From e8920eda0623c51fa2b90ade820fc5b99c207e28 Mon Sep 17 00:00:00 2001 From: roxbeecoxb Date: Wed, 3 Mar 2021 17:58:54 +0000 Subject: [PATCH 1/4] Added level 8 & 9 --- webapp/xss_trainer/app.py | 24 +++++++- .../xss_trainer/templates/levels/level8.html | 57 +++++++++++++++++++ .../xss_trainer/templates/levels/level9.html | 45 +++++++++++++++ 3 files changed, 123 insertions(+), 3 deletions(-) create mode 100644 webapp/xss_trainer/templates/levels/level8.html create mode 100644 webapp/xss_trainer/templates/levels/level9.html diff --git a/webapp/xss_trainer/app.py b/webapp/xss_trainer/app.py index 7c40e21..c83d36b 100644 --- a/webapp/xss_trainer/app.py +++ b/webapp/xss_trainer/app.py @@ -26,7 +26,7 @@ # My Selenium Driver import driver -MAX_LEVEL = 6 +MAX_LEVEL = 9 REDIS_URL = "redis://redis:6379/0" SECRET_KEY = b"foobarbaz" @@ -55,7 +55,9 @@ (3, "Simple Filter"), (4,"Regexp Filter"), (5,"PHP Filter"), - (6,"Script Filter")] + (6,"Script Filter"), + (8,"Escape Characters"), + (9, "Encoding")] # (7,"Output")] import subprocess @@ -239,9 +241,25 @@ def _filterData(level, data): #clean = evalPhp(theStr) payload = markdown.markdown(clean) - + + elif level == 8: + payload = (data.replace("'", "\\'")).replace('"', '\\"') # This is more of a level 2/3 difficulty + + elif level == 9: + import base64 + payload = (data.replace("<", "")).replace(">","") + # We are expecting a b64 string, so we need to add out own padding if thats not what they give us + try: + # Rather than using .decode('base64') and leave it as bytex, let's format a nice string + decoded_payload = base64.b64decode(payload.encode('ascii')).decode('ascii') + except Exception: + decoded_payload = ("Input did not have correct encoding") + return (decoded_payload) + + return payload + def _renderPage(level, submitted, result, message, payload): """ Helper Function to render a given page diff --git a/webapp/xss_trainer/templates/levels/level8.html b/webapp/xss_trainer/templates/levels/level8.html new file mode 100644 index 0000000..5e6e681 --- /dev/null +++ b/webapp/xss_trainer/templates/levels/level8.html @@ -0,0 +1,57 @@ +{% extends "levelBase.html" %} + +{% block content %} + +

Level {{ level }}

+ +{% markdown %} + +In this level some characters are getting escaped using backslashes. How could you send your payload without using those characters? + + +??? hint + + In computing, data can be represented in many ways. What other ways can text be represented? + + +### Filter + +```python +def filter(data): + payload = (data.replace("'", "\\'")) + payload = payload.replace('"', '\\"') + return data +``` + +Or (approximately) Equivalent PHP +```php + +``` + +{% endmarkdown %} +{% endblock content%} + + +{% block defaultForm %} +
+
+

Vulnerable Form

+
+
+
+
+
+ + +
+ +
+
+
+
+{% endblock defaultForm %} diff --git a/webapp/xss_trainer/templates/levels/level9.html b/webapp/xss_trainer/templates/levels/level9.html new file mode 100644 index 0000000..caab026 --- /dev/null +++ b/webapp/xss_trainer/templates/levels/level9.html @@ -0,0 +1,45 @@ +{% extends "levelBase.html" %} + +{% block content %} + +

Level {{ level }}

+ +{% markdown %} + +Users usually submit data for a reason. This page does something with your inputted data. The admin of this page has also coded a filter to strip any < > characters from the input. + +??? hint + + When sending information on the web, data is often encoded/decoded. + + +### Filter + +```python +def filter(data): + payload = (data.replace('<', '') + payload = payload.replace('>', '') +``` + +{% endmarkdown %} +{% endblock content%} + + +{% block defaultForm %} +
+
+

Vulnerable Form

+
+
+
+
+
+ + +
+ +
+
+
+
+{% endblock defaultForm %} From d7789b880f8f61245124be428dfcfda6bf419529 Mon Sep 17 00:00:00 2001 From: sharkmoos Date: Thu, 6 May 2021 15:27:48 +0100 Subject: [PATCH 2/4] Fixed level 7 --- webapp/xss_trainer/levels/contrib.py | 1 + webapp/xss_trainer/templates/levels/EscapeChars.html | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/webapp/xss_trainer/levels/contrib.py b/webapp/xss_trainer/levels/contrib.py index ab79f34..3378054 100644 --- a/webapp/xss_trainer/levels/contrib.py +++ b/webapp/xss_trainer/levels/contrib.py @@ -20,6 +20,7 @@ class EscapeChars(meta.BaseLevel): def sanitise(self, data): # This is more of a level 2/3 difficulty payload = (data.replace("'", "\\'")).replace('"', '\\"') + payload = (data.replace("<", "")).replace('>', '') return payload class Encoding(meta.BaseLevel): diff --git a/webapp/xss_trainer/templates/levels/EscapeChars.html b/webapp/xss_trainer/templates/levels/EscapeChars.html index 8a880d6..91c58d7 100644 --- a/webapp/xss_trainer/templates/levels/EscapeChars.html +++ b/webapp/xss_trainer/templates/levels/EscapeChars.html @@ -18,6 +18,8 @@ def filter(data): payload = (data.replace("'", "\\'")) payload = payload.replace('"', '\\"') + payload = payload.replace('<', '') + payload = payload.replace('>', '') return data ``` @@ -26,6 +28,8 @@ ", "") return $payload; } ?> From 7f6622174c41036d8887ff129702c049f0c3f29a Mon Sep 17 00:00:00 2001 From: sharkmoos Date: Mon, 7 Mar 2022 19:13:45 +0000 Subject: [PATCH 3/4] Updated level 7 to close a loophole --- webapp/xss_trainer/levels/contrib.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/webapp/xss_trainer/levels/contrib.py b/webapp/xss_trainer/levels/contrib.py index 3378054..7a99cfd 100644 --- a/webapp/xss_trainer/levels/contrib.py +++ b/webapp/xss_trainer/levels/contrib.py @@ -18,9 +18,11 @@ class EscapeChars(meta.BaseLevel): author = "Sharkmoos" def sanitise(self, data): - # This is more of a level 2/3 difficulty - payload = (data.replace("'", "\\'")).replace('"', '\\"') - payload = (data.replace("<", "")).replace('>', '') + try: + int(data) + payload = (data.replace("'", "\\'")).replace('"', '\\"') + except ValueError: + payload = "e("<", "")).replace('>', '') return payload class Encoding(meta.BaseLevel): From 7727546f3f39374837f1fa6883cc1be0d5663a6e Mon Sep 17 00:00:00 2001 From: sharkmoos Date: Mon, 7 Mar 2022 19:15:25 +0000 Subject: [PATCH 4/4] Trashed the changes --- webapp/xss_trainer/app.py | 359 ------------------ webapp/xss_trainer/levels/contrib.py | 2 +- .../templates/levels/EscapeChars.html | 4 - .../xss_trainer/templates/levels/level8.html | 57 --- .../xss_trainer/templates/levels/level9.html | 45 --- 5 files changed, 1 insertion(+), 466 deletions(-) delete mode 100644 webapp/xss_trainer/app.py delete mode 100644 webapp/xss_trainer/templates/levels/level8.html delete mode 100644 webapp/xss_trainer/templates/levels/level9.html diff --git a/webapp/xss_trainer/app.py b/webapp/xss_trainer/app.py deleted file mode 100644 index c83d36b..0000000 --- a/webapp/xss_trainer/app.py +++ /dev/null @@ -1,359 +0,0 @@ -""" -Very simple Flask App. For Testing -""" - - -import html -import urllib.parse -import logging - -import re - -import flask -from flask import Flask, session -import flask - -from flask_redis import FlaskRedis - -from jinja_markdown import MarkdownExtension -import markdown - -#Well that fills me with confidence.... -#from flask.ext.session import Session -#from flask_session import Session -import redis - -# My Selenium Driver -import driver - -MAX_LEVEL = 9 - -REDIS_URL = "redis://redis:6379/0" -SECRET_KEY = b"foobarbaz" - -app = flask.Flask(__name__) -app.config.update( - REDIS_URL = REDIS_URL, - #SESSION_TYPE= "redis", - #SESSION_REDIS = redis.from_url(REDIS_URL), - SESSION_COOKIE_SAMESITE='Lax', - ) - -app.config["SECRET_KEY"] = SECRET_KEY - -app.jinja_env.add_extension(MarkdownExtension) - -redis_client = FlaskRedis(app) -#Session(app) - -#Last Request -lastRequest = {} - -LEVELS = [(0,"Training"), - (1,"No Filter"), - (2,"ClientSide Filter"), - (3, "Simple Filter"), - (4,"Regexp Filter"), - (5,"PHP Filter"), - (6,"Script Filter"), - (8,"Escape Characters"), - (9, "Encoding")] -# (7,"Output")] - -import subprocess - -@app.route('/') -def main(): - """ - Render the homepage - """ - #flask.session["bleh"] = b"Bleh" - if "level" not in flask.session: - flask.session["level"] = 0 - - level = flask.session.get("level") - return flask.render_template('index.html', - level=level, - navLevels = LEVELS) - -@app.route("/reset") -def reset(): - """ - Clear the Session - """ - flask.session.clear() - return flask.redirect(flask.url_for("main")) - - -@app.route("/konami") -def konami(): - flask.session["level"] = 100 - return flask.redirect(flask.url_for("main")) - - -@app.route("/testPhp") -def test(): - """ - Testing - """ - #with open("/tmp/script.php","w") as fd: - theStr = ['$input = ""', - '$output = preg_replace("/", "") - - elif level == 4: - regexp = re.compile("<\/?script>", re.IGNORECASE) - payload = regexp.sub("", data) - - elif level == 5: - #PHP version of Level 4 - theStr = ['$input = "{0}"'.format(data), - '$output = preg_replace("/"# - #app.logger.info("Last Request was") - return flask.render_template("render.html", - payload=thePayload) - - -# --------------- TESTING CODEZ --------------- - - diff --git a/webapp/xss_trainer/levels/contrib.py b/webapp/xss_trainer/levels/contrib.py index 7a99cfd..3701199 100644 --- a/webapp/xss_trainer/levels/contrib.py +++ b/webapp/xss_trainer/levels/contrib.py @@ -22,7 +22,7 @@ def sanitise(self, data): int(data) payload = (data.replace("'", "\\'")).replace('"', '\\"') except ValueError: - payload = "e("<", "")).replace('>', '') + payload = "You must enter a string payload for this level" return payload class Encoding(meta.BaseLevel): diff --git a/webapp/xss_trainer/templates/levels/EscapeChars.html b/webapp/xss_trainer/templates/levels/EscapeChars.html index 91c58d7..8a880d6 100644 --- a/webapp/xss_trainer/templates/levels/EscapeChars.html +++ b/webapp/xss_trainer/templates/levels/EscapeChars.html @@ -18,8 +18,6 @@ def filter(data): payload = (data.replace("'", "\\'")) payload = payload.replace('"', '\\"') - payload = payload.replace('<', '') - payload = payload.replace('>', '') return data ``` @@ -28,8 +26,6 @@ ", "") return $payload; } ?> diff --git a/webapp/xss_trainer/templates/levels/level8.html b/webapp/xss_trainer/templates/levels/level8.html deleted file mode 100644 index 5e6e681..0000000 --- a/webapp/xss_trainer/templates/levels/level8.html +++ /dev/null @@ -1,57 +0,0 @@ -{% extends "levelBase.html" %} - -{% block content %} - -

