diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 00000000..6597db0a --- /dev/null +++ b/Dockerfile @@ -0,0 +1,24 @@ +# Stage 1: Build Stage +FROM openjdk:8 as build + +WORKDIR /app + +# Copy the source code into the Docker image +COPY . . + +# Install Maven and JDK, then build the project +RUN apt-get update && \ + apt-get install -y maven && \ + mvn clean package + +# Stage 2: Runtime Stage +FROM tomcat:7.0.82 + +# Copy the WAR file built in the previous stage +COPY --from=build /app/target/*.war /usr/local/tomcat/webapps/ + +# Copy the pre-prepared tomcat-users.xml to set up user roles +COPY default-tomcat.xml /usr/local/tomcat/conf/tomcat-users.xml + +# CMD to start Tomcat +CMD ["catalina.sh", "run"] diff --git a/LICENSE b/LICENSE index 23cb7903..d6a93266 100644 --- a/LICENSE +++ b/LICENSE @@ -1,4 +1,4 @@ - GNU GENERAL PUBLIC LICENSE +GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., @@ -337,3 +337,4 @@ proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. + diff --git a/README.md b/README.md index 8560b23a..7ed511d0 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,75 @@ -This is Vulnerable Web Application developed for course by Cyber Security and Privacy Foundation -(www.cysecurity.org) for Java programmers +This is a "Vulnerable" Web Application developed by Cyber Security and Privacy Foundation(www.cysecurity.org). This app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code. -Get the VulnerableSpring Project from here: -https://github.com/breakthesec/VulnerableSpring +**The full course content is now available on Github for free:** + +https://github.com/CSPF-Founder/JavaSecurityCourse + + +**The full course on Hacking and Securing Web Java Programs is available in** ----------------------------------- -The full course on Hacking and Securing Web Java Programs is available in ------------------------------------ https://www.udemy.com/hacking-securing-java-web-programming/ ----------------------------------- -VirtualBox VM can be found here: ----------------------------------- -http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download +**Warning**: Don't run this app in Your Main Machine or in an online server. Install it in Vitual Machine. + + +How to Use/Setup ? +------------- + +**Method 1.Super Very Easiest Method: Docker** + The easiest way to use Java Vulnerable is using Docker which set up everything for you with 1 command line + + Steps: + + 1. Install Docker: https://docs.docker.com/engine/installation/ + 2. Install docker-compose: https://docs.docker.com/compose/install/ + 3. Inside this directory, run `sudo docker-compose up` and wait untill everything is configured for you. + 4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp + 5. Change the JDBC URL from jdbc:mysql://localhost:3306 to jdbc:mysql://mysql:3306 + 6. Click the Install Button + 7. Enjoy :) + + +**Method 2.Very Easiest Method : VirtualBox VM** + The second most easiest way to use Java Vulnerable is using the VirtualBox VM which has everything set up and ready to use. + + Steps: + + 1. Install the VirtualBox : https://www.virtualbox.org/wiki/Downloads + 2. Download the VM Image from here : http://sourceforge.net/projects/javavulnerablelab/files/v0.1/JavaVulnerableLab.ova/download + 3. Import the JavaVulnerable.ova into VirtualBox. + 4. Change the Network Settings to Host-Only Network + 5. Start the Machine and Log into the Machine( Credentials; username: root password: cspf) + 6. Start Tomcat by entering "service tomcat start" in the Terminal + 7. Start mysql by entering "service mysql start" in the Terminal + 8. Find the IP Address of Machine + 9. In your Browser, go to "http://[IP_ADDRESS_OF_VM]:8080/JavaVulnerableLab/install.jsp + 10. Click the Install Button + 11. Enjoy :) + +**Method 3.Easiest Method : Standalone Web Application** + In this mehtod, you will be running an executable "JAR" file which runs the application with an embedded Apache Tomcat. + + Steps: + + 1. Install JDK + 2. Download Executable Jar from here: http://sourceforge.net/projects/javavulnerablelab/files/v0.2/JavaVulnerableLab.jar/download + 3. Double Click the JavaVulnerable.jar to run( if double click is not working, run this command "java -jar JavaVulnerable.jar" in your Terminal or CMD) + 4. In your Browser, go to "http://localhost:8080/JavaVulnerableLab/install.jsp + 5. Click the Install Button + +**Method 4. Using War file:** + This is a NORMAL method to deploy the WAR file. + + Steps: + + 1. Install Apache Tomcat server + 2. Go to http://[Tomcat_INSTALLED_IP]:8080/manager/ (make sure you have modified tomcat-users.xml file of the tomcat to allow the manager). + 3. Download our WAR file from here: https://sourceforge.net/projects/javavulnerablelab/files/latest/JavaVulnerableLab.war/download + 4. Deploy the WAR in Apache Tomcat manager. + 5. Go to http://[Tomcat_INSTALLED_IP]:8080/JavaVulnerableLab/install.jsp + 6. Click the Install Button + + +Get the VulnerableSpring Project from here: +https://github.com/CSPF-Founder/VulnerableSpring + diff --git a/build.xml b/build.xml deleted file mode 100644 index 841659cb..00000000 --- a/build.xml +++ /dev/null @@ -1,71 +0,0 @@ - - - - - - - - - - - Builds, tests, and runs the project JavaVulnerableLab. - - - diff --git a/default-tomcat.xml b/default-tomcat.xml new file mode 100644 index 00000000..a225d5e4 --- /dev/null +++ b/default-tomcat.xml @@ -0,0 +1,6 @@ + + + + + + diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 00000000..23d7f3a3 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,20 @@ + +services: + jvl: + image: cspf/jvl + build: + dockerfile: ./Dockerfile + context: ./ + ports: + - 8080:8080 + links: + - mysql + + mysql: + image: mysql:5.7 + environment: + MYSQL_ROOT_PASSWORD: root + MYSQL_ROOT_HOST: "%" + MYSQL_DATABASE: abc + command: + - "--default-authentication-plugin=mysql_native_password" diff --git a/nbproject/ant-deploy.xml b/nbproject/ant-deploy.xml deleted file mode 100644 index 5ca2a427..00000000 --- a/nbproject/ant-deploy.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/build-impl.xml b/nbproject/build-impl.xml deleted file mode 100644 index df502d08..00000000 --- a/nbproject/build-impl.xml +++ /dev/null @@ -1,1448 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set src.dir - Must set test.src.dir - Must set build.dir - Must set build.web.dir - Must set build.generated.dir - Must set dist.dir - Must set build.classes.dir - Must set dist.javadoc.dir - Must set build.test.classes.dir - Must set build.test.results.dir - Must set build.classes.excludes - Must set dist.war - - - - - - - - - -The Java EE server classpath is not correctly set up - server home directory is missing. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Dj2ee.server.home=<app_server_installation_directory> - - -The Java EE server classpath is not correctly set up. Your active server type is ${j2ee.server.type}. -Either open the project in the IDE and assign the server or setup the server classpath manually. -For example like this: - ant -Duser.properties.file=<path_to_property_file> (where you put the property "j2ee.platform.classpath" in a .properties file) -or ant -Dj2ee.platform.classpath=<server_classpath> (where no properties file is used) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No tests executed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -The libs.CopyLibs.classpath property is not set up. -This property must point to -org-netbeans-modules-java-j2seproject-copylibstask.jar file which is part -of NetBeans IDE installation and is usually located at -<netbeans_installation>/java<version>/ant/extra folder. -Either open the project in the IDE and make sure CopyLibs library -exists or setup the property manually. For example like this: - ant -Dlibs.CopyLibs.classpath=a/path/to/org-netbeans-modules-java-j2seproject-copylibstask.jar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must set JVM to use for profiling in profiler.info.jvm - Must set profiler agent JVM arguments in profiler.info.jvmargs.agent - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - Must select a file in the IDE or set jsp.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Browser not found, cannot launch the deployed application. Try to set the BROWSER environment variable. - - - Launching ${browse.url} - - - - - - Must select one file in the IDE or set run.class - - - - Must select one file in the IDE or set run.class - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - - - - - - - - Must select one file in the IDE or set debug.class - - - - - Must set fix.includes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This target only works when run from inside the NetBeans IDE. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Must select some files in the IDE or set javac.includes - - - - - - - - - - - - - - - - - - - Some tests failed; see details above. - - - - - - - - - Must select some files in the IDE or set test.includes - - - - Some tests failed; see details above. - - - - Must select some files in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - Some tests failed; see details above. - - - - - Must select one file in the IDE or set test.class - - - - Must select one file in the IDE or set test.class - Must select some method in the IDE or set test.method - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/nbproject/genfiles.properties b/nbproject/genfiles.properties deleted file mode 100644 index cb66364d..00000000 --- a/nbproject/genfiles.properties +++ /dev/null @@ -1,8 +0,0 @@ -build.xml.data.CRC32=903755fa -build.xml.script.CRC32=8f523743 -build.xml.stylesheet.CRC32=651128d4@1.67.1.1 -# This file is used by a NetBeans-based IDE to track changes in generated files such as build-impl.xml. -# Do not edit this file. You may delete it but then the IDE will never regenerate such files for you. -nbproject/build-impl.xml.data.CRC32=903755fa -nbproject/build-impl.xml.script.CRC32=084958d7 -nbproject/build-impl.xml.stylesheet.CRC32=99ea4b56@1.67.1.1 diff --git a/nbproject/private/private.properties b/nbproject/private/private.properties deleted file mode 100644 index a50452d9..00000000 --- a/nbproject/private/private.properties +++ /dev/null @@ -1,8 +0,0 @@ -deploy.ant.properties.file=/home/breakthesec/.netbeans/8.0/tomcat80.properties -j2ee.server.domain=/home/breakthesec/.netbeans/8.0/apache-tomcat-8.0.3.0_base -j2ee.server.home=/home/breakthesec/apache-tomcat-8.0.3 -j2ee.server.instance=tomcat80:home=/home/breakthesec/apache-tomcat-8.0.3:base=apache-tomcat-8.0.3.0_base -javac.debug=true -javadoc.preview=true -selected.browser=default -user.properties.file=/home/breakthesec/.netbeans/8.0/build.properties diff --git a/nbproject/private/private.xml b/nbproject/private/private.xml deleted file mode 100644 index 6807a2ba..00000000 --- a/nbproject/private/private.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - - diff --git a/nbproject/project.properties b/nbproject/project.properties deleted file mode 100644 index 6ea3de55..00000000 --- a/nbproject/project.properties +++ /dev/null @@ -1,88 +0,0 @@ -annotation.processing.enabled=true -annotation.processing.enabled.in.editor=true -annotation.processing.processors.list= -annotation.processing.run.all.processors=true -annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output -build.classes.dir=${build.web.dir}/WEB-INF/classes -build.classes.excludes=**/*.java,**/*.form -build.dir=build -build.generated.dir=${build.dir}/generated -build.generated.sources.dir=${build.dir}/generated-sources -build.test.classes.dir=${build.dir}/test/classes -build.test.results.dir=${build.dir}/test/results -build.web.dir=${build.dir}/web -build.web.excludes=${build.classes.excludes} -client.urlPart= -compile.jsps=false -conf.dir=${source.root}/conf -debug.classpath=${build.classes.dir}:${javac.classpath} -debug.test.classpath=\ - ${run.test.classpath} -display.browser=true -# Files to be excluded from distribution war -dist.archive.excludes= -dist.dir=dist -dist.ear.war=${dist.dir}/${war.ear.name} -dist.javadoc.dir=${dist.dir}/javadoc -dist.war=${dist.dir}/${war.name} -endorsed.classpath=\ - ${libs.javaee-endorsed-api-6.0.classpath} -excludes= -file.reference.json-20090211.jar=/media/breakthesec/Extra/GuestFolder/jar libs/json-20090211.jar -file.reference.mysql-connector-java-5.1.33-bin.jar=../mysql-connector-java-5.1.33-bin.jar -includes=** -j2ee.compile.on.save=true -j2ee.copy.static.files.on.save=true -j2ee.deploy.on.save=true -j2ee.platform=1.7-web -j2ee.platform.classpath=${j2ee.server.home}/lib/annotations-api.jar:${j2ee.server.home}/lib/catalina-ant.jar:${j2ee.server.home}/lib/catalina-ha.jar:${j2ee.server.home}/lib/catalina-storeconfig.jar:${j2ee.server.home}/lib/catalina-tribes.jar:${j2ee.server.home}/lib/catalina.jar:${j2ee.server.home}/lib/ecj-4.3.1.jar:${j2ee.server.home}/lib/el-api.jar:${j2ee.server.home}/lib/jasper-el.jar:${j2ee.server.home}/lib/jasper.jar:${j2ee.server.home}/lib/jsp-api.jar:${j2ee.server.home}/lib/servlet-api.jar:${j2ee.server.home}/lib/tomcat-api.jar:${j2ee.server.home}/lib/tomcat-coyote.jar:${j2ee.server.home}/lib/tomcat-dbcp.jar:${j2ee.server.home}/lib/tomcat-i18n-es.jar:${j2ee.server.home}/lib/tomcat-i18n-fr.jar:${j2ee.server.home}/lib/tomcat-i18n-ja.jar:${j2ee.server.home}/lib/tomcat-jdbc.jar:${j2ee.server.home}/lib/tomcat-jni.jar:${j2ee.server.home}/lib/tomcat-spdy.jar:${j2ee.server.home}/lib/tomcat-util-scan.jar:${j2ee.server.home}/lib/tomcat-util.jar:${j2ee.server.home}/lib/tomcat-websocket.jar:${j2ee.server.home}/lib/websocket-api.jar -j2ee.server.type=Tomcat -jar.compress=false -javac.classpath=\ - ${file.reference.mysql-connector-java-5.1.33-bin.jar}:\ - ${file.reference.json-20090211.jar}:\ - ${libs.jstl.classpath} -# Space-separated list of extra javac options -javac.compilerargs= -javac.debug=true -javac.deprecation=false -javac.processorpath=\ - ${javac.classpath} -javac.source=1.6 -javac.target=1.6 -javac.test.classpath=\ - ${javac.classpath}:\ - ${build.classes.dir} -javac.test.processorpath=\ - ${javac.test.classpath} -javadoc.additionalparam= -javadoc.author=false -javadoc.encoding=${source.encoding} -javadoc.noindex=false -javadoc.nonavbar=false -javadoc.notree=false -javadoc.preview=true -javadoc.private=false -javadoc.splitindex=true -javadoc.use=true -javadoc.version=false -javadoc.windowtitle= -lib.dir=${web.docbase.dir}/WEB-INF/lib -persistence.xml.dir=${conf.dir} -platform.active=default_platform -resource.dir=setup -run.test.classpath=\ - ${javac.test.classpath}:\ - ${build.test.classes.dir} -# Space-separated list of JVM arguments used when running a class with a main method or a unit test -# (you may also define separate properties like run-sys-prop.name=value instead of -Dname=value): -runmain.jvmargs= -source.encoding=UTF-8 -source.root=src -src.dir=${source.root}/java -test.src.dir=test -war.content.additional= -war.ear.name=${war.name} -war.name=JavaVulnerableLab.war -web.docbase.dir=web -webinf.dir=web/WEB-INF diff --git a/nbproject/project.xml b/nbproject/project.xml deleted file mode 100644 index fe0dff12..00000000 --- a/nbproject/project.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - org.netbeans.modules.web.project - - - JavaVulnerableLab - 1.6.5 - - - ${file.reference.mysql-connector-java-5.1.33-bin.jar} - WEB-INF/lib - - - ${file.reference.json-20090211.jar} - WEB-INF/lib - - - ${libs.jstl.classpath} - WEB-INF/lib - - - - - - - - - - - - diff --git a/pom.xml b/pom.xml new file mode 100644 index 00000000..0cdcea36 --- /dev/null +++ b/pom.xml @@ -0,0 +1,51 @@ + + 4.0.0 + org.cysecurity + JavaVulnerableLab + war + 0.0.1-SNAPSHOT + JavaVulnerableLab Maven Webapp + http://maven.apache.org + + + junit + junit + 3.8.1 + test + + + mysql + mysql-connector-java + 5.1.26 + + + org.json + json + 20090211 + + + javax.servlet + jstl + 1.2 + + + org.hibernate + hibernate-core + 4.0.1.Final + + + javax.servlet + servlet-api + 2.3 + provided + + + + JavaVulnerableLab + + + 1.7 + 1.7 + + diff --git a/src/conf/MANIFEST.MF b/src/conf/MANIFEST.MF deleted file mode 100644 index 59499bce..00000000 --- a/src/conf/MANIFEST.MF +++ /dev/null @@ -1,2 +0,0 @@ -Manifest-Version: 1.0 - diff --git a/src/java/controller/AddPage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java similarity index 98% rename from src/java/controller/AddPage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java index 0b8da423..343701b3 100644 --- a/src/java/controller/AddPage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.BufferedWriter; import java.io.File; diff --git a/src/java/controller/EmailCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java similarity index 97% rename from src/java/controller/EmailCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java index cbcf1c5f..c5edb24d 100644 --- a/src/java/controller/EmailCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/EmailCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** @@ -89,7 +89,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) * @throws ServletException if a servlet-specific error occurs * @throws IOException if an I/O error occurs */ - @Override + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { processRequest(request, response); diff --git a/src/java/controller/ForwardMe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java similarity index 98% rename from src/java/controller/ForwardMe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java index 56cca1c5..72ee696c 100644 --- a/src/java/controller/ForwardMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/install.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java similarity index 98% rename from src/java/controller/install.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Install.java index ad6b9cc6..4d84a8ae 100644 --- a/src/java/controller/install.