-
Notifications
You must be signed in to change notification settings - Fork 156
Feature/CWE 20 #165
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
timmyteo
wants to merge
2
commits into
OWASP:main
Choose a base branch
from
timmyteo:feature/CWE-20
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Feature/CWE 20 #165
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Binary file not shown.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> | ||
| <%@ page import="inc.insecure.*" %> | ||
| <%@ page import="insecure.inc.Constants" %> | ||
| <% | ||
| String alertVisibility = "hidden"; | ||
| String usr = request.getParameter("usr"); | ||
| String pwd = request.getParameter("pwd"); | ||
|
|
||
| if(usr!=null && pwd!=null) { | ||
| alertVisibility=""; | ||
| if(usr.equals("demo") && pwd.equals("demo1234")) { | ||
| request.getSession().setAttribute("cwe20loggedin", true); | ||
| response.sendRedirect("cwe20loggedin.jsp"); | ||
| } | ||
| } | ||
| %> | ||
| <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> | ||
| <html> | ||
| <head> | ||
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> | ||
| <title>Improper Input Validation</title> | ||
| <link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css"> | ||
| <script src="public/jquery.min.js"></script> | ||
| <script src="public/bootstrap/js/bootstrap.min.js"></script> | ||
|
|
||
| </head> | ||
| <body> | ||
| <nav class="navbar navbar-inverse"> | ||
| <div class="container-fluid"> | ||
| <div class="navbar-header"> | ||
| <a class="navbar-brand" href="index.jsp">Insecure Inc.</a> | ||
| </div> | ||
| <ul class="nav navbar-nav"> | ||
| <li class="active"><a href="#">cwe20 - Improper Input Validation</a></li> | ||
| </ul> | ||
| </div> | ||
| </nav> | ||
| <div class="container"> | ||
| <p>Welcome to cwe20 - Improper Input Validation!</p> | ||
| <p>Your yearly subscription to Insecure Inc. is about to expire. Please login to pay for your next year of subscription.</p> | ||
| <p>You can use the following guest account credentials to login, | ||
| user: <code>demo</code>, password: <code>demo1234</code> </p> | ||
| <form action="cwe20.jsp" autocomplete="off" method="POST"> | ||
| <div class="form-group"> | ||
| <label for="usr">Name:</label> | ||
| <input type="text" class="form-control" id="usr" name="usr"> | ||
| </div> | ||
| <!-- disables autocomplete --><input type="text" style="display:none"> | ||
| <div class="form-group"> | ||
| <label for="pwd">Password:</label> | ||
| <input type="password" class="form-control" id="pwd" name="pwd"> | ||
| </div> | ||
| <input type="submit" id="submit" class="btn" value="Submit"> | ||
| <br><br> | ||
| <div class="alert alert-danger <%=alertVisibility%>"> | ||
| Invalid credentials! | ||
| </div> | ||
| </form> | ||
| </div> | ||
| </body> | ||
| </html> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> | ||
| <%@ page import="inc.insecure.*" %> | ||
| <%@ page import="insecure.inc.Constants" %> | ||
| <% | ||
|
|
||
| String alertVisibility = "hidden"; | ||
| String error = ""; | ||
| String logoutParameter = request.getParameter("logout"); | ||
|
|
||
| if(logoutParameter!=null){ | ||
| if(logoutParameter.equals("true")){ | ||
| response.sendRedirect("cwe20.jsp?loggedin=false"); | ||
| } | ||
| } | ||
|
|
||
| if(session == null || session.getAttribute("cwe20loggedin") == null || !(boolean)session.getAttribute("cwe20loggedin")) { | ||
| response.sendRedirect("cwe20.jsp?loggedin=false"); | ||
| } | ||
| else { | ||
| String cost = request.getParameter("cost"); | ||
| int costParsed = 0; | ||
|
|
||
| try { | ||
| costParsed = Integer.parseInt(cost); | ||
| } catch (Exception e) { | ||
| cost = null; | ||
| } | ||
|
|
||
| if(cost != null) { | ||
| alertVisibility = ""; | ||
|
|
||
| if(costParsed == 0) { | ||
| error = "The subscription amount cannot be zero!"; | ||
| } else if (costParsed > 0) { | ||
| error = "Subscription was renewed!"; | ||
| } else { | ||
| session.setAttribute(Constants.CHALLENGE_ID,"cwe20"); | ||
| response.sendRedirect(Constants.SECRET_PAGE); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| %> | ||
| <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> | ||
| <html> | ||
| <head> | ||
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> | ||
| <title>Guest</title> | ||
| <link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css"> | ||
| <script src="public/jquery.min.js"></script> | ||
| <script src="public/bootstrap/js/bootstrap.min.js"></script> | ||
|
|
||
| </head> | ||
| <body> | ||
| <nav class="navbar navbar-inverse"> | ||
| <div class="container-fluid"> | ||
| <div class="navbar-header"> | ||
| <a class="navbar-brand" href="index.jsp">Insecure Inc.</a> | ||
| </div> | ||
| <ul class="nav navbar-nav"> | ||
| <li class="active"><a href="#">Guest</a></li> | ||
| </ul> | ||
|
|
||
| <ul class="nav navbar-nav navbar-right"> | ||
| <li><a href="cwe20loggedin.jsp?logout=true"><span class="glyphicon glyphicon-log-out"></span> Logout</a></li> | ||
| </ul> | ||
|
|
||
| </div> | ||
| </nav> | ||
| <div class="container"> | ||
| <h1>Time to renew your subscription for Insecure Inc.</h1> | ||
| <p>Select your payment method and purchase your next year of service</p> | ||
| <form action="cwe20loggedin.jsp" autocomplete="off" method="POST"> | ||
| <div class="form-group"> | ||
| <label for="payment">Payment Method:</label> | ||
| <select name="payment" id="payment"> | ||
| <option value="1" selected>Visa card ending *2356</option> | ||
| </select> | ||
| <input type="hidden" class="form-control" id="cost" name="cost" value="60"> | ||
| </div> | ||
| <input type="submit" id="submit" class="btn" value="Submit"> | ||
| <br> | ||
| <br> | ||
| After submitting your renewal, you will see a charge of $60 on your statement under "Insecure Inc." | ||
| <br> | ||
| <br> | ||
| <div class="alert alert-danger <%=alertVisibility%>"> | ||
| <%=error%> | ||
| </div> | ||
| </form> | ||
| </div> | ||
| </body> | ||
| </html> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+42.9 KB
trainingportal/static/lessons/attack-grams/improperinputvalidation.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| The purpose of this challenge is to demonstrate the MITRE Top 25 programming flaw: 'Improper Input Validation'. Given that this CWE is broad and covers many different underlying attacks, the focus of this challenge will be in logical operations. | ||
|
|
||
| > *"The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly."* | ||
| > - From MITRE [CWE 20](https://cwe.mitre.org/data/definitions/20.html) | ||
|
|
||
| The developer of the vulnerable application has implemented a subscription page for users to renew subscription to the service. The developer has not considered all possibilities that should be validated with the untrusted data coming from the user. Find a way to renew the subscription without paying any money. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| ### Solution for "Improper Input Validation" challenge | ||
|
|
||
| Systems that accept data from the user should perform all possible data validations for the given context that the data will be used in, and reject the data if it does not conform to the expectations of the data format. Just a few examples include: | ||
|
|
||
| - Ensuring data that should represent a number is only comprised of numeric characters and is greater than or equal to zero if the number is expected to be positive | ||
| - Ensuring data that should only be a certain length or within a certain range of values conforms to that expectation | ||
| - Ensuring reasonableness of data, like it does not really make sense that a user is requesting 1,000,000,000,000 units of a product | ||
|
|
||
| To pass this challenge: | ||
|
|
||
| - Inspect the HTML of the form; the goal is to find values that can be tampered with | ||
| - Submit the form with values such that a subscription renewal will occur without the system deducting a payment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@timmyteo did you mean costParsed == 60 here? (the participant passes the challenge if they are able to alter the 60 value that is embedded in the html on the else branch)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@paul-ion The goal of this exercise is to "Find a way to renew the subscription without paying any money." This would likely be accomplished if the cost variable value is set to zero or a negative number in the form. The default value is 60.
There is some input validation in place with
if(costParsed == 0), meaning that the likely first tamper choice of zero is protected against and will be rejected. But there is no validation for negative numbers. In the context of this vulnerability, there is no reason the form should accept negative numbers and we would expect them to be rejected. In order to pass the challenge, a negative number must be submitted.Please let me know if the challenge makes sense. I am open to modifying any aspect if you think it would improve learning or understanding. Thanks for your feedback.