diff --git a/.whitesource b/.whitesource new file mode 100644 index 0000000..891f01f --- /dev/null +++ b/.whitesource @@ -0,0 +1,3 @@ +{ + "settingsInheritedFrom": "wrbejar/whitesource-config@master" +} \ No newline at end of file diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..cb80dcf --- /dev/null +++ b/Dockerfile @@ -0,0 +1,9 @@ +FROM tomcat + +COPY . . + +RUN apt-get update ; apt-get install maven default-jdk -y ; update-alternatives --config javac + +RUN mvn clean package ; cp target/*.war /usr/local/tomcat/webapps/ + +CMD ["catalina.sh","run"] diff --git a/LICENSE b/LICENSE index 23cb790..d6a9326 100644 --- a/LICENSE +++ b/LICENSE @@ -1,4 +1,4 @@ - GNU GENERAL PUBLIC LICENSE +GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., @@ -337,3 +337,4 @@ proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. + diff --git a/README.md b/README.md index 8560b23..7ed511d 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,75 @@ -This is Vulnerable Web Application developed for course by Cyber Security and Privacy Foundation -(www.cysecurity.org) for Java programmers +This is a "Vulnerable" Web Application developed by Cyber Security and Privacy Foundation(www.cysecurity.org). This app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code. -Get the VulnerableSpring Project from here: -https://github.com/breakthesec/VulnerableSpring +**The full course content is now available on Github for free:** + +https://github.com/CSPF-Founder/JavaSecurityCourse + + +**The full course on Hacking and Securing Web Java Programs is available in** ----------------------------------- -The full course on Hacking and Securing Web Java Programs is available in ------------------------------------ https://www.udemy.com/hacking-securing-java-web-programming/ ----------------------------------- -VirtualBox VM can be found here: ----------------------------------- -http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download +**Warning**: Don't run this app in Your Main Machine or in an online server. Install it in Vitual Machine. + + +How to Use/Setup ? +------------- + +**Method 1.Super Very Easiest Method: Docker** + The easiest way to use Java Vulnerable is using Docker which set up everything for you with 1 command line + + Steps: + + 1. Install Docker: https://docs.docker.com/engine/installation/ + 2. Install docker-compose: https://docs.docker.com/compose/install/ + 3. Inside this directory, run `sudo docker-compose up` and wait untill everything is configured for you. + 4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp + 5. Change the JDBC URL from jdbc:mysql://localhost:3306 to jdbc:mysql://mysql:3306 + 6. Click the Install Button + 7. Enjoy :) + + +**Method 2.Very Easiest Method : VirtualBox VM** + The second most easiest way to use Java Vulnerable is using the VirtualBox VM which has everything set up and ready to use. + + Steps: + + 1. Install the VirtualBox : https://www.virtualbox.org/wiki/Downloads + 2. Download the VM Image from here : http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download + 3. Import the JavaVulnerable.ova into VirtualBox. + 4. Change the Network Settings to Host-Only Network + 5. Start the Machine and Log into the Machine( Credentials; username: root password: cspf) + 6. Start Tomcat by entering "service tomcat start" in the Terminal + 7. Start mysql by entering "service mysql start" in the Terminal + 8. Find the IP Address of Machine + 9. In your Browser, go to "http://[IP_ADDRESS_OF_VM]:8080/JavaVulnerableLab/install.jsp + 10. Click the Install Button + 11. Enjoy :) + +**Method 3.Easiest Method : Standalone Web Application** + In this mehtod, you will be running an executable "JAR" file which runs the application with an embedded Apache Tomcat. + + Steps: + + 1. Install JDK + 2. Download Executable Jar from here: http://sourceforge.net/projects/javavulnerablelab/files/v0.2/JavaVulnerableLab.jar/download + 3. Double Click the JavaVulnerable.jar to run( if double click is not working, run this command "java -jar JavaVulnerable.jar" in your Terminal or CMD) + 4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp + 5. Click the Install Button + +**Method 4. Using War file:** + This is a NORMAL method to deploy the WAR file. + + Steps: + + 1. Install Apache Tomcat server + 2. Go to http://[Tomcat_INSTALLED_IP]:8080/manager/ (make sure you have modified tomcat-users.xml file of the tomcat to allow the manager). + 3. Download our WAR file from here: https://sourceforge.net/projects/javavulnerablelab/files/latest/JavaVulnerableLab.war/download + 4. Deploy the WAR in Apache Tomcat manager. + 5. Go to http://[Tomcat_INSTALLED_IP]:8080/JavaVulnerableLab/install.jsp + 6. Click the Install Button + + +Get the VulnerableSpring Project from here: +https://github.com/CSPF-Founder/VulnerableSpring + diff --git a/build.xml b/build.xml deleted file mode 100644 index 841659c..0000000 --- a/build.xml +++ /dev/null @@ -1,71 +0,0 @@ - - - - - - - - - - - Builds, tests, and runs the project JavaVulnerableLab. - - - diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..672bcac --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,11 @@ +javavulnlab: + build: . + ports: + - 8080:8080 + links: + - mysql + +mysql: + image: mysql + environment: + - MYSQL_ROOT_PASSWORD=root diff --git a/nbproject/ant-deploy.xml b/nbproject/ant-deploy.xml deleted file mode 100644 index 5ca2a42..0000000 --- a/nbproject/ant-deploy.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/build-impl.xml b/nbproject/build-impl.xml deleted file mode 100644 index df502d0..0000000 --- a/nbproject/build-impl.xml +++ /dev/null @@ -1,1448 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set src.dir - Must set test.src.dir - Must set build.dir - Must set build.web.dir - Must set build.generated.dir - Must set dist.dir - Must set build.classes.dir - Must set dist.javadoc.dir - Must set build.test.classes.dir - Must set build.test.results.dir - Must set build.classes.excludes - Must set dist.war - - - - - - - - - -The Java EE server classpath is not correctly set up - server home directory is missing. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Dj2ee.server.home=<app_server_installation_directory> - - -The Java EE server classpath is not correctly set up. Your active server type is ${j2ee.server.type}. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Duser.properties.file=<path_to_property_file> (where you put the property "j2ee.platform.classpath" in a .properties file) -or ant -Dj2ee.platform.classpath=<server_classpath> (where no properties file is used) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No tests executed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -The libs.CopyLibs.classpath property is not set up. -This property must point to -org-netbeans-modules-java-j2seproject-copylibstask.jar file which is part -of NetBeans IDE installation and is usually located at -<netbeans_installation>/java<version>/ant/extra folder. -Either open the project in the IDE and make sure CopyLibs library -exists or setup the property manually. For example like this: - ant -Dlibs.CopyLibs.classpath=a/path/to/org-netbeans-modules-java-j2seproject-copylibstask.jar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set JVM to use for profiling in profiler.info.jvm - Must set profiler agent JVM arguments in profiler.info.jvmargs.agent - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - Must select a file in the IDE or set jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Browser not found, cannot launch the deployed application. Try to set the BROWSER environment variable. - - - Launching ${browse.url} - - - - - - Must select one file in the IDE or set run.class - - - - Must select one file in the IDE or set run.class - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - Must set fix.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This target only works when run from inside the NetBeans IDE. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - Some tests failed; see details above. - - - - - - - - - Must select some files in the IDE or set test.includes - - - - Some tests failed; see details above. - - - - Must select some files in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - Some tests failed; see details above. - - - - - Must select one file in the IDE or set test.class - - - - Must select one file in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/genfiles.properties b/nbproject/genfiles.properties deleted file mode 100644 index cb66364..0000000 --- a/nbproject/genfiles.properties +++ /dev/null @@ -1,8 +0,0 @@ -build.xml.data.CRC32=903755fa -build.xml.script.CRC32=8f523743 -build.xml.stylesheet.CRC32=651128d4@1.67.1.1 -# This file is used by a NetBeans-based IDE to track changes in generated files such as build-impl.xml. -# Do not edit this file. You may delete it but then the IDE will never regenerate such files for you. -nbproject/build-impl.xml.data.CRC32=903755fa -nbproject/build-impl.xml.script.CRC32=084958d7 -nbproject/build-impl.xml.stylesheet.CRC32=99ea4b56@1.67.1.1 diff --git a/nbproject/private/private.properties b/nbproject/private/private.properties deleted file mode 100644 index a50452d..0000000 --- a/nbproject/private/private.properties +++ /dev/null @@ -1,8 +0,0 @@ -deploy.ant.properties.file=/home/breakthesec/.netbeans/8.0/tomcat80.properties -j2ee.server.domain=/home/breakthesec/.netbeans/8.0/apache-tomcat-8.0.3.0_base -j2ee.server.home=/home/breakthesec/apache-tomcat-8.0.3 -j2ee.server.instance=tomcat80:home=/home/breakthesec/apache-tomcat-8.0.3:base=apache-tomcat-8.0.3.0_base -javac.debug=true -javadoc.preview=true -selected.browser=default -user.properties.file=/home/breakthesec/.netbeans/8.0/build.properties diff --git a/nbproject/private/private.xml b/nbproject/private/private.xml deleted file mode 100644 index 6807a2b..0000000 --- a/nbproject/private/private.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - - diff --git a/nbproject/project.properties b/nbproject/project.properties deleted file mode 100644 index 6ea3de5..0000000 --- a/nbproject/project.properties +++ /dev/null @@ -1,88 +0,0 @@ -annotation.processing.enabled=true -annotation.processing.enabled.in.editor=true -annotation.processing.processors.list= -annotation.processing.run.all.processors=true -annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output -build.classes.dir=${build.web.dir}/WEB-INF/classes -build.classes.excludes=**/*.java,**/*.form -build.dir=build -build.generated.dir=${build.dir}/generated -build.generated.sources.dir=${build.dir}/generated-sources -build.test.classes.dir=${build.dir}/test/classes -build.test.results.dir=${build.dir}/test/results -build.web.dir=${build.dir}/web -build.web.excludes=${build.classes.excludes} -client.urlPart= -compile.jsps=false -conf.dir=${source.root}/conf -debug.classpath=${build.classes.dir}:${javac.classpath} -debug.test.classpath=\ - ${run.test.classpath} -display.browser=true -# Files to be excluded from distribution war -dist.archive.excludes= -dist.dir=dist -dist.ear.war=${dist.dir}/${war.ear.name} -dist.javadoc.dir=${dist.dir}/javadoc -dist.war=${dist.dir}/${war.name} -endorsed.classpath=\ - ${libs.javaee-endorsed-api-6.0.classpath} -excludes= -file.reference.json-20090211.jar=/media/breakthesec/Extra/GuestFolder/jar libs/json-20090211.jar -file.reference.mysql-connector-java-5.1.33-bin.jar=../mysql-connector-java-5.1.33-bin.jar -includes=** -j2ee.compile.on.save=true -j2ee.copy.static.files.on.save=true -j2ee.deploy.on.save=true -j2ee.platform=1.7-web -j2ee.platform.classpath=${j2ee.server.home}/lib/annotations-api.jar:${j2ee.server.home}/lib/catalina-ant.jar:${j2ee.server.home}/lib/catalina-ha.jar:${j2ee.server.home}/lib/catalina-storeconfig.jar:${j2ee.server.home}/lib/catalina-tribes.jar:${j2ee.server.home}/lib/catalina.jar:${j2ee.server.home}/lib/ecj-4.3.1.jar:${j2ee.server.home}/lib/el-api.jar:${j2ee.server.home}/lib/jasper-el.jar:${j2ee.server.home}/lib/jasper.jar:${j2ee.server.home}/lib/jsp-api.jar:${j2ee.server.home}/lib/servlet-api.jar:${j2ee.server.home}/lib/tomcat-api.jar:${j2ee.server.home}/lib/tomcat-coyote.jar:${j2ee.server.home}/lib/tomcat-dbcp.jar:${j2ee.server.home}/lib/tomcat-i18n-es.jar:${j2ee.server.home}/lib/tomcat-i18n-fr.jar:${j2ee.server.home}/lib/tomcat-i18n-ja.jar:${j2ee.server.home}/lib/tomcat-jdbc.jar:${j2ee.server.home}/lib/tomcat-jni.jar:${j2ee.server.home}/lib/tomcat-spdy.jar:${j2ee.server.home}/lib/tomcat-util-scan.jar:${j2ee.server.home}/lib/tomcat-util.jar:${j2ee.server.home}/lib/tomcat-websocket.jar:${j2ee.server.home}/lib/websocket-api.jar -j2ee.server.type=Tomcat -jar.compress=false -javac.classpath=\ - ${file.reference.mysql-connector-java-5.1.33-bin.jar}:\ - ${file.reference.json-20090211.jar}:\ - ${libs.jstl.classpath} -# Space-separated list of extra javac options -javac.compilerargs= -javac.debug=true -javac.deprecation=false -javac.processorpath=\ - ${javac.classpath} -javac.source=1.6 -javac.target=1.6 -javac.test.classpath=\ - ${javac.classpath}:\ - ${build.classes.dir} -javac.test.processorpath=\ - ${javac.test.classpath} -javadoc.additionalparam= -javadoc.author=false -javadoc.encoding=${source.encoding} -javadoc.noindex=false -javadoc.nonavbar=false -javadoc.notree=false -javadoc.preview=true -javadoc.private=false -javadoc.splitindex=true -javadoc.use=true -javadoc.version=false -javadoc.windowtitle= -lib.dir=${web.docbase.dir}/WEB-INF/lib -persistence.xml.dir=${conf.dir} -platform.active=default_platform -resource.dir=setup -run.test.classpath=\ - ${javac.test.classpath}:\ - ${build.test.classes.dir} -# Space-separated list of JVM arguments used when running a class with a main method or a unit test -# (you may also define separate properties like run-sys-prop.name=value instead of -Dname=value): -runmain.jvmargs= -source.encoding=UTF-8 -source.root=src -src.dir=${source.root}/java -test.src.dir=test -war.content.additional= -war.ear.name=${war.name} -war.name=JavaVulnerableLab.war -web.docbase.dir=web -webinf.dir=web/WEB-INF diff --git a/nbproject/project.xml b/nbproject/project.xml deleted file mode 100644 index fe0dff1..0000000 --- a/nbproject/project.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - org.netbeans.modules.web.project - - - JavaVulnerableLab - 1.6.5 - - - ${file.reference.mysql-connector-java-5.1.33-bin.jar} - WEB-INF/lib - - - ${file.reference.json-20090211.jar} - WEB-INF/lib - - - ${libs.jstl.classpath} - WEB-INF/lib - - - - - - - - - - - - diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..e90d521 --- /dev/null +++ b/pom.xml @@ -0,0 +1,47 @@ + + 4.0.0 + org.cysecurity + JavaVulnerableLab + war + 0.0.1-SNAPSHOT + JavaVulnerableLab Maven Webapp + http://maven.apache.org + + + junit + junit + 3.8.1 + test + + + mysql + mysql-connector-java + 5.1.26 + + + org.json + json + 20090211 + + + javax.servlet + jstl + 1.2 + + + org.hibernate + hibernate-core + 4.0.1.Final + + + javax.servlet + servlet-api + 2.3 + provided + + + + JavaVulnerableLab + + diff --git a/src/conf/MANIFEST.MF b/src/conf/MANIFEST.MF deleted file mode 100644 index 59499bc..0000000 --- a/src/conf/MANIFEST.MF +++ /dev/null @@ -1,2 +0,0 @@ -Manifest-Version: 1.0 - diff --git a/src/java/controller/AddPage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java similarity index 98% rename from src/java/controller/AddPage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java index 0b8da42..343701b 100644 --- a/src/java/controller/AddPage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.BufferedWriter; import java.io.File; diff --git a/src/java/controller/EmailCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java similarity index 97% rename from src/java/controller/EmailCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java index cbcf1c5..c5edb24 100644 --- a/src/java/controller/EmailCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** @@ -89,7 +89,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ - @Override + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); diff --git a/src/java/controller/ForwardMe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java similarity index 98% rename from src/java/controller/ForwardMe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java index 56cca1c..72ee696 100644 --- a/src/java/controller/ForwardMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/install.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java similarity index 98% rename from src/java/controller/install.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Install.java index ad6b9cc..4d84a8a 100644 --- a/src/java/controller/install.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java @@ -1,4 +1,4 @@ - package controller; + package org.cysecurity.cspf.jvl.controller; /* * To change this license header, choose License Headers in Project Properties. @@ -10,7 +10,6 @@ import java.io.FileOutputStream; import java.io.IOException; import java.io.PrintWriter; -import java.security.NoSuchAlgorithmException; import java.sql.Connection; import java.sql.DriverManager; import java.sql.SQLException; @@ -20,13 +19,13 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.HashMe; +import org.cysecurity.cspf.jvl.model.HashMe; /** * * @author breakthesec */ -public class install extends HttpServlet { +public class Install extends HttpServlet { static String dburl; static String jdbcdriver; @@ -224,4 +223,4 @@ public String getServletInfo() { return "Short description"; }// -} +} \ No newline at end of file diff --git a/src/java/controller/LoginValidator.java b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java similarity index 98% rename from src/java/controller/LoginValidator.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java index 81993bd..2331d13 100644 --- a/src/java/controller/LoginValidator.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; diff --git a/src/java/controller/Logout.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java similarity index 98% rename from src/java/controller/Logout.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java index 7bd07be..986de9b 100644 --- a/src/java/controller/Logout.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/open.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java similarity index 96% rename from src/java/controller/open.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Open.java index b45ff10..9cf1a26 100644 --- a/src/java/controller/open.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ * * @author breakthesec */ -public class open extends HttpServlet { +public class Open extends HttpServlet { /** * Processes requests for both HTTP GET and POST diff --git a/src/java/controller/Register.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java similarity index 97% rename from src/java/controller/Register.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Register.java index 4b679e3..afa2f83 100644 --- a/src/java/controller/Register.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/java/controller/SendMessage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java similarity index 97% rename from src/java/controller/SendMessage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java index 11bfe52..73fa79a 100644 --- a/src/java/controller/SendMessage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -14,7 +14,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/java/controller/UsernameCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java similarity index 97% rename from src/java/controller/UsernameCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java index 231f1a8..f24eccd 100644 --- a/src/java/controller/UsernameCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** diff --git a/src/java/controller/XPathQuery.java b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java similarity index 98% rename from src/java/controller/XPathQuery.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java index 0a0bb60..a50856a 100644 --- a/src/java/controller/XPathQuery.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/xxe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java similarity index 95% rename from src/java/controller/xxe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java index 9e0d61c..f871866 100644 --- a/src/java/controller/xxe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.InputStream; @@ -44,14 +44,14 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re InputStream xml=request.getInputStream(); DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); - InputSource is = new InputSource(xml); + InputSource is = new InputSource(xml); Document doc = builder.parse(is); Element element = doc.getDocumentElement(); NodeList nodes = element.getChildNodes(); out.print("
Result:
"); out.print("---------------------
"); for (int i = 0; i < nodes.getLength(); i++) { - out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getTextContent()); + out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getFirstChild().getNodeValue().toString()); out.print("
"); } } diff --git a/src/java/model/DBConnect.java b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java similarity index 97% rename from src/java/model/DBConnect.java rename to src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java index 9dd95fd..77d1485 100644 --- a/src/java/model/DBConnect.java +++ b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package model; +package org.cysecurity.cspf.jvl.model; import java.io.FileInputStream; @@ -40,4 +40,4 @@ public Connection connect(String path) throws IOException,ClassNotFoundException } } -} +} \ No newline at end of file diff --git a/src/java/model/HashMe.java b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java similarity index 78% rename from src/java/model/HashMe.java rename to src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java index 5cea454..635a180 100644 --- a/src/java/model/HashMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java @@ -1,10 +1,4 @@ -/* - * To change this license header, choose License Headers in Project Properties. - * To change this template file, choose Tools | Templates - * and open the template in the editor. - */ - -package model; +package org.cysecurity.cspf.jvl.model; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java new file mode 100644 index 0000000..7c94f64 