first commit
This commit is contained in:
OPSXCQ
parent
985a5c928c
commit
f40a84879c
551 changed files with 72374 additions and 24 deletions
62
dvwa/vulnerabilities/captcha/help/help.php
Normal file
62
dvwa/vulnerabilities/captcha/help/help.php
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
<div class="body_padded">
|
||||
<h1>Help - Insecure CAPTCHA</h1>
|
||||
|
||||
<div id="code">
|
||||
<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
|
||||
<tr>
|
||||
<td><div id="code">
|
||||
<h3>About</h3>
|
||||
<p>A <?php echo dvwaExternalLinkUrlGet( 'http://www.captcha.net/', 'CAPTCHA' ); ?> is a program that can tell whether its user is a human or a computer. You've probably seen
|
||||
them - colourful images with distorted text at the bottom of Web registration forms. CAPTCHAs are used by many websites to prevent abuse from
|
||||
"bots", or automated programs usually written to generate spam. No computer program can read distorted text as well as humans can, so bots
|
||||
cannot navigate sites protected by CAPTCHAs.</p>
|
||||
|
||||
<p>CAPTCHAs are often used to protect sensitive functionality from automated bots. Such functionality typically includes user registration and changes,
|
||||
password changes, and posting content. In this example, the CAPTCHA is guarding the change password functionality for the user account. This provides
|
||||
limited protection from CSRF attacks as well as automated bot guessing.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Objective</h3>
|
||||
<p>Your aim, change the current user's password in a automated manner because of the poor CAPTCHA system.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Low Level</h3>
|
||||
<p>The issue with this CAPTCHA is that it is easily bypassed. The developer has made the assumption that all users will progress through screen 1, complete the CAPTCHA, and then
|
||||
move on to the next screen where the password is actually updated. By submitting the new password directly to the change page, the user may bypass the CAPTCHA system.</p>
|
||||
|
||||
<p>The parameters required to complete this challenge in low security would be similar to the following:</p>
|
||||
<pre>Spoiler: <span class="spoiler">?step=2&password_new=password&password_conf=password&Change=Change</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Medium Level</h3>
|
||||
<p>The developer has attempted to place state around the session and keep track of whether the user successfully completed the
|
||||
CAPTCHA prior to submitting data. Because the state variable (Spoiler: <span class="spoiler">passed_captcha</span>) is on the client side,
|
||||
it can also be manipulated by the attacker like so:</p>
|
||||
<pre>Spoiler: <span class="spoiler">?step=2&password_new=password&password_conf=password&passed_captcha=true&Change=Change</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>High Level</h3>
|
||||
<p>There has been development code left in, which was never removed in production. It is possible to mimic the development values, to allow
|
||||
invalid values in be placed into the CAPTCHA field.</p>
|
||||
<p>You will need to spoof your user-agent (Spoiler: <span class="spoiler">reCAPTCHA</span>) as well as use the CAPTCHA value of
|
||||
(Spoiler: <span class="spoiler">hidd3n_valu3</span>) to skip the check.</p>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Impossible Level</h3>
|
||||
<p>In the impossible level, the developer has removed all avenues of attack. The process has been simplified so that data and CAPTCHA verification occurs in one
|
||||
single step. Alternatively, the developer could have moved the state variable server side (from the medium level), so the user cannot alter it.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</div>
|
||||
|
||||
<br />
|
||||
|
||||
<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'http://www.captcha.net/' ); ?></p>
|
||||
</div>
|
||||
98
dvwa/vulnerabilities/captcha/index.php
Normal file
