From d9354761d84b6bd8a935c5367a6e0d4839563f4f Mon Sep 17 00:00:00 2001 From: Student USO VM User Date: Sat, 4 Apr 2026 10:08:00 +0000 Subject: [PATCH] Standardize defaced-website activity structure --- .../activities/defaced-website/README.md | 25 +++++++----------- .../defaced-website/deploy/Dockerfile | 15 +++++++++++ .../defaced-website/deploy/Makefile | 26 +++++++++---------- .../defaced-website/deploy/values.yaml | 23 ++++++++++++++++ .../defaced-website/src/_healthcheck.php | 4 +++ 5 files changed, 64 insertions(+), 29 deletions(-) create mode 100644 chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/values.yaml create mode 100644 chapters/web-application-security/exotic-attacks/activities/defaced-website/src/_healthcheck.php diff --git a/chapters/web-application-security/exotic-attacks/activities/defaced-website/README.md b/chapters/web-application-security/exotic-attacks/activities/defaced-website/README.md index 43c41c3d..e68d20e1 100644 --- a/chapters/web-application-security/exotic-attacks/activities/defaced-website/README.md +++ b/chapters/web-application-security/exotic-attacks/activities/defaced-website/README.md @@ -1,24 +1,17 @@ -# Name: Web: Exotic Attacks: Defaced Website +# Name -## Vulnerability - -Source code disclosure + loose comparison in PHP - -## Exploit +Web: Exotic Attacks: Defaced Website -Inspect the requests made when accessing the website. +## Description -Notice that it tries to load `/img/d3f4c3d.png` but receives 404 Not Found. +Get the flag from [defaced-website](#). The website has been defaced! Can you find out what happened and retrieve the flag? -Instead you can try to access `/img/defaced.png`, now this image exists and it is a capture of a piece from the source code. +Score: 25 -The server computes the md5 hash of the string formed by concatenating the username and password. -If it is equal (using loose comparison) to `0e413229387827631581229643338212`, it displays the flag. - -From the table in the session content, we know that the md5 hash of the string `QNKCDZO` is `0e830400451993494058024219903391`, which would equal to `0e413229387827631581229643338212`. +## Vulnerability -The final payload in POST data is: +Source code disclosure + loose comparison in PHP -`username=QNKCDZO&password=&submit=Login` +## Exploit -Exploit in `../sol/solution.sh`. +Solution in `./sol/solution.sh`. diff --git a/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Dockerfile b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Dockerfile index a6adf2da..bca26bfe 100644 --- a/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Dockerfile +++ b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Dockerfile @@ -1,3 +1,18 @@ +# Stage 1: Generate the source file with the flag +FROM alpine:latest AS builder + +ARG FLAG +COPY src/index-template.php /tmp/index-template.php +RUN sed "s/__TEMPLATE__/${FLAG}/g" /tmp/index-template.php > /tmp/index.php + +# Stage 2: Final image FROM php:7.2-apache COPY src/ /var/www/html/ + +# copy the generated source file from builder stage +COPY --from=builder /tmp/index.php /var/www/html/index.php + +RUN rm /var/www/html/index-template.php + + diff --git a/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Makefile b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Makefile index 9f6ea0c7..ba7c78c0 100644 --- a/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Makefile +++ b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Makefile @@ -1,20 +1,20 @@ -FILE := ../flag -FLAG := $(shell cat $(FILE)) +EXTERNAL_PORT := 8005 +INTERNAL_PORT := 80 +NAME := sss-web-08_defaced-website +FLAG := $(shell cat ../flag) -run: generate build - docker run -d -p 8005:80 --name sss-web-08_defaced-website sss-web-08_defaced-website +run: build + docker run -d -p $(EXTERNAL_PORT):$(INTERNAL_PORT) --name $(NAME) -t $(NAME) -build: generate - docker build -f Dockerfile -t sss-web-08_defaced-website .. - -generate: - sed 's/__TEMPLATE__/$(FLAG)/g' ../src/index-template.php > ../src/index.php +build: + docker build --build-arg FLAG=$(FLAG) -t $(NAME) -f Dockerfile .. stop: - docker stop sss-web-08_defaced-website + docker stop $(NAME) clean: stop - docker rm sss-web-08_defaced-website - rm ../src/index.php + docker rm $(NAME) + docker image rm $(NAME):latest + +.PHONY: run build stop clean -.PHONY: build run stop clean diff --git a/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/values.yaml b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/values.yaml new file mode 100644 index 00000000..e5d21193 --- /dev/null +++ b/chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/values.yaml @@ -0,0 +1,23 @@ +namespace: exotic-attacks + +challenge: + name: defaced-website + category: exotic-attacks + +image: + repository: ghcr.io/open-education-hub/web-security/exotic-attacks/defaced-website + tag: latest + pullPolicy: Always + +containerPort: 80 + +service: + type: NodePort + port: 80 + nodePort: 8005 + +healthCheck: + enabled: true + path: "/_healthcheck.php" + initialDelaySeconds: 5 + periodSeconds: 15 diff --git a/chapters/web-application-security/exotic-attacks/activities/defaced-website/src/_healthcheck.php b/chapters/web-application-security/exotic-attacks/activities/defaced-website/src/_healthcheck.php new file mode 100644 index 00000000..8e08ec03 --- /dev/null +++ b/chapters/web-application-security/exotic-attacks/activities/defaced-website/src/_healthcheck.php @@ -0,0 +1,4 @@ +