Skip to content

Commit c421269

Browse files
author
William Franco
committed
feat: fixing stegonography
1 parent 13a98dd commit c421269

File tree

2 files changed

+135
-105
lines changed

2 files changed

+135
-105
lines changed

‎owasp-top10-2021-apps/a5/stegonography/app/index.js‎

Lines changed: 109 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -3,143 +3,155 @@ const express = require("express");
33
const bodyParser = require("body-parser");
44
const app = express();
55
const router = express.Router();
6-
const cookieParser = require('cookie-parser');
6+
const cookieParser = require("cookie-parser");
77
require("dotenv-safe").load();
8-
const jwt = require('jsonwebtoken');
9-
var mongo = require('mongodb')
8+
const jwt = require("jsonwebtoken");
9+
var mongo = require("mongodb");
1010

1111
// Configures everything needed for the app
12-
app.use(express.static('static'));
13-
app.use('/css', express.static('./css'));
14-
app.use('/js', express.static('./js'));
15-
app.use('/images', express.static('./images'));
16-
app.set('views', 'static/views');
17-
app.engine('html', require('ejs').renderFile);
18-
app.set('view engine', 'html');
12+
app.use(express.static("static"));
13+
app.use("/css", express.static("./css"));
14+
app.use("/js", express.static("./js"));
15+
app.use("/images", express.static("./images"));
16+
app.set("views", "static/views");
17+
app.engine("html", require("ejs").renderFile);
18+
app.set("view engine", "html");
1919
app.use(bodyParser.json());
20-
app.use(bodyParser.urlencoded({ extended: true}));
21-
app.use(cookieParser())
20+
app.use(bodyParser.urlencoded({ extended: true }));
21+
app.use(cookieParser());
2222

2323
// Creates a connection to the database
24-
var port = process.env.MONGO_PORT
25-
var MongoClient = require('mongodb').MongoClient;
26-
var url = "mongodb://db:27017/stego"
24+
var port = process.env.MONGO_PORT;
25+
var MongoClient = require("mongodb").MongoClient;
26+
var url = "mongodb://db:27017/stego";
2727

2828
// Connect to the database
29-
MongoClient.connect(url, function(err, db) {
30-
if (err) throw err;
31-
console.log("Database created!");
32-
db.close();
29+
MongoClient.connect(url, function (err, db) {
30+
if (err) throw err;
31+
console.log("Database created!");
32+
db.close();
3333
});
3434

3535
// Create "users" collection
36-
var url = "mongodb://db:27017/stego"
37-
MongoClient.connect(url, function(err, db) {
36+
var url = "mongodb://db:27017/stego";
37+
MongoClient.connect(url, function (err, db) {
38+
if (err) throw err;
39+
var dbo = db.db("stego");
40+
dbo.createCollection("users", function (err, ress) {
3841
if (err) throw err;
39-
var dbo = db.db("stego");
40-
dbo.createCollection("users", function(err, ress) {
41-
if (err) throw err;
42-
console.log("Users collection created!");
43-
db.close();
44-
})
42+
console.log("Users collection created!");
43+
db.close();
44+
});
4545
});
4646

4747
// Add "admin" default user to the database
48-
MongoClient.connect(url, function(err, db) {
48+
MongoClient.connect(url, function (err, db) {
49+
if (err) throw err;
50+
var dbo = db.db("stego");
51+
var myobj = { username: process.env.USER, password: process.env.PASS };
52+
dbo.collection("users").insertOne(myobj, function (err, res) {
4953
if (err) throw err;
50-
var dbo = db.db("stego");
51-
var myobj = { username: "admin", password: "admin" };
52-
dbo.collection("users").insertOne(myobj, function(err, res) {
53-
if (err) throw err;
54-
console.log("Admin user added to the database");
55-
db.close();
56-
});
54+
console.log("Admin user added to the database");
55+
db.close();
56+
});
5757
});
5858

5959
// User login route, get webpage
60-
router.get("/login", function(req,res) {
61-
res.render("login.html");
62-
})
60+
router.get("/login", function (req, res) {
61+
res.render("login.html");
62+
});
6363

6464
// User login route, submit POST request to server
65-
router.post("/login", function(req,res) {
66-
var username = req.body.user.name;
67-
var password = req.body.user.password;
68-
69-
// Verifies user credentials
70-
function VerifiesUser(callback) {
71-
MongoClient.connect(url, function(err, db) {
72-
if (err) throw err;
73-
var dbo = db.db("stego");
74-
var query = { username: username, password: password };
75-
dbo.collection("users").find(query).toArray(function(err, result) {
76-
if (err) throw err;
77-
db.close();
78-
if( result.length == 0 ){
79-
callback('not_found')
80-
} else {
81-
callback(result[0].username);
82-
}
83-
});
65+
router.post("/login", function (req, res) {
66+
var username = req.body.user.name;
67+
var password = req.body.user.password;
68+
69+
// Verifies user credentials
70+
function VerifiesUser(callback) {
71+
MongoClient.connect(url, function (err, db) {
72+
if (err) throw err;
73+
var dbo = db.db("stego");
74+
var query = { username: username, password: password };
75+
dbo
76+
.collection("users")
77+
.find(query)
78+
.toArray(function (err, result) {
79+
if (err) throw err;
80+
db.close();
81+
if (result.length == 0) {
82+
callback("not_found");
83+
} else {
84+
callback(result[0].username);
85+
}
8486
});
85-
};
86-
87-
VerifiesUser((username) => {
88-
if (username == "admin") {
89-
var token = jwt.sign({ username }, process.env.SECRET, {
90-
expiresIn: 300 // Token expires in 5 minutes
91-
});
92-
res.cookie('nodejsSessionToken', token).redirect(301, "/admin");
93-
} else {
94-
res.status(500).send('Invalid username or password!').redirect(301, "/logout");
95-
}
9687
});
97-
})
88+
}
89+
90+
// User: admin, password: admin, userRole: 1 //normal 2 //admin
91+
92+
VerifiesUser((username) => {
93+
if (username == process.env.USER) {
94+
var token = jwt.sign({ username }, process.env.SECRET, {
95+
expiresIn: 300, // Token expires in 5 minutes
96+
});
97+
res.cookie("SessionToken", token).redirect(301, "/as-admin");
98+
} else {
99+
res
100+
.status(500)
101+
.send("Invalid username or password!")
102+
.redirect(301, "/logout");
103+
}
104+
});
105+
});
98106

99107
// Logout route to deauthorize user session tokens
100-
router.get("/logout", function(req, res) {
101-
res.status(200).clearCookie('nodejsSessionToken').redirect(301, "/");
108+
router.get("/logout", function (req, res) {
109+
res.status(200).clearCookie("SessionToken").redirect(301, "/");
102110
});
103111

104112
// Admin maintenance page
105113
router.get("/admin", verifyJWT, (req, res, next) => {
106-
res.status(200).render("admin.html");
114+
res.status(200).render("admin.html");
107115
});
108116

109117
// Change password route
110-
router.get("/changepassword", verifyJWT, function(req, res, next) {
111-
// Code to change user password in the database
112-
})
118+
router.get("/changepassword", verifyJWT, function (req, res, next) {
119+
// Code to change user password in the database
120+
});
113121

114122
// Healthcheck route
115-
router.get("/healthcheck", function(req,res) {
116-
res.send("WORKING");
117-
})
123+
router.get("/healthcheck", function (req, res) {
124+
res.send("WORKING");
125+
});
118126

119127
// Main page
120-
router.get("/", function(req,res) {
121-
res.render("index.html")
122-
})
128+
router.get("/", function (req, res) {
129+
res.render("index.html");
130+
});
123131

