https://github.com/rafaeljusto/vulnerable

Lab to test some website attacks
https://github.com/rafaeljusto/vulnerable

Last synced: about 9 hours ago
JSON representation

Lab to test some website attacks

• Host: GitHub
• URL: https://github.com/rafaeljusto/vulnerable
• Owner: rafaeljusto
• License: mit
• Created: 2017-06-23T14:42:42.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2017-07-20T11:19:47.000Z (over 7 years ago)
• Last Synced: 2024-06-20T09:15:16.005Z (5 months ago)
• Language: Go
• Size: 67.4 KB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# vulnerable

Lab scenario to test some website common attacks, such as

[CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) (Cross-Site

Request Forgery) and [XSS](https://en.wikipedia.org/wiki/Cross-site_scripting)

(Cross-site scripting). To test the CSRF attack we created 2 websites, the good

guy, that is a simple registration, login and update, and the bad guy website,

that will try to change the information while the session is still valid.

This lab was created for the [LACTLD](http://lactld.org/) 2017 technical

workshop at Costa Rica.

## Install

Download the project with the following command:

```

go get -u github.com/rafaeljusto/vulnerable/...

```

Make sure that your `$GOPATH/bin` is in your `$PATH` environment. The just run

the commands:

```

goodguy -port 8080

badguy -port 8081 -attack-server localhost:8080

```

## CSRF

1. Go to the Good Guy website (`http://localhost:8080`), register a new account

   and login into the system.

2. Check registered name in Good Guy's search page

   (`http://localhost:8080/search`) to see the currently name of the registered

   user.

3. With your session still valid in the Good Guy website, access the Bad Guy

   website (`http://localhost:8081`) to get your account hijacked.

4. Go back to the Good Guy's search page (`http://localhost:8080/search`) to

   check that your account name was changed. Also, if you logout and try to

   login again it will failed, because the password was changed.