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java @@ -0,0 +1,36 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ + +package org.cysecurity.cspf.jvl.model.orm; + +/** + * + * @author breakthesec + */ +public class Users { + Long id; + String username; + String about; + + public Long getId() { + return id; + } + private void setId(Long id) { + this.id = id; + } + public String getUsername() { + return username; + } + public void setUsername(String username) { + this.username = username; + } + public String getAbout() { + return about; + } + public void setAbout(String about) { + this.about = about; + } +} diff --git a/src/main/resources/Users.hbm.xml b/src/main/resources/Users.hbm.xml new file mode 100644 index 0000000..e8f5b6a --- /dev/null +++ b/src/main/resources/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/web/ForgotPassword.jsp b/src/main/webapp/ForgotPassword.jsp similarity index 97% rename from web/ForgotPassword.jsp rename to src/main/webapp/ForgotPassword.jsp index ea6a01f..b56f6cb 100644 --- a/web/ForgotPassword.jsp +++ b/src/main/webapp/ForgotPassword.jsp @@ -1,5 +1,5 @@ - <%@page import="model.DBConnect"%> + <%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.Connection"%> diff --git a/web/META-INF/context.xml b/src/main/webapp/META-INF/context.xml similarity index 100% rename from web/META-INF/context.xml rename to src/main/webapp/META-INF/context.xml diff --git a/web/Register.jsp b/src/main/webapp/Register.jsp similarity index 100% rename from web/Register.jsp rename to src/main/webapp/Register.jsp diff --git a/web/WEB-INF/AdminPanel.jsp b/src/main/webapp/WEB-INF/AdminPanel.jsp similarity index 100% rename from web/WEB-INF/AdminPanel.jsp rename to src/main/webapp/WEB-INF/AdminPanel.jsp diff --git a/web/WEB-INF/config.properties b/src/main/webapp/WEB-INF/config.properties similarity index 79% rename from web/WEB-INF/config.properties rename to src/main/webapp/WEB-INF/config.properties index 452aa0b..70b612e 100644 --- a/web/WEB-INF/config.properties +++ b/src/main/webapp/WEB-INF/config.properties @@ -5,6 +5,6 @@ dbuser=root dbpass=root dbname=abc -dburl=jdbc:mysql://localhost:3306/ +dburl=jdbc:mysql://mysql:3306/ jdbcdriver=com.mysql.jdbc.Driver -siteTitle=Java Vulnerable Lab \ No newline at end of file +siteTitle=Java Vulnerable Lab diff --git a/web/WEB-INF/users.xml b/src/main/webapp/WEB-INF/users.xml similarity index 100% rename from web/WEB-INF/users.xml rename to src/main/webapp/WEB-INF/users.xml diff --git a/web/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml similarity index 60% rename from web/WEB-INF/web.xml rename to src/main/webapp/WEB-INF/web.xml index d208798..d26a626 100644 --- a/web/WEB-INF/web.xml +++ b/src/main/webapp/WEB-INF/web.xml @@ -1,56 +1,61 @@ - - - - install - controller.install + + + + + + Install + org.cysecurity.cspf.jvl.controller.Install loginValidator - controller.LoginValidator + org.cysecurity.cspf.jvl.controller.LoginValidator Register - controller.Register + org.cysecurity.cspf.jvl.controller.Register Logout - controller.Logout + org.cysecurity.cspf.jvl.controller.Logout - open - controller.open + Open + org.cysecurity.cspf.jvl.controller.Open SendMessage - controller.SendMessage + org.cysecurity.cspf.jvl.controller.SendMessage ForwardMe - controller.ForwardMe + org.cysecurity.cspf.jvl.controller.ForwardMe AddPage - controller.AddPage + org.cysecurity.cspf.jvl.controller.AddPage UsernameCheck - controller.UsernameCheck + org.cysecurity.cspf.jvl.controller.UsernameCheck EmailCheck - controller.EmailCheck + org.cysecurity.cspf.jvl.controller.EmailCheck XPathQuery - controller.XPathQuery + org.cysecurity.cspf.jvl.controller.XPathQuery xxe - controller.xxe + org.cysecurity.cspf.jvl.controller.xxe + - install - /install + Install + /Install loginValidator @@ -65,8 +70,8 @@ /Logout - open - /open + Open + /Open SendMessage @@ -92,8 +97,9 @@ XPathQuery /XPathQuery.do - + xxe - /vulnerability/Injection/xxe.do + /xxe.do + diff --git a/web/admin/AddPage.jsp b/src/main/webapp/admin/AddPage.jsp similarity index 100% rename from web/admin/AddPage.jsp rename to src/main/webapp/admin/AddPage.jsp diff --git a/web/admin/Configure.jsp b/src/main/webapp/admin/Configure.jsp similarity index 100% rename from web/admin/Configure.jsp rename to src/main/webapp/admin/Configure.jsp diff --git a/web/admin/admin.jsp b/src/main/webapp/admin/admin.jsp similarity index 100% rename from web/admin/admin.jsp rename to src/main/webapp/admin/admin.jsp diff --git a/web/admin/adminlogin.jsp b/src/main/webapp/admin/adminlogin.jsp similarity index 75% rename from web/admin/adminlogin.jsp rename to src/main/webapp/admin/adminlogin.jsp index 208ae80..9d5b46f 100644 --- a/web/admin/adminlogin.jsp +++ b/src/main/webapp/admin/adminlogin.jsp @@ -1,19 +1,9 @@ - <%@page import="model.HashMe"%> + <%@page import="org.cysecurity.cspf.jvl.model.HashMe"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.SQLException"%> -<%@page import="model.DBConnect"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Connection"%> -<%@ include file="/header.jsp" %> - - Admin Login Panel:
-
- - - - -
UserName:
Password :
-
<% if(request.getParameter("Login")!=null) { @@ -35,23 +25,38 @@ if(request.getParameter("Login")!=null) session.setAttribute("privilege", rs.getString("privilege")); Cookie privilege=new Cookie("privilege","admin"); - privilege.setPath(path); + privilege.setPath(request.getContextPath()); response.addCookie(privilege); response.sendRedirect("admin.jsp"); } else { - out.print("Username/Password is wrong"); + response.sendRedirect("adminlogin.jsp?err=Username/Password is wrong"); } } } catch(SQLException ex) { - - response.sendRedirect("Something went wrong"); + response.sendRedirect("adminlogin.jsp?err=Something went wrong"); + } + catch(Exception e) + { + response.sendRedirect("adminlogin.jsp?err="+e); + } } %> +<%@ include file="/header.jsp" %> + Admin Login Page:
+
+ + + + + +
UserName:
Password :
<% if(request.getParameter("err")!=null){out.print(request.getParameter("err"));} %>
+
+ <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/admin/index.jsp b/src/main/webapp/admin/index.jsp similarity index 100% rename from web/admin/index.jsp rename to src/main/webapp/admin/index.jsp diff --git a/web/admin/manageusers.jsp b/src/main/webapp/admin/manageusers.jsp similarity index 94% rename from web/admin/manageusers.jsp rename to src/main/webapp/admin/manageusers.jsp index 5c92788..daac64f 100644 --- a/web/admin/manageusers.jsp +++ b/src/main/webapp/admin/manageusers.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.SQLException"%> -<%@page import="model.DBConnect"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Connection"%> <% diff --git a/web/changeCardDetails.jsp b/src/main/webapp/changeCardDetails.jsp similarity index 97% rename from web/changeCardDetails.jsp rename to src/main/webapp/changeCardDetails.jsp index 0df3868..ca164c7 100644 --- a/web/changeCardDetails.jsp +++ b/src/main/webapp/changeCardDetails.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/docs/doc1.pdf b/src/main/webapp/docs/doc1.pdf similarity index 100% rename from web/docs/doc1.pdf rename to src/main/webapp/docs/doc1.pdf diff --git a/web/docs/exampledoc.pdf b/src/main/webapp/docs/exampledoc.pdf similarity index 100% rename from web/docs/exampledoc.pdf rename to src/main/webapp/docs/exampledoc.pdf diff --git a/web/footer.jsp b/src/main/webapp/footer.jsp similarity index 100% rename from web/footer.jsp rename to src/main/webapp/footer.jsp diff --git a/web/header.jsp b/src/main/webapp/header.jsp similarity index 98% rename from web/header.jsp rename to src/main/webapp/header.jsp index 88afd3f..f2691bc 100644 --- a/web/header.jsp +++ b/src/main/webapp/header.jsp @@ -47,6 +47,8 @@ +
  • ORM Injection
    • + diff --git a/web/images/Thumbs.db b/src/main/webapp/images/Thumbs.db similarity index 100% rename from web/images/Thumbs.db rename to src/main/webapp/images/Thumbs.db diff --git a/web/images/bg.png b/src/main/webapp/images/bg.png similarity index 100% rename from web/images/bg.png rename to src/main/webapp/images/bg.png diff --git a/web/index.jsp b/src/main/webapp/index.jsp similarity index 100% rename from web/index.jsp rename to src/main/webapp/index.jsp diff --git a/web/install.jsp b/src/main/webapp/install.jsp similarity index 93% rename from web/install.jsp rename to src/main/webapp/install.jsp index 457a708..dfbe8f7 100644 --- a/web/install.jsp +++ b/src/main/webapp/install.jsp @@ -3,14 +3,14 @@ <%@ include file="/header.jsp" %> -
    + - + diff --git a/web/jquery.min.js b/src/main/webapp/jquery.min.js similarity index 100% rename from web/jquery.min.js rename to src/main/webapp/jquery.min.js diff --git a/web/login.jsp b/src/main/webapp/login.jsp similarity index 100% rename from web/login.jsp rename to src/main/webapp/login.jsp diff --git a/web/myprofile.jsp b/src/main/webapp/myprofile.jsp similarity index 97% rename from web/myprofile.jsp rename to src/main/webapp/myprofile.jsp index 8b165d2..d9eb99d 100644 --- a/web/myprofile.jsp +++ b/src/main/webapp/myprofile.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) diff --git a/web/robots.txt b/src/main/webapp/robots.txt similarity index 100% rename from web/robots.txt rename to src/main/webapp/robots.txt diff --git a/web/style.css b/src/main/webapp/style.css similarity index 100% rename from web/style.css rename to src/main/webapp/style.css diff --git a/web/vulnerability/DisplayMessage.jsp b/src/main/webapp/vulnerability/DisplayMessage.jsp similarity index 96% rename from web/vulnerability/DisplayMessage.jsp rename to src/main/webapp/vulnerability/DisplayMessage.jsp index bdd332e..dfad1d0 100644 --- a/web/vulnerability/DisplayMessage.jsp +++ b/src/main/webapp/vulnerability/DisplayMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/Injection/1.xsl b/src/main/webapp/vulnerability/Injection/1.xsl similarity index 100% rename from web/vulnerability/Injection/1.xsl rename to src/main/webapp/vulnerability/Injection/1.xsl diff --git a/web/vulnerability/Injection/2.xsl b/src/main/webapp/vulnerability/Injection/2.xsl similarity index 100% rename from web/vulnerability/Injection/2.xsl rename to src/main/webapp/vulnerability/Injection/2.xsl diff --git a/src/main/webapp/vulnerability/Injection/Users.hbm.xml b/src/main/webapp/vulnerability/Injection/Users.hbm.xml new file mode 100644 index 0000000..34bc592 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/web/vulnerability/Injection/courses.xml b/src/main/webapp/vulnerability/Injection/courses.xml similarity index 100% rename from web/vulnerability/Injection/courses.xml rename to src/main/webapp/vulnerability/Injection/courses.xml diff --git a/src/main/webapp/vulnerability/Injection/orm.jsp b/src/main/webapp/vulnerability/Injection/orm.jsp new file mode 100644 index 0000000..4d99eca --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/orm.jsp @@ -0,0 +1,60 @@ + +<%@page import="org.hibernate.cfg.Configuration"%> +<%@page import="org.hibernate.SessionFactory"%> +<%@page import="java.util.List"%> +<%@page import="org.cysecurity.cspf.jvl.model.orm.Users"%> +<%@page import="org.hibernate.Query"%> +<%@page import="org.hibernate.Session"%> +<%@ include file="/header.jsp" %> +<%! +private static String queryUsers(Session session,String id) { + Query query = session.createQuery("from Users where id="+id); + List list = query.list(); + java.util.Iterator iter = list.iterator(); + String results="Details:
    ---------------
    "; + if (iter.hasNext()) { + Users users = iter.next(); + results+= "Name: " + users.getUsername() +"
    About: " + users.getAbout(); + } + session.getTransaction().commit(); + return results; + + } + +%> +<% + + try{ + + //Reading config from properties file: + String dbuser=properties.getProperty("dbuser"); + String dbpass = properties.getProperty("dbpass"); + String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname"); + String jdbcdriver = properties.getProperty("jdbcdriver"); + + Configuration configuration = new Configuration(); + configuration.setProperty( "hibernate.connection.driver_class",jdbcdriver); + configuration.setProperty( "hibernate.connection.url",dbfullurl); + configuration.setProperty( "hibernate.connection.username", dbuser); + configuration.setProperty( "hibernate.connection.password", dbpass); + configuration.setProperty( "hibernate.dialect","org.hibernate.dialect.MySQLDialect"); + + + configuration.addResource("Users.hbm.xml"); + SessionFactory factory; + factory=configuration.buildSessionFactory(); + Session ormSession = factory.openSession(); + + ormSession.beginTransaction(); + + out.print(queryUsers(ormSession,request.getParameter("id"))); + + } + catch(Exception e) + { + out.print(e); + } + + %> + +<%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/Injection/xpath_login.jsp b/src/main/webapp/vulnerability/Injection/xpath_login.jsp similarity index 100% rename from web/vulnerability/Injection/xpath_login.jsp rename to src/main/webapp/vulnerability/Injection/xpath_login.jsp diff --git a/web/vulnerability/Injection/xslt.jsp b/src/main/webapp/vulnerability/Injection/xslt.jsp similarity index 100% rename from web/vulnerability/Injection/xslt.jsp rename to src/main/webapp/vulnerability/Injection/xslt.jsp diff --git a/web/vulnerability/Injection/xxe.jsp b/src/main/webapp/vulnerability/Injection/xxe.jsp similarity index 95% rename from web/vulnerability/Injection/xxe.jsp rename to src/main/webapp/vulnerability/Injection/xxe.jsp index 2419a47..8cd2402 100644 --- a/web/vulnerability/Injection/xxe.jsp +++ b/src/main/webapp/vulnerability/Injection/xxe.jsp @@ -5,7 +5,7 @@ $("#req").click(function(){ var xml = 'Neoneo@matrix'; $.ajax({ - url: 'xxe.do', + url: '<%=path%>/xxe.do', processData: false, type: "POST", data: xml, diff --git a/web/vulnerability/Messages.jsp b/src/main/webapp/vulnerability/Messages.jsp similarity index 95% rename from web/vulnerability/Messages.jsp rename to src/main/webapp/vulnerability/Messages.jsp index e58fc75..fe2c4b9 100644 --- a/web/vulnerability/Messages.jsp +++ b/src/main/webapp/vulnerability/Messages.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/SendMessage.jsp b/src/main/webapp/vulnerability/SendMessage.jsp similarity index 94% rename from web/vulnerability/SendMessage.jsp rename to src/main/webapp/vulnerability/SendMessage.jsp index e28563e..1ce0f03 100644 --- a/web/vulnerability/SendMessage.jsp +++ b/src/main/webapp/vulnerability/SendMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/UserDetails.jsp b/src/main/webapp/vulnerability/UserDetails.jsp similarity index 95% rename from web/vulnerability/UserDetails.jsp rename to src/main/webapp/vulnerability/UserDetails.jsp index fd43529..d7a1043 100644 --- a/web/vulnerability/UserDetails.jsp +++ b/src/main/webapp/vulnerability/UserDetails.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/web/vulnerability/baasm/SiteTitle.jsp b/src/main/webapp/vulnerability/baasm/SiteTitle.jsp similarity index 100% rename from web/vulnerability/baasm/SiteTitle.jsp rename to src/main/webapp/vulnerability/baasm/SiteTitle.jsp diff --git a/web/vulnerability/baasm/URLRewriting.jsp b/src/main/webapp/vulnerability/baasm/URLRewriting.jsp similarity index 100% rename from web/vulnerability/baasm/URLRewriting.jsp rename to src/main/webapp/vulnerability/baasm/URLRewriting.jsp diff --git a/web/vulnerability/csrf/change-info.jsp b/src/main/webapp/vulnerability/csrf/change-info.jsp similarity index 95% rename from web/vulnerability/csrf/change-info.jsp rename to src/main/webapp/vulnerability/csrf/change-info.jsp index ba49852..9c27092 100644 --- a/web/vulnerability/csrf/change-info.jsp +++ b/src/main/webapp/vulnerability/csrf/change-info.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/csrf/changepassword.jsp b/src/main/webapp/vulnerability/csrf/changepassword.jsp similarity index 96% rename from web/vulnerability/csrf/changepassword.jsp rename to src/main/webapp/vulnerability/csrf/changepassword.jsp index ba84913..ca1646f 100644 --- a/web/vulnerability/csrf/changepassword.jsp +++ b/src/main/webapp/vulnerability/csrf/changepassword.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/forum.jsp b/src/main/webapp/vulnerability/forum.jsp similarity index 98% rename from web/vulnerability/forum.jsp rename to src/main/webapp/vulnerability/forum.jsp index 8632f5b..6c71c00 100644 --- a/web/vulnerability/forum.jsp +++ b/src/main/webapp/vulnerability/forum.jsp @@ -11,7 +11,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> diff --git a/web/vulnerability/forumUsersList.jsp b/src/main/webapp/vulnerability/forumUsersList.jsp similarity index 93% rename from web/vulnerability/forumUsersList.jsp rename to src/main/webapp/vulnerability/forumUsersList.jsp index e05fc62..595e98d 100644 --- a/web/vulnerability/forumUsersList.jsp +++ b/src/main/webapp/vulnerability/forumUsersList.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/web/vulnerability/forumposts.jsp b/src/main/webapp/vulnerability/forumposts.jsp similarity index 94% rename from web/vulnerability/forumposts.jsp rename to src/main/webapp/vulnerability/forumposts.jsp index e442e02..e2c7096 100644 --- a/web/vulnerability/forumposts.jsp +++ b/src/main/webapp/vulnerability/forumposts.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); diff --git a/web/vulnerability/idor/change-email.jsp b/src/main/webapp/vulnerability/idor/change-email.jsp similarity index 95% rename from web/vulnerability/idor/change-email.jsp rename to src/main/webapp/vulnerability/idor/change-email.jsp index 8ab67b1..0dd3c34 100644 --- a/web/vulnerability/idor/change-email.jsp +++ b/src/main/webapp/vulnerability/idor/change-email.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/idor/download.jsp b/src/main/webapp/vulnerability/idor/download.jsp similarity index 100% rename from web/vulnerability/idor/download.jsp rename to src/main/webapp/vulnerability/idor/download.jsp diff --git a/web/vulnerability/mfac/SearchEngines.jsp b/src/main/webapp/vulnerability/mfac/SearchEngines.jsp similarity index 100% rename from web/vulnerability/mfac/SearchEngines.jsp rename to src/main/webapp/vulnerability/mfac/SearchEngines.jsp diff --git a/web/vulnerability/sde/hash.jsp b/src/main/webapp/vulnerability/sde/hash.jsp similarity index 100% rename from web/vulnerability/sde/hash.jsp rename to src/main/webapp/vulnerability/sde/hash.jsp diff --git a/web/vulnerability/securitymisconfig/pages.jsp b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp similarity index 95% rename from web/vulnerability/securitymisconfig/pages.jsp rename to src/main/webapp/vulnerability/securitymisconfig/pages.jsp index 4393fc7..0f49b06 100644 --- a/web/vulnerability/securitymisconfig/pages.jsp +++ b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp @@ -3,7 +3,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% try { diff --git a/web/vulnerability/sqli/download.jsp b/src/main/webapp/vulnerability/sqli/download.jsp similarity index 100% rename from web/vulnerability/sqli/download.jsp rename to src/main/webapp/vulnerability/sqli/download.jsp diff --git a/web/vulnerability/sqli/download_id.jsp b/src/main/webapp/vulnerability/sqli/download_id.jsp similarity index 97% rename from web/vulnerability/sqli/download_id.jsp rename to src/main/webapp/vulnerability/sqli/download_id.jsp index 5949e76..f0d5d24 100644 --- a/web/vulnerability/sqli/download_id.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/download_id_union.jsp b/src/main/webapp/vulnerability/sqli/download_id_union.jsp similarity index 97% rename from web/vulnerability/sqli/download_id_union.jsp rename to src/main/webapp/vulnerability/sqli/download_id_union.jsp index 750ab15..9cbbdc2 100644 --- a/web/vulnerability/sqli/download_id_union.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id_union.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/union2.jsp b/src/main/webapp/vulnerability/sqli/union2.jsp similarity index 100% rename from web/vulnerability/sqli/union2.jsp rename to src/main/webapp/vulnerability/sqli/union2.jsp diff --git a/web/vulnerability/unvalidated/OpenForward.jsp b/src/main/webapp/vulnerability/unvalidated/OpenForward.jsp similarity index 100% rename from web/vulnerability/unvalidated/OpenForward.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenForward.jsp diff --git a/web/vulnerability/unvalidated/OpenURL.jsp b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp similarity index 86% rename from web/vulnerability/unvalidated/OpenURL.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenURL.jsp index ccc824e..3d6d004 100644 --- a/web/vulnerability/unvalidated/OpenURL.jsp +++ b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp @@ -1,4 +1,4 @@ <%@ include file="/header.jsp" %> Cyber Security & Privacy Foundation has always been committed in providing the public with knowledge on how to defend themselves from malicious elements on the internet. Hence, we have started a new Certification Program that checks the security and quality of websites and security products. -

    Click Here to know more >> +

    Click Here to know more >> <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/xss/flash/exss.jsp b/src/main/webapp/vulnerability/xss/flash/exss.jsp similarity index 100% rename from web/vulnerability/xss/flash/exss.jsp rename to src/main/webapp/vulnerability/xss/flash/exss.jsp diff --git a/web/vulnerability/xss/flash/xss1.swf b/src/main/webapp/vulnerability/xss/flash/xss1.swf similarity index 100% rename from web/vulnerability/xss/flash/xss1.swf rename to src/main/webapp/vulnerability/xss/flash/xss1.swf diff --git a/web/vulnerability/xss/flash/xss2.swf b/src/main/webapp/vulnerability/xss/flash/xss2.swf similarity index 100% rename from web/vulnerability/xss/flash/xss2.swf rename to src/main/webapp/vulnerability/xss/flash/xss2.swf diff --git a/web/vulnerability/xss/search.jsp b/src/main/webapp/vulnerability/xss/search.jsp similarity index 100% rename from web/vulnerability/xss/search.jsp rename to src/main/webapp/vulnerability/xss/search.jsp diff --git a/web/vulnerability/xss/xss4.jsp b/src/main/webapp/vulnerability/xss/xss4.jsp similarity index 100% rename from web/vulnerability/xss/xss4.jsp rename to src/main/webapp/vulnerability/xss/xss4.jsp
    Website Title:
    Database Name:
    Database User:
    Database Password:
    JDBC Driver:
    JDBC URL:
    JDBC URL:
    Admin Login Credential:
    Username(Default):
    Password(Default):