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java @@ -1,4 +1,4 @@ - package controller; + package org.cysecurity.cspf.jvl.controller; /* * To change this license header, choose License Headers in Project Properties. @@ -10,7 +10,6 @@ import java.io.FileOutputStream; import java.io.IOException; import java.io.PrintWriter; -import java.security.NoSuchAlgorithmException; import java.sql.Connection; import java.sql.DriverManager; import java.sql.SQLException; @@ -20,13 +19,13 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.HashMe; +import org.cysecurity.cspf.jvl.model.HashMe; /** * * @author breakthesec */ -public class install extends HttpServlet { +public class Install extends HttpServlet { static String dburl; static String jdbcdriver; @@ -224,4 +223,4 @@ public String getServletInfo() { return "Short description"; }// -} +} \ No newline at end of file diff --git a/src/java/controller/LoginValidator.java b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java similarity index 98% rename from src/java/controller/LoginValidator.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java index 81993bd9..2331d13d 100644 --- a/src/java/controller/LoginValidator.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; diff --git a/src/java/controller/Logout.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java similarity index 98% rename from src/java/controller/Logout.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java index 7bd07bef..986de9b3 100644 --- a/src/java/controller/Logout.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Logout.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/open.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java similarity index 96% rename from src/java/controller/open.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Open.java index b45ff108..9cf1a268 100644 --- a/src/java/controller/open.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ * * @author breakthesec */ -public class open extends HttpServlet { +public class Open extends HttpServlet { /** * Processes requests for both HTTP GET and POST diff --git a/src/java/controller/Register.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java similarity index 97% rename from src/java/controller/Register.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/Register.java index 4b679e3c..afa2f835 100644 --- a/src/java/controller/Register.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -17,7 +17,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/java/controller/SendMessage.java b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java similarity index 97% rename from src/java/controller/SendMessage.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java index 11bfe52d..73fa79aa 100644 --- a/src/java/controller/SendMessage.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -14,7 +14,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; /** * diff --git a/src/java/controller/UsernameCheck.java b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java similarity index 97% rename from src/java/controller/UsernameCheck.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java index 231f1a81..f24eccdc 100644 --- a/src/java/controller/UsernameCheck.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; @@ -15,7 +15,7 @@ import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import model.DBConnect; +import org.cysecurity.cspf.jvl.model.DBConnect; import org.json.JSONObject; /** diff --git a/src/java/controller/XPathQuery.java b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java similarity index 98% rename from src/java/controller/XPathQuery.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java index 0a0bb606..a50856a3 100644 --- a/src/java/controller/XPathQuery.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.PrintWriter; diff --git a/src/java/controller/xxe.java b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java similarity index 95% rename from src/java/controller/xxe.java rename to src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java index 9e0d61c7..f8718662 100644 --- a/src/java/controller/xxe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package controller; +package org.cysecurity.cspf.jvl.controller; import java.io.IOException; import java.io.InputStream; @@ -44,14 +44,14 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re InputStream xml=request.getInputStream(); DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); - InputSource is = new InputSource(xml); + InputSource is = new InputSource(xml); Document doc = builder.parse(is); Element element = doc.getDocumentElement(); NodeList nodes = element.getChildNodes(); out.print("
Result:
"); out.print("---------------------
"); for (int i = 0; i < nodes.getLength(); i++) { - out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getTextContent()); + out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getFirstChild().getNodeValue().toString()); out.print("
"); } } diff --git a/src/java/model/DBConnect.java b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java similarity index 97% rename from src/java/model/DBConnect.java rename to src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java index 9dd95fdc..77d1485c 100644 --- a/src/java/model/DBConnect.java +++ b/src/main/java/org/cysecurity/cspf/jvl/model/DBConnect.java @@ -4,7 +4,7 @@ * and open the template in the editor. */ -package model; +package org.cysecurity.cspf.jvl.model; import java.io.FileInputStream; @@ -40,4 +40,4 @@ public Connection connect(String path) throws IOException,ClassNotFoundException } } -} +} \ No newline at end of file diff --git a/src/java/model/HashMe.java b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java similarity index 78% rename from src/java/model/HashMe.java rename to src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java index 5cea4546..635a180d 100644 --- a/src/java/model/HashMe.java +++ b/src/main/java/org/cysecurity/cspf/jvl/model/HashMe.java @@ -1,10 +1,4 @@ -/* - * To change this license header, choose License Headers in Project Properties. - * To change this template file, choose Tools | Templates - * and open the template in the editor. - */ - -package model; +package org.cysecurity.cspf.jvl.model; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; diff --git a/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java new file mode 100644 index 00000000..7c94f644 --- /dev/null +++ b/src/main/java/org/cysecurity/cspf/jvl/model/orm/Users.java @@ -0,0 +1,36 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ + +package org.cysecurity.cspf.jvl.model.orm; + +/** + * + * @author breakthesec + */ +public class Users { + Long id; + String username; + String about; + + public Long getId() { + return id; + } + private void setId(Long id) { + this.id = id; + } + public String getUsername() { + return username; + } + public void setUsername(String username) { + this.username = username; + } + public String getAbout() { + return about; + } + public void setAbout(String about) { + this.about = about; + } +} diff --git a/src/main/resources/Users.hbm.xml b/src/main/resources/Users.hbm.xml new file mode 100644 index 00000000..e8f5b6a2 --- /dev/null +++ b/src/main/resources/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/web/ForgotPassword.jsp b/src/main/webapp/ForgotPassword.jsp similarity index 97% rename from web/ForgotPassword.jsp rename to src/main/webapp/ForgotPassword.jsp index ea6a01fd..b56f6cba 100644 --- a/web/ForgotPassword.jsp +++ b/src/main/webapp/ForgotPassword.jsp @@ -1,5 +1,5 @@ - <%@page import="model.DBConnect"%> + <%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.Connection"%> diff --git a/web/META-INF/context.xml b/src/main/webapp/META-INF/context.xml similarity index 100% rename from web/META-INF/context.xml rename to src/main/webapp/META-INF/context.xml diff --git a/web/Register.jsp b/src/main/webapp/Register.jsp similarity index 100% rename from web/Register.jsp rename to src/main/webapp/Register.jsp diff --git a/web/WEB-INF/AdminPanel.jsp b/src/main/webapp/WEB-INF/AdminPanel.jsp similarity index 100% rename from web/WEB-INF/AdminPanel.jsp rename to src/main/webapp/WEB-INF/AdminPanel.jsp diff --git a/web/WEB-INF/config.properties b/src/main/webapp/WEB-INF/config.properties similarity index 79% rename from web/WEB-INF/config.properties rename to src/main/webapp/WEB-INF/config.properties index 452aa0b8..70b612e1 100644 --- a/web/WEB-INF/config.properties +++ b/src/main/webapp/WEB-INF/config.properties @@ -5,6 +5,6 @@ dbuser=root dbpass=root dbname=abc -dburl=jdbc:mysql://localhost:3306/ +dburl=jdbc:mysql://mysql:3306/ jdbcdriver=com.mysql.jdbc.Driver -siteTitle=Java Vulnerable Lab \ No newline at end of file +siteTitle=Java Vulnerable Lab diff --git a/web/WEB-INF/users.xml b/src/main/webapp/WEB-INF/users.xml similarity index 100% rename from web/WEB-INF/users.xml rename to src/main/webapp/WEB-INF/users.xml diff --git a/web/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml similarity index 60% rename from web/WEB-INF/web.xml rename to src/main/webapp/WEB-INF/web.xml index d208798c..d26a626c 100644 --- a/web/WEB-INF/web.xml +++ b/src/main/webapp/WEB-INF/web.xml @@ -1,56 +1,61 @@ - - - - install - controller.install + + + + + + Install + org.cysecurity.cspf.jvl.controller.Install loginValidator - controller.LoginValidator + org.cysecurity.cspf.jvl.controller.LoginValidator Register - controller.Register + org.cysecurity.cspf.jvl.controller.Register Logout - controller.Logout + org.cysecurity.cspf.jvl.controller.Logout - open - controller.open + Open + org.cysecurity.cspf.jvl.controller.Open SendMessage - controller.SendMessage + org.cysecurity.cspf.jvl.controller.SendMessage ForwardMe - controller.ForwardMe + org.cysecurity.cspf.jvl.controller.ForwardMe AddPage - controller.AddPage + org.cysecurity.cspf.jvl.controller.AddPage UsernameCheck - controller.UsernameCheck + org.cysecurity.cspf.jvl.controller.UsernameCheck EmailCheck - controller.EmailCheck + org.cysecurity.cspf.jvl.controller.EmailCheck XPathQuery - controller.XPathQuery + org.cysecurity.cspf.jvl.controller.XPathQuery xxe - controller.xxe + org.cysecurity.cspf.jvl.controller.xxe + - install - /install + Install + /Install loginValidator @@ -65,8 +70,8 @@ /Logout - open - /open + Open + /Open SendMessage @@ -92,8 +97,9 @@ XPathQuery /XPathQuery.do - + xxe - /vulnerability/Injection/xxe.do + /xxe.do + diff --git a/web/admin/AddPage.jsp b/src/main/webapp/admin/AddPage.jsp similarity index 100% rename from web/admin/AddPage.jsp rename to src/main/webapp/admin/AddPage.jsp diff --git a/web/admin/Configure.jsp b/src/main/webapp/admin/Configure.jsp similarity index 100% rename from web/admin/Configure.jsp rename to src/main/webapp/admin/Configure.jsp diff --git a/web/admin/admin.jsp b/src/main/webapp/admin/admin.jsp similarity index 100% rename from web/admin/admin.jsp rename to src/main/webapp/admin/admin.jsp diff --git a/web/admin/adminlogin.jsp b/src/main/webapp/admin/adminlogin.jsp similarity index 75% rename from web/admin/adminlogin.jsp rename to src/main/webapp/admin/adminlogin.jsp index 208ae80e..9d5b46f7 100644 --- a/web/admin/adminlogin.jsp +++ b/src/main/webapp/admin/adminlogin.jsp @@ -1,19 +1,9 @@ - <%@page import="model.HashMe"%> + <%@page import="org.cysecurity.cspf.jvl.model.HashMe"%> <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.SQLException"%> -<%@page import="model.DBConnect"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Connection"%> -<%@ include file="/header.jsp" %> - - Admin Login Panel:
-
- - - - -
UserName:
Password :
-
