2021-03-02 15:48:37 +00:00
<!DOCTYPE html>
< html >
< body >
2021-03-02 18:57:11 +00:00
< p >
< h2 > Products:< / h2 >
< ul >
{% autoescape off %} {% for p in products %}
< li > {{ p.name}}< / li >
{% endfor %} {% endautoescape %}
< / ul >
< / p >
2021-03-02 15:48:37 +00:00
< p >
< form method = "POST" action = "/add_product" >
{% csrf_token %}
< label > Add product:< / label > < br >
< input id = "add_product" name = "name" type = "text" / >
< button type = "submit" > Submit< / button >
< a href = "#" onClick = "xss_inject_attack()" > XSS injection attack (steal cookies)< / a >
< / form >
< / p >
< p >
2021-03-02 18:57:11 +00:00
< form method = "GET" >
2021-03-02 15:48:37 +00:00
< label > Find Product by Name< / label > < br / >
2021-03-02 18:57:11 +00:00
< input id = "find_product_by_name" name = "filter" type = "text" / >
2021-03-02 15:48:37 +00:00
< button type = "submit " > Search< / button >
< a href = "#" onClick = "sql_inject_attack()" > Sql injection attack (Get all users of system along with their details)< / a >
< / form >
< / p >
< p >
< form method = "POST" action = "/import_products" enctype = "multipart/form-data" >
{% csrf_token %}
< label for = "file" > Import Products (XML):< / label > < br >
< input name = "file" type = "file" / >
< button type = "submit " > Submit< / button >
2021-03-02 18:57:11 +00:00
< span > Use < a href = "/static/products.xml" download = "wicked-products.xml" > this file< / a > to use a XXE Entity vulnerability to expose all users on a Unix system< / span >
2021-03-02 15:48:37 +00:00
< / form >
< / p >
< a href = "/logout" > Log out< / a >
< script >
function xss_inject_attack() {
document.querySelector("#add_product").value = "< script > a l e r t ( ' I g o t y o u r c o o k i e , h a - h a a ! ' ) < / s c r " + " i p t > " ;
}
function sql_inject_attack() {
document.querySelector("#find_product_by_name").value = "' AND false UNION ALL select id, username||' '||password||' '||first_name||''||last_name||' '||email from auth_user where username like '";
}
< / script >
< / body >
< / html >
