├── .github
└── FUNDING.yml
├── README.md
├── html
├── buy.php
├── exec.php
├── log.php
├── portfolio.php
├── sqlinject.php
├── xsrf.html
└── xss.php
└── owasp.sql
/.github/FUNDING.yml:
--------------------------------------------------------------------------------
1 | # These are supported funding model platforms
2 |
3 | github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
4 | patreon: # Replace with a single Patreon username
5 | open_collective: # Replace with a single Open Collective username
6 | ko_fi: # Replace with a single Ko-fi username
7 | tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8 | community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9 | liberapay: # Replace with a single Liberapay username
10 | issuehunt: # Replace with a single IssueHunt username
11 | otechie: # Replace with a single Otechie username
12 | custom: http://paypal.me/jayaditya11
13 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # OWASP_DEMO
2 | just a bunch of vulnerable web pages for demo
3 |
4 | ##Database
5 | Jut import the database using phpmyadmin or execute queries manually .
6 |
7 | No UI has been made , it's just basic demo to show how some attacks works.
8 |
--------------------------------------------------------------------------------
/html/buy.php:
--------------------------------------------------------------------------------
1 |
14 |
15 |
16 |
17 | Cross-Site Request Forgery
18 |
19 |
20 | prepare('INSERT INTO portfolios (id,symbol,shares)
27 | VALUES (:id,:symbol,:shares)');
28 | $stmt->bindValue(':id',$_SESSION['id']);
29 | $stmt->bindValue(':symbol',$_GET['symbol']);
30 | $stmt->bindValue(':shares',$_GET['shares']);
31 | $stmt->execute();
32 | echo "You just bought {$_GET['shares']} shares of {$_GET['symbol']}!
";
33 | }
34 | ?>
35 |
36 |
37 |
--------------------------------------------------------------------------------
/html/exec.php:
--------------------------------------------------------------------------------
1 |
18 |
19 |
20 | exec() Attack
21 |
22 |
23 | Available commands:
24 |
32 |
33 | Output of last command:
34 |
35 |
39 |
40 |
41 |
42 |
--------------------------------------------------------------------------------
/html/log.php:
--------------------------------------------------------------------------------
1 | prepare('INSERT INTO cookies (cookie) VALUES (:cookie)');
19 | $stmt->bindValue(':cookie',$_GET['x']);
20 | $stmt->execute();
21 | }
22 |
--------------------------------------------------------------------------------
/html/portfolio.php:
--------------------------------------------------------------------------------
1 | | Symbol | Shares |
|---|
';
19 | foreach ($dbh->query(sprintf("SELECT symbol, shares
20 | FROM portfolios
21 | WHERE id='%s'", $_SESSION['id'])) as $holding)
22 | print "| {$holding[0]} | {$holding[1]} |
";
23 | print '';
24 | }
25 |
26 | ?>
27 |
28 |
29 |
30 | Portfolio (Cross-Site Request Forgery)
31 |
32 |
33 | Current portfolio:
34 |
35 |
36 |
37 |
--------------------------------------------------------------------------------
/html/sqlinject.php:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | OWASP DEMO
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 | query($sql) as $row)
43 | {
44 | // if any rows returned, we logged in
45 | $success = true;
46 | }
47 |
48 | // print results
49 | if ($success)
50 | echo "Successful login!\n";
51 | else
52 | echo "Bad username or password\n";
53 | ?>
54 |
55 |
56 |
--------------------------------------------------------------------------------
/html/xsrf.html:
--------------------------------------------------------------------------------
1 |
6 |
7 |
8 | Cross-Site Request Forgery
9 |
10 |
11 | This is my completely benign website. Trust me.
12 |
13 | 
14 |
15 |
16 |
--------------------------------------------------------------------------------
/html/xss.php:
--------------------------------------------------------------------------------
1 | alert("Hacked!");
7 | *
8 | * Hello!
9 | * Hello!
10 | *
11 | **********************************************************************/
12 |
13 | // database connection
14 | $dsn = 'mysql:host=localhost;dbname=owasp';
15 | $db_user = 'root';
16 | $db_pass = '';
17 | $dbh = new PDO($dsn, $db_user, $db_pass);
18 |
19 | // create a dummy cookie
20 | session_start();
21 | setcookie('user', $db_user);
22 | setcookie('password', $db_pass);
23 |
24 | // handle database inserts
25 | if (isset($_POST['comment']))
26 | {
27 | $stmt = $dbh->prepare('INSERT INTO comments (comment) VALUES (:comment)');
28 | $stmt->bindValue(':comment',$_POST['comment']);
29 | $stmt->execute();
30 | }
31 |
32 | // function to display all comments
33 | function print_comment_table($dbh)
34 | {
35 | print '| Comment |
|---|
';
36 | foreach ($dbh->query('SELECT * FROM comments') as $comment)
37 | print "| {$comment[1]} |
";
38 | print '
';
39 | }
40 |
41 | ?>
42 |
43 |
44 | Stored Cross-Site Scripting
45 |
46 |
47 | Current comments:
48 |
49 | Add a new comment:
50 |
54 |
55 |
56 |
--------------------------------------------------------------------------------
/owasp.sql:
--------------------------------------------------------------------------------
1 |
2 |
3 | SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
4 | SET time_zone = "+00:00";
5 |
6 |
7 |
8 |
9 | CREATE TABLE IF NOT EXISTS `comments` (
10 | `id` int(11) NOT NULL AUTO_INCREMENT,
11 | `comment` text NOT NULL,
12 | PRIMARY KEY (`id`)
13 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=14 ;
14 |
15 |
16 |
17 | CREATE TABLE IF NOT EXISTS `cookies` (
18 | `id` int(11) NOT NULL AUTO_INCREMENT,
19 | `cookie` text NOT NULL,
20 | PRIMARY KEY (`id`)
21 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=9 ;
22 |
23 |
24 |
25 | CREATE TABLE IF NOT EXISTS `portfolios` (
26 | `id` int(11) NOT NULL,
27 | `symbol` char(8) NOT NULL,
28 | `shares` int(11) NOT NULL,
29 | PRIMARY KEY (`id`,`symbol`)
30 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
31 |
32 |
33 |
34 | INSERT INTO `portfolios` (`id`, `symbol`, `shares`) VALUES
35 | (1, 'AAPL', 100);
36 |
37 |
38 |
39 | CREATE TABLE IF NOT EXISTS `test` (
40 | `id` int(11) NOT NULL AUTO_INCREMENT,
41 | PRIMARY KEY (`id`)
42 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
43 |
44 |
45 |
46 | CREATE TABLE IF NOT EXISTS `users` (
47 | `id` varchar(15) NOT NULL,
48 | `pwd` varchar(15) NOT NULL,
49 | PRIMARY KEY (`id`)
50 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
51 |
52 |
53 | INSERT INTO `users` (`id`, `pwd`) VALUES
54 | ('alain', 'abc123'),
55 | ('chris', 'password'),
56 | ('david', 'secret'),
57 | ('peter', 'qwerty'),
58 | ('jay', 'test123'),
59 | ('spyros','owasp');
60 |
--------------------------------------------------------------------------------