98
dvwa/vulnerabilities/captcha/index.php
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
<?php
|
||||
|
||||
define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . "external/recaptcha/recaptchalib.php";
|
||||
|
||||
dvwaPageStartup( array( 'authenticated', 'phpids' ) );
|
||||
|
||||
$page = dvwaPageNewGrab();
|
||||
$page[ 'title' ] = 'Vulnerability: Insecure CAPTCHA' . $page[ 'title_separator' ].$page[ 'title' ];
|
||||
$page[ 'page_id' ] = 'captcha';
|
||||
$page[ 'help_button' ] = 'captcha';
|
||||
$page[ 'source_button' ] = 'captcha';
|
||||
|
||||
dvwaDatabaseConnect();
|
||||
|
||||
$vulnerabilityFile = '';
|
||||
switch( $_COOKIE[ 'security' ] ) {
|
||||
case 'low':
|
||||
$vulnerabilityFile = 'low.php';
|
||||
break;
|
||||
case 'medium':
|
||||
$vulnerabilityFile = 'medium.php';
|
||||
break;
|
||||
case 'high':
|
||||
$vulnerabilityFile = 'high.php';
|
||||
break;
|
||||
default:
|
||||
$vulnerabilityFile = 'impossible.php';
|
||||
break;
|
||||
}
|
||||
|
||||
$hide_form = false;
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/captcha/source/{$vulnerabilityFile}";
|
||||
|
||||
// Check if we have a reCAPTCHA key
|
||||
$WarningHtml = '';
|
||||
if( $_DVWA[ 'recaptcha_public_key' ] == "" ) {
|
||||
$WarningHtml = "<div class=\"warning\"><em>reCAPTCHA API key missing</em> from config file: " . realpath( dirname( dirname( getcwd() ) ) . "/config/config.inc.php" ) . "</div>";
|
||||
$html = "<em>Please register for a key</em> from reCAPTCHA: " . dvwaExternalLinkUrlGet('https://www.google.com/recaptcha/admin/create');
|
||||
$hide_form = true;
|
||||
}
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<div class=\"body_padded\">
|
||||
<h1>Vulnerability: Insecure CAPTCHA</h1>
|
||||
|
||||
{$WarningHtml}
|
||||
|
||||
<div class=\"vulnerable_code_area\">
|
||||
<form action=\"#\" method=\"POST\" ";
|
||||
|
||||
if( $hide_form )
|
||||
$page[ 'body' ] .= "style=\"display:none;\"";
|
||||
|
||||
$page[ 'body' ] .= ">
|
||||
<h3>Change your password:</h3>
|
||||
<br />
|
||||
|
||||
<input type=\"hidden\" name=\"step\" value=\"1\" />\n";
|
||||
|
||||
if( $vulnerabilityFile == 'impossible.php' ) {
|
||||
$page[ 'body' ] .= "
|
||||
Current password:<br />
|
||||
<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_current\"><br />";
|
||||
}
|
||||
|
||||
$page[ 'body' ] .= " New password:<br />
|
||||
<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_new\"><br />
|
||||
Confirm new password:<br />
|
||||
<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_conf\"><br />
|
||||
|
||||
" . recaptcha_get_html( $_DVWA[ 'recaptcha_public_key' ] );
|
||||
if( $vulnerabilityFile == 'high.php' )
|
||||
$page[ 'body' ] .= "\n\n <!-- **DEV NOTE** Response: 'hidd3n_valu3' && User-Agent: 'reCAPTCHA' **/DEV NOTE** -->\n";
|
||||
|
||||
if( $vulnerabilityFile == 'high.php' || $vulnerabilityFile == 'impossible.php' )
|
||||
$page[ 'body' ] .= "\n " . tokenField();
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<br />
|
||||
|
||||
<input type=\"submit\" value=\"Change\" name=\"Change\">
|
||||
</form>
|
||||
{$html}
|
||||
</div>
|
||||
|
||||
<h2>More Information</h2>
|
||||
<ul>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.captcha.net/' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.google.com/recaptcha/' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Testing_for_Captcha_(OWASP-AT-012)' ) . "</li>
|
||||
</ul>
|
||||
</div>\n";
|
||||
|
||||
dvwaHtmlEcho( $page );
|
||||
|
||||
?>
|
||||
50
dvwa/vulnerabilities/captcha/source/high.php
Normal file
50
dvwa/vulnerabilities/captcha/source/high.php
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) ) {
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
|
||||
// Check CAPTCHA from 3rd party
|
||||
$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
|
||||
$_SERVER[ 'REMOTE_ADDR' ],
|
||||
$_POST[ 'recaptcha_challenge_field' ],
|
||||
$_POST[ 'recaptcha_response_field' ] );
|
||||
|
||||
// Did the CAPTCHA fail?
