Skip to content

Commit 13a98dd

Browse files
thiagolotufothiagolotufo
authored
Add Insecure Design app to A4 from OWASP top 10 (#617)
* chore: add insecure design app in secDevLabs * change: add insecure design app in readme and rename app folder * fix: update readme.md
1 parent cd48a87 commit 13a98dd

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+475105
-21
lines changed

‎README.md‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -32,27 +32,28 @@ After mitigating a vulnerability, you can send a Pull Request to gently ask the
3232

3333
Disclaimer: You are about to install vulnerable apps in your machine! 🔥
3434

35-
| Vulnerability | Language | Application |
36-
| --------------------------------------------- | -------------- | ------------------------------------------------------------------------------ |
37-
| A1 - Broken Access Control | Golang | [Vulnerable Ecommerce API](owasp-top10-2021-apps/a1/ecommerce-api) |
38-
| A1 - Broken Access Control | NodeJS | [Tic-Tac-Toe](owasp-top10-2021-apps/a1/tictactoe) |
39-
| A1 - Broken Access Control | Golang | [Camplake-API](owasp-top10-2021-apps/a1/camplake-api) |
40-
| A2 - Cryptographic Failures | Golang | [SnakePro](owasp-top10-2021-apps/a2/snake-pro) |
41-
| A3 - Injection | Golang | [CopyNPaste API](owasp-top10-2021-apps/a3/copy-n-paste) |
42-
| A3 - Injection | NodeJS | [Mongection](owasp-top10-2021-apps/a3/mongection) |
43-
| A3 - Injection | Python | [SSType](owasp-top10-2021-apps/a3/sstype) |
44-
| A3 - Injection (XSS) | Python | [Gossip World](owasp-top10-2021-apps/a3/gossip-world) |
45-
| A3 - Injection (XSS) | React | [Comment Killer](owasp-top10-2021-apps/a3/comment-killer) |
46-
| A3 - Injection (XSS) | Angular/Spring | [Streaming](owasp-top10-2021-apps/a3/streaming) |
47-
| A5 - Security Misconfiguration (XXE) | PHP | [ViniJr Blog](owasp-top10-2021-apps/a5/vinijr-blog) |
48-
| A5 - Security Misconfiguration | PHP | [Vulnerable Wordpress Misconfig](owasp-top10-2021-apps/a5/misconfig-wordpress) |
49-
| A5 - Security Misconfiguration | NodeJS | [Stegonography](owasp-top10-2021-apps/a5/stegonography) |
50-
| A6 - Vulnerable and Outdated Components | PHP | [Cimentech](owasp-top10-2021-apps/a6/cimentech) |
51-
| A6 - Vulnerable and Outdated Components | Python | [Golden Hat Society](owasp-top10-2021-apps/a6/golden-hat) |
52-
| A7 - Identity and Authentication Failures | Python | [Saidajaula Monster Fit](owasp-top10-2021-apps/a7/saidajaula-monster) |
53-
| A7 - Identity and Authentication Failures | Golang | [Insecure go project](owasp-top10-2021-apps/a7/insecure-go-project) |
54-
| A8 - Software and Data Integrity Failures | Python | [Amarelo Designs](owasp-top10-2021-apps/a8/amarelo-designs) |
55-
| A9 - Security Logging and Monitoring Failures | Python | [GamesIrados.com](owasp-top10-2021-apps/a9/games-irados) |
35+
| Vulnerability | Language | Application |
36+
| --------------------------------------------- | -------------- | ------------------------------------------------------------------------------- |
37+
| A1 - Broken Access Control | Golang | [Vulnerable Ecommerce API](owasp-top10-2021-apps/a1/ecommerce-api) |
38+
| A1 - Broken Access Control | NodeJS | [Tic-Tac-Toe](owasp-top10-2021-apps/a1/tictactoe) |
39+
| A1 - Broken Access Control | Golang | [Camplake-API](owasp-top10-2021-apps/a1/camplake-api) |
40+
| A2 - Cryptographic Failures | Golang | [SnakePro](owasp-top10-2021-apps/a2/snake-pro) |
41+
| A3 - Injection | Golang | [CopyNPaste API](owasp-top10-2021-apps/a3/copy-n-paste) |
42+
| A3 - Injection | NodeJS | [Mongection](owasp-top10-2021-apps/a3/mongection) |
43+
| A3 - Injection | Python | [SSType](owasp-top10-2021-apps/a3/sstype) |
44+
| A3 - Injection (XSS) | Python | [Gossip World](owasp-top10-2021-apps/a3/gossip-world) |
45+
| A3 - Injection (XSS) | React | [Comment Killer](owasp-top10-2021-apps/a3/comment-killer) |
46+
| A3 - Injection (XSS) | Angular/Spring | [Streaming](owasp-top10-2021-apps/a3/streaming) |
47+
| A4 - Insecure Design | React/Go | [Super Recovery Password App](owasp-top10-2021-apps/a4/super-recovery-password) |
48+
| A5 - Security Misconfiguration (XXE) | PHP | [ViniJr Blog](owasp-top10-2021-apps/a5/vinijr-blog) |
49+
| A5 - Security Misconfiguration | PHP | [Vulnerable Wordpress Misconfig](owasp-top10-2021-apps/a5/misconfig-wordpress) |
50+
| A5 - Security Misconfiguration | NodeJS | [Stegonography](owasp-top10-2021-apps/a5/stegonography) |
51+
| A6 - Vulnerable and Outdated Components | PHP | [Cimentech](owasp-top10-2021-apps/a6/cimentech) |
52+
| A6 - Vulnerable and Outdated Components | Python | [Golden Hat Society](owasp-top10-2021-apps/a6/golden-hat) |
53+
| A7 - Identity and Authentication Failures | Python | [Saidajaula Monster Fit](owasp-top10-2021-apps/a7/saidajaula-monster) |
54+
| A7 - Identity and Authentication Failures | Golang | [Insecure go project](owasp-top10-2021-apps/a7/insecure-go-project) |
55+
| A8 - Software and Data Integrity Failures | Python | [Amarelo Designs](owasp-top10-2021-apps/a8/amarelo-designs) |
56+
| A9 - Security Logging and Monitoring Failures | Python | [GamesIrados.com](owasp-top10-2021-apps/a9/games-irados) |
5657

