Skip to content

Commit 6665f35

Browse files
paul-ionpaul-ion
authored
Merge pull request #137 from timmyteo/feature/CWE-209
Feature/CWE 209
2 parents 6dba519 + 9d7a877 commit 6665f35

File tree

9 files changed

+174
-2
lines changed

9 files changed

+174
-2
lines changed

‎AttackGrams.pptx‎

3.37 KB
Binary file not shown.

‎insecureinc/src/main/webapp/cwe209.jsp‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
2+
<%@ page import="inc.insecure.*" %>
3+
<%@ page import="insecure.inc.Constants" %>
4+
<%
5+
String alertVisibility="hidden";
6+
String usr = request.getParameter("usr");
7+
String pwd = request.getParameter("pwd");
8+
9+
if(usr!=null && pwd!=null){
10+
alertVisibility="";
11+
if(usr.equals("demo") && pwd.equals("demo1234")){
12+
request.getSession().setAttribute("cwe209loggedin", true);
13+
response.sendRedirect("cwe209loggedin.jsp");
14+
}
15+
16+
//see if the database user account is tried
17+
if(usr.equals("svc.database.insecure.inc") && pwd.equals("OWASP_R0ckZ!")){
18+
session.setAttribute(Constants.CHALLENGE_ID,"cwe209");
19+
response.sendRedirect(Constants.SECRET_PAGE);
20+
}
21+
}
22+
23+
24+
%>
25+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
26+
<html>
27+
<head>
28+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
29+
<title>Generation of Error Message Containing Sensitive Information</title>
30+
<link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css">
31+
<script src="public/jquery.min.js"></script>
32+
<script src="public/bootstrap/js/bootstrap.min.js"></script>
33+
34+
</head>
35+
<body>
36+
<nav class="navbar navbar-inverse">
37+
<div class="container-fluid">
38+
<div class="navbar-header">
39+
<a class="navbar-brand" href="index.jsp">Insecure Inc.</a>
40+
</div>
41+
<ul class="nav navbar-nav">
42+
<li class="active"><a href="#">CWE209 - Generation of Error Message Containing Sensitive Information</a></li>
43+
</ul>
44+
</div>
45+
</nav>
46+
<div class="container">
47+
<p>Welcome to CWE209 - Generation of Error Message Containing Sensitive Information! You can use the following guest account credentials to login,
48+
user: <code>demo</code>, password: <code>demo1234</code> </p>
49+
<form action="cwe209.jsp" autocomplete="off" method="POST">
50+
<div class="form-group">
51+
<label for="usr">Name:</label>
52+
<input type="text" class="form-control" id="usr" name="usr">
53+
</div>
54+
<!-- disables autocomplete --><input type="text" style="display:none">
55+
<div class="form-group">
56+
<label for="pwd">Password:</label>
57+
<input type="password" class="form-control" id="pwd" name="pwd">
58+
</div>
59+
<input type="submit" id="submit" class="btn" value="Submit">
60+
<br><br>
61+
<div class="alert alert-danger <%=alertVisibility%>">
62+
Invalid credentials!
63+
</div>
64+
</form>
65+
</div>
66+
</body>
67+
</html>

‎insecureinc/src/main/webapp/cwe209loggedin.jsp‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
2+
<%@ page import="inc.insecure.*" %>
3+
<%
4+
if(session.getAttribute("cwe209loggedin")==null || !(boolean)session.getAttribute("cwe209loggedin") || request.getParameter("logout")!=null){
5+
session.setAttribute("cwe209loggedin",false);
6+
response.sendRedirect("cwe209.jsp?loggedin=false");
7+
}
8+
else{
9+
String alertVisibility="hidden";
10+
String query = request.getParameter("query");
11+
12+
if(query!=null){
13+
if(query.contains("'") || query.contains("<") || query.contains(">") || query.contains("#") || query.contains("-") || query.contains("=")){
14+
try{
15+
throw new RuntimeException("Error: unexpected character in query '" + query + "' using connection jdbc:mysql://localhost:3306/insecureinc?user=svc.database.insecure.inc&password=OWASP_R0ckZ!");
16+
}
17+
catch (Exception e){
18+
e.printStackTrace(response.getWriter());
19+
}
20+
}
21+
else{
22+
alertVisibility="";
23+
}
24+
}
25+
%>
26+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
27+
<html>
28+
<head>
29+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
30+
<title>Guest</title>
31+
<link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css">
32+
<script src="public/jquery.min.js"></script>
33+
<script src="public/bootstrap/js/bootstrap.min.js"></script>
34+
35+
</head>
36+
<body>
37+
<nav class="navbar navbar-inverse">
38+
<div class="container-fluid">
39+
<div class="navbar-header">
40+
<a class="navbar-brand" href="index.jsp">Insecure Inc.</a>
41+
</div>
42+
<ul class="nav navbar-nav">
43+
<li class="active"><a href="#">Guest</a></li>
44+
</ul>
45+
<ul class="nav navbar-nav navbar-right">
46+
<li><a href="cwe209loggedin.jsp?logout=true"><span class="glyphicon glyphicon-log-out"></span> Logout</a></li>
47+
</ul>
48+
</div>
49+
</nav>
50+
<div class="container">
51+
<h1>Welcome to the guest section of the site.</h1>
52+
<p>Please enter your search term to return results from the Insecure Inc. archive.</p>
53+
<form action="cwe209loggedin.jsp" autocomplete="off" method="POST">
54+
<div class="form-group">
55+
<label for="search">Search:</label>
56+
<input type="text" class="form-control" id="search" name="query">
57+
</div>
58+
<input type="submit" id="submit" class="btn" value="Submit">
59+
<br><br>
60+
<div class="alert alert-danger <%=alertVisibility%>">
61+
No results found for '<%=query%>'!
62+
</div>
63+
</form>
64+
</div>
65+
</body>
66+
</html>
67+
<%
68+
}
69+
%>

