From 71333c2b86cc19991e74d14a7d96eb5ace836408 Mon Sep 17 00:00:00 2001 From: silvareal Date: Tue, 2 Apr 2019 12:06:03 +0100 Subject: [PATCH 01/33] major update --- .gitignore | 6 ++- dbdex/__init__.py | 0 dbdex/admin.py | 3 ++ dbdex/apps.py | 5 +++ {projectwork => dbdex}/forms.py | 0 dbdex/migrations/__init__.py | 0 dbdex/models.py | 3 ++ .../templates/dbdex}/formparameter.html | 2 +- .../templates/dbdex}/header.html | 2 +- .../templates/dbdex}/index.html | 2 +- {templates => dbdex/templates/dbdex}/sql.html | 2 +- {templates => dbdex/templates/dbdex}/xss.html | 2 +- dbdex/tests.py | 3 ++ dbdex/urls.py | 10 +++++ {projectwork => dbdex}/views.py | 41 ++++++++++-------- projectwork/settings.py | 2 + projectwork/urls.py | 24 +--------- requirements.txt | 4 +- static/{bootstrap => }/css/bootstrap-grid.css | 0 .../css/bootstrap-grid.css.map | 0 .../css/bootstrap-grid.min.css | 0 .../css/bootstrap-grid.min.css.map | 0 .../{bootstrap => }/css/bootstrap-reboot.css | 0 .../css/bootstrap-reboot.css.map | 0 .../css/bootstrap-reboot.min.css | 0 .../css/bootstrap-reboot.min.css.map | 0 static/{bootstrap => }/css/bootstrap.css | 0 static/{bootstrap => }/css/bootstrap.css.map | 0 static/{bootstrap => }/css/bootstrap.min.css | 0 .../{bootstrap => }/css/bootstrap.min.css.map | 0 static/{photo => img}/home.jpg | Bin static/{bootstrap => }/js/bootstrap.bundle.js | 0 .../js/bootstrap.bundle.js.map | 0 .../js/bootstrap.bundle.min.js | 0 .../js/bootstrap.bundle.min.js.map | 0 static/{bootstrap => }/js/bootstrap.js | 0 static/{bootstrap => }/js/bootstrap.js.map | 0 static/{bootstrap => }/js/bootstrap.min.js | 0 .../{bootstrap => }/js/bootstrap.min.js.map | 0 39 files changed, 62 insertions(+), 49 deletions(-) create mode 100644 dbdex/__init__.py create mode 100644 dbdex/admin.py create mode 100644 dbdex/apps.py rename {projectwork => dbdex}/forms.py (100%) create mode 100644 dbdex/migrations/__init__.py create mode 100644 dbdex/models.py rename {templates => dbdex/templates/dbdex}/formparameter.html (99%) rename {templates => dbdex/templates/dbdex}/header.html (98%) rename {templates => dbdex/templates/dbdex}/index.html (99%) rename {templates => dbdex/templates/dbdex}/sql.html (99%) rename {templates => dbdex/templates/dbdex}/xss.html (99%) create mode 100644 dbdex/tests.py create mode 100644 dbdex/urls.py rename {projectwork => dbdex}/views.py (87%) rename static/{bootstrap => }/css/bootstrap-grid.css (100%) rename static/{bootstrap => }/css/bootstrap-grid.css.map (100%) rename static/{bootstrap => }/css/bootstrap-grid.min.css (100%) rename static/{bootstrap => }/css/bootstrap-grid.min.css.map (100%) rename static/{bootstrap => }/css/bootstrap-reboot.css (100%) rename static/{bootstrap => }/css/bootstrap-reboot.css.map (100%) rename static/{bootstrap => }/css/bootstrap-reboot.min.css (100%) rename static/{bootstrap => }/css/bootstrap-reboot.min.css.map (100%) rename static/{bootstrap => }/css/bootstrap.css (100%) rename static/{bootstrap => }/css/bootstrap.css.map (100%) rename static/{bootstrap => }/css/bootstrap.min.css (100%) rename static/{bootstrap => }/css/bootstrap.min.css.map (100%) rename static/{photo => img}/home.jpg (100%) rename static/{bootstrap => }/js/bootstrap.bundle.js (100%) rename static/{bootstrap => }/js/bootstrap.bundle.js.map (100%) rename static/{bootstrap => }/js/bootstrap.bundle.min.js (100%) rename static/{bootstrap => }/js/bootstrap.bundle.min.js.map (100%) rename static/{bootstrap => }/js/bootstrap.js (100%) rename static/{bootstrap => }/js/bootstrap.js.map (100%) rename static/{bootstrap => }/js/bootstrap.min.js (100%) rename static/{bootstrap => }/js/bootstrap.min.js.map (100%) diff --git a/.gitignore b/.gitignore index f1c8043..d9c6f71 100644 --- a/.gitignore +++ b/.gitignore @@ -55,7 +55,7 @@ coverage.xml # Django stuff: *.log local_settings.py -db.sqlite3 +./db.sqlite3 # Flask stuff: instance/ @@ -103,3 +103,7 @@ venv.bak/ # mypy .mypy_cache/ +!media/**/init.txt +**/migrations/** +!**/migrations +!**/migrations/__init__.py diff --git a/dbdex/__init__.py b/dbdex/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/dbdex/admin.py b/dbdex/admin.py new file mode 100644 index 0000000..8c38f3f --- /dev/null +++ b/dbdex/admin.py @@ -0,0 +1,3 @@ +from django.contrib import admin + +# Register your models here. diff --git a/dbdex/apps.py b/dbdex/apps.py new file mode 100644 index 0000000..0e59406 --- /dev/null +++ b/dbdex/apps.py @@ -0,0 +1,5 @@ +from django.apps import AppConfig + + +class DbdexConfig(AppConfig): + name = 'dbdex' diff --git a/projectwork/forms.py b/dbdex/forms.py similarity index 100% rename from projectwork/forms.py rename to dbdex/forms.py diff --git a/dbdex/migrations/__init__.py b/dbdex/migrations/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/dbdex/models.py b/dbdex/models.py new file mode 100644 index 0000000..71a8362 --- /dev/null +++ b/dbdex/models.py @@ -0,0 +1,3 @@ +from django.db import models + +# Create your models here. diff --git a/templates/formparameter.html b/dbdex/templates/dbdex/formparameter.html similarity index 99% rename from templates/formparameter.html rename to dbdex/templates/dbdex/formparameter.html index edd150e..8ebc2f1 100644 --- a/templates/formparameter.html +++ b/dbdex/templates/dbdex/formparameter.html @@ -6,7 +6,7 @@ Sql injection test - + - + + +
+
+ + + -
-

XSS

-
-
+

HTTP HEADER

- - - -
-
-

Scan the http header

-

Please enter the url to be tested in the following format:
- http://www.example.com/ -

-
{% csrf_token %} - {{form}} - - -
-
- -
- {% if httpheader %} -

result :

-
    - {% for key,values in head.items %} -
  • - {{key}} : {{values}} -
    • - {% endfor %} -
- {% endif %} -
-
- - - +
+

XSS

+
+ + + + + +
+
+

Scan the http header

+

Please enter the url to be tested in the following format:
+ http://www.example.com/ +

+
{% csrf_token %} + {{form}} + +
+
+
+ {% if httpheader %} +

result :

+
    + {% for key,values in head.items %} +
  • + {{key}} : {{values}} +
    • + {% endfor %} +
+ {% endif %} +
+
- - + + + + + \ No newline at end of file diff --git a/static/css/index.css b/static/css/index.css new file mode 100644 index 0000000..88714e3 --- /dev/null +++ b/static/css/index.css @@ -0,0 +1,93 @@ +#pad{ + padding: 10px; +} + +#welcometext{ + max-width: 400px; +} + +#centralize{ + text-justify: auto; + text-align: center; + padding-top: 150px; +} + +#getstarted{ + background-color: #ffffff; + border: 1px solid white; + border-radius: 5px; + color: #013C46; + text-decoration: none; + +} + +#showcase, #documentation, #feedback{ + min-height: 650px; +} + +#feedback{ + max-width: 500px; + padding-top: 60px; +} +#documentation{ + padding-top: 10px; + background-color: white; +} + +#documentation h2,h3{ + text-align: center; + color: #013C46; +} + +#documentation h3,li{ + padding-top: 20px; +} + +#showcase{ + background: url("{% static 'img/home.jpg' %}") no-repeat center center; + background-size: cover; +} + +.row{ + max-width: 100%; +} + +.navbar { + -webkit-box-shadow: 0 8px 6px -6px #999; + -moz-box-shadow: 0 8px 6px -6px #999; + box-shadow: 0 8px 6px -6px #999; + + /* the rest of your styling */ +} + +.col-sm-3 ul{ + list-style: none; +} + +label[for="id_fullname"] { + color:white; +} + +label[for="id_email"] { + color:white; +} + +label[for="id_comment"] { + color:white; +} + +#id_email, #id_comment{ + padding-top: 10px; +} + +#footer{ + height: 40px; + background-color: rgb(1, 39, 46); +} + +#centerit{ + color:white; + text-align: center; + padding-top: 5px; + margin-bottom: 0%; +} \ No newline at end of file From 56b0f82df2e84032b99a7f80f23918ec47e4cefa Mon Sep 17 00:00:00 2001 From: silvareal Date: Wed, 3 Apr 2019 15:05:04 +0100 Subject: [PATCH 04/33] DRY template --- dbdex/templates/dbdex/base.html | 33 ++ dbdex/templates/dbdex/documentation.html | 71 ++++ dbdex/templates/dbdex/feedback.html | 15 + dbdex/templates/dbdex/formparameter.html | 277 +++------------ dbdex/templates/dbdex/forms.html | 6 + dbdex/templates/dbdex/header.html | 189 +--------- dbdex/templates/dbdex/index.html | 207 +---------- dbdex/templates/dbdex/nav/header.html | 26 ++ dbdex/templates/dbdex/nav/tabbar.html | 17 + dbdex/templates/dbdex/sql.html | 434 ++++++++--------------- dbdex/templates/dbdex/xss.html | 267 +++----------- dbdex/urls.py | 21 +- dbdex/views.py | 7 + screenshots/.gitignore | 104 ------ static/css/index.css | 223 +++++++++++- 15 files changed, 695 insertions(+), 1202 deletions(-) create mode 100644 dbdex/templates/dbdex/base.html create mode 100644 dbdex/templates/dbdex/documentation.html create mode 100644 dbdex/templates/dbdex/feedback.html create mode 100644 dbdex/templates/dbdex/forms.html create mode 100644 dbdex/templates/dbdex/nav/header.html create mode 100644 dbdex/templates/dbdex/nav/tabbar.html delete mode 100644 screenshots/.gitignore diff --git a/dbdex/templates/dbdex/base.html b/dbdex/templates/dbdex/base.html new file mode 100644 index 0000000..1f627ca --- /dev/null +++ b/dbdex/templates/dbdex/base.html @@ -0,0 +1,33 @@ +{% load static %} + + + + + + + {% block title %}{% endblock title %} || SQL-DEX + + + + + + + {% include 'dbdex/nav/header.html' %} + + {% block content %} + {% endblock content %} + + + + + + + + + + \ No newline at end of file diff --git a/dbdex/templates/dbdex/documentation.html b/dbdex/templates/dbdex/documentation.html new file mode 100644 index 0000000..1f9a4ad --- /dev/null +++ b/dbdex/templates/dbdex/documentation.html @@ -0,0 +1,71 @@ +{% extends 'dbdex/base.html' %} +{% load static %} + +{% block title %}Documentation{% endblock title %} + +{% block content %} + +
+ +

Documentation

+
+

SQL Injection is one of the most dangerous vulnerabilities a web application can be + prone to. When a user’s input is being passed unvalidated and unsanitzed as part of an + SQL query that means that the user can manipulate the query itself and force it to return + different data than what it was supposed to return. we will see how and why this is so + dangerous. + Example of vulnerable code + +

+ Suppose that we have a web application which takes the parameter + “article” via $_GET request and queries the database to get an article’s content. + http://website.com/show.php?article=1 The underlying PHP code is the following: // + The ”article” parameter is assigned to $article variable without any sanitization or + validation $articleid = $_GET[‘article’]; // The $articleid parameter is passed as part + of the query $query = "SELECT * FROM articles WHERE articleid = $articleid"; + If a user changes the article parameter to 1 AND 1=1 then the query becomes like this: + $query = "SELECT * FROM articles WHERE articleid = 1 AND 1=1"; In this case, the content + of the page does not change because the two conditions in the SQL statement are both true. + There is an article with an id of 1, and 1 equals to 1 which is true. If a user changes + the parameter to 1 AND 1=2, it returns nothing because 1 is not equal to 2.That means + that the user is controlling the query and can adjust it accordingly to manipulate the + results. +

+ +
+
+
+

SQL Injection

+
    +
  • You can scan a url for SQL Injection vulnerability simply by inserting the url in the url field and clicking "Test Url
    • +
  • If the url is vulnerable to SQL Injection, It will be shown in the result
    • +
  • Procedures to take in protecting against this kind of attack will be suggested if the url is vulnerable to this kind of attack.
    • +
+
+ +
+

HTTP HEADER

+
    +
  • Get basic informations About HTTP protocol of any website E.g Cookies,hostname
    • +
  • You can insert a website address or I.P address in the URL field and click on Get info.
    • +
  • Procedures to take in protecting against this kind of attack will be suggested if the url is vulnerable to this kind of attack.
    • +
+
+ +
+

Cross Site Scrpting

+
    +
  • Cross-site scripting is the unintended execution of remote code by a web + client. Any web application might expose itself to XSS if it takes input from + a user and outputs it directly on a web page. If input includes HTML or JavaScript, + remote code can be executed when this content is rendered by the web client. +
    • + +
+
+
+
+ +
+
+{% endblock content %} \ No newline at end of file diff --git a/dbdex/templates/dbdex/feedback.html b/dbdex/templates/dbdex/feedback.html new file mode 100644 index 0000000..ecec66e --- /dev/null +++ b/dbdex/templates/dbdex/feedback.html @@ -0,0 +1,15 @@ +{% extends 'dbdex/base.html' %} +{% load static %} + +{% block title %}feedback{% endblock title %} + +{% block content %} + +
+

FEEDBACK


+
+ {% csrf_token %} + Contact + +
+{% endblock content %} \ No newline at end of file diff --git a/dbdex/templates/dbdex/formparameter.html b/dbdex/templates/dbdex/formparameter.html index 8ebc2f1..7f2fb24 100644 --- a/dbdex/templates/dbdex/formparameter.html +++ b/dbdex/templates/dbdex/formparameter.html @@ -1,223 +1,60 @@ +{% extends 'dbdex/base.html' %} {% load static %} - - - - - - - Sql injection test - - - - - - - -
-
- - - - -
-

XSS

-
-
-
- +{% block title %}Form Parameter{% endblock title %} + +{% block content %} + + {% include 'dbdex/nav/tabbar.html' %} + + +
+
+

Form Parameter

+

Please enter the url to be tested in the following format:
+ http://www.example.com/login.php +

+ + {% include 'dbdex/forms.html' %} + +
+ {% if notvulnerable %} +

RESULT

+ {{link}}{{getresult}} - -
-
-

Form Parameter

-

Please enter the url to be tested in the following format:
- http://www.example.com/login.php -

- {% csrf_token %} - {{form}} - - - - -
- {% if notvulnerable %} -

RESULT

- {{link}}{{getresult}} - - {% endif %} - - {% if vulnerable %} - RESULT: - {{link}}{{getresult}} -

Vulnerability Description

-
- - - - - - - - - - - - - - - - - - - - -
IssueDescriptionSuggested Remediation
Input ValidationEven though an id will always be a number, the example above is not validating user input at all.

-

While validating user input is not a direct solution to SQL injection, it helps us control malicious user input into the database.

Before even processing the SQL query, validate user input.

-

In this case, we need to check that the input is a number.

Code allows for SQL injectionThe example above is accepting user input (in this case, from a GET parameter), and including it directly in the SQL statement.

-

This allows an attacker to inject SQL into the query, therefore tricking the application into sending a malformed query to the database.

Use parameterized queries when dealing with SQL queries that contains user input.

A parameterized query allows the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.

-
- {% endif %} -
-
- - -
-
- - - - - - - - - - \ No newline at end of file + {% endif %} + + {% if vulnerable %} + RESULT: + {{link}}{{getresult}} +

Vulnerability Description

+
+ + + + + + + + + + + + + + + + + + + + +
IssueDescriptionSuggested Remediation
Input ValidationEven though an id will always be a number, the example above is not validating user input at all.

+

While validating user input is not a direct solution to SQL injection, it helps us control malicious user input into the database.

Before even processing the SQL query, validate user input.

+

In this case, we need to check that the input is a number.

Code allows for SQL injectionThe example above is accepting user input (in this case, from a GET parameter), and including it directly in the SQL statement.

+

This allows an attacker to inject SQL into the query, therefore tricking the application into sending a malformed query to the database.

Use parameterized queries when dealing with SQL queries that contains user input.

A parameterized query allows the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.

+
+ {% endif %} + + +{% endblock content %} \ No newline at end of file diff --git a/dbdex/templates/dbdex/forms.html b/dbdex/templates/dbdex/forms.html new file mode 100644 index 0000000..6f56e48 --- /dev/null +++ b/dbdex/templates/dbdex/forms.html @@ -0,0 +1,6 @@ + +
+ {% csrf_token %} + {{form}} + +
\ No newline at end of file diff --git a/dbdex/templates/dbdex/header.html b/dbdex/templates/dbdex/header.html index 9276a95..7e4aaf1 100644 --- a/dbdex/templates/dbdex/header.html +++ b/dbdex/templates/dbdex/header.html @@ -1,164 +1,11 @@ +{% extends 'dbdex/base.html' %} {% load static %} - - - - - - - Sql injection test - - - - - - - - - -
-
- - - - - -
-

XSS

-
-
-
+{% block title %}HTTP Header Test{% endblock title %} +{% block content %} + + {% include 'dbdex/nav/tabbar.html' %}
@@ -167,10 +14,9 @@

Scan the http header

Please enter the url to be tested in the following format:
http://www.example.com/

-
{% csrf_token %} - {{form}} - -
+ + + {% include 'dbdex/forms.html' %}
@@ -179,26 +25,11 @@

Scan the http header

    {% for key,values in head.items %}
  • - {{key}} : {{values}} + {{key}} : {{values}}
    • {% endfor %}
{% endif %}
- - - - - - - - - - - \ No newline at end of file +{% endblock content %} \ No newline at end of file diff --git a/dbdex/templates/dbdex/index.html b/dbdex/templates/dbdex/index.html index e13926e..be55cfa 100644 --- a/dbdex/templates/dbdex/index.html +++ b/dbdex/templates/dbdex/index.html @@ -1,199 +1,18 @@ -{% load static %} - - - - - - - - Home - - - - +{% block title %}Home{% endblock title %} - -
-
-

SQLDEX 1.0

-

Welcome to sqldex, you can scan urls to detect for sql injection vulnurability.
This will help you detect SQL injection in your website.

- - -
-
- -
- -

Documentation

-
-

SQL Injection is one of the most dangerous vulnerabilities a web application can be prone to. When a user’s input is being passed unvalidated and unsanitzed as part of an SQL query that means that the user can manipulate the query itself and force it to return different data than what it was supposed to return. we will see how and why this is so dangerous. -

Example of vulnerable code

- Suppose that we have a web application which takes the parameter “article” via $_GET request and queries the database to get an article’s content. http://website.com/show.php?article=1 The underlying PHP code is the following: // The ”article” parameter is assigned to $article variable without any sanitization or validation $articleid = $_GET[‘article’]; // The $articleid parameter is passed as part of the query $query = "SELECT * FROM articles WHERE articleid = $articleid"; - - - If a user changes the article parameter to 1 AND 1=1 then the query becomes like this: $query = "SELECT * FROM articles WHERE articleid = 1 AND 1=1"; In this case, the content of the page does not change because the two conditions in the SQL statement are both true. There is an article with an id of 1, and 1 equals to 1 which is true. - - If a user changes the parameter to 1 AND 1=2, it returns nothing because 1 is not equal to 2. - - That means that the user is controlling the query and can adjust it accordingly to manipulate the results.

-
-
-
-
-

SQL Injection

-
    -
  • You can scan a url for SQL Injection vulnerability simply by inserting the url in the url field and clicking "Test Url
    • -
  • If the url is vulnerable to SQL Injection, It will be shown in the result
    • -
  • Procedures to take in protecting against this kind of attack will be suggested if the url is vulnerable to this kind of attack.
    • -
-
-
-

HTTP HEADER

-
    -
  • Get basic informations About HTTP protocol of any website E.g Cookies,hostname
    • -
  • You can insert a website address or I.P address in the URL field and click on Get info.
    • -
  • Procedures to take in protecting against this kind of attack will be suggested if the url is vulnerable to this kind of attack.
    • -
-
-
-

Cross Site Scrpting

-
    -
  • Cross-site scripting is the unintended execution of remote code by a web client. Any web application might expose itself to XSS if it takes input from a user and outputs it directly on a web page. If input includes HTML or JavaScript, remote code can be executed when this content is rendered by the web client.
    • - -
-
- -
-
- -
-
-

{{feedback}}


-
{% csrf_token %} - {{contact}} -
-
-
- - +{% block content %} +
+
+

SQLDEX 1.0

+

Welcome to sqldex, you can scan urls to detect for sql injection vulnurability.
This will help you detect SQL injection in your website.

+ +
+
+{% endblock content %} - - - - - - - \ No newline at end of file + \ No newline at end of file diff --git a/dbdex/templates/dbdex/nav/header.html b/dbdex/templates/dbdex/nav/header.html new file mode 100644 index 0000000..56f1c62 --- /dev/null +++ b/dbdex/templates/dbdex/nav/header.html @@ -0,0 +1,26 @@ + + diff --git a/dbdex/templates/dbdex/nav/tabbar.html b/dbdex/templates/dbdex/nav/tabbar.html new file mode 100644 index 0000000..cde7a72 --- /dev/null +++ b/dbdex/templates/dbdex/nav/tabbar.html @@ -0,0 +1,17 @@ +
+
+ + + + +
+

XSS

+
+
+
\ No newline at end of file diff --git a/dbdex/templates/dbdex/sql.html b/dbdex/templates/dbdex/sql.html index 7f81ecf..18d74c1 100644 --- a/dbdex/templates/dbdex/sql.html +++ b/dbdex/templates/dbdex/sql.html @@ -1,298 +1,162 @@ +{% extends 'dbdex/base.html' %} {% load static %} - - - - - - - Sql injection test - - - - - -