Skip to content
Snippets Groups Projects
Commit ca6671b0 authored by Oualid Hassan's avatar Oualid Hassan
Browse files

add correct server

parent 4fd943bd
Branches
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 72 additions and 0 deletions
server_correct.py 0 → 100644
+ 72
− 0
View file @ ca6671b0
#!/usr/bin/env python3
import mysql.connector
import cherrypy
import config
class VulnerableApp(object):
def __init__(self):
cherrypy.config.update({'server.socket_host': '0.0.0.0', 'server.socket_port': 8080,})
self.conn = mysql.connector.connect(host=config.DB_HOST, user=config.DB_USER, database=config.DB_NAME, password=config.DB_PASS)
@cherrypy.expose
def index(self, **post):
cursor = self.conn.cursor()
if cherrypy.request.method == "POST":
requete = "INSERT INTO chaines (txt,who) VALUES(%s,%s)"
tuple = (post['chaine'],cherrypy.request.remote.ip)
print("req: [" + requete + "]")
cursor.execute(requete,tuple)
self.conn.commit()
chaines = []
cursor.execute("SELECT txt,who FROM chaines");
for row in cursor.fetchall():
chaines.append(row[0] + " envoye par: " + row[1])
cursor.close()
return '''
<html>
<head>
<title>Application Python Vulnerable</title>
</head>
<body>
<p>
Bonjour, je suis une application vulnerable qui sert a inserer des chaines dans une base de données MySQL!
</p>
<p>
Liste des chaines actuellement insérées:
<ul>
'''+"\n".join(["<li>" + s + "</li>" for s in chaines])+'''
</ul>
</p>
<p> Inserer une chaine:
<form method="post" onsubmit="return validate()">
<input type="text" name="chaine" id="chaine" value="" />
<br />
<input type="submit" name="submit" value="OK" />
</form>
<script>
function validate() {
var regex = /^[a-zA-Z0-9]+$/;
var chaine = document.getElementById('chaine').value;
console.log(regex.test(chaine));
if (!regex.test(chaine)) {
alert("Veuillez entrer une chaine avec uniquement des lettres et des chiffres");
return false;
}
return true;
}
</script>
</p>
</body>
</html>
'''
cherrypy.quickstart(VulnerableApp())
\ No newline at end of file
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment