{"id":20981451,"url":"https://github.com/nobe4/wasp","last_synced_at":"2026-04-27T09:02:05.057Z","repository":{"id":75249065,"uuid":"98724890","full_name":"nobe4/wasp","owner":"nobe4","description":"Perfectly insecure web application that sting !","archived":false,"fork":false,"pushed_at":"2017-07-29T10:21:42.000Z","size":16,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-12-27T19:52:13.829Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nobe4.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-07-29T10:13:05.000Z","updated_at":"2017-07-29T10:22:45.000Z","dependencies_parsed_at":"2023-06-05T20:45:19.134Z","dependency_job_id":null,"html_url":"https://github.com/nobe4/wasp","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/nobe4/wasp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nobe4%2Fwasp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nobe4%2Fwasp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nobe4%2Fwasp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nobe4%2Fwasp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nobe4","download_url":"https://codeload.github.com/nobe4/wasp/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nobe4%2Fwasp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32329466,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-19T05:37:48.105Z","updated_at":"2026-04-27T09:02:05.036Z","avatar_url":"https://github.com/nobe4.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WASP Challenge\n\n\u003e Perfectly insecure web application that sting !\n\nThis challenge was written for a [London Sectalks](http://www.sectalks.org/london/) event organised in July 2017.\n\nYou can find a fully-working docker-compose file in `docker-compose.yml`, you only need to run `docker-compose up` to run it.\n\nIf you want to roll this on a server/VM, I recommend a Debian 8, and the `setup.sh` script should be able to install everything needed.\n\n**The README is heavily spoiling the challenge, don't look at it if you want to try to solve the challenge !**\n\n# How does it work?\n\nThe application is a simple [Flask](http://flask.pocoo.org/) server, using [SQLAlchemy](http://www.sqlalchemy.org/) for the database interactions. \n\nThere is a [MySQL](https://www.mysql.com/) server running and an [nginx](https://www.nginx.com/) proxy configured.\n\nA [phantom.js](http://phantomjs.org/) bot will look at flagged posts and mark them as checked every 5 seconds.\n\nIf you want to customize it, look at `.env` which contains most of the key data for the challenge config.\n\n# Challenge setup\n\n```\nGood evening fellow hackers, your task is simple: find the password used by the user \"sectalk\" to register on the website.\n\nWhat you need:\n- A web browser\n- Some programming knowledge\n- Your brain\n\nWhat you don't need:\n- Scan the application\n- Bruteforce the application\n- Spam the application\n(seriously, you don't need that)\n\nThe challenge lives here: http://HOSTNAME:PORT/\nUsing `user`/`th1s1ss0s3c_r3` to auth.\n```\n\n# Where to look? (aka the interesting pieces)\n\nTo create the challenge I had to manually add vulnerabilities to the code, here is a list of the places where I put a vulnerability:\n\n- `web/templates/post.html` l1 and `web/templates/home.html` l16\n\nThis is the first vulnerability the user will see. The [`safe` filter](http://jinja.pocoo.org/docs/2.9/templates/#html-escaping) will let the content of the post to be display verbatim on the web page. This is useful if you want to include images, videos, ... But can also cause horrible security issues if you don't check for malicious scripts, for more information look at the [OWASP XSS wiki](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)).\n\n- `web/server.py` l152 and l141\n\nThis one is more subtle, it's using a `GET` request parameter as a verification token to do some admin stuff. Because of the previous vulnerability, the keys can be extracted if a user can see an incoming request from the admin (namely using the [`referer`](https://en.wikipedia.org/wiki/HTTP_referer) header of the `HTTP` request). For this challenge, the keys are ~unique, but still, this is giving away a lot of information.\n\n- `phantom/phantom.js` l15-27 and `web/server.py` l99-136\n\nWithout knowing a way to generate the admin key, the previous vulnerability can't lead to any further exploitations, but it's using an custom-made \"cryptographic\" key. [Never use your own cryptographic function](https://security.stackexchange.com/a/18198). For this exercise it was possible to reverse the process, quite easily as long as you could generate multiple keys (you would see at some point the number wrapping around at 999).\n\n- `web/server.py` l173-178\n\nThis one is maybe the worst of all, it's a typical [SQL Injection](https://www.owasp.org/index.php/SQL_injection). By looking around the `post_id` of the request, you could inject you own commands in the SQL engine directly, and giving access to the whole database.\n\n- `web/models.py` l19\n\nWhile storing plaintext passwords is a [very-very bad idea](https://stackoverflow.com/a/1054033/2558252) using a function as \"simple\" as MD5 is quite adventurous. [There](https://crackstation.net/) [are](https://md5.gromweb.com/) [numerous](http://reversemd5.com/) [websites](https://isc.sans.edu/tools/reversehash.html) that provides a `md5` reverse lookup service. In the case of this challenge, the password is so simple than any of these tools will find it.\n\n# Results\n\nIt was a really fun challenge to run and to create, the `XSS` flaws was clearly going to cause users to mess with other's people browser, and the story tells that everybody in the room got RickRolled!\n\nWhile looking at the logs and restarting the server from time to time, we discovered some unknown issues:\n\n1. If you inject something like `\u003cscript\u003ewhile(1){}\u003c/script\u003e` it will make the phantomjs bot hang, trapped in the loop.\n2. You can create multiple users with the same username.\n3. You can make the login/signup form crash if you pass too much data in the fields.\n\n# Leaderboard\n\n1. [taw](https://github.com/taw)\n2. [blinken](https://github.com/blinken) \u0026 [npny](https://github.com/npny)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnobe4%2Fwasp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnobe4%2Fwasp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnobe4%2Fwasp/lists"}