pentest.sh

#!/bin/bash

BASE="http://localhost:7778"

ok() { echo "✅ $1"; }
fail() { echo "❌ $1"; }

register() {
  curl -s -X POST "$BASE/register?userId=test&userName=TestUser" > /dev/null
}

echo "=== SETUP ==="
register

echo "=== PATH TRAVERSAL ==="
code=$(curl -s -o /dev/null -w "%{http_code}" \
"$BASE/exportReport?userId=test&filename=../../../../tmp/hacked.txt")

[[ "$code" != "200" ]] && ok "Path traversal blocked ($code)" || fail "Path traversal NOT blocked"

echo "=== SSRF localhost ==="
code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
"$BASE/notify?userId=test&callbackUrl=http://localhost:7000")

[[ "$code" -ge 400 ]] && ok "SSRF localhost blocked ($code)" || fail "SSRF NOT blocked"

echo "=== SSRF metadata ==="
code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
"$BASE/notify?userId=test&callbackUrl=http://169.254.169.254")

[[ "$code" -ge 400 ]] && ok "SSRF metadata blocked ($code)" || fail "SSRF NOT blocked"

echo "=== LARGE INPUT ==="
LONG=$(python3 -c "print('A'*10000)")
code=$(curl -s -o /dev/null -w "%{http_code}" \
"$BASE/totalActivity?userId=$LONG")

[[ "$code" == "400" ]] && ok "Large input rejected" || fail "No input limit ($code)"

echo "=== RATE LIMIT ==="
rate_limited=0

for i in {1..50}; do
  code=$(curl -s -o /dev/null -w "%{http_code}" \
  "$BASE/totalActivity?userId=test")

  if [[ "$code" == "429" ]]; then
    rate_limited=1
    break
  fi
done

[[ "$rate_limited" == "1" ]] && ok "Rate limit works" || fail "NO rate limit"

echo "=== INVALID SESSION ==="
code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
"$BASE/recordSession?userId=test&loginTime=2025-01-01T10:00:00&logoutTime=2025-01-01T09:00:00")

[[ "$code" != "200" ]] && ok "Invalid session rejected" || fail "Bad session accepted"

echo "=== NO AUTH ==="
code=$(curl -s -o /dev/null -w "%{http_code}" \
"$BASE/totalActivity?userId=test")

[[ "$code" == "401" ]] && ok "Auth required" || fail "Auth missing"

echo "=== SQLi TEST ==="
code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
"$BASE/register?userId=%27%20OR%201%3D1%20--&userName=test")

[[ "$code" == "400" ]] && ok "Input filtered" || fail "SQLi not blocked"