‎insecureinc/src/main/webapp/index.jsp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ body {
6464
<li><a href="cwe327.jsp">Use of a Broken or Risky Cryptographic Algorithm</a></li>
6565
<li><a href="cwe759.jsp">Use of a One-Way Hash without a Salt</a></li>
6666
<li><a href="cwe798.jsp">Use of Hard-coded Credentials</a></li>
67+
<li><a href="cwe209.jsp">Generation of Error Message Containing Sensitive Information</a></li>
6768
<li><a href="cwe307.jsp">Improper Restriction of Excessive Authentication Attempts</a></li>
6869
<li><a href="cwe190.jsp">Integer Overflow or Wraparound</a></li>
6970
<li><a href="cwe494.jsp">Download of Code Without Integrity Check</a></li>

‎trainingportal/static/lessons/attack-grams/errormessage.png‎

45.2 KB
Loading

‎trainingportal/static/lessons/blackBelt/cwe209.html‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<p>
2+
The purpose of this challenge is to demonstrate the MITRE Top 25 programming flaw: 'Generation of Error Message Containing Sensitive Information'.
3+
<br><br>
4+
5+
<blockquote>
6+
<p>
7+
<i>The product generates an error message that includes sensitive information about its environment, users, or associated data.</i>
8+
</p>
9+
<footer>From MITRE <a target="_blank" rel="noopener noreferrer" href="https://cwe.mitre.org/data/definitions/209.html">CWE 209</a></footer>
10+
</blockquote>
11+
<p>
12+
The developer of this part of the site has not implemented secure error handling. As a result, sensitive information about how the application is built can leak and be exploited.
13+
</p>

‎trainingportal/static/lessons/blackBelt/cwe209.sol.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
### Solution for "Generation of Error Message Containing Sensitive Information" challenge
2+
3+
Error messages can contain detailed information about how the application operates, as well as sensitive information about its environment, users, or associated data.
4+
Instead of allowing detailed error messages to be returned to the user, generic error messages with an error ID or code should be returned instead.
5+
The details of the error can be saved to the application logs, accessible only to the application owners.
6+
7+
8+
To pass this challenge:
9+
10+
- Become familiar with the Insecure Inc. archive search after logging in with the guest account.
11+
- Invoke an error in the archive search by entering characters that might be problematic.
12+
- Review error details for credentials that can be used for authentication.

‎trainingportal/static/lessons/blackBelt/definitions.json‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,17 @@
9999
"solution":"cwe759.sol.md",
100100
"playLink":"/cwe759.jsp",
101101
"codeBlockIds":["useStrongDataEncryption"]
102-
}
102+
},
103+
{
104+
"id":"cwe209",
105+
"name":"Generation of Error Message Containing Sensitive Information",
106+
"description": "cwe209.html",
107+
"attackGram":"errormessage.png",
108+
"solution":"cwe209.sol.md",
109+
"playLink":"/cwe209.jsp",
110+
"mission":"Authenticate to the website using credentials discovered in detailed error messages.",
111+
"codeBlockIds":["displayGenericErrorMessages"]
112+
}
103113
]
104114
},
105115
{

‎trainingportal/static/lessons/modules.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"name":"Black Belt",
1818
"summary":"Common software security flaws",
1919
"description":"This module is based on the SANS Top 25 - Most Dangerous Software Flaws. Lessons are entry level difficulty aimed at introducing the concepts of vulnerability, exploit and software defense.",
20-
"description2":"Includes 23 lessons. Estimated duration 4 hours.",
20+
"description2":"Includes 24 lessons. Estimated duration 4 hours.",
2121
"badgeInfo":{
2222
"line1":"Secure Coding",
2323
"line2":"Black Belt",

0 commit comments

Comments
 (0)