124132
// Returns the error web-page if none other is found
125-
app.use('/', router);
126-
app.use(function(req, res, next) {
127-
res.status(404).render("error.html")
133+
app.use("/", router);
134+
app.use(function (req, res, next) {
135+
res.status(404).render("error.html");
128136
});
129137
// Listen on port 10006
130138
app.listen(10006, () => {
131-
console.log("Server running on port 10006!");
132-
})
139+
console.log("Server running on port 10006!");
140+
});
133141

134142
// Verifies the JWT token
135-
function verifyJWT(req, res, next){
136-
var token = req.cookies.nodejsSessionToken;
137-
if (!token) return res.status(401).send({auth: false, message: 'No token provided'});
138-
139-
jwt.verify(token, process.env.SECRET, function(err, decoded) {
140-
if (err) return res.status(500).send({ auth: false, message: 'Failed to authenticate token.' });
141-
142-
req.userId = decoded.id;
143-
next();
144-
});
145-
}
143+
function verifyJWT(req, res, next) {
144+
var token = req.cookies.SessionToken;
145+
if (!token)
146+
return res.status(401).send({ auth: false, message: "No token provided" });
147+
148+
jwt.verify(token, process.env.SECRET, function (err, decoded) {
149+
if (err)
150+
return res
151+
.status(500)
152+
.send({ auth: false, message: "Failed to authenticate token." });
153+
154+
req.userId = decoded.id;
155+
next();
156+
});
157+
}

‎owasp-top10-2021-apps/a5/stegonography/deployments/generate-env.sh‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,41 @@
44
#
55

66
# API environment variables
7-
SECRET=$RANDOM$RANDOM
7+
SECRET=$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
8+
USER=$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
9+
PASS=$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
810

911
echo "#.env" > app/.env
1012
echo "SECRET=$SECRET" >> app/.env
13+
# echo "USER=$USER" >> app/.env
14+
# echo "PASS=$PASS" >> app/.env
1115

1216

1317
# Database environment variables
14-
# MONGO_DATABASE="stego"
15-
MONGO_DATABASE_USERNAME=User$RANDOM$RANDOM
16-
MONGO_DATABASE_PASSWORD=Pass$RANDOM$RANDOM
17-
# MONGO_PORT=27017
18+
MONGO_DATABASE="stego$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')"
19+
MONGO_DATABASE_USERNAME=User$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
20+
MONGO_DATABASE_PASSWORD=Pass$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
21+
MONGO_PORT=27017
22+
MONGO_ROOT_PASSWORD=Root$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
1823

1924
echo "#" > deployments/.dockers.env
2025
echo "# This file is auto generated and contains all environment variables needed by Stegonography's database" >> deployments/.dockers.env
2126
echo "#" >> deployments/.dockers.env
2227
echo "MONGO_ROOT_PASSWORD=$MONGO_ROOT_PASSWORD" >> deployments/.dockers.env
2328
echo "MONGO_DATABASE=$MONGO_DATABASE" >> deployments/.dockers.env
24-
echo "MONGO_USER=$MONGO_USER" >> deployments/.dockers.env
25-
echo "MONGO_PASSWORD=$MONGO_PASSWORD" >> deployments/.dockers.env
26-
echo "MONGO_PORT=$MONGO_PORT" >> deployments/.dockers.env
29+
echo "MONGO_USER=$MONGO_DATABASE_USERNAME" >> deployments/.dockers.env
30+
echo "MONGO_PASSWORD=$MONGO_DATABASE_PASSWORD" >> deployments/.dockers.env
31+
echo "MONGO_PORT=$MONGO_PORT" >> deployments/.dockers.env
32+
echo "USER=$USER" >> deployments/.dockers.env
33+
echo "PASS=$PASS" >> deployments/.dockers.env
34+
35+
36+
37+
38+
# KEY_LENGTH=32
39+
40+
# # Gera uma chave criptograficamente segura
41+
# SECURE_KEY=$(pwgen -s $KEY_LENGTH 1 | md5sum | awk '{print $1}')
42+
43+
# # Exibe a chave gerada
44+
# echo "Chave gerada: $SECURE_KEY"

0 commit comments

Comments
 (0)