cmaheshbl / cxflowgithub

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

CxFlowMasterPush-Test11

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

Please note that The BodgeIt Store is no longer being worked on

You are strongly recommended to use OWASP Juice Shop instead!

Note that the BodgeIt Store is now available as a Docker image: https://hub.docker.com/r/psiinon/bodgeit/

Some of its features and characteristics:

• Easy to install - just requires java and a servlet engine, e.g. Tomcat
• Self contained (no additional dependencies other than to 2 in the above line)
• Easy to change on the fly - all the functionality is implemented in JSPs, so no IDE required
• Cross platform
• Open source
• No separate db to install and configure - it uses an 'in memory' db that is automatically (re)initialized on start up

All you need to do is download and open the zip file, and then extract the war file into the webapps directory of your favorite servlet engine.

Then point your browser at (for example) http://localhost:8080/bodgeit

You may find it easier to find vulnerabilities using a pen test tool.

If you dont have a favourite one, I'd recommend the Zed Attack Proxy (for which I'm the project lead).

The Bodge It Store include the following significant vulnerabilities:

• Cross Site Scripting
• SQL injection
• Hidden (but unprotected) content
• Cross Site Request Forgery
• Debug code
• Insecure Object References
• Application logic vulnerabilities If you spot any others then let me know ;)

There is also a 'scoring' page (linked from the 'About Us' page) where you can see various hacking challenges and whether you have completed them or not.

In the relatively near future I'm hoping to add things like:

• Ajax requests
• More vulnerabilities (of course)

You can now also perform automated security regression tests on the Bodge It Store - see the wiki.

Any feedback (or offers of help to develop it further;) would be appreciated.

cxflowgithub's Issues

CX Stored_XSS @ root/search.jsp [master]

Stored_XSS issue exists @ root/search.jsp in branch master

The application's %> embeds untrusted data in the generated output with output, at line 49 of root\search.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 34 of root\search.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 34

---

Code (Line #34):

		rs = stmt.executeQuery(sql);

---

CX Stored_XSS @ root/score.jsp [master]

Stored_XSS issue exists @ root/score.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 19 of root\score.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 14 of root\score.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 14

---

Code (Line #14):

			rs = stmt.executeQuery();

---

CX Reflected_XSS_All_Clients @ root/search.jsp [master]

Reflected_XSS_All_Clients issue exists @ root/search.jsp in branch master

The application's %><br/><br/> embeds untrusted data in the generated output with query, at line 18 of root\search.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by simply providing modified data in the user input ""q"", which is read by the = method at line 10 of root\search.jsp. This input then flows through the code straight to the output web page, without sanitization. 
This can enable a Reflected Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 10

---

Code (Line #10):

String query = (String) request.getParameter("q");

---

CX Stored_XSS @ root/basket.jsp [master]

Stored_XSS issue exists @ root/basket.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 262 of root\basket.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 247 of root\basket.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 247

---

Code (Line #247):

		rs = stmt.executeQuery();

---

CX Reflected_XSS_All_Clients @ root/contact.jsp [master]

Reflected_XSS_All_Clients issue exists @ root/contact.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 37 of root\contact.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by simply providing modified data in the user input ""comments"", which is read by the = method at line 11 of root\contact.jsp. This input then flows through the code straight to the output web page, without sanitization. 
This can enable a Reflected Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 11

---

Code (Line #11):

String comments = (String) request.getParameter("comments");

---

CX Stored_XSS @ root/admin.jsp [master]

Stored_XSS issue exists @ root/admin.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 21 of root\admin.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 16 of root\admin.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 16

---

Code (Line #16):

		rs = stmt.executeQuery();

---

CX Reflected_XSS_All_Clients @ root/basket.jsp [master]

Reflected_XSS_All_Clients issue exists @ root/basket.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 146 of root\basket.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by simply providing modified data in the user input getCookies, which is read by the request.getCookies method at line 38 of root\basket.jsp. This input then flows through the code straight to the output web page, without sanitization. 
This can enable a Reflected Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 38

---

Code (Line #38):

	Cookie[] cookies = request.getCookies();

---

CX SQL_Injection @ root/password.jsp [master]

SQL_Injection issue exists @ root/password.jsp in branch master

The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 24 of root\password.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""password1""; this input is then read by the = method at line 10 of root\password.jsp. This input then flows through the code, into a query and to the database server - without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 10

---

Code (Line #10):

String password1 = (String) request.getParameter("password1");

---

CX Reflected_XSS_All_Clients @ root/register.jsp [master]

Reflected_XSS_All_Clients issue exists @ root/register.jsp in branch master

The application's <td><%=username%></td> embeds untrusted data in the generated output with username, at line 57 of root\password.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by simply providing modified data in the user input ""username"", which is read by the = method at line 6 of root\register.jsp. This input then flows through the code straight to the output web page, without sanitization. 
This can enable a Reflected Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 6 46

---

Code (Line #6):

String username = (String) request.getParameter("username");

---

Code (Line #46):

			Cookie[] cookies = request.getCookies();

---

CX Reflected_XSS_All_Clients @ root/login.jsp [master]

Reflected_XSS_All_Clients issue exists @ root/login.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 91 of root\login.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by simply providing modified data in the user input ""username"", which is read by the = method at line 7 of root\login.jsp. This input then flows through the code straight to the output web page, without sanitization. 
This can enable a Reflected Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 35 7

---

Code (Line #35):

			Cookie[] cookies = request.getCookies();

---

Code (Line #7):

String username = (String) request.getParameter("username");

---

CX Stored_XSS @ root/contact.jsp [master]

Stored_XSS issue exists @ root/contact.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 68 of root\contact.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 63 of root\contact.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 63

---

Code (Line #63):

		rs = stmt.executeQuery();

---

CX Stored_XSS @ root/header.jsp [master]

Stored_XSS issue exists @ root/header.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 94 of root\header.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 91 of root\header.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 91

---

Code (Line #91):

		rs = stmt.executeQuery();

---

CX SQL_Injection @ root/basket.jsp [master]

SQL_Injection issue exists @ root/basket.jsp in branch master

The application's stmt.execute method executes an SQL query with execute, at line 279 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 38 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 38 153 217 43

---

Code (Line #38):

	Cookie[] cookies = request.getCookies();

---

Code (Line #153):

	String productId = request.getParameter("productid");

---

Code (Line #217):

		Map params = request.getParameterMap();

---

Code (Line #43):

				basketId = cookie.getValue();

---

CX SQL_Injection @ root/login.jsp [master]

SQL_Injection issue exists @ root/login.jsp in branch master

The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 15 of root\login.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""username""; this input is then read by the = method at line 7 of root\login.jsp. This input then flows through the code, into a query and to the database server - without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 35 7 8 40

---

Code (Line #35):

			Cookie[] cookies = request.getCookies();

---

Code (Line #7):

String username = (String) request.getParameter("username");

---

Code (Line #8):

String password = (String) request.getParameter("password");

---

Code (Line #40):

						basketId = cookie.getValue();

---

CX SQL_Injection @ root/register.jsp [master]

SQL_Injection issue exists @ root/register.jsp in branch master

The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 24 of root\password.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""username""; this input is then read by the = method at line 6 of root\register.jsp. This input then flows through the code, into a query and to the database server - without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 51 6 7 46

---

Code (Line #51):

						basketId = cookie.getValue();

---

Code (Line #6):

String username = (String) request.getParameter("username");

---

Code (Line #7):

String password1 = (String) request.getParameter("password1");

---

Code (Line #46):

			Cookie[] cookies = request.getCookies();

---

CX Stored_XSS @ root/login.jsp [master]

Stored_XSS issue exists @ root/login.jsp in branch master

The application's <td><%=username%></td> embeds untrusted data in the generated output with username, at line 57 of root\password.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 15 of root\login.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 15

---

Code (Line #15):

		rs = stmt.executeQuery("SELECT * FROM Users WHERE (name = '" + username + "' AND password = '" + password + "')");

---

CX Stored_XSS @ root/product.jsp [master]

Stored_XSS issue exists @ root/product.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 49 of root\product.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 42 of root\product.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 42 59

---

Code (Line #42):

			rs = stmt.executeQuery();

---

Code (Line #59):

			rs = stmt.executeQuery();

---

CX Stored_XSS @ src/com/thebodgeitstore/search/AdvancedSearch.java [master]

Stored_XSS issue exists @ src/com/thebodgeitstore/search/AdvancedSearch.java in branch master

The application's out.print embeds untrusted data in the generated output with print, at line 20 of root\advanced.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the setResults method with rs, at line 186 of src\com\thebodgeitstore\search\AdvancedSearch.java. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 186

---

Code (Line #186):

            rs = stmt.executeQuery(sql);

---

CX Stored_XSS @ root/home.jsp [master]

Stored_XSS issue exists @ root/home.jsp in branch master

The application's out.println embeds untrusted data in the generated output with println, at line 31 of root\home.jsp. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the stmt.executeQuery method with rs, at line 25 of root\home.jsp. This untrusted data then flows through the code straight to the output web page, without sanitization. 
This can enable a Stored Cross-Site Scripting (XSS) attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 25

---

Code (Line #25):

			rs = stmt.executeQuery();

---