Skip to content
Snippets Groups Projects
Commit c6fbd5a7 authored by Quentin Bouchard's avatar Quentin Bouchard
Browse files

Le TP est fini

parent 4fb5f585
Branches
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
monEnvTP/__pycache__/config.cpython-38.pyc 0 → 100644
+ 0
− 0
View file @ c6fbd5a7
File added
monEnvTP/server_correct.py 0 → 100755
+ 72
− 0
View file @ c6fbd5a7
#!/usr/bin/env python3
import mysql.connector
import cherrypy
import config
class VulnerableApp(object):
def __init__(self):
self.conn = mysql.connector.connect(host=config.DB_HOST, user=config.DB_USER, database=config.DB_NAME, password=config.DB_PASS)
@cherrypy.expose
def index(self, **post):
cursor = self.conn.cursor()
if cherrypy.request.method == "POST":
requete = "INSERT INTO chaines (txt,who) VALUES(%s,%s)"
print("req: [" + requete + "]")
tuple = (post["chaine"], cherrypy.request.remote.ip)
cursor.execute(requete,tuple)
self.conn.commit()
chaines = []
cursor.execute("SELECT txt,who FROM chaines");
for row in cursor.fetchall():
chaines.append(row[0] + " envoye par: " + row[1])
cursor.close()
return '''
<html>
<head>
<title>Application Python Vulnerable</title>
</head>
<body>
<p>
Bonjour, je suis une application vulnerable qui sert a inserer des chaines dans une base de données MySQL!
</p>
<p>
Liste des chaines actuellement insérées:
<ul>
'''+"\n".join(["<li>" + s + "</li>" for s in chaines])+'''
</ul>
</p>
<p> Inserer une chaine:
<form method="post" onsubmit="return validate()">
<input type="text" name="chaine" id="chaine" value="" />
<br />
<input type="submit" name="submit" value="OK" />
</form>
<script>
function validate() {
var regex = /^[a-zA-Z0-9]+$/;
var chaine = document.getElementById('chaine').value;
console.log(regex.test(chaine));
if (!regex.test(chaine)) {
alert("Veuillez entrer une chaine avec uniquement des lettres et des chiffres");
return false;
}
return true;
}
</script>
</p>
</body>
</html>
'''
cherrypy.server.socket_host='0.0.0.0'
cherrypy.quickstart(VulnerableApp())
monEnvTP/server_xss.py 0 → 100755
+ 73
− 0
View file @ c6fbd5a7
#!/usr/bin/env python3
import mysql.connector
import cherrypy
import config
import html
class VulnerableApp(object):
def __init__(self):
self.conn = mysql.connector.connect(host=config.DB_HOST, user=config.DB_USER, database=config.DB_NAME, password=config.DB_PASS)
@cherrypy.expose
def index(self, **post):
cursor = self.conn.cursor()
if cherrypy.request.method == "POST":
requete = "INSERT INTO chaines (txt,who) VALUES('" + post["chaine"] + "','" + cherrypy.request.remote.ip + "')"
requete = html.escape(requete)
print("req: [" + requete + "]")
cursor.execute(requete)
self.conn.commit()
chaines = []
cursor.execute("SELECT txt,who FROM chaines");
for row in cursor.fetchall():
chaines.append(row[0] + " envoye par: " + row[1])
cursor.close()
return '''
<html>
<head>
<title>Application Python Vulnerable</title>
</head>
<body>
<p>
Bonjour, je suis une application vulnerable qui sert a inserer des chaines dans une base de données MySQL!
</p>
<p>
Liste des chaines actuellement insérées:
<ul>
'''+"\n".join(["<li>" + s + "</li>" for s in chaines])+'''
</ul>
</p>
<p> Inserer une chaine:
<form method="post" onsubmit="return validate()">
<input type="text" name="chaine" id="chaine" value="" />
<br />
<input type="submit" name="submit" value="OK" />
</form>
<script>
function validate() {
var regex = /^[a-zA-Z0-9]+$/;
var chaine = document.getElementById('chaine').value;
console.log(regex.test(chaine));
if (!regex.test(chaine)) {
alert("Veuillez entrer une chaine avec uniquement des lettres et des chiffres");
return false;
}
return true;
}
</script>
</p>
</body>
</html>
'''
cherrypy.server.socket_host='0.0.0.0'
cherrypy.quickstart(VulnerableApp())
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment