chore: migrate legacy PHP customer portal into monorepo

examples/dvwa/.gitattributes

@@ -0,0 +1,31 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+#
+# The above will handle all files NOT found below
+#
+
+# Documents
+*.pdf diff=astextplain
+*.PDF diff=astextplain
+*.md text diff=markdown
+
+# Graphics
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.ico binary
+
+# Archives
+*.db binary
+
+# Text files where line endings should be preserved
+*.patch -text
+
+#
+# Exclude files from exporting
+#
+
+.gitattributes export-ignore
+.gitignore export-ignore
+.gitkeep export-ignore

examples/dvwa/.gitignore

@@ -0,0 +1,18 @@
+# Neither the config file or its backup should go
+# into the repo.
+config/config.inc.php.bak
+config/config.inc.php
+
+# Vim swap files
+.*swp
+
+# VS Code editor files
+*.code-workspace
+
+# Used by pytest
+tests/__pycache__/
+
+# Don't include any uploaded images
+hackable/uploads/*
+.DS_Store
+.DS_Store

examples/dvwa/about.php

@@ -0,0 +1,56 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'About' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'about';
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h2>About</h2>
+	<p>Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment</p>
+	<p>Pre-August 2020, All material is copyright 2008-2015 RandomStorm & Ryan Dewhurst.</p>
+	<p>Ongoing, All material is copyright Robin Wood and probably Ryan Dewhurst.</p>
+
+	<h2>Links</h2>
+	<ul>
+		<li>Project Home: " . dvwaExternalLinkUrlGet( 'https://github.com/digininja/DVWA' ) . "</li>
+		<li>Bug Tracker: " . dvwaExternalLinkUrlGet( 'https://github.com/digininja/DVWA/issues' ) . "</li>
+		<li>Wiki: " . dvwaExternalLinkUrlGet( 'https://github.com/digininja/DVWA/wiki' ) . "</li>
+	</ul>
+
+	<h2>Credits</h2>
+	<ul>
+		<li>Brooks Garrett: " . dvwaExternalLinkUrlGet( 'http://brooksgarrett.com/','www.brooksgarrett.com' ) . "</li>
+		<li>Craig</li>
+		<li>g0tmi1k: " . dvwaExternalLinkUrlGet( 'https://blog.g0tmi1k.com/','g0tmi1k.com' ) . "</li>
+		<li>Jamesr: " . dvwaExternalLinkUrlGet( 'https://www.creativenucleus.com/','www.creativenucleus.com' ) . "</li>
+		<li>Jason Jones</li>
+		<li>RandomStorm</li>
+		<li>Ryan Dewhurst: " . dvwaExternalLinkUrlGet( 'https://wpscan.com/','wpscan.com' ) . "</li>
+		<li>Shinkurt: " . dvwaExternalLinkUrlGet( 'https://evil.blog/','evil.blog' ) . "</li>
+		<li>Tedi Heriyanto: " . dvwaExternalLinkUrlGet( 'http://tedi.heriyanto.net/','tedi.heriyanto.net' ) . "</li>
+		<li>Tom Mackenzie</li>
+		<li>Robin Wood: " . dvwaExternalLinkUrlGet( 'https://digi.ninja/','digi.ninja' ) . "</li>
+		<li>Zhengyang Song: " . dvwaExternalLinkUrlGet( 'https://github.com/songzy12/','songzy12' ) . "</li>
+	</ul>
+
+	<h2>License</h2>
+	<p>Damn Vulnerable Web Application (DVWA) is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.</p>
+
+	<h2>Development</h2>
+	<p>Everyone is welcome to contribute and help make DVWA as successful as it can be. All contributors can have their name and link (if they wish) placed in the credits section. To contribute pick an Issue from the Project Home to work on or submit a patch to the Issues list.</p>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+exit;
+
+?>

