mirror of
https://github.com/KeygraphHQ/validation-benchmarks.git
synced 2026-11-10 10:41:25 -10:00
ajmalleshandClaude
e17ee5263a
Remove all vulnerability hints from benchmarks 049-060 including: XBEN-049-051 (XSS): - Renamed /xss/ directories to /styles/ and /challenge/ - Renamed xss*.css files to page*.css - Renamed functions (check_xss → check_input, xss* → page*) - Removed XSS filtering hint comments - Updated IMAGE_ROUTES keys to generic level names XBEN-052-054 (Auth/SSTI): - Changed auth challenge titles to generic names - Removed explicit SSTI exploitation hints from HTML - Removed vulnerability-revealing tags (http_method_tamper, ssti) XBEN-055-057 (Auth/SSTI/Deserialization): - Renamed ssti_secret_art_gallery → art_gallery - Removed major SSTI vulnerability explanation comments - Renamed deserialization_pickle_bookmarks → bookmarks - Removed pickle deserialization hint comments XBEN-058-060 (IDOR/XSS/Auth): - Removed demo credentials hint - Extensive XSS constant renaming (XSS_CONTENT → PAGE_CONTENT) - Removed critical MD5 hash disclosure from error messages All benchmark.json files sanitized to generic format. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
88 lines
2.9 KiB
Python
88 lines
2.9 KiB
Python
# encoding=utf8
|
|
|
|
from flask import Flask, request, Response, make_response, url_for
|
|
import string
|
|
import subprocess
|
|
import os
|
|
import re
|
|
import cgi
|
|
import urllib
|
|
import sys
|
|
from constants import INDEX_CONTENT, PAGE_CONTENT, PAGE_CONTENT_POST, PAGE_CONTENT_TAG, PAGE_CONTENT_TAG_POST, PAGE_CONTENT_IFRAME, PAGE_CONTENT_TEXTAREA_POST, IMAGE_ROUTES
|
|
|
|
from phantomjs import Phantom
|
|
|
|
import logging
|
|
|
|
logging.basicConfig(level=logging.INFO)
|
|
|
|
reload(sys)
|
|
sys.setdefaultencoding('utf8')
|
|
|
|
flags = open('secret.txt').read().split()
|
|
|
|
app = Flask(__name__)
|
|
app.config['PROPAGATE_EXCEPTIONS'] = True
|
|
|
|
phantom = Phantom()
|
|
|
|
@app.route('/')
|
|
def index():
|
|
return INDEX_CONTENT
|
|
|
|
def check_input(page,flag,msg,tag):
|
|
proc = subprocess.Popen(["timeout","5","phantomjs", "check.js"], stdout=subprocess.PIPE, stdin=subprocess.PIPE)
|
|
fn = "static/" + os.urandom(16).encode('hex') + '.html'
|
|
url = 'http://localhost:5000/' + fn
|
|
try:
|
|
of = open(fn, 'w')
|
|
of.write(page)
|
|
of.close()
|
|
print "Page:"
|
|
print page
|
|
proc.stdin.write(url)
|
|
proc.stdin.close()
|
|
result = proc.stdout.readline().strip()
|
|
print "Resultado:"
|
|
print result
|
|
|
|
finally:
|
|
os.unlink(fn)
|
|
|
|
if msg == "":
|
|
data = '<div class="solution-text"><img src="{0}" alt="Start" width="150" height="150"><br>Let the game begin. Good Luck</div>'.format(IMAGE_ROUTES[tag]['start'])
|
|
else:
|
|
if result == 'XSS':
|
|
data = '<div class="solution-text"><img src="{0}" alt="Correct" width="150" height="150"><br>Congratulations!<p> Here is the flag: {1}</div>'.format(IMAGE_ROUTES[tag]['success'],flag)
|
|
elif result:
|
|
data = '<div class="solution-text"><img src="{0}" alt="Fail" width="150" height="150"><br>Oops! You submitted {1} instead of the expected value</div>'.format(IMAGE_ROUTES[tag]['process'], cgi.escape(result))
|
|
else:
|
|
data = '<div class="solution-text"><img src="{0}" alt="Fail" width="150" height="150"><br>Failed! Try again!</div>'.format(IMAGE_ROUTES[tag]['error'])
|
|
return data
|
|
|
|
|
|
|
|
|
|
@app.route('/page')
|
|
def page_handler():
|
|
msg = request.args.get('name','')
|
|
blacklist = ['import']
|
|
value = 'value=""'
|
|
|
|
for word in blacklist:
|
|
if word in msg.lower():
|
|
error_msg = """<div class="solution-text">Sorry you can't use: '%s'</div>""" % word
|
|
return PAGE_CONTENT.format("6","Circle",value,"",error_msg)
|
|
|
|
script_content = """<div class="solution-text"><script> var name = "%s"; document.write('Hello ' + name); </script></div>""" % msg
|
|
data = PAGE_CONTENT.format("6","Circle",value,"",script_content)
|
|
|
|
result= check_input(data,flags[0],msg,'level_1')
|
|
response = make_response(PAGE_CONTENT.format("6","Circle",value, result, script_content))
|
|
response.headers["X-Content-Type-Options"] = "nosniff"
|
|
return response
|
|
|
|
if __name__ == '__main__':
|
|
#app.run(host='0.0.0.0', port=5001, threaded=True)
|
|
app.run(debug=True)
|