Level {{ level }}

- -{% markdown %} - -In this level some characters are getting escaped using backslashes. How could you send your payload without using those characters? - - -??? hint - - In computing, data can be represented in many ways. What other ways can text be represented? - - -### Filter - -```python -def filter(data): - payload = (data.replace("'", "\\'")) - payload = payload.replace('"', '\\"') - return data -``` - -Or (approximately) Equivalent PHP -```php - -``` - -{% endmarkdown %} -{% endblock content%} - - -{% block defaultForm %} -
-
-

Vulnerable Form

-
-
-
-
-
- - -
- -
-
-
-
-{% endblock defaultForm %} diff --git a/webapp/xss_trainer/templates/levels/level9.html b/webapp/xss_trainer/templates/levels/level9.html deleted file mode 100644 index caab026..0000000 --- a/webapp/xss_trainer/templates/levels/level9.html +++ /dev/null @@ -1,45 +0,0 @@ -{% extends "levelBase.html" %} - -{% block content %} - -

Level {{ level }}

- -{% markdown %} - -Users usually submit data for a reason. This page does something with your inputted data. The admin of this page has also coded a filter to strip any < > characters from the input. - -??? hint - - When sending information on the web, data is often encoded/decoded. - - -### Filter - -```python -def filter(data): - payload = (data.replace('<', '') - payload = payload.replace('>', '') -``` - -{% endmarkdown %} -{% endblock content%} - - -{% block defaultForm %} -
-
-

Vulnerable Form

-
-
-
-
-
- - -
- -
-
-
-
-{% endblock defaultForm %}