Skip to content

Commit e810cb9

Browse files
Merge branch 'adeyosemanputra:master' into master
2 parents b2e9f25 + 411f9e9 commit e810cb9

7,110 files changed

Lines changed: 777 additions & 1137115 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/hadolint.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
# hadoint is a Dockerfile linter written in Haskell
66
# that helps you build best practice Docker images.
77
# More details at https://github.com/hadolint/hadolint
8+
# testing the pipeline
89

910
name: Hadolint
1011

.gitignore

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ env
44
pygoat/db.sqlite3
55
venv
66
*.sqlite3
7-
*db.sqlite3
8-
*/app.log
9-
pygoat/app.log
7+
*db.sqlite3*
8+
app.log
9+
bin

PyGoatBot.py

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
from chatterbot import ChatBot
2+
from chatterbot.logic import BestMatch
3+
from chatterbot.trainers import ListTrainer
4+
5+
# Dataset generated by ChatGPT
6+
training_data = [
7+
'What is OWASP PyGoat?',
8+
'OWASP PyGoat is an intentionally vulnerable web application used for learning web security testing.',
9+
'Why should I learn web security testing?',
10+
'Learning web security testing can help you understand how to identify and prevent web application attacks.',
11+
'What types of vulnerabilities can PyGoat help me learn about?',
12+
'PyGoat can help you learn about various types of web application vulnerabilities, including injection attacks, cross-site scripting (XSS), and broken authentication and session management.',
13+
'How can I use PyGoat to learn web security testing?',
14+
'PyGoat includes a series of lessons and challenges designed to teach you about web security testing techniques and common vulnerabilities.',
15+
'Is PyGoat suitable for beginners?',
16+
'Yes, PyGoat is designed to be accessible to beginners and experienced professionals alike.',
17+
'Where can I download PyGoat?',
18+
'You can download PyGoat from the official GitHub repository at https://github.com/OWASP/PyGoat',
19+
'Are there any resources available to help me get started with PyGoat?',
20+
'Yes, the PyGoat documentation includes a Getting Started guide and a list of additional resources to help you learn about web security testing.',
21+
'Can I contribute to PyGoat?',
22+
'Yes, PyGoat is an open-source project and welcomes contributions from anyone interested in improving the application.',
23+
]
24+
25+
chatbot = ChatBot(
26+
"PyGoatBot",
27+
storage_adapter="chatterbot.storage.SQLStorageAdapter",
28+
database_uri="sqlite:///database.sqlite3",
29+
logic_adapters=[
30+
{
31+
"import_path": "chatterbot.logic.BestMatch",
32+
"default_response": "I'm sorry, I'm not sure",
33+
"maximum_similarity_threshold": 0.80,
34+
}
35+
],
36+
)
37+
38+
trainer = ListTrainer(chatbot)
39+
trainer.train(training_data)
40+
41+
print("Welcome to PyGoatBot! Type 'q' or 'exit' to quit.")
42+
while True:
43+
try:
44+
user_input = input("You: ")
45+
if user_input.lower() == "exit" or user_input.lower() == "q":
46+
break
47+
48+
print("Available questions:")
49+
for i, question in enumerate(training_data[::2], start=1):
50+
print(f"{i}. {question}")
51+
52+
while True:
53+
try:
54+
question_index = int(input("Enter a number to select a question: "))
55+
break
56+
except ValueError:
57+
print("Please enter a valid number.")
58+
59+
question = training_data[(question_index - 1) * 2]
60+
response = chatbot.get_response(question)
61+
print(f"PyGoatBot: {response}")
62+
63+
except (KeyboardInterrupt, EOFError):
64+
break

README.md

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Table of Contents
1616
* [Docker Container](#docker-container)
1717
* [Installation Video](#installation-video)
1818
* [Uninstallation](#uninstallation)
19-
* [Solutions](#solutions)
19+
* [Solutions](/Solutions/solution.md)
2020
* [For Developers](/docs/dev_guide.md)
2121

2222
## Installation
@@ -36,26 +36,23 @@ First, Clone the repository using GitHub website or git in Terminal
3636
#### Method 1
3737

3838
1. Install all app and python requirements using installer file - `bash installer.sh`
39-
2. Change directory to the the Django Project directory `cd pygoat`<br>
40-
3. Apply the migrations `python3 manage.py migrate`.<br>
41-
4. Finally, run the development server `python3 manage.py runserver`.<br>
42-
5. The project will be available at <http://127.0.0.1:8000>
39+
2. Apply the migrations `python3 manage.py migrate`.<br>
40+
3. Finally, run the development server `python3 manage.py runserver`.<br>
41+
4. The project will be available at <http://127.0.0.1:8000>
4342

4443
#### Method 2
4544

4645
1. Install python3 requirements `pip install -r requirements.txt`.<br>
47-
2. Change directory to the the Django Project directory `cd pygoat`<br>
48-
3. Apply the migrations `python3 manage.py migrate`.<br>
49-
4. Finally, run the development server `python3 manage.py runserver`.<br>
50-
5. The project will be available at <http://127.0.0.1:8000>
46+
2. Apply the migrations `python3 manage.py migrate`.<br>
47+
3. Finally, run the development server `python3 manage.py runserver`.<br>
48+
4. The project will be available at <http://127.0.0.1:8000>
5149

5250
#### Method 3
5351

5452
1. Install all app and python requirements using `setup.py` file - `pip3 install .`
55-
2. Change directory to the the Django Project directory `cd pygoat`<br>
56-
3. Apply the migrations `python3 manage.py migrate`.<br>
57-
4. Finally, run the development server `python3 manage.py runserver`.<br>
58-
5. The project will be available at <http://127.0.0.1:8000>
53+
2. Apply the migrations `python3 manage.py migrate`.<br>
54+
3. Finally, run the development server `python3 manage.py runserver`.<br>
55+
4. The project will be available at <http://127.0.0.1:8000>
5956

6057
### Docker Container
6158
1. Install [Docker](https://www.docker.com)
@@ -70,17 +67,19 @@ First, Clone the repository using GitHub website or git in Terminal
7067

7168
### Build Docker Image and Run
7269
1. Clone the repository &ensp; `git clone https://github.com/adeyosemanputra/pygoat.git`
73-
2. Change the directory where Dockerfile exists &ensp; `cd pygoat`
74-
3. Build the docker image from Dockerfile using &ensp; `docker build -f Dockerfile -t pygoat .`
75-
4. Run the docker image &ensp;`docker run --rm -p 8000:8000 pygoat:latest`
76-
5. Browse to <http://127.0.0.1:8000> or <http://0.0.0.0:8000>
70+
2. Build the docker image from Dockerfile using &ensp; `docker build -f Dockerfile -t pygoat .`
71+
3. Run the docker image &ensp;`docker run --rm -p 8000:8000 pygoat:latest`
72+
4. Browse to <http://127.0.0.1:8000> or <http://0.0.0.0:8000>
7773

7874
### Installation video
7975

8076
1. From Source using `installer.sh`
8177
- [Installing PyGoat from Source](https://www.youtube.com/watch?v=7bYBJXG3FRQ)
8278
2. Without using `installer.sh`
8379
- [![](http://img.youtube.com/vi/rfzQiMeiwso/0.jpg)](http://www.youtube.com/watch?v=rfzQiMeiwso "Installation Pygoat")
80+
3. Install with Mac M1 (using Virtualenv)
81+
- [![](http://img.youtube.com/vi/rfzQiMeiwso/0.jpg)](https://youtu.be/a5UV7mUw580 "Install with Mac M1 - using Virtualenv")
82+
8483

8584
## Uninstallation
8685

@@ -99,7 +98,7 @@ $ python3 uninstaller.py
9998
```
10099

101100
## Solutions
102-
<a href="/pygoat/Solutions/solution.md">Solutions to all challenges</a>
101+
<a href="/Solutions/solution.md">Solutions to all challenges</a>
103102

104103
## Contributors ✨
105104

Solutions/solution.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ On Successful injection
2121
![image](https://user-images.githubusercontent.com/61360833/118371252-5986ea00-b5c9-11eb-9efb-6beedd558f56.png)
2222

2323

24-
### Command Injection
24+
### Command Injection Lab 1
2525
The user on accessing the lab is provided with a feature to perform a name server lookup on the given domain. The user has to give a domain name and the server would perform a ns lookup and return back to the client. If the user is running the lab, based on the OS he can select Windows or Linux.
2626

2727
The user can cause the server to execute commands ,because of the lack of input validation.
@@ -38,6 +38,15 @@ This should give you the output for both`ns lookup` as well as for the `ifconfig
3838

3939
![cmd_inj_2](https://user-images.githubusercontent.com/70275323/154504361-4baa73cb-f73b-44a8-8769-0af2e7b53c24.png)
4040

41+
### Command Injection Lab 2
42+
We are given an input form where we can calculate basic arithmetic expressions. Our task is to exploit this functionality and achieve code execution.
43+
44+
This lab is using `eval()` function in backend which is used to evaluate expression in python. If the expression is a legal python statement, then it will be executed.
45+
46+
If we submit the expression `1 + 1`, we get the output as `2`. Similarly, on submitting the expression `7 * 7`, we get the output as `49`.
47+
48+
Now, if we submit `os.system("id")`, we get nothing in the output. But if we check the terminal, we will see that the command gets executed and the result is printed on the terminal screen. You can also verify this by submitting `os.system("sleep 30")`, and you will notice that the request completes after 30 seconds.
49+
4150
## A2:Broken Authentication
4251

4352
The main aim of this lab is to login as admin, and to achieve this, exploit the lack of `rate limiting` feature in the otp verification flow. You can see that the otp is only of 3 digit(for demo purposes) and neither does the application have any captcha nor any restriction on number of tries for the otp.

app.log

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -815,3 +815,10 @@ INFO:django.utils.autoreload:/home/sankalpa/Desktop/gsoc/pygoat/introduction/vie
815815
INFO:django.utils.autoreload:/home/sankalpa/Desktop/gsoc/pygoat/introduction/views.py changed, reloading.
816816
INFO:django.utils.autoreload:/home/sankalpa/Desktop/gsoc/pygoat/introduction/views.py changed, reloading.
817817
INFO:django.utils.autoreload:/home/sankalpa/Desktop/gsoc/pygoat/introduction/views.py changed, reloading.
818+
WARNING:django.request:Not Found: /mitre/21f
819+
WARNING:django.request:Not Found: /favicon.ico
820+
INFO:django.utils.autoreload:/home/toxin/Project/gsoc/pygoat/pygoat/settings.py changed, reloading.
821+
WARNING:django.request:Not Found: /mitre/21f
822+
INFO:django.utils.autoreload:/home/toxin/Project/gsoc/pygoat/pygoat/settings.py changed, reloading.
823+
WARNING:django.request:Not Found: /mitre/21f
824+
WARNING:django.request:Not Found: /x

bin/activate

Lines changed: 0 additions & 83 deletions
This file was deleted.

bin/activate.csh

Lines changed: 0 additions & 55 deletions
This file was deleted.

0 commit comments

Comments
 (0)