yeswehack/vulnerable-code-snippets

Twitter vulnerable snippets

Vulnerable Code Snippets

Vulnerabilities | Programming languages | Run a vulnerable code snippet | Installation | Update

YesWeHack present code snippets containing several different vulnerabilities to practice your code analysis in a safe dockerized envoriment. The vulnerable code snippets are suitable for all skill levels.

~ New vulnerable code snippet at Twitter @yeswehack every Friday! 🗒

If you want to see something special or if you just have an idea about a vulnerable code snippet, feel free to create a "New Issue" where you explain your idea, no idea is stupid.

---

⚠️ Be aware

Be sure to run this in a secure environment, as the code is vulnerable and is intended to be used for learning code analysis! By default, all vulnerable code snippets contain a docker setup that isolates the code from your host system and make it safe to run (read more in the section : "Run a vulnerable code snippet").

Twitter (X) posts

A Collection of all vulnerable code snippets posted on our Twitter 📂

ID	Vulnerability	Description
📜#1	SQLi & XSS	Backslash filter collide
📜#2	Improper file access & XSS	Invalid char and regex verificaion
📜#3	Log Forging injection, Path traversal & Code injection	Poor filter and improper include() handling
📜#4	XSS	Invalid user input filter
📜#5	SSRF & Broken authorization	Trusted user input and client IP from header
📜#6	SSTI	Mixed input format
📜#7	SQLi	Use of invalid variable within statement
📜#8	CSRF	No CSRF token included
📜#9	Open Redirect	Invalid regex handler
📜#10	DOM XSS	Backend filter collide with client side JavaScript
📜#11	CORS	Misconfigured Access-Control-Allow header
📜#12	CSRF/ClickJacking	GET request CSRF with insecure delete process / ClickJacking - X-Frame-Options set in HTML meta tag
📜#13	Path Traversal/Unrestricted File Upload	Poor Path Traversal and file upload protection results in a code injection
📜#14	DOS	Incorrect operator handler in "for loop"
📜#15	Weak Password Recovery Mechanism for Forgotten Password	Weak hash for password recovery
📜#16	IDOR	insecure if statement leads to improper access control
📜#17	Insecure deserialization	Execute trusted user input inside pickle function loads()
📜#18	Path Traversal	Improper user validation of filename
📜#19	Open Redirect	Invalid handling of user-controlled input "location.hash"
📜#20	SQL injection	Invalid use of function replace(), The char is only replaced once
📜#21	PostMessage DOM XSS	No origin validation, leading to PostMessage DOM XSS
📜#22	XSS/OpenRedirect	The filter protection does not filter all special characters that can be used to exploit the vulnerabilities
📜#23	Buffer overflow	Take user's STDIN input with the gets() function without checking the buffer size
📜#24	SQL injection	Incorrect use of the PHP function addslashes()
📜#25	XSS - CSP bypass	No validation of user input along with insecure handling of nonce
📜#26	Path Traversal	The filter provided by the PHP function "preg_replace()" is limited to filtering only the first 10 characters
📜#27	Web Cache Poisoning	The HTTP header Referer is reflected in the cached response body without being filtered
📜#28	Business logic vulnerability	An attacker can withdraw negative amounts to increase the overall balance of their account
📜#29	IDOR	An attacker can gain access to sensitive data from other users by performing a Forced browsing attack
📜#30	Insecure deserialization	Use of a dangerous function (exec) that can be controlled by the user, resulting in an RCE
📜#31	LFI	No proper character escaping or filter verification. The include() function executes all PHP code in the given file, no matter the file extension, resulting in code injection
📜#32	Format injection!	Format a string containing values provided by the client, resulting in a format injection
📜#33	SQL injection (second order)	All SQL queries use prepared statements except the last one. This statement extracts a value from the database that was once controlled by the user and adds it to the SQL query, leading to an SQL injection (second order)
📜#34	Regular expression Denial of Service (ReDoS)	Poorly configured regex pattern used to filter user-controlled input
📜#35	XSS	Trusted user input in GET parameter
📜#36	Unrestricted File Upload	Insufficient validation of the file extension of the uploaded file and missed validation of the file content
📜#37	SSRF	Insecure handling of the proxy header X-Forwarded-Host and cURL leading to a full SSRF
📜#38	Code injection	The user can write customised content to a selected file which is then launched on the vulnerable system
📜#39	LFI	Exploitation of an LFI make it possible to run the tool pearcmd resulting in a remote code execution
📜#40	Unrestricted File Upload	The php3 extension can be used to execute php code due to the configuration in the Apache proxy.
📜#41	New!	...

Vulnerabilities

• Broken access control - CWE-284
• Code injection - CWE-94
• Cross Site Request Forgery (CSRF) - CWE-352
• SQL injection (SQLi) - CWE-89
• Cross Site Scripting (XSS) - CWE-79
• Open Redirect - CWE-601
• Server-side template injection (SSTI) - CWE-1336
• Server Side Request Forgery (SSRF) - CWE-918
• Cross Origin Resource Sharing (CORS) - CWE-942
• Clickjacking - CWE-1021
• Unrestricted File Upload - CWE-434
• Path Traversal - CWE-35
• Denial Of Service - CWE-400
• Weak Password Recovery Mechanism for Forgotten Password - CWE-640
• Insecure Direct Object Reference (IDOR) - CWE-639
• Deserialization Of Untrusted Data - CWE-502
• Local File Inclusion - CWE-98
• Buffer Overflow - CWE-120
• Acceptance of Extraneous Untrusted Data With Trusted Data ("Cache Poisoning") - CWE-349
• Business Logic Errors - CWE-840
• Format injection - CWE-134

Programming languages

• PHP
• Python
• Golang
• Java
• JavaScript
• C

Also included

• SQL (MySQL)
• HTML
• CSS

---

Run a vulnerable code snippet

In each vulnerable code snippet (Vsnippet) folder there is a docker-compose.yml file. To start a Vsnippet in an isolated docker environment simply run the following command:

docker compose up --build

or

docker-compose up --build

Installation

git clone https://github.com/yeswehack/vulnerable-code-snippets.git

Update

To get the latest vulnerable code snippets, run:

git pull

~ H4v3 y0u f0und th3 E4st3r 3gg y3t? 🐇🪺

For questions, help or if you have discovered a problem with the code. Contact us on Twitter: @yeswehack 📬

vulnerable-code-snippets's Issues

Error in CORS snippet

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
According to the documentation, Cookies cannot be passed with ACAO: * and ACAC: true
This happens in a CORS code snippet

Vulnerable Code leading to Path Traversal and Information disclosure.

Dockerize the project

Dockerizing the project would make it easier for people to run the snippets without installing PHP or MySQL on their systems.

We can potentially use Docker Compose to make it even easier.

XSS 10-xss.php - (Single quote char ['] exploitation may not work, depending on the PHP version) DOM JavaScript exploitation still works.

Hi,

I think the XSS example (XSS/2/10-xss.php) is no longer vulnerable.
According to the PHP manuals on htmlspecialchars they changes the default flags of htmlspecialchars enabling ENT_QUOTES by default now.