | Node node; 34 | 35 | /** 36 | * Controller for controlling the challenge GUI. 37 | */ 38 | ChallengeController controller; 39 | } 40 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/Message.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message; 18 | 19 | import lombok.EqualsAndHashCode; 20 | import lombok.Getter; 21 | import lombok.RequiredArgsConstructor; 22 | 23 | /** 24 | * Message base class. 25 | *

26 | * Message is a protocol data unit in vulnerable application. 27 | *

28 | */ 29 | @EqualsAndHashCode 30 | @Getter 31 | @RequiredArgsConstructor 32 | public abstract class Message { 33 | /** 34 | * Identifier of target handler. 35 | */ 36 | private final int target; 37 | 38 | /** 39 | * Obtains type of the message. 40 | * @return Message type 41 | */ 42 | public abstract MessageType getType(); 43 | } 44 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/core/connection/ServerConnection.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.core.connection; 18 | 19 | import com.warxim.vucsa.common.connection.Connection; 20 | import com.warxim.vucsa.common.connection.listener.ConnectionListener; 21 | import com.warxim.vucsa.common.message.MessageHandler; 22 | 23 | import java.net.Socket; 24 | 25 | /** 26 | * Server connection representing connection between client and server. 27 | */ 28 | public class ServerConnection extends Connection { 29 | public ServerConnection(int id, Socket socket, ConnectionListener listener, MessageHandler handler) { 30 | super(id, listener, handler); 31 | this.socket = socket; 32 | } 33 | } 34 | 35 | -------------------------------------------------------------------------------- /vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/ChallengeController.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.client.challenge; 18 | 19 | import com.warxim.vucsa.client.Bundle; 20 | import com.warxim.vucsa.common.message.Message; 21 | 22 | /** 23 | * Base class of challenge controllers. 24 | */ 25 | public abstract class ChallengeController { 26 | /** 27 | * Sends message using client manager. 28 | * @param message Message to be sent 29 | * @return {@code true} if the message has been successfully sent 30 | */ 31 | protected boolean sendMessage(Message message) { 32 | var clientManager = Bundle.getInstance().getClientManager(); 33 | return clientManager.sendMessage(message); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/xml/XmlChallenge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.xml; 18 | 19 | import com.warxim.vucsa.server.challenge.Challenge; 20 | import com.warxim.vucsa.server.core.ServerManager; 21 | import com.warxim.vucsa.common.ChallengeConstant; 22 | 23 | /** 24 | * XML challenge 25 | */ 26 | public class XmlChallenge extends Challenge { 27 | @Override 28 | public void load(ServerManager serverManager) { 29 | serverManager.registerHandler(ChallengeConstant.XML_TARGET, new XmlHandler()); 30 | } 31 | 32 | @Override 33 | public void unload(ServerManager serverManager) { 34 | serverManager.unregisterHandler(ChallengeConstant.XML_TARGET); 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/verticalaccesscontrol/request/UserInfoRequest.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.verticalaccesscontrol.request; 18 | 19 | import com.warxim.vucsa.common.message.MessageType; 20 | import com.warxim.vucsa.common.message.Message; 21 | import lombok.Builder; 22 | import lombok.EqualsAndHashCode; 23 | import lombok.Value; 24 | 25 | /** 26 | * User info request. 27 | */ 28 | @Value 29 | @EqualsAndHashCode(callSuper = true) 30 | public class UserInfoRequest extends Message { 31 | @Builder 32 | public UserInfoRequest(int target) { 33 | super(target); 34 | } 35 | 36 | @Override 37 | public MessageType getType() { 38 | return MessageType.VERTICAL_ACCESS_CONTROL_USER_INFO_REQUEST; 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/core/listener/ServerListener.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.core.listener; 18 | 19 | /** 20 | * Server listener for listening for server events. 21 | */ 22 | public interface ServerListener { 23 | /** 24 | * Event before start step is processed (server is starting). 25 | */ 26 | default void beforeStart() {} 27 | 28 | /** 29 | * Event after start step is processed (server is running). 30 | */ 31 | default void afterStart() {} 32 | 33 | /** 34 | * Event before stop step is processed (server is stopping). 35 | */ 36 | default void beforeStop() {} 37 | 38 | /** 39 | * Event before stop step is processed (server is offline). 40 | */ 41 | default void afterStop() {} 42 | } 43 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/advanced/ChainedProcessorDescriptor.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal.advanced; 18 | 19 | import java.io.Serializable; 20 | 21 | /** 22 | * Vulnerable class, part of RCE Deserialization challenge 23 | */ 24 | public class ChainedProcessorDescriptor implements Serializable { 25 | private final Processor processor; 26 | private final Object[] args; 27 | 28 | public ChainedProcessorDescriptor(Processor processor, Object[] args) { 29 | this.processor = processor; 30 | this.args = args; 31 | } 32 | 33 | public Processor getProcessor() { 34 | return processor; 35 | } 36 | 37 | public Object[] getArgs() { 38 | return args; 39 | } 40 | } -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/connection/listener/ConnectionListener.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.connection.listener; 18 | 19 | import com.warxim.vucsa.common.connection.Connection; 20 | 21 | /** 22 | * ConnectionListener allows code to listen for connection start/stop events. 23 | *

