Standardize defaced-website activity structure

chapters/web-application-security/exotic-attacks/activities/defaced-website/README.md

@@ -1,24 +1,17 @@
-# Name: Web: Exotic Attacks: Defaced Website
+# Name
 
-## Vulnerability
-
-Source code disclosure + loose comparison in PHP
-
-## Exploit
+Web: Exotic Attacks: Defaced Website
 
-Inspect the requests made when accessing the website.
+## Description
 
-Notice that it tries to load `/img/d3f4c3d.png` but receives 404 Not Found.
+Get the flag from [defaced-website](#). The website has been defaced! Can you find out what happened and retrieve the flag?
 
-Instead you can try to access `/img/defaced.png`, now this image exists and it is a capture of a piece from the source code.
+Score: 25
 
-The server computes the md5 hash of the string formed by concatenating the username and password.
-If it is equal (using loose comparison) to `0e413229387827631581229643338212`, it displays the flag.
-
-From the table in the session content, we know that the md5 hash of the string `QNKCDZO` is `0e830400451993494058024219903391`, which would equal to `0e413229387827631581229643338212`.
+## Vulnerability
 
-The final payload in POST data is:
+Source code disclosure + loose comparison in PHP
 
-`username=QNKCDZO&password=&submit=Login`
+## Exploit
 
-Exploit in `../sol/solution.sh`.
+Solution in `./sol/solution.sh`.

chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Dockerfile

@@ -1,3 +1,18 @@
+# Stage 1: Generate the source file with the flag
+FROM alpine:latest AS builder
+
+ARG FLAG
+COPY src/index-template.php /tmp/index-template.php
+RUN sed "s/__TEMPLATE__/${FLAG}/g" /tmp/index-template.php > /tmp/index.php
+
+# Stage 2: Final image
 FROM php:7.2-apache
 
 COPY src/ /var/www/html/
+
+# copy the generated source file from builder stage
+COPY --from=builder /tmp/index.php /var/www/html/index.php
+
+RUN rm /var/www/html/index-template.php
+
+

chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/Makefile

@@ -1,20 +1,20 @@
-FILE	:= ../flag
-FLAG	:= $(shell cat $(FILE))
+EXTERNAL_PORT := 8005
+INTERNAL_PORT := 80
+NAME := sss-web-08_defaced-website
+FLAG := $(shell cat ../flag)
 
-run: generate build
-	docker run -d -p 8005:80 --name sss-web-08_defaced-website sss-web-08_defaced-website
+run: build
+	docker run -d -p $(EXTERNAL_PORT):$(INTERNAL_PORT) --name $(NAME) -t $(NAME)
 
-build: generate
-	docker build -f Dockerfile -t sss-web-08_defaced-website ..
-
-generate:
-	sed 's/__TEMPLATE__/$(FLAG)/g' ../src/index-template.php > ../src/index.php
+build:
+	docker build --build-arg FLAG=$(FLAG) -t $(NAME) -f Dockerfile ..
 
 stop:
-	docker stop sss-web-08_defaced-website
+	docker stop $(NAME)
 
 clean: stop
-	docker rm sss-web-08_defaced-website
-	rm ../src/index.php
+	docker rm $(NAME)
+	docker image rm $(NAME):latest
+
+.PHONY: run build stop clean
 
-.PHONY: build run stop clean

chapters/web-application-security/exotic-attacks/activities/defaced-website/deploy/values.yaml

@@ -0,0 +1,23 @@
+namespace: exotic-attacks
+
+challenge:
+  name: defaced-website
+  category: exotic-attacks
+
+image:
+  repository: ghcr.io/open-education-hub/web-security/exotic-attacks/defaced-website
+  tag: latest
+  pullPolicy: Always
+
+containerPort: 80
+
+service:
+  type: NodePort
+  port: 80
+  nodePort: 8005
+
+healthCheck:
+  enabled: true
+  path: "/_healthcheck.php"
+  initialDelaySeconds: 5
+  periodSeconds: 15

chapters/web-application-security/exotic-attacks/activities/defaced-website/src/_healthcheck.php

@@ -0,0 +1,4 @@
+<?php
+http_response_code(200);
+echo "OK";
+?>