<% if(request.getParameter("Login")!=null) { @@ -35,23 +25,38 @@ if(request.getParameter("Login")!=null) session.setAttribute("privilege", rs.getString("privilege")); Cookie privilege=new Cookie("privilege","admin"); - privilege.setPath(path); + privilege.setPath(request.getContextPath()); response.addCookie(privilege); response.sendRedirect("admin.jsp"); } else { - out.print("Username/Password is wrong"); + response.sendRedirect("adminlogin.jsp?err=Username/Password is wrong"); } } } catch(SQLException ex) { - - response.sendRedirect("Something went wrong"); + response.sendRedirect("adminlogin.jsp?err=Something went wrong"); + } + catch(Exception e) + { + response.sendRedirect("adminlogin.jsp?err="+e); + } } %> +<%@ include file="/header.jsp" %> + Admin Login Page:
+
+ + + + + +
UserName:
Password :
<% if(request.getParameter("err")!=null){out.print(request.getParameter("err"));} %>
+
+ <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/admin/index.jsp b/src/main/webapp/admin/index.jsp similarity index 100% rename from web/admin/index.jsp rename to src/main/webapp/admin/index.jsp diff --git a/web/admin/manageusers.jsp b/src/main/webapp/admin/manageusers.jsp similarity index 94% rename from web/admin/manageusers.jsp rename to src/main/webapp/admin/manageusers.jsp index 5c927883..daac64f2 100644 --- a/web/admin/manageusers.jsp +++ b/src/main/webapp/admin/manageusers.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.ResultSet"%> <%@page import="java.sql.SQLException"%> -<%@page import="model.DBConnect"%> +<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.sql.Connection"%> <% diff --git a/web/changeCardDetails.jsp b/src/main/webapp/changeCardDetails.jsp similarity index 97% rename from web/changeCardDetails.jsp rename to src/main/webapp/changeCardDetails.jsp index 0df3868d..ca164c7e 100644 --- a/web/changeCardDetails.jsp +++ b/src/main/webapp/changeCardDetails.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/docs/doc1.pdf b/src/main/webapp/docs/doc1.pdf similarity index 100% rename from web/docs/doc1.pdf rename to src/main/webapp/docs/doc1.pdf diff --git a/web/docs/exampledoc.pdf b/src/main/webapp/docs/exampledoc.pdf similarity index 100% rename from web/docs/exampledoc.pdf rename to src/main/webapp/docs/exampledoc.pdf diff --git a/web/footer.jsp b/src/main/webapp/footer.jsp similarity index 100% rename from web/footer.jsp rename to src/main/webapp/footer.jsp diff --git a/web/header.jsp b/src/main/webapp/header.jsp similarity index 98% rename from web/header.jsp rename to src/main/webapp/header.jsp index 88afd3f6..f2691bcf 100644 --- a/web/header.jsp +++ b/src/main/webapp/header.jsp @@ -47,6 +47,8 @@ +
  • ORM Injection
    • + diff --git a/web/images/Thumbs.db b/src/main/webapp/images/Thumbs.db similarity index 100% rename from web/images/Thumbs.db rename to src/main/webapp/images/Thumbs.db diff --git a/web/images/bg.png b/src/main/webapp/images/bg.png similarity index 100% rename from web/images/bg.png rename to src/main/webapp/images/bg.png diff --git a/web/index.jsp b/src/main/webapp/index.jsp similarity index 100% rename from web/index.jsp rename to src/main/webapp/index.jsp diff --git a/web/install.jsp b/src/main/webapp/install.jsp similarity index 93% rename from web/install.jsp rename to src/main/webapp/install.jsp index 457a708e..dfbe8f73 100644 --- a/web/install.jsp +++ b/src/main/webapp/install.jsp @@ -3,14 +3,14 @@ <%@ include file="/header.jsp" %> -
    + - + diff --git a/web/jquery.min.js b/src/main/webapp/jquery.min.js similarity index 100% rename from web/jquery.min.js rename to src/main/webapp/jquery.min.js diff --git a/web/login.jsp b/src/main/webapp/login.jsp similarity index 100% rename from web/login.jsp rename to src/main/webapp/login.jsp diff --git a/web/myprofile.jsp b/src/main/webapp/myprofile.jsp similarity index 97% rename from web/myprofile.jsp rename to src/main/webapp/myprofile.jsp index 8b165d2d..d9eb99de 100644 --- a/web/myprofile.jsp +++ b/src/main/webapp/myprofile.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) diff --git a/web/robots.txt b/src/main/webapp/robots.txt similarity index 100% rename from web/robots.txt rename to src/main/webapp/robots.txt diff --git a/web/style.css b/src/main/webapp/style.css similarity index 100% rename from web/style.css rename to src/main/webapp/style.css diff --git a/web/vulnerability/DisplayMessage.jsp b/src/main/webapp/vulnerability/DisplayMessage.jsp similarity index 96% rename from web/vulnerability/DisplayMessage.jsp rename to src/main/webapp/vulnerability/DisplayMessage.jsp index bdd332eb..dfad1d01 100644 --- a/web/vulnerability/DisplayMessage.jsp +++ b/src/main/webapp/vulnerability/DisplayMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/Injection/1.xsl b/src/main/webapp/vulnerability/Injection/1.xsl similarity index 100% rename from web/vulnerability/Injection/1.xsl rename to src/main/webapp/vulnerability/Injection/1.xsl diff --git a/web/vulnerability/Injection/2.xsl b/src/main/webapp/vulnerability/Injection/2.xsl similarity index 100% rename from web/vulnerability/Injection/2.xsl rename to src/main/webapp/vulnerability/Injection/2.xsl diff --git a/src/main/webapp/vulnerability/Injection/Users.hbm.xml b/src/main/webapp/vulnerability/Injection/Users.hbm.xml new file mode 100644 index 00000000..34bc5929 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/Users.hbm.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/web/vulnerability/Injection/courses.xml b/src/main/webapp/vulnerability/Injection/courses.xml similarity index 100% rename from web/vulnerability/Injection/courses.xml rename to src/main/webapp/vulnerability/Injection/courses.xml diff --git a/src/main/webapp/vulnerability/Injection/orm.jsp b/src/main/webapp/vulnerability/Injection/orm.jsp new file mode 100644 index 00000000..4d99eca9 --- /dev/null +++ b/src/main/webapp/vulnerability/Injection/orm.jsp @@ -0,0 +1,60 @@ + +<%@page import="org.hibernate.cfg.Configuration"%> +<%@page import="org.hibernate.SessionFactory"%> +<%@page import="java.util.List"%> +<%@page import="org.cysecurity.cspf.jvl.model.orm.Users"%> +<%@page import="org.hibernate.Query"%> +<%@page import="org.hibernate.Session"%> +<%@ include file="/header.jsp" %> +<%! +private static String queryUsers(Session session,String id) { + Query query = session.createQuery("from Users where id="+id); + List list = query.list(); + java.util.Iterator iter = list.iterator(); + String results="Details:
    ---------------
    "; + if (iter.hasNext()) { + Users users = iter.next(); + results+= "Name: " + users.getUsername() +"
    About: " + users.getAbout(); + } + session.getTransaction().commit(); + return results; + + } + +%> +<% + + try{ + + //Reading config from properties file: + String dbuser=properties.getProperty("dbuser"); + String dbpass = properties.getProperty("dbpass"); + String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname"); + String jdbcdriver = properties.getProperty("jdbcdriver"); + + Configuration configuration = new Configuration(); + configuration.setProperty( "hibernate.connection.driver_class",jdbcdriver); + configuration.setProperty( "hibernate.connection.url",dbfullurl); + configuration.setProperty( "hibernate.connection.username", dbuser); + configuration.setProperty( "hibernate.connection.password", dbpass); + configuration.setProperty( "hibernate.dialect","org.hibernate.dialect.MySQLDialect"); + + + configuration.addResource("Users.hbm.xml"); + SessionFactory factory; + factory=configuration.buildSessionFactory(); + Session ormSession = factory.openSession(); + + ormSession.beginTransaction(); + + out.print(queryUsers(ormSession,request.getParameter("id"))); + + } + catch(Exception e) + { + out.print(e); + } + + %> + +<%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/Injection/xpath_login.jsp b/src/main/webapp/vulnerability/Injection/xpath_login.jsp similarity index 100% rename from web/vulnerability/Injection/xpath_login.jsp rename to src/main/webapp/vulnerability/Injection/xpath_login.jsp diff --git a/web/vulnerability/Injection/xslt.jsp b/src/main/webapp/vulnerability/Injection/xslt.jsp similarity index 100% rename from web/vulnerability/Injection/xslt.jsp rename to src/main/webapp/vulnerability/Injection/xslt.jsp diff --git a/web/vulnerability/Injection/xxe.jsp b/src/main/webapp/vulnerability/Injection/xxe.jsp similarity index 95% rename from web/vulnerability/Injection/xxe.jsp rename to src/main/webapp/vulnerability/Injection/xxe.jsp index 2419a47a..8cd24022 100644 --- a/web/vulnerability/Injection/xxe.jsp +++ b/src/main/webapp/vulnerability/Injection/xxe.jsp @@ -5,7 +5,7 @@ $("#req").click(function(){ var xml = 'Neoneo@matrix'; $.ajax({ - url: 'xxe.do', + url: '<%=path%>/xxe.do', processData: false, type: "POST", data: xml, diff --git a/web/vulnerability/Messages.jsp b/src/main/webapp/vulnerability/Messages.jsp similarity index 95% rename from web/vulnerability/Messages.jsp rename to src/main/webapp/vulnerability/Messages.jsp index e58fc75e..fe2c4b92 100644 --- a/web/vulnerability/Messages.jsp +++ b/src/main/webapp/vulnerability/Messages.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/SendMessage.jsp b/src/main/webapp/vulnerability/SendMessage.jsp similarity index 94% rename from web/vulnerability/SendMessage.jsp rename to src/main/webapp/vulnerability/SendMessage.jsp index e28563e9..1ce0f03c 100644 --- a/web/vulnerability/SendMessage.jsp +++ b/src/main/webapp/vulnerability/SendMessage.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% if(session.getAttribute("isLoggedIn")!=null) { diff --git a/web/vulnerability/UserDetails.jsp b/src/main/webapp/vulnerability/UserDetails.jsp similarity index 95% rename from web/vulnerability/UserDetails.jsp rename to src/main/webapp/vulnerability/UserDetails.jsp index fd435299..d7a10439 100644 --- a/web/vulnerability/UserDetails.jsp +++ b/src/main/webapp/vulnerability/UserDetails.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/web/vulnerability/baasm/SiteTitle.jsp b/src/main/webapp/vulnerability/baasm/SiteTitle.jsp similarity index 100% rename from web/vulnerability/baasm/SiteTitle.jsp rename to src/main/webapp/vulnerability/baasm/SiteTitle.jsp diff --git a/web/vulnerability/baasm/URLRewriting.jsp b/src/main/webapp/vulnerability/baasm/URLRewriting.jsp similarity index 100% rename from web/vulnerability/baasm/URLRewriting.jsp rename to src/main/webapp/vulnerability/baasm/URLRewriting.jsp diff --git a/web/vulnerability/csrf/change-info.jsp b/src/main/webapp/vulnerability/csrf/change-info.jsp similarity index 95% rename from web/vulnerability/csrf/change-info.jsp rename to src/main/webapp/vulnerability/csrf/change-info.jsp index ba498527..9c27092d 100644 --- a/web/vulnerability/csrf/change-info.jsp +++ b/src/main/webapp/vulnerability/csrf/change-info.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/csrf/changepassword.jsp b/src/main/webapp/vulnerability/csrf/changepassword.jsp similarity index 96% rename from web/vulnerability/csrf/changepassword.jsp rename to src/main/webapp/vulnerability/csrf/changepassword.jsp index ba849131..ca1646fc 100644 --- a/web/vulnerability/csrf/changepassword.jsp +++ b/src/main/webapp/vulnerability/csrf/changepassword.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/forum.jsp b/src/main/webapp/vulnerability/forum.jsp similarity index 98% rename from web/vulnerability/forum.jsp rename to src/main/webapp/vulnerability/forum.jsp index 8632f5b3..6c71c007 100644 --- a/web/vulnerability/forum.jsp +++ b/src/main/webapp/vulnerability/forum.jsp @@ -11,7 +11,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page contentType="text/html" pageEncoding="UTF-8"%> diff --git a/web/vulnerability/forumUsersList.jsp b/src/main/webapp/vulnerability/forumUsersList.jsp similarity index 93% rename from web/vulnerability/forumUsersList.jsp rename to src/main/webapp/vulnerability/forumUsersList.jsp index e05fc621..595e98d6 100644 --- a/web/vulnerability/forumUsersList.jsp +++ b/src/main/webapp/vulnerability/forumUsersList.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); String username=request.getParameter("username"); diff --git a/web/vulnerability/forumposts.jsp b/src/main/webapp/vulnerability/forumposts.jsp similarity index 94% rename from web/vulnerability/forumposts.jsp rename to src/main/webapp/vulnerability/forumposts.jsp index e442e02a..e2c7096d 100644 --- a/web/vulnerability/forumposts.jsp +++ b/src/main/webapp/vulnerability/forumposts.jsp @@ -2,7 +2,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties")); diff --git a/web/vulnerability/idor/change-email.jsp b/src/main/webapp/vulnerability/idor/change-email.jsp similarity index 95% rename from web/vulnerability/idor/change-email.jsp rename to src/main/webapp/vulnerability/idor/change-email.jsp index 8ab67b12..0dd3c345 100644 --- a/web/vulnerability/idor/change-email.jsp +++ b/src/main/webapp/vulnerability/idor/change-email.jsp @@ -6,7 +6,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% diff --git a/web/vulnerability/idor/download.jsp b/src/main/webapp/vulnerability/idor/download.jsp similarity index 100% rename from web/vulnerability/idor/download.jsp rename to src/main/webapp/vulnerability/idor/download.jsp diff --git a/web/vulnerability/mfac/SearchEngines.jsp b/src/main/webapp/vulnerability/mfac/SearchEngines.jsp similarity index 100% rename from web/vulnerability/mfac/SearchEngines.jsp rename to src/main/webapp/vulnerability/mfac/SearchEngines.jsp diff --git a/web/vulnerability/sde/hash.jsp b/src/main/webapp/vulnerability/sde/hash.jsp similarity index 100% rename from web/vulnerability/sde/hash.jsp rename to src/main/webapp/vulnerability/sde/hash.jsp diff --git a/web/vulnerability/securitymisconfig/pages.jsp b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp similarity index 95% rename from web/vulnerability/securitymisconfig/pages.jsp rename to src/main/webapp/vulnerability/securitymisconfig/pages.jsp index 4393fc73..0f49b06c 100644 --- a/web/vulnerability/securitymisconfig/pages.jsp +++ b/src/main/webapp/vulnerability/securitymisconfig/pages.jsp @@ -3,7 +3,7 @@ <%@page import="java.sql.Statement"%> <%@page import="java.sql.Connection"%> <%@ include file="/header.jsp" %> - <%@ page import="model.DBConnect"%> + <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <% try { diff --git a/web/vulnerability/sqli/download.jsp b/src/main/webapp/vulnerability/sqli/download.jsp similarity index 100% rename from web/vulnerability/sqli/download.jsp rename to src/main/webapp/vulnerability/sqli/download.jsp diff --git a/web/vulnerability/sqli/download_id.jsp b/src/main/webapp/vulnerability/sqli/download_id.jsp similarity index 97% rename from web/vulnerability/sqli/download_id.jsp rename to src/main/webapp/vulnerability/sqli/download_id.jsp index 5949e76a..f0d5d247 100644 --- a/web/vulnerability/sqli/download_id.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/download_id_union.jsp b/src/main/webapp/vulnerability/sqli/download_id_union.jsp similarity index 97% rename from web/vulnerability/sqli/download_id_union.jsp rename to src/main/webapp/vulnerability/sqli/download_id_union.jsp index 750ab15e..9cbbdc2f 100644 --- a/web/vulnerability/sqli/download_id_union.jsp +++ b/src/main/webapp/vulnerability/sqli/download_id_union.jsp @@ -7,7 +7,7 @@ <%@page import="java.sql.ResultSetMetaData"%> <%@page import="java.sql.ResultSet"%> <%@ page import="java.util.*,java.io.*"%> -<%@ page import="model.DBConnect"%> +<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%> <%@page import="java.io.File"%> diff --git a/web/vulnerability/sqli/union2.jsp b/src/main/webapp/vulnerability/sqli/union2.jsp similarity index 100% rename from web/vulnerability/sqli/union2.jsp rename to src/main/webapp/vulnerability/sqli/union2.jsp diff --git a/web/vulnerability/unvalidated/OpenForward.jsp b/src/main/webapp/vulnerability/unvalidated/OpenForward.jsp similarity index 100% rename from web/vulnerability/unvalidated/OpenForward.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenForward.jsp diff --git a/web/vulnerability/unvalidated/OpenURL.jsp b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp similarity index 86% rename from web/vulnerability/unvalidated/OpenURL.jsp rename to src/main/webapp/vulnerability/unvalidated/OpenURL.jsp index ccc824e8..3d6d0045 100644 --- a/web/vulnerability/unvalidated/OpenURL.jsp +++ b/src/main/webapp/vulnerability/unvalidated/OpenURL.jsp @@ -1,4 +1,4 @@ <%@ include file="/header.jsp" %> Cyber Security & Privacy Foundation has always been committed in providing the public with knowledge on how to defend themselves from malicious elements on the internet. Hence, we have started a new Certification Program that checks the security and quality of websites and security products. -

    Click Here to know more >> +

    Click Here to know more >> <%@ include file="/footer.jsp" %> \ No newline at end of file diff --git a/web/vulnerability/xss/flash/exss.jsp b/src/main/webapp/vulnerability/xss/flash/exss.jsp similarity index 100% rename from web/vulnerability/xss/flash/exss.jsp rename to src/main/webapp/vulnerability/xss/flash/exss.jsp diff --git a/web/vulnerability/xss/flash/xss1.swf b/src/main/webapp/vulnerability/xss/flash/xss1.swf similarity index 100% rename from web/vulnerability/xss/flash/xss1.swf rename to src/main/webapp/vulnerability/xss/flash/xss1.swf diff --git a/web/vulnerability/xss/flash/xss2.swf b/src/main/webapp/vulnerability/xss/flash/xss2.swf similarity index 100% rename from web/vulnerability/xss/flash/xss2.swf rename to src/main/webapp/vulnerability/xss/flash/xss2.swf diff --git a/web/vulnerability/xss/search.jsp b/src/main/webapp/vulnerability/xss/search.jsp similarity index 100% rename from web/vulnerability/xss/search.jsp rename to src/main/webapp/vulnerability/xss/search.jsp diff --git a/web/vulnerability/xss/xss4.jsp b/src/main/webapp/vulnerability/xss/xss4.jsp similarity index 100% rename from web/vulnerability/xss/xss4.jsp rename to src/main/webapp/vulnerability/xss/xss4.jsp
    Website Title:
    Database Name:
    Database User:
    Database Password:
    JDBC Driver:
    JDBC URL:
    JDBC URL:
    Admin Login Credential:
    Username(Default):
    Password(Default):