5758
## OWASP Top 10 (2016) Mobile apps: 📲
5859

‎owasp-top10-2021-apps/a4/super-recovery-password/.gitignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# dependencies
2+
src/app/node_modules/
3+
/.pnp
4+
.pnp.js
5+
6+
# testing
7+
/coverage
8+
9+
# production
10+
/build
11+
12+
# misc
13+
.DS_Store
14+
.env.local
15+
.env.development.local
16+
.env.test.local
17+
.env.production.local
18+
19+
npm-debug.log*
20+
yarn-debug.log*
21+
yarn-error.log*
22+
db
23+
.env

‎owasp-top10-2021-apps/a4/super-recovery-password/Makefile‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
.SILENT:
2+
.DEFAULT_GOAL := help
3+
4+
GO ?= go
5+
GOROOT ?= $(shell $(GO) env GOROOT)
6+
GOPATH ?= $(shell $(GO) env GOPATH)
7+
GOBIN ?= $(GOPATH)/bin
8+
GODEP ?= $(GOBIN)/dep
9+
GOLINT ?= $(GOBIN)/golint
10+
GOSEC ?= $(GOBIN)/gosec
11+
12+
INSECUREBIN ?= insecureDesignA4
13+
14+
COLOR_RESET = \033[0m
15+
COLOR_COMMAND = \033[36m
16+
COLOR_YELLOW = \033[33m
17+
COLOR_GREEN = \033[32m
18+
COLOR_RED = \033[31m
19+
20+
21+
## Installs a development environment
22+
install: compose msg
23+
24+
## Runs a bruteforce attack
25+
bruteforce:
26+
docker-compose -f brute-force/docker-compose.yml down -v --remove-orphans
27+
docker-compose -f brute-force/docker-compose.yml build
28+
docker run --rm --network insecure_net -ti brute-force
29+
30+
## Composes project using docker-compose
31+
compose:
32+
docker-compose -f deployments/docker-compose.yml down -v --remove-orphans
33+
docker-compose -f deployments/docker-compose.yml up -d --build --force-recreate
34+
35+
## Prints initialization message after compose phase
36+
msg:
37+
chmod +x deployments/check-init.sh
38+
./deployments/check-init.sh
39+
40+
## Gets all go test dependencies
41+
get-deps:
42+
$(GO) get -u github.com/golang/dep/cmd/dep
43+
$(GO) get -u golang.org/x/lint/golint
44+
$(GO) get -u github.com/securego/gosec/cmd/gosec
45+
46+
## Checks depencies of the project
47+
check-deps:
48+
$(GODEP) ensure -v
49+
50+
## Runs a security static analysis using Gosec
51+
check-sec:
52+
$(GOSEC) ./... 2> /dev/null
53+
54+
## Perfoms all make tests
55+
test: get-deps lint security-check
56+
57+
## Runs lint
58+
lint:
59+
$(GOLINT) $(shell $(GO) list ./...)
60+
61+
## Builds Go project to the executable fil
62+
build:
63+
$(GO) build -o "$(INSECUREBIN)"
64+
65+
## Prints help message
66+
help:
67+
printf "\n${COLOR_YELLOW}${PROJECT}\n------\n${COLOR_RESET}"
68+
awk '/^[a-zA-Z\-\_0-9\.%]+:/ { \
69+
helpMessage = match(lastLine, /^## (.*)/); \
70+
if (helpMessage) { \
71+
helpCommand = substr($$1, 0, index($$1, ":")); \
72+
helpMessage = substr(lastLine, RSTART + 3, RLENGTH); \
73+
printf "${COLOR_COMMAND}$$ make %s${COLOR_RESET} %s\n", helpCommand, helpMessage; \
74+
} \
75+
} \
76+
{ lastLine = $$0 }' $(MAKEFILE_LIST) | sort
77+
printf "\n"

