{"id":19528875,"url":"https://github.com/netspi/betafast","last_synced_at":"2025-04-26T11:33:39.331Z","repository":{"id":40876161,"uuid":"258410845","full_name":"NetSPI/BetaFast","owner":"NetSPI","description":"Vulnerable thick client applications used as examples in the Introduction to Hacking Desktop Applications blog series","archived":false,"fork":false,"pushed_at":"2024-01-09T19:06:22.000Z","size":20112,"stargazers_count":101,"open_issues_count":3,"forks_count":13,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-04T12:05:06.034Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://www.betafast.net","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NetSPI.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-24T05:03:21.000Z","updated_at":"2025-01-08T07:39:05.000Z","dependencies_parsed_at":"2024-11-11T01:33:54.508Z","dependency_job_id":null,"html_url":"https://github.com/NetSPI/BetaFast","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FBetaFast","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FBetaFast/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FBetaFast/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FBetaFast/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NetSPI","download_url":"https://codeload.github.com/NetSPI/BetaFast/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250981015,"owners_count":21517762,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T01:20:29.794Z","updated_at":"2025-04-26T11:33:37.460Z","avatar_url":"https://github.com/NetSPI.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Image of BetaFast](https://github.com/NetSPI/BetaFast/blob/master/docs/images/betafast-logo.png)\n# BetaFast\n## The Company\nBetaFast is the provider of a premier Betamax rental kiosk. Browse the wide selection of movies and begin renting today!\n\n## Releases\nTwo vulnerable applications have been released. One is BetaFast, a premier Betamax rental kiosk, written with three-tier architecture. The other is Beta Bank, a premier finance application for the elite, written with two-tier architecture.\n\nBetaFast contains but is not limited to the following vulnerabilities:\n* Hardcoded Encryption Data\n* Hardcoded Encrypted Password\n* SQL Injection\n* Authorization Bypass\n* Missing Server-Side Input Validation\n* Cleartext Password Stored - Registry\n* Cleartext Sensitive Data Stored - Files\n* Weak File Upload Controls\n* Weak Input Validation\n* No Code Obfuscation\n\nBeta Bank was written to include many of the above findings while highlighting some additional security flaws:\n* Unencrypted Database Connection\n* Hardcoded Connection String\n* Weak Password Storage\n* Custom Encryption Implementation\n\nBetaFast and Beta Bank were developed in conjunction with our blog series Introduction to Hacking Thick Clients. An overview and further instructions can be found at https://blog.netspi.com/introducing-betafast/.\n\n**Published Blog Entries:**\n* [The GUI](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-1-the-gui/)\n* [The Network](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-2-the-network/)\n* [The File System and Registry](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-3/)\n* [The Assemblies](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-4-the-assemblies/)\n* [The API](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-5-the-api/)\n* [The Memory](https://blog.netspi.com/introduction-to-hacking-thick-clients-part-6-the-memory/)\n\n## The Client\nTo use the client, open either the BetaFast or Beta Bank solution in Visual Studio and compile the source code. The solution uses .Net Framework 4.6.1.\n\n## The Server\nEnsure that Docker is installed and that there are no conflicts with Hyper-V. Docker files can be edited to configure the database credentials, database server address and port, and the web server address and port. **Do not modify db-init.sql table formats unless you're prepared to modify how the API works.**\n\nDocker should be configured to have a good amount of RAM and other settings. If it and the host machine lack the resources to serve data quickly, there will be weird timeouts in the client. A lot of large images are retrieved on initial login. If there are issues creating the container and connecting with sa, increase the sleep command time in db-init.sh.\n\nTo launch the servers, use the following commands in the same directory as docker-compose.yml:\n\n```docker-compose build```\n\n```docker-compose up```\n\nWhen testing is completed, stop the containers using Ctrl - C and then type `docker-compose down`.\n\nNote - by default, the web server is available on 127.0.0.1:8080. Therefore, if testing with docker on the same machine as the BetaFast client, do not run a system proxy on 127.0.0.1:8080. Also, I like to modify the hosts file to have www.betafast.net resolve to 127.0.0.1. I then change the BetaFast client to point to http://www.betafast.net:8080 in the configuration file.\n\n## Video Instructions\nAn instructional video on preparing the applications is hosted at https://www.youtube.com/watch?v=joVF53aOXX0.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fbetafast","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetspi%2Fbetafast","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fbetafast/lists"}