|
||||
if( !$resp->is_valid && ( $_POST[ 'recaptcha_response_field' ] != 'hidd3n_valu3' || $_SERVER[ 'HTTP_USER_AGENT' ] != 'reCAPTCHA' ) ) {
|
||||
// What happens when the CAPTCHA was entered incorrectly
|
||||
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
|
||||
$hide_form = false;
|
||||
return;
|
||||
}
|
||||
else {
|
||||
// CAPTCHA was correct. Do both new passwords match?
|
||||
if( $pass_new == $pass_conf ) {
|
||||
$pass_new = mysql_real_escape_string( $pass_new );
|
||||
$pass_new = md5( $pass_new );
|
||||
|
||||
// Update database
|
||||
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";
|
||||
$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
// Feedback for user
|
||||
$html .= "<pre>Password Changed.</pre>";
|
||||
}
|
||||
else {
|
||||
// Ops. Password mismatch
|
||||
$html .= "<pre>Both passwords must match.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
}
|
||||
|
||||
mysql_close();
|
||||
}
|
||||
|
||||
// Generate Anti-CSRF token
|
||||
generateSessionToken();
|
||||
|
||||
?>
|
||||
68
dvwa/vulnerabilities/captcha/source/impossible.php
Normal file
68
dvwa/vulnerabilities/captcha/source/impossible.php
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) ) {
|
||||
// Check Anti-CSRF token
|
||||
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
|
||||
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_new = stripslashes( $pass_new );
|
||||
$pass_new = mysql_real_escape_string( $pass_new );
|
||||
$pass_new = md5( $pass_new );
|
||||
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
$pass_conf = stripslashes( $pass_conf );
|
||||
$pass_conf = mysql_real_escape_string( $pass_conf );
|
||||
$pass_conf = md5( $pass_conf );
|
||||
|
||||
$pass_curr = $_POST[ 'password_current' ];
|
||||
$pass_curr = stripslashes( $pass_curr );
|
||||
$pass_curr = mysql_real_escape_string( $pass_curr );
|
||||
$pass_curr = md5( $pass_curr );
|
||||
|
||||
// Check CAPTCHA from 3rd party
|
||||
$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
|
||||
$_SERVER[ 'REMOTE_ADDR' ],
|
||||
$_POST[ 'recaptcha_challenge_field' ],
|
||||
$_POST[ 'recaptcha_response_field' ] );
|
||||
|
||||
// Did the CAPTCHA fail?
|
||||
if( !$resp->is_valid ) {
|
||||
// What happens when the CAPTCHA was entered incorrectly
|
||||
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
|
||||
$hide_form = false;
|
||||
return;
|
||||
}
|
||||
else {
|
||||
// Check that the current password is correct
|
||||
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
|
||||
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
|
||||
$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
|
||||
$data->execute();
|
||||
|
||||
// Do both new password match and was the current password correct?
|
||||
if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
|
||||
// Update the database
|
||||
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
|
||||
$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
|
||||
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
|
||||
$data->execute();
|
||||
|
||||
// Feedback for the end user - success!
|
||||
$html .= "<pre>Password Changed.</pre>";
|
||||
}
|
||||
else {
|
||||
// Feedback for the end user - failed!
|
||||
$html .= "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Generate Anti-CSRF token
|
||||
generateSessionToken();
|
||||
|
||||
?>
|
||||
75
dvwa/vulnerabilities/captcha/source/low.php
Normal file
75
dvwa/vulnerabilities/captcha/source/low.php
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
|
||||
// Check CAPTCHA from 3rd party
|
||||
$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
|
||||
$_SERVER[ 'REMOTE_ADDR' ],
|
||||
$_POST[ 'recaptcha_challenge_field' ],
|
||||
$_POST[ 'recaptcha_response_field' ] );
|
||||
|
||||
// Did the CAPTCHA fail?
|
||||
if( !$resp->is_valid ) {
|
||||
// What happens when the CAPTCHA was entered incorrectly
|
||||
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
|
||||
$hide_form = false;
|
||||
return;
|
||||
}
|
||||
else {
|
||||
// CAPTCHA was correct. Do both new passwords match?
|
||||
if( $pass_new == $pass_conf ) {
|
||||
// Show next stage for the user
|
||||
$html .= "
|
||||
<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
|
||||
<form action=\"#\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"step\" value=\"2\" />
|
||||
<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
|
||||
<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
|
||||
<input type=\"submit\" name=\"Change\" value=\"Change\" />
|
||||
</form>";
|
||||
}
|
||||
else {
|
||||
// Both new passwords do not match.
|
||||
$html .= "<pre>Both passwords must match.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
|
||||
// Check to see if both password match
|
||||
if( $pass_new == $pass_conf ) {
|
||||
// They do!
|
||||
$pass_new = mysql_real_escape_string( $pass_new );
|
||||
$pass_new = md5( $pass_new );
|
||||
|
||||
// Update database
|
||||
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
|
||||
$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>Password Changed.</pre>";
|
||||
}
|
||||
else {
|
||||
// Issue with the passwords matching
|
||||
$html .= "<pre>Passwords did not match.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
|
||||
mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
83
dvwa/vulnerabilities/captcha/source/medium.php
Normal file
83
dvwa/vulnerabilities/captcha/source/medium.php
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
|
||||
// Check CAPTCHA from 3rd party
|
||||
$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
|
||||
$_SERVER[ 'REMOTE_ADDR' ],
|
||||
$_POST[ 'recaptcha_challenge_field' ],
|
||||
$_POST[ 'recaptcha_response_field' ] );
|
||||
|
||||
// Did the CAPTCHA fail?
|
||||
if( !$resp->is_valid ) {
|
||||
// What happens when the CAPTCHA was entered incorrectly
|
||||
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
|
||||
$hide_form = false;
|
||||
return;
|
||||
}
|
||||
else {
|
||||
// CAPTCHA was correct. Do both new passwords match?
|
||||
if( $pass_new == $pass_conf ) {
|
||||
// Show next stage for the user
|
||||
$html .= "
|
||||
<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
|
||||
<form action=\"#\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"step\" value=\"2\" />
|
||||
<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
|
||||
<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
|
||||
<input type=\"hidden\" name=\"passed_captcha\" value=\"true\" />
|
||||
<input type=\"submit\" name=\"Change\" value=\"Change\" />
|
||||
</form>";
|
||||
}
|
||||
else {
|
||||
// Both new passwords do not match.
|
||||
$html .= "<pre>Both passwords must match.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
|
||||
// Hide the CAPTCHA form
|
||||
$hide_form = true;
|
||||
|
||||
// Get input
|
||||
$pass_new = $_POST[ 'password_new' ];
|
||||
$pass_conf = $_POST[ 'password_conf' ];
|
||||
|
||||
// Check to see if they did stage 1
|
||||
if( !$_POST[ 'passed_captcha' ] ) {
|
||||
$html .= "<pre><br />You have not passed the CAPTCHA.</pre>";
|
||||
$hide_form = false;
|
||||
return;
|
||||
}
|
||||
|
||||
// Check to see if both password match
|
||||
if( $pass_new == $pass_conf ) {
|
||||
// They do!
|
||||
$pass_new = mysql_real_escape_string( $pass_new );
|
||||
$pass_new = md5( $pass_new );
|
||||
|
||||
// Update database
|
||||
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
|
||||
$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>Password Changed.</pre>";
|
||||
}
|
||||
else {
|
||||
// Issue with the passwords matching
|
||||
$html .= "<pre>Passwords did not match.</pre>";
|
||||
$hide_form = false;
|
||||
}
|
||||
|
||||
mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue