-
Notifications
You must be signed in to change notification settings - Fork 446
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Insecure Design app to A4 from OWASP top 10 (#617)
* chore: add insecure design app in secDevLabs * change: add insecure design app in readme and rename app folder * fix: update readme.md
- Loading branch information
1 parent
cd48a87
commit 13a98dd
Showing
64 changed files
with
475,105 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 23 additions & 0 deletions
23
owasp-top10-2021-apps/a4/super-recovery-password/.gitignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| # dependencies | ||
| src/app/node_modules/ | ||
| /.pnp | ||
| .pnp.js | ||
|
|
||
| # testing | ||
| /coverage | ||
|
|
||
| # production | ||
| /build | ||
|
|
||
| # misc | ||
| .DS_Store | ||
| .env.local | ||
| .env.development.local | ||
| .env.test.local | ||
| .env.production.local | ||
|
|
||
| npm-debug.log* | ||
| yarn-debug.log* | ||
| yarn-error.log* | ||
| db | ||
| .env |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| .SILENT: | ||
| .DEFAULT_GOAL := help | ||
|
|
||
| GO ?= go | ||
| GOROOT ?= $(shell $(GO) env GOROOT) | ||
| GOPATH ?= $(shell $(GO) env GOPATH) | ||
| GOBIN ?= $(GOPATH)/bin | ||
| GODEP ?= $(GOBIN)/dep | ||
| GOLINT ?= $(GOBIN)/golint | ||
| GOSEC ?= $(GOBIN)/gosec | ||
|
|
||
| INSECUREBIN ?= insecureDesignA4 | ||
|
|
||
| COLOR_RESET = \033[0m | ||
| COLOR_COMMAND = \033[36m | ||
| COLOR_YELLOW = \033[33m | ||
| COLOR_GREEN = \033[32m | ||
| COLOR_RED = \033[31m | ||
|
|
||
|
|
||
| ## Installs a development environment | ||
| install: compose msg | ||
|
|
||
| ## Runs a bruteforce attack | ||
| bruteforce: | ||
| docker-compose -f brute-force/docker-compose.yml down -v --remove-orphans | ||
| docker-compose -f brute-force/docker-compose.yml build | ||
| docker run --rm --network insecure_net -ti brute-force | ||
|
|
||
| ## Composes project using docker-compose | ||
| compose: | ||
| docker-compose -f deployments/docker-compose.yml down -v --remove-orphans | ||
| docker-compose -f deployments/docker-compose.yml up -d --build --force-recreate | ||
|
|
||
| ## Prints initialization message after compose phase | ||
| msg: | ||
| chmod +x deployments/check-init.sh | ||
| ./deployments/check-init.sh | ||
|
|
||
| ## Gets all go test dependencies | ||
| get-deps: | ||
| $(GO) get -u github.com/golang/dep/cmd/dep | ||
| $(GO) get -u golang.org/x/lint/golint | ||
| $(GO) get -u github.com/securego/gosec/cmd/gosec | ||
|
|
||
| ## Checks depencies of the project | ||
| check-deps: | ||
| $(GODEP) ensure -v | ||
|
|
||
| ## Runs a security static analysis using Gosec | ||
| check-sec: | ||
| $(GOSEC) ./... 2> /dev/null | ||
|
|
||
| ## Perfoms all make tests | ||
| test: get-deps lint security-check | ||
|
|
||
| ## Runs lint | ||
| lint: | ||
| $(GOLINT) $(shell $(GO) list ./...) | ||
|
|
||
| ## Builds Go project to the executable fil | ||
| build: | ||
| $(GO) build -o "$(INSECUREBIN)" | ||
|
|
||
| ## Prints help message | ||
| help: | ||
| printf "\n${COLOR_YELLOW}${PROJECT}\n------\n${COLOR_RESET}" | ||
| awk '/^[a-zA-Z\-\_0-9\.%]+:/ { \ | ||
| helpMessage = match(lastLine, /^## (.*)/); \ | ||
| if (helpMessage) { \ | ||
| helpCommand = substr($$1, 0, index($$1, ":")); \ | ||
| helpMessage = substr(lastLine, RSTART + 3, RLENGTH); \ | ||
| printf "${COLOR_COMMAND}$$ make %s${COLOR_RESET} %s\n", helpCommand, helpMessage; \ | ||
| } \ | ||
| } \ | ||
| { lastLine = $$0 }' $(MAKEFILE_LIST) | sort | ||
| printf "\n" |
108 changes: 108 additions & 0 deletions
108
owasp-top10-2021-apps/a4/super-recovery-password/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| # Super Recovery Password App | ||
|
|
||
| <b>Super Recovery Password App</b> is a simple Golang Web App that contains an example of a Insecure Design vulnerability, and its main goal is to illustrate how an attacker could explore it. | ||
|
|
||
| ## Index | ||
|
|
||
| - [Definition](#what-is-insecure-design) | ||
| - [Setup](#setup) | ||
| - [Attack narrative](#attack-narrative) | ||
| - [Objectives](#secure-this-app) | ||
| - [Solutions](#pr-solutions) | ||
| - [Contributing](#contributing) | ||
|
|
||
| ## What is Insecure Design? | ||
|
|
||
| Insecure design is a broad category representing different weaknesses, expressed as “missing or ineffective control design.” An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks. Therefore, this security risk is focused on the potentials for damage associated with flaws in design and architecture. | ||
|
|
||
| The main goal of this app is to discuss how **Insecure Design** vulnerabilities can be exploited and to encourage developers to send secDevLabs Pull Requests on how they would mitigate these flaws. | ||
|
|
||
| ## Setup | ||
|
|
||
| To start this intentionally **insecure application**, you will need [Docker][docker install] and [Docker Compose][docker compose install]. After forking [secDevLabs](https://github.com/globocom/secDevLabs), you must type the following commands to start: | ||
|
|
||
| ```sh | ||
| cd secDevLabs/owasp-top10-2021-apps/a4/super-recovery-password | ||
| ``` | ||
|
|
||
| ```sh | ||
| make install | ||
| ``` | ||
|
|
||
| Then simply visit [http://localhost:40001][app] ! 😆 | ||
|
|
||
| ## Get to know the app | ||
|
|
||
| To properly understand how this application works, you can follow these simple steps: | ||
|
|
||
| - Register an user and make log in; | ||
| - Click in `Forgot Password?` buttom and recovery your password. | ||
|
|
||
| ## Attack narrative | ||
|
|
||
| Now that you know the purpose of this app, what could go wrong? The following section describes how an attacker could identify and eventually find sensitive information about the app or its users. We encourage you to follow these steps and try to reproduce them on your own to better understand the attack vector! | ||
|
|
||
| ### Enumeration Users | ||
|
|
||
| - In terminal, execute the following command to run `brute force` script. | ||
|
|
||
| ```sh | ||
| make bruteforce | ||
| ``` | ||
|
|
||
| - Select the second option and wait until the script lists the users of the application. | ||
|
|
||
|  | ||
|
|
||
| ### Change user password | ||
|
|
||
| - In terminal, execute the following command to run `brute force` script. | ||
|
|
||
| ```sh | ||
| make bruteforce | ||
| ``` | ||
|
|
||
| - Select the second option and enter a login discovered in the first step. The script will use word lists with answers to all password recovery questions to change the user’s password. | ||
|
|
||
|  | ||
|
|
||
| ### Testing a user’s new password | ||
|
|
||
| - Access `http://localhost:40001/login` | ||
|
|
||
|  | ||
|
|
||
| ### Enter the admin credentials (use old password and new password) | ||
|
|
||
| - Old admin password | ||
|
|
||
|  | ||
|
|
||
| - New admin passowrd | ||
|
|
||
|  | ||
|
|
||
| - Restricted route | ||
|
|
||
|  | ||
|
|
||
| ## Secure this app | ||
|
|
||
| How would you mitigate this vulnerability? After your changes, an attacker should not be able to: | ||
|
|
||
| - Enumerate Users | ||
| - Brute Force Passwords | ||
| - Know password recovery questions of a user | ||
| - Change a user’s password without a strong password recovery method | ||
|
|
||
| ## PR solutions | ||
|
|
||
| [Spoiler alert 🚨] To understand how this vulnerability can be mitigated, check out [these pull requests](https://github.com/globocom/secDevLabs/pulls?q=is%3Apr+label%3A%22mitigation+solution+%F0%9F%94%92%22+label%3ASuper-Recovery-Password)! | ||
|
|
||
| ## Contributing | ||
|
|
||
| We encourage you to contribute to SecDevLabs! Please check out the [Contributing to SecDevLabs](../../../docs/CONTRIBUTING.md) section for guidelines on how to proceed! 🎉 | ||
|
|
||
| [docker install]: https://docs.docker.com/install/ | ||
| [docker compose install]: https://docs.docker.com/compose/install/ | ||
| [app]: http://localhost:40001 |
9 changes: 9 additions & 0 deletions
9
owasp-top10-2021-apps/a4/super-recovery-password/brute-force/bf.Dockerfile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| FROM python:3.9.1 | ||
|
|
||
| WORKDIR /brute-force | ||
|
|
||
| ADD ./brute-force /brute-force/ | ||
|
|
||
| RUN pip install -q -r requirements.txt | ||
|
|
||
| ENTRYPOINT ["python3", "scripts.py"] |
15 changes: 15 additions & 0 deletions
15
owasp-top10-2021-apps/a4/super-recovery-password/brute-force/docker-compose.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| version: '3' | ||
|
|
||
| networks: | ||
| default: | ||
| name: insecure_net | ||
| external: true | ||
|
|
||
| services: | ||
| bf: | ||
| build: | ||
| context: ../ | ||
| dockerfile: ./brute-force/bf.Dockerfile | ||
| image: brute-force:latest | ||
| external_links: | ||
| - api:api |
1 change: 1 addition & 0 deletions
1
owasp-top10-2021-apps/a4/super-recovery-password/brute-force/requirements.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| requests==2.28.0 |
Oops, something went wrong.