‎owasp-top10-2021-apps/a4/super-recovery-password/README.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# Super Recovery Password App
2+
3+
<b>Super Recovery Password App</b> is a simple Golang Web App that contains an example of a Insecure Design vulnerability, and its main goal is to illustrate how an attacker could explore it.
4+
5+
## Index
6+
7+
- [Definition](#what-is-insecure-design)
8+
- [Setup](#setup)
9+
- [Attack narrative](#attack-narrative)
10+
- [Objectives](#secure-this-app)
11+
- [Solutions](#pr-solutions)
12+
- [Contributing](#contributing)
13+
14+
## What is Insecure Design?
15+
16+
Insecure design is a broad category representing different weaknesses, expressed as “missing or ineffective control design.” An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks. Therefore, this security risk is focused on the potentials for damage associated with flaws in design and architecture.
17+
18+
The main goal of this app is to discuss how **Insecure Design** vulnerabilities can be exploited and to encourage developers to send secDevLabs Pull Requests on how they would mitigate these flaws.
19+
20+
## Setup
21+
22+
To start this intentionally **insecure application**, you will need [Docker][docker install] and [Docker Compose][docker compose install]. After forking [secDevLabs](https://github.com/globocom/secDevLabs), you must type the following commands to start:
23+
24+
```sh
25+
cd secDevLabs/owasp-top10-2021-apps/a4/super-recovery-password
26+
```
27+
28+
```sh
29+
make install
30+
```
31+
32+
Then simply visit [http://localhost:40001][app] ! 😆
33+
34+
## Get to know the app
35+
36+
To properly understand how this application works, you can follow these simple steps:
37+
38+
- Register an user and make log in;
39+
- Click in `Forgot Password?` buttom and recovery your password.
40+
41+
## Attack narrative
42+
43+
Now that you know the purpose of this app, what could go wrong? The following section describes how an attacker could identify and eventually find sensitive information about the app or its users. We encourage you to follow these steps and try to reproduce them on your own to better understand the attack vector!
44+
45+
### Enumeration Users
46+
47+
- In terminal, execute the following command to run `brute force` script.
48+
49+
```sh
50+
make bruteforce
51+
```
52+
53+
- Select the second option and wait until the script lists the users of the application.
54+
55+
![enumeration users](./images/attack-1.png)
56+
57+
### Change user password
58+
59+
- In terminal, execute the following command to run `brute force` script.
60+
61+
```sh
62+
make bruteforce
63+
```
64+
65+
- Select the second option and enter a login discovered in the first step. The script will use word lists with answers to all password recovery questions to change the user’s password.
66+
67+
![reseting user password](./images/attack-3.png)
68+
69+
### Testing a user’s new password
70+
71+
- Access `http://localhost:40001/login`
72+
73+
![login form](./images/login-form.png)
74+
75+
### Enter the admin credentials (use old password and new password)
76+
77+
- Old admin password
78+
79+
![old admin credentials](./images/attack-4.png)
80+
81+
- New admin passowrd
82+
83+
![new admin password](./images/attack-5.png)
84+
85+
- Restricted route
86+
87+
![new admin password](./images/restricted-1.png)
88+
89+
## Secure this app
90+
91+
How would you mitigate this vulnerability? After your changes, an attacker should not be able to:
92+
93+
- Enumerate Users
94+
- Brute Force Passwords
95+
- Know password recovery questions of a user
96+
- Change a user’s password without a strong password recovery method
97+
98+
## PR solutions
99+
100+
[Spoiler alert 🚨] To understand how this vulnerability can be mitigated, check out [these pull requests](https://github.com/globocom/secDevLabs/pulls?q=is%3Apr+label%3A%22mitigation+solution+%F0%9F%94%92%22+label%3ASuper-Recovery-Password)!
101+
102+
## Contributing
103+
104+
We encourage you to contribute to SecDevLabs! Please check out the [Contributing to SecDevLabs](../../../docs/CONTRIBUTING.md) section for guidelines on how to proceed! 🎉
105+
106+
[docker install]: https://docs.docker.com/install/
107+
[docker compose install]: https://docs.docker.com/compose/install/
108+
[app]: http://localhost:40001

‎owasp-top10-2021-apps/a4/super-recovery-password/brute-force/bf.Dockerfile‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM python:3.9.1
2+
3+
WORKDIR /brute-force
4+
5+
ADD ./brute-force /brute-force/
6+
7+
RUN pip install -q -r requirements.txt
8+
9+
ENTRYPOINT ["python3", "scripts.py"]

‎owasp-top10-2021-apps/a4/super-recovery-password/brute-force/docker-compose.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: '3'
2+
3+
networks:
4+
default:
5+
name: insecure_net
6+
external: true
7+
8+
services:
9+
bf:
10+
build:
11+
context: ../
12+
dockerfile: ./brute-force/bf.Dockerfile
13+
image: brute-force:latest
14+
external_links:
15+
- api:api

‎owasp-top10-2021-apps/a4/super-recovery-password/brute-force/requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
requests==2.28.0

0 commit comments

Comments
 (0)