cleanup

training/htb/challenges/web/cdnio/challenge/app/blueprints/__init__.py

@@ -0,0 +1,3 @@
+from .main import main_bp
+from .bot import bot_bp
+from .auth import auth_bp

training/htb/challenges/web/cdnio/challenge/app/blueprints/auth/__init__.py

@@ -0,0 +1,5 @@
+from flask import Blueprint
+
+auth_bp = Blueprint('auth_bp', __name__,)
+
+from .routes import * 

training/htb/challenges/web/cdnio/challenge/app/blueprints/auth/routes.py

@@ -0,0 +1,96 @@
+from . import auth_bp
+
+from flask import request, jsonify, current_app, render_template
+
+import datetime, uuid, sqlite3, jwt
+
+
+def get_db_connection():
+    conn = sqlite3.connect("/www/app/database.db")
+    conn.row_factory = sqlite3.Row
+    return conn
+
+def generate_api_key():
+    return str(uuid.uuid4()) 
+
+@auth_bp.route('/', methods=['POST', 'GET'])
+def search():
+
+    if request.method == 'POST':
+        data = request.get_json()
+
+        username = data.get('username')
+        password = data.get('password')
+        
+        if not username or not password:
+            return jsonify({"message": "username or password are required!"}), 400
+
+        conn = get_db_connection()
+
+        user = conn.execute(
+            "SELECT * FROM users WHERE username = ?", (username,)
+        ).fetchone()
+        conn.close()
+
+        if user and user["password"] == password:
+
+            token = jwt.encode(
+                {
+                    "sub": user["username"],
+                    "iat": datetime.datetime.utcnow(),
+                    "exp": datetime.datetime.utcnow() + datetime.timedelta(days=1),
+                },
+                current_app.config["JWT_SECRET_KEY"],
+                algorithm="HS256",
+            )
+
+            return jsonify({"token": f"{token}"}), 200
+
+        else:
+            return jsonify({"message": "Credentials not found. Please check your username and password."}), 404
+
+    else:
+        return render_template('search.html')
+
+
+
+@auth_bp.route('/register', methods=['POST', 'GET'])
+def register():
+
+    if request.method == 'POST':
+        data = request.get_json()
+
+        username = data.get('username')
+        password = data.get('password')
+        email = data.get('email')
+
+        if not username or not password or not email:
+            return jsonify({"message": "username, password, and email are required!"}), 400
+
+        conn = get_db_connection()
+
+        existing_user = conn.execute(
+            "SELECT * FROM users WHERE username = ? OR email = ?", (username, email,)
+        ).fetchone()
+
+        if existing_user:
+            conn.close()
+            return jsonify({"message": "Username or email already exists!"}), 409
+
+        api_key = generate_api_key()
+
+        conn.execute(
+            """
+            INSERT INTO users (username, password, email, api_key, created_at)
+            VALUES (?, ?, ?, ?, ?)
+            """,
+            (username, password, email, api_key, datetime.datetime.utcnow())
+        )
+
+        conn.commit()
+        conn.close()
+
+        return jsonify({"message": f"User {username} registered successfully!"}), 201
+
+    else:
+        return render_template('register.html')

training/htb/challenges/web/cdnio/challenge/app/blueprints/bot/__init__.py

@@ -0,0 +1,5 @@
+from flask import Blueprint
+
+bot_bp = Blueprint('bot_bp', __name__,)
+
+from .routes import * 

training/htb/challenges/web/cdnio/challenge/app/blueprints/bot/routes.py

@@ -0,0 +1,22 @@
+from . import bot_bp
+
+from app.utils.bot import bot_thread
+from app.middleware.auth import jwt_required
+
+from flask import request, jsonify
+
+
+@bot_bp.route('/visit', methods=['POST'])
+@jwt_required
+def visit():
+
+    data = request.get_json()
+
+    uri = data.get('uri')
+    
+    if not uri:
+        return jsonify({"message": "URI is required"}), 400
+
+    bot_thread(uri)
+
+    return jsonify({"message": f"Visiting URI: {uri}"}), 200

training/htb/challenges/web/cdnio/challenge/app/blueprints/main/__init__.py

@@ -0,0 +1,5 @@
+from flask import Blueprint
+
+main_bp = Blueprint('main_bp', __name__,)
+
+from .routes import * 

training/htb/challenges/web/cdnio/challenge/app/blueprints/main/routes.py

@@ -0,0 +1,47 @@
+from . import main_bp
+
+from app.middleware.auth import jwt_required
+from flask import jsonify, request
+
+import re, sqlite3
+
+def get_db_connection():
+    conn = sqlite3.connect("/www/app/database.db")
+    conn.row_factory = sqlite3.Row
+    return conn
+
+@main_bp.route('/<path:subpath>', methods=['GET'])
+@jwt_required
+def profile(subpath):
+    
+    if re.match(r'.*^profile', subpath): # Django perfection
+
+        decoded_token = request.decoded_token
+
+        username = decoded_token.get('sub')
+        if not username:
+            return jsonify({"error": "Invalid token payload!"}), 401
+
+        conn = get_db_connection()
+
+        user = conn.execute(
+            "SELECT id, username, email, api_key, created_at, password FROM users WHERE username = ?",
+            (username,)
+        ).fetchone()
+        conn.close()
+
+        if user:
+            return jsonify({
+                "id": user["id"],
+                "username": user["username"],
+                "email": user["email"],
+                "password": user["password"],
+                "api_key": user["api_key"],
+                "created_at": user["created_at"]
+            }), 200
+
+        else:
+            return jsonify({"error": "User not found"}), 404
+
+    else:
+        return jsonify({"error": "No match"}), 404