examples/dvwa/config/config.inc.php.dist

@@ -0,0 +1,56 @@
+<?php
+
+# If you are having problems connecting to the MySQL database and all of the variables below are correct
+# try changing the 'db_server' variable from localhost to 127.0.0.1. Fixes a problem due to sockets.
+#   Thanks to @digininja for the fix.
+
+# Database management system to use
+$DBMS = getenv('DBMS') ?: 'MySQL';
+#$DBMS = 'PGSQL'; // Currently disabled
+
+# Database variables
+#   WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup.
+#   Please use a database dedicated to DVWA.
+#
+# If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user.
+#   See README.md for more information on this.
+$_DVWA = array();
+$_DVWA[ 'db_server' ]   = getenv('DB_SERVER') ?: '127.0.0.1';
+$_DVWA[ 'db_database' ] = getenv('DB_DATABASE') ?: 'dvwa';
+$_DVWA[ 'db_user' ]     = getenv('DB_USER') ?: 'dvwa';
+$_DVWA[ 'db_password' ] = getenv('DB_PASSWORD') ?: 'p@ssw0rd';
+$_DVWA[ 'db_port']      = getenv('DB_PORT') ?: '3306';
+
+# ReCAPTCHA settings
+#   Used for the 'Insecure CAPTCHA' module
+#   You'll need to generate your own keys at: https://www.google.com/recaptcha/admin
+$_DVWA[ 'recaptcha_public_key' ]  = getenv('RECAPTCHA_PUBLIC_KEY') ?: '';
+$_DVWA[ 'recaptcha_private_key' ] = getenv('RECAPTCHA_PRIVATE_KEY') ?: '';
+
+# Default security level
+#   Default value for the security level with each session.
+#   The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'.
+$_DVWA[ 'default_security_level' ] = getenv('DEFAULT_SECURITY_LEVEL') ?: 'impossible';
+
+# Default locale
+#   Default locale for the help page shown with each session.
+#   The default is 'en'. You may wish to set this to either 'en' or 'zh'.
+$_DVWA[ 'default_locale' ] = getenv('DEFAULT_LOCALE') ?: 'en';
+
+# Disable authentication
+#   Some tools don't like working with authentication and passing cookies around
+#   so this setting lets you turn off authentication.
+$_DVWA[ 'disable_authentication' ] = getenv('DISABLE_AUTHENTICATION') ?: false;
+
+define ('MYSQL', 'mysql');
+define ('SQLITE', 'sqlite');
+
+# SQLi DB Backend
+#   Use this to switch the backend database used in the SQLi and Blind SQLi labs.
+#   This does not affect the backend for any other services, just these two labs.
+#   If you do not understand what this means, do not change it.
+$_DVWA['SQLI_DB'] = getenv('SQLI_DB') ?: MYSQL;
+#$_DVWA['SQLI_DB'] = SQLITE;
+#$_DVWA['SQLITE_DB'] = 'sqli.db';
+
+?>

examples/dvwa/database/bac_setup.sql

@@ -0,0 +1,30 @@
+-- Create tables for Broken Access Control module
+
+-- Table for access logging
+CREATE TABLE IF NOT EXISTS access_log (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    user_id INT NOT NULL,
+    target_id INT NOT NULL,
+    action VARCHAR(50) NOT NULL,
+    timestamp DATETIME NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(user_id),
+    FOREIGN KEY (target_id) REFERENCES users(user_id)
+) ENGINE=InnoDB;
+
+-- Table for security logging (unauthorized attempts)
+CREATE TABLE IF NOT EXISTS security_log (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    user_id INT NOT NULL,
+    target_id INT NOT NULL,
+    action VARCHAR(50) NOT NULL,
+    timestamp DATETIME NOT NULL,
+    ip_address VARCHAR(45) NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(user_id),
+    FOREIGN KEY (target_id) REFERENCES users(user_id)
+) ENGINE=InnoDB;
+
+-- Add role column to users table if it doesn't exist
+ALTER TABLE users ADD COLUMN IF NOT EXISTS role VARCHAR(20) DEFAULT 'user';
+
+-- Update admin user to have admin role
+UPDATE users SET role = 'admin' WHERE user = 'admin';

