Initial commit

test_projects/vulnerable_app/scripts/backup.js

@@ -0,0 +1,88 @@
+/**
+ * Backup script with JavaScript security vulnerabilities
+ */
+
+// Hardcoded API keys and secrets
+const API_KEY = "api_key_1234567890abcdefghijklmnopqrstuvwxyz";
+const SECRET_KEY = "secret_1234567890abcdefghijklmnopqrstuvwxyz";
+const MONGODB_URI = "mongodb://admin:password123@localhost:27017/mydb";
+const REDIS_PASSWORD = "redis_password_123456";
+
+// Firebase configuration with keys
+const firebaseConfig = {
+    apiKey: "AIzaSyDOCAbC123dEf456GhI789jKl01-MnO",
+    authDomain: "myapp.firebaseapp.com",
+    projectId: "myapp-12345",
+    storageBucket: "myapp.appspot.com",
+    messagingSenderId: "123456789",
+    appId: "1:123456789:web:ab123cd456ef789gh012ij"
+};
+
+// Dangerous eval usage
+function executeCode(userInput) {
+    eval(userInput);  // Code injection vulnerability
+}
+
+// Dynamic function creation
+function createFunction(code) {
+    return new Function(code);  // Code injection vulnerability
+}
+
+// XSS vulnerabilities
+function displayMessage(message) {
+    document.body.innerHTML = message;  // XSS vulnerability
+}
+
+function updateContent(html) {
+    document.getElementById('content').innerHTML = html;  // XSS vulnerability
+}
+
+// Insecure data handling
+function processUserData(data) {
+    document.write(data);  // XSS vulnerability
+}
+
+// Command injection via child_process
+const { exec } = require('child_process');
+
+function runCommand(userInput) {
+    exec('ls ' + userInput, (error, stdout, stderr) => {  // Command injection
+        console.log(stdout);
+    });
+}
+
+// SQL injection in Node.js
+function getUserData(userId) {
+    const query = `SELECT * FROM users WHERE id = ${userId}`;  // SQL injection
+    db.query(query);
+}
+
+// Path traversal
+const fs = require('fs');
+
+function readFile(filename) {
+    return fs.readFileSync('../../../' + filename);  // Path traversal
+}
+
+// Insecure randomness
+function generateToken() {
+    return Math.random().toString(36);  // Weak randomness
+}
+
+// Hardcoded JWT secret
+const jwt = require('jsonwebtoken');
+const JWT_SECRET = 'my-super-secret-jwt-key';
+
+function createToken(payload) {
+    return jwt.sign(payload, JWT_SECRET);
+}
+
+// Bitcoin private key (example)
+const BITCOIN_PRIVATE_KEY = "5KJvsngHeMpm884wtkJNzQGaCErckhHJBGFsvd3VyK5qMZXj3hS";
+
+// Ethereum private key
+const ETH_PRIVATE_KEY = "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
+
+// AWS credentials in code
+process.env.AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE";
+process.env.AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";

test_projects/vulnerable_app/scripts/deploy.php

@@ -0,0 +1,68 @@
+<?php
+/**
+ * Deployment script with multiple security issues
+ */
+
+// Hardcoded credentials
+$db_password = "admin123";
+$api_token = "token_1234567890abcdefghijklmnop";
+$ssh_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...";
+
+// Direct use of $_GET and $_POST without validation
+$user_id = $_GET['id'];
+$username = $_POST['username'];
+$action = $_REQUEST['action'];
+
+// SQL injection vulnerability
+$query = "SELECT * FROM users WHERE id = $user_id";
+mysql_query($query);
+
+// Command execution vulnerabilities
+system("ls -la " . $_GET['directory']);
+exec("cat " . $_POST['file']);
+shell_exec("ping " . $_GET['host']);
+passthru("ps aux | grep " . $_GET['process']);
+
+// Dangerous eval usage
+$code = $_POST['code'];
+eval($code);  // Code execution vulnerability
+
+// File inclusion vulnerabilities
+include($_GET['page'] . '.php');
+require_once($_POST['template']);
+
+// Insecure file operations
+$uploaded_file = $_FILES['upload']['tmp_name'];
+$destination = "/var/www/uploads/" . $_FILES['upload']['name'];
+move_uploaded_file($uploaded_file, $destination);  // No validation
+
+// More SQL injection patterns
+$search = $_POST['search'];
+$sql = "SELECT * FROM products WHERE name LIKE '%$search%'";
+$result = mysql_query($sql);
+
+// XSS vulnerability
+echo "Welcome, " . $_GET['name'];
+print("Your search: " . $_POST['query']);
+
+// Session hijacking vulnerability
+session_start();
+$_SESSION['user'] = $_GET['user'];
+
+// Weak cryptography
+$password = md5($_POST['password']);  // Weak hashing
+$encrypted = base64_encode($_POST['sensitive_data']);  // Not encryption
+
+// Directory traversal
+$file = $_GET['file'];
+readfile("/var/www/html/" . $file);
+
+// MongoDB injection
+$username = $_POST['username'];
+$password = $_POST['password'];
+$query = array(
+    "username" => $username,
+    "password" => $password
+);
+
+?>