teodoran / web-hack Goto Github PK

Workshop focusing on OWASP top 10 web security risks

License: MIT License

C# 64.22% HTML 7.81% JavaScript 20.97% CSS 7.00%

web-hack's Introduction

Sticky Notes

The best-of-breed cloud-based sticky note solution. Obviously not containing any security risks. To compete in the intertwingled world of tomorrow, we at Sticky Software Solutions™ are committed to delivering the best-of-breed cloud-based sticky note solution.

Getting started

In order to work on Sticky Notes, you'll need the .NET 6.0 SDK, and your favorite code-editing tool. If you have no prior tool preference, Visual Studio Code with the C# extension is recommended, as this incurs no extra cost to Sticky Software Solutions™, thus preserving shareholder dividends next quarter.

Cloning, building and running

Start by cloning this repo. Then navigate into the web-hack/Notes.Api/ folder and start the application with dotnet watch run:

$ web-hack/Notes.Api> dotnet watch run
watch : Hot reload enabled. For a list of supported edits, see https://aka.ms/dotnet/hot-reload. Press "Ctrl + R" to restart.
watch : Building...
  Determining projects to restore...
  All projects are up-to-date for restore.
  Notes.Api -> /web-hack/Notes.Api/bin/Debug/net6.0/Notes.Api.dll
watch : Started
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://localhost:5000
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /web-hack/Notes.Api
Opening in existing browser session.

This should restore dependencies, build and start Notes.Api. Since we're using watch, Notes.Api should be recompiled and restarted whenever we change one of the source files in the /Notes.Api folder.

Opening Notes.Client

Notes.Client is a static website, and it's hosted by Notes.Api. To open it, visit localhost:5000/client.

Initially, it won't show much, since we're currently not logged on to the Sticky Notes application. To logon, you'll need to press the "Login" button in the upper right corner, and enter a valid username and password.

Note: If you're using Firefox and have trouble logging in, you have to enable HTML <dialog>-element. This feature is behind the dom.dialog_element.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.

Working with Notes.Api in Swagger UI

You can access Notes.Api directly through Swagger UI. This gives you the option to craft requests and send them directly to the API, without using Notes.Client. To open Swagger UI, visit localhost:5000/swagger.

In order to make any requests to the API, you first need to authorize, using av valid username and password. To authorize, press the "Authorize" button, and enter a valid username and password.

Ready for some hacking?

With everything set up and working properly, you're ready to start on the workshop. The workshop is divided into sections under the /Documents folder. Start by navigating to 0_INTRODUCTION.md, and go on from there.

web-hack's People

Contributors

Stargazers

Watchers

Forkers

sheeeng ubehaga attacker-codeninja ellaoui94

web-hack's Issues

Change XXS-challenge so `textContent` is used instead of `innerText`

The attribute innerText is usually thought to be safe, but as described in the DOM based XSS Prevention Cheat Sheet, this is not always the case (for instance when using a <script>-tag. It's better therefore to use the attribute textContent.

In addition, textContent is more performant.

Flag hunt progress-tracking solution

Workshop participants can choose to hunt for flags during the workshop. To make hunting flags more exiting, and foster a competitive atmosphere, we should add a solution for tracking the flag hunt progress.

The solution should be able to:

Validate the flags found by a workshop participant.
Give the workshop participant an overview of the flags they found, and which flags remain to be found.
Present a leader-board that tracks the top participants, suitable for showing on a big screen as the workshop progresses.

Use of the flag hunt tracking application should be introduced as a part of the workshop documentation.

Notes.Client should show when API-requests fail

Currently, Notes.Client just glosses API-request failures. This makes Sticky Notes unnecessarily hard to use, and is sometimes confusing to the point of hindering the workshop. A simple solution would be to add some alerts when something fails, or something similar.

Add Flag to part 3, Cross Site Scripting (XSS)

Part 3, Cross Site Scripting (XSS), is missing a flag for the workshop participants to find. It would be neat if this was added.

The flag should be retrievable by using XSS, so one would need to create a bot that regularly accesses the site as another user, and triggers an action that can be exploited using XSS. One option is to have this user store the flag in local storage, or as a global JavaScript variable.

In addition, one would need to create a new XSS vulnerability in the Sticky Notes solution. One option would be to let the application logo image URL be configured from an URL in the database. If this is changed, then one should be able to perform an XSS attack using the img-tag.

Set up hosting, build and deploy for the challenge application

During the workshop, the participants work on a separate instance of the application when hunting for flags. Previously, this instance has been hosted locally by the workshop host by using ngrok. It would make it easier to host the workshop if the challenge instance was hosted online somewhere.

If hosted online, then build and deploy automation should be set up, so a push to master triggers a new build and deploy. The build should inject the flags as secret configuration values. In addition, the database should be recreated from some dump-file, so that the state of the application is reset every time a new version is deployed.

GitHub Actions are suggested as a tool for setting up build and deploy.

Improve workshop documentation

The documentation could probably need a brush-up. A couple of issues was noted when running the workshop for the first time:

Some participants was confused about when to use the online challenge instance of the Sticky Notes to hunt for flags. Instead they ended up looking for fags in their local instance of Sticky Notes. This could probably be improved if the introduction was a bit more thorough.
The introduction to each vulnerability is a bit short. It should be improved to give participants a better understanding of the vulnerability in general, before they start performing an exploit in the fault section.
It would be beneficial if someone other than the original author goes through the workshop, and updates the documentation where it's confusing, or otherwise lacking.

Any ideas for new vulnerabilities to add to the workshop?

Currently, the workshop covers 5 common security vulnerabilities:

Sensitive data exposure
Broken access control
Cross site scripting (XSS)
SQL injection
Insecure deserialization

Ideally, this should be expanded to cover more vulnerabilities, and/or show other exploits of the most common vulnerabilities. One option is to try to cover more of the vulnerabilities in OWASP top 10, but interesting twists on the vulnerabilities already covered, or vulnerabilities outside the top 10 is also interesting.

Does anyone have any ideas to new sections that could be added? How should the vulnerability be structured as a "Fault", "Fix" and "Flag"?