examples/dvwa/database/create_mssql_db.sql

@@ -0,0 +1,15 @@
+/*
+In case I get round to adding MS SQL support, this creates and populates the tables.
+*/
+
+CREATE DATABASE dvwa;
+
+USE dvwa;
+
+CREATE TABLE users (user_id INT PRIMARY KEY,first_name VARCHAR(15),last_name VARCHAR(15), [user] VARCHAR(15), password VARCHAR(32),avatar VARCHAR(70), last_login DATETIME, failed_login INT);
+
+INSERT INTO users VALUES ('1','admin','admin','admin',CONVERT(NVARCHAR(32),HashBytes('MD5', 'password'),2),'admin.jpg', GETUTCDATE(), '0'), ('2','Gordon','Brown','gordonb',CONVERT(NVARCHAR(32),HashBytes('MD5', 'abc123'),2),'gordonb.jpg', GETUTCDATE(), '0'), ('3','Hack','Me','1337',CONVERT(NVARCHAR(32),HashBytes('MD5', 'charley'),2),'1337.jpg', GETUTCDATE(), '0'), ('4','Pablo','Picasso','pablo',CONVERT(NVARCHAR(32),HashBytes('MD5', 'letmein'),2),'pablo.jpg', GETUTCDATE(), '0'), ('5', 'Bob','Smith','smithy',CONVERT(NVARCHAR(32),HashBytes('MD5', 'password'),2),'smithy.jpg', GETUTCDATE(), '0');
+
+CREATE TABLE guestbook (comment_id INT IDENTITY(1,1) PRIMARY KEY, comment VARCHAR(300), name VARCHAR(100),2);
+
+INSERT INTO guestbook (comment, name) VALUES ('This is a test comment.','test');

examples/dvwa/database/create_oracle_db.sql

@@ -0,0 +1,27 @@
+/* Create a copy of the database and contents in Oracle */
+
+CREATE TABLE users (
+user_id NUMBER NOT NULL,
+first_name varchar(20) DEFAULT NULL,
+last_name varchar(20) DEFAULT NULL,
+"user" varchar(20) DEFAULT NULL,
+password varchar(20) DEFAULT NULL,
+avatar varchar(20) DEFAULT NULL,
+last_login TIMESTAMP,
+failed_login NUMBER,
+PRIMARY KEY (user_id)
+);
+
+CREATE TABLE guestbook
+(comment_id NUMBER GENERATED BY DEFAULT AS IDENTITY,
+"comment" VARCHAR(100) DEFAULT NULL,
+"name" VARCHAR(100) NOT NULL,
+PRIMARY KEY (comment_id));
+
+INSERT INTO users values ('1','admin','admin','admin',('password'),'admin.jpg', sysdate, '0');
+INSERT INTO users values ('2','Gordon','Brown','gordonb',('abc123'),'gordonb.jpg', sysdate, '0');
+INSERT INTO users values ('3','Hack','Me','1337',('charley'),'1337.jpg', sysdate, '0');
+INSERT INTO users values ('4','Pablo','Picasso','pablo',('letmein'),'pablo.jpg', sysdate, '0');
+INSERT INTO users values ('5','Bob','Smith','smithy',('password'),'smithy.jpg', sysdate, '0');
+
+INSERT INTO guestbook ("comment", "name") VALUES ('What a brilliant app!', 'Marcel Marceau');

examples/dvwa/database/create_postgresql_db.sql

@@ -0,0 +1,7 @@
+CREATE TABLE users (user_id INT PRIMARY KEY,first_name VARCHAR(15),last_name VARCHAR(15), "user" VARCHAR(15), password VARCHAR(32),avatar VARCHAR(70), last_login timestamp, failed_login INT);
+
+INSERT INTO users VALUES ('1','admin','admin','admin',MD5('password'),'admin.jpg', CURRENT_TIMESTAMP, '0'),('2','Gordon','Brown','gordonb',MD5('abc123'),'gordonb.jpg', CURRENT_TIMESTAMP, '0'), ('3','Hack','Me','1337',MD5('charley'),'1337.jpg', CURRENT_TIMESTAMP, '0'), ('4','Pablo','Picasso','pablo',MD5('letmein'),'pablo.jpg', CURRENT_TIMESTAMP, '0'), ('5', 'Bob','Smith','smithy',MD5('password'),'smithy.jpg', CURRENT_TIMESTAMP, '0');
+
+CREATE TABLE guestbook (comment_id serial PRIMARY KEY, comment VARCHAR(300), name VARCHAR(100));
+
+INSERT INTO guestbook (comment, name) VALUES ('This is a test comment.','test');

examples/dvwa/database/create_sqlite_db.sql

@@ -0,0 +1,27 @@
+CREATE TABLE `users` (
+`user_id` int NOT NULL,
+`first_name` text DEFAULT NULL,
+`last_name` text DEFAULT NULL,
+`user` text DEFAULT NULL,
+`password` text DEFAULT NULL,
+`avatar` text DEFAULT NULL,
+`last_login` datetime,
+`failed_login` int,
+PRIMARY KEY (`user_id`)
+);
+
+CREATE TABLE `guestbook` (
+`comment_id` int,
+`comment` text default null,
+`name` text DEFAULT NULL,
+PRIMARY KEY (`comment_id`)
+);
+
+
+insert into users values ('1','admin','admin','admin',('password'),'admin.jpg', DATE(), '0');
+insert into users values ('2','Gordon','Brown','gordonb',('abc123'),'gordonb.jpg', DATE(), '0');
+insert into users values ('3','Hack','Me','1337',('charley'),'1337.jpg', DATE(), '0');
+insert into users values ('4','Pablo','Picasso','pablo',('letmein'),'pablo.jpg', DATE(), '0');
+insert into users values ('5','Bob','Smith','smithy',('password'),'smithy.jpg', DATE(), '0');;
+
+insert into guestbook values ('1', 'What a brilliant app!', 'Marcel Marceau');

examples/dvwa/docs/pdf.html

@@ -0,0 +1 @@
+Damn Vulnerable Web Application (DVWA) <a href="docs/DVWA_v1.3.pdf">Official Documentation PDF v1.3</a>

examples/dvwa/dvwa/css/help.css

@@ -0,0 +1,45 @@
+body {
+	background-color: #e7e7e7;
+	font-family: Arial, Helvetica, sans-serif;
+	font-size: 13px;
+}
+
+h1 {
+	font-size: 25px;
+}
+
+div#container {
+}
+
+div#code {
+	background-color: #ffffff;
+}
+
+div#area {
+	margin-left: 30px;
+}
+
+span.spoiler {
+	background-color: black;
+	color: black;
+}
+
+/* === Dark theme === */
+body.dark {
+	background: #2f2f2f;
+	color: #f8fafa;
+}
+
+body.dark a {
+	color: #99cc33;
+}
+
+body.dark div#code {
+	background-color: #2f2f2f;
+	color: #f8fafa;
+}
+
+body.dark table {
+	background-color: #2f2f2f;
+	border: none !important;
+}

examples/dvwa/dvwa/css/login.css

@@ -0,0 +1,59 @@
+body {
+	background: #fefffe;
+	font: 12px/15px Arial, Helvetica, sans-serif;
+	line-height: 20px;
+	color: #6b6b6b;
+}
+
+#wrapper {
+	text-align: center;
+	margin: 0 auto;
+}
+
+#content {
+	display: inline-block;
+	padding: 20px;
+	width: auto;
+}
+
+#footer {
+	position: absolute;
+	width: 100%;
+	height: 50px;
+	bottom: 0px;
+	left: 0px;
+}
+
+label {
+	float: left;
+	text-align: right;
+	margin-right: 0.5em;
+	display: block;
+	overflow: hidden;
+	padding-right: 50px;
+	font-weight: bold;
+}
+
+.loginInput {
+	float: left;
+	color: #6B6B6B;
+	width: 320px;
+	background-color: #F4F4F4;
+	border: 1px;
+	border-style: solid;
+	border-color: #c4c4c4;
+	padding: 6px;
+	margin-bottom: 12px;
+}
+
+fieldset {
+	width: 350px;
+	padding: 10px 20px 10px 20px;
+	overflow: hidden;
+	border-style: none;
+}
+
+p {
+	font-size: 10px;
+}
+