24 | * All event handlers should be called from ConnectionManager. 25 | *

26 | */ 27 | public interface ConnectionListener { 28 | /** 29 | * Event for connection start. 30 | * @param connection Connection that started 31 | */ 32 | default void onConnectionStart(Connection connection) {} 33 | 34 | /** 35 | * Event for connection stop. 36 | * @param connection Connection that stopped 37 | */ 38 | default void onConnectionStop(Connection connection) {} 39 | } 40 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/verticalaccesscontrol/request/SecretRequest.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.verticalaccesscontrol.request; 18 | 19 | import com.warxim.vucsa.common.message.MessageType; 20 | import com.warxim.vucsa.common.message.Message; 21 | import lombok.Builder; 22 | import lombok.EqualsAndHashCode; 23 | import lombok.Value; 24 | 25 | /** 26 | * Secret request (requests server to send secret to the client). 27 | */ 28 | @Value 29 | @EqualsAndHashCode(callSuper = true) 30 | public class SecretRequest extends Message { 31 | @Builder 32 | public SecretRequest(int target) { 33 | super(target); 34 | } 35 | 36 | @Override 37 | public MessageType getType() { 38 | return MessageType.VERTICAL_ACCESS_CONTROL_SECRET_REQUEST; 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/verticalaccesscontrol/request/SecretRequestDeserializer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.verticalaccesscontrol.request; 18 | 19 | import com.warxim.vucsa.common.message.SerializedMessage; 20 | import com.warxim.vucsa.common.message.Message; 21 | import com.warxim.vucsa.common.message.MessageDeserializer; 22 | 23 | import java.util.Optional; 24 | 25 | /** 26 | * Deserializer for {@link SecretRequest}. 27 | */ 28 | public class SecretRequestDeserializer implements MessageDeserializer { 29 | @Override 30 | public Optional deserializeMessage(SerializedMessage serializedMessage) { 31 | return Optional.of(SecretRequest.builder() 32 | .target(serializedMessage.getTarget()) 33 | .build()); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization/internal/advanced/ProcessorCommand.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2023 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.rcedeserialization.internal.advanced; 18 | 19 | import java.io.ObjectInputStream; 20 | import java.io.Serializable; 21 | 22 | /** 23 | * Vulnerable class, part of RCE Deserialization challenge 24 | */ 25 | public class ProcessorCommand implements Serializable { 26 | private final Processor processor; 27 | private final Object[] args; 28 | 29 | private ProcessorCommand(Processor processor, Object[] args) { 30 | this.processor = processor; 31 | this.args = args; 32 | } 33 | 34 | private void readObject(ObjectInputStream in) throws Exception { 35 | in.defaultReadObject(); 36 | 37 | processor.process(args); 38 | } 39 | } -------------------------------------------------------------------------------- /vucsa-common/src/main/java/com/warxim/vucsa/common/message/verticalaccesscontrol/request/UserInfoRequestDeserializer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.common.message.verticalaccesscontrol.request; 18 | 19 | import com.warxim.vucsa.common.message.Message; 20 | import com.warxim.vucsa.common.message.MessageDeserializer; 21 | import com.warxim.vucsa.common.message.SerializedMessage; 22 | 23 | import java.util.Optional; 24 | 25 | /** 26 | * Deserializer for {@link UserInfoRequest}. 27 | */ 28 | public class UserInfoRequestDeserializer implements MessageDeserializer { 29 | @Override 30 | public Optional deserializeMessage(SerializedMessage serializedMessage) { 31 | return Optional.of(UserInfoRequest.builder() 32 | .target(serializedMessage.getTarget()) 33 | .build()); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/bufferoverread/BufferOverreadChallenge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Vulnerable Client-Server Application (VuCSA) 3 | * 4 | * Copyright (C) 2021 Michal Válka 5 | * 6 | * This program is free software: you can redistribute it and/or modify it under the terms of the 7 | * GNU General Public License as published by the Free Software Foundation, either version 3 of the 8 | * License, or (at your option) any later version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without 11 | * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 | * General Public License for more details. 13 | * 14 | * You should have received a copy of the GNU General Public License along with this program. If 15 | * not, see . 16 | */ 17 | package com.warxim.vucsa.server.challenge.bufferoverread; 18 | 19 | import com.warxim.vucsa.server.challenge.Challenge; 20 | import com.warxim.vucsa.server.core.ServerManager; 21 | import com.warxim.vucsa.common.ChallengeConstant; 22 | 23 | /** 24 | * Buffer over-read challenge 25 | */ 26 | public class BufferOverreadChallenge extends Challenge { 27 | @Override 28 | public void load(ServerManager serverManager) { 29 | serverManager.registerHandler(ChallengeConstant.BUFFER_OVERREAD_TARGET, new BufferOverreadHandler()); 30 | } 31 | 32 | @Override 33 | public void unload(ServerManager serverManager) { 34 | serverManager.unregisterHandler(ChallengeConstant.BUFFER_OVERREAD_TARGET); 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /vucsa-client/src/main/resources/fxml/challenge/horizontalaccesscontrol/HorizontalAccessControlTab.fxml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |