test from kali -> pycharm ui

Signed-off-by: ABHIJIT SINHA <grey.shell@gmail.com>

Author: greyshell

web/boilerplate/test_mysql.py

@@ -34,7 +34,7 @@ def safe_select_all_query(self):
             return False, e
 
     def unsafe_select_query(self, user):
-        # creating the cursor
+        # create the cursor
         cursor = self.db.conn.cursor()
         rows = None
         try:

web/sqli/db_house-keeping/db_clean-up.sql

@@ -1,10 +1,13 @@
 # author: greyshell
-# usage: mysql -u root -p < resource.sql
-# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+# description: truncate tables
+# usage: mysql -u root --password=<pass> < db_clean.sql
+# lab: sqli
 
-# sql injection: case02, clear the posts
-delete from vulnapp.tbl_post02 where user NOT LIKE 'asinha%';
+# case02: clear all posts, not created by 'asinha'
+DELETE FROM vulnapp.tbl_post02 WHERE user NOT LIKE 'asinha%';
 
-# sql injection: case03, clear the posts
-delete from vulnapp.tbl_post03 where user LIKE 'anonymous-%';
-update vulnapp.tbl_post03 set age = 25, comment = 'Hello', city = 'San Jose' where user = 'admin';
+# case03: clear all posts, created by default anonymous user
+DELETE FROM vulnapp.tbl_post03 WHERE user LIKE 'anonymous-%';
+
+# case03: reset to the default settings
+UPDATE vulnapp.tbl_post03 SET age = 25, comment = 'Hello', city = 'San Jose' WHERE user = 'admin';

web/sqli/db_house-keeping/db_drop.sql

@@ -1,16 +1,17 @@
 # author: greyshell
-# usage: mysql -u root -p < resource.sql
-# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+# description: drop all tables and db
+# usage: mysql -u root --password=<pass> < db_drop.sql
+# lab: sqli
 
-# drop all tables
-# sql injection: case01
+
+# case01:
 DROP TABLE vulnapp.tbl_post01
 
-# sql injection: case02
+# case02:
 DROP TABLE vulnapp.tbl_post02
 DROP TABLE vulnapp.tbl_secret
 
-# sql injection: case03
+# case03:
 DROP TABLE vulnapp.tbl_post03
 
 DROP DATABASE vulnapp;

web/sqli/db_house-keeping/db_setup.sql

@@ -1,12 +1,13 @@
 # author: greyshell
-# usage: mysql -u root -p < resource.sql
-# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+# description: create db, tables and inset data
+# usage: mysql -u root --password=<pass> < db_setup.sql
+# lab: sqli
 
-# create database
-CREATE DATABASE vulnapp;
 
-# sql injection: case01
-CREATE TABLE vulnapp.tbl_post01 (
+CREATE DATABASE IF NOT EXISTS vulnapp;
+
+# case01:
+CREATE TABLE IF NOT EXISTS vulnapp.tbl_post01 (
 comment VARCHAR(30) NOT NULL,
 user VARCHAR(10) NOT NULL
 );
@@ -16,8 +17,8 @@ INSERT INTO vulnapp.tbl_post01 (comment, user) VALUES ('hi', 'usman');
 INSERT INTO vulnapp.tbl_post01 (comment, user) VALUES ('ola', 'amol');
 
 
-# sql injection: case02
-CREATE TABLE vulnapp.tbl_post02 (
+# case02:
+CREATE TABLE IF NOT EXISTS vulnapp.tbl_post02 (
 comment VARCHAR(30) NOT NULL,
 pin INT NOT NULL,
 age INT NOT NULL,
@@ -26,7 +27,7 @@ user VARCHAR(30) NOT NULL
 
 INSERT INTO vulnapp.tbl_post02 (comment, pin, age, user) VALUES ('hola', 100, 25, 'dhaval');
 
-CREATE TABLE vulnapp.tbl_secret (
+CREATE TABLE IF NOT EXISTS vulnapp.tbl_secret (
 user VARCHAR(30) NOT NULL,
 token INT NOT NULL,
 password VARCHAR(30) NOT NULL
@@ -35,8 +36,8 @@ password VARCHAR(30) NOT NULL
 INSERT INTO vulnapp.tbl_secret (user, token, password) VALUES ('asinha', 777, 'blue@123');
 INSERT INTO vulnapp.tbl_secret (user, token, password) VALUES ('admin', 101, 'grey@321');
 
-# sql injection: case03
-CREATE TABLE vulnapp.tbl_post03 (
+# case03:
+CREATE TABLE IF NOT EXISTS vulnapp.tbl_post03 (
 comment VARCHAR(30) NOT NULL,
 city VARCHAR(30) NOT NULL,
 age INT NOT NULL,

web/sqli/template/case01.html

@@ -19,7 +19,8 @@ <h2>SQL Injection</h2>
 <i>author: greyshell</i><br><br>
 Objective: extract admin's password and token <br><br>
 <form method="POST">
-    Enter a user to view his comments:
+    Enter a user (e.g. usman, pedro, amol) to view his comments:
+    <br><br>
     <label>
         <input type="text" name="user" size=100/>
     </label><br/><br/>

web/sqli/template/case02.html

@@ -17,9 +17,9 @@
 <body>
 <h2>SQL Injection</h2>
 <i>author: greyshell</i><br><br>
-Objective: extract admin's token(INT) and password(VARCHAR) from a secret table<br><br>
+Objective: extract admin's token(INT) and password(VARCHAR) from the "secret" table<br><br>
 <form method="POST">
-    Enter your comment:
+    Enter your comment as an anonymous user:
     <label>
         <input type="text" name="comment" size=100/>
     </label><br/><br/>

web/xss/db_house-keeping/db_clean.sql

@@ -0,0 +1,6 @@
+# author: greyshell
+# description: truncate tables
+# usage: mysql -u root --password=<pass> < db_clean.sql
+# lab: xss
+
+TRUNCATE TABLE vulnapp.tbl_users;

web/xss/db_house-keeping/db_drop.sql

@@ -0,0 +1,8 @@
+# author: greyshell
+# description: drop all tables an db
+# usage: mysql -u root --password=<pass> < db_drop.sql
+# lab: xss
+
+DROP TABLE vulnapp.tbl_users;
+
+DROP DATABASE vulnapp;

web/xss/db_house-keeping/db_setup.sql

@@ -0,0 +1,19 @@
+# author: greyshell
+# description: create db, tables and inset data
+# usage: mysql -u root --password=<pass> < db_setup.sql
+# lab: xss
+
+
+CREATE DATABASE IF NOT EXISTS vulnapp;
+
+CREATE TABLE IF NOT EXISTS vulnapp.tbl_users (
+id INT(11) NOT NULL AUTO_INCREMENT,
+username VARCHAR(25) NOT NULL,
+password VARCHAR(25) NOT NULL,
+name VARCHAR(25) NOT NULL,
+age INT(11) NOT NULL,
+PRIMARY KEY (id)
+);
+
+INSERT INTO vulnapp.tbl_users (username, password, name, age) VALUES ('admin', 'abc', 'admin', 38);
+INSERT INTO vulnapp.tbl_users (username, password, name, age) VALUES ('vampire', 'xyz', 'dhaval', 22);

web/xss/template/welcome.html

@@ -16,5 +16,7 @@
     <input type="button" value="submit" onclick="changeAgeRequest()"/><br/>
     <span id="notice"></span>
 </form>
+<br>
+note: xss end point: /xss?payload=your_script
 </body>
 </html>