added training

training/srdnlenctf-2025/web_Ben10/src/Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY . /app
+
+RUN pip install --no-cache-dir -r requirements.txt
+
+EXPOSE 5000
+
+ENV FLASK_ENV=production
+ENV FLAG="srdnlen{b3n_l0v3s_br0k3n_4cc355_c0ntr0l_vulns}"
+
+CMD ["flask", "run", "--host=0.0.0.0"]

training/srdnlenctf-2025/web_Ben10/src/app.py

@@ -0,0 +1,242 @@
+import secrets
+import sqlite3
+import os
+from flask import Flask, render_template, request, redirect, url_for, flash, session
+
+app = Flask(__name__)
+app.secret_key = 'your_secret_key'
+
+DATABASE = 'database.db'
+FLAG = os.getenv('FLAG', 'srdnlen{TESTFLAG}')
+
+
+def init_db():
+    """Initialize the SQLite database."""
+    conn = sqlite3.connect(DATABASE)
+    cursor = conn.cursor()
+    cursor.execute('''CREATE TABLE IF NOT EXISTS users (
+                        id INTEGER PRIMARY KEY AUTOINCREMENT,
+                        username TEXT UNIQUE,
+                        password TEXT,
+                        admin_username TEXT,
+                        reset_token TEXT
+                      )''')
+    conn.commit()
+    conn.close()
+
+
+def get_user_by_username(username):
+    """Helper function to fetch user by username."""
+    conn = sqlite3.connect(DATABASE)
+    cursor = conn.cursor()
+    cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
+    user = cursor.fetchone()
+    conn.close()
+    return user
+
+
+def get_reset_token_for_user(username):
+    """Helper function to fetch reset token for a user."""
+    conn = sqlite3.connect(DATABASE)
+    cursor = conn.cursor()
+    cursor.execute("SELECT reset_token FROM users WHERE username = ?", (username,))
+    token = cursor.fetchone()
+    conn.close()
+    return token
+
+
+def update_reset_token(username, reset_token):
+    """Helper function to update reset token."""
+    conn = sqlite3.connect(DATABASE)
+    cursor = conn.cursor()
+    cursor.execute("UPDATE users SET reset_token = ? WHERE username = ?", (reset_token, username))
+    conn.commit()
+    conn.close()
+
+
+def update_password(username, new_password):
+    """Helper function to update the password."""
+    conn = sqlite3.connect(DATABASE)
+    cursor = conn.cursor()
+    cursor.execute("UPDATE users SET password = ?, reset_token = NULL WHERE username = ?", (new_password, username))
+    conn.commit()
+    conn.close()
+
+
+@app.route('/')
+def index():
+    """Redirect to /home if user is logged in, otherwise to /login."""
+    if 'username' in session:
+        return redirect(url_for('home'))
+    return redirect(url_for('login'))
+
+
+@app.route('/register', methods=['GET', 'POST'])
+def register():
+    """Handle user registration."""
+    if request.method == 'POST':
+        username = request.form['username']
+        password = request.form['password']
+
+        if username.startswith('admin') or '^' in username:
+            flash("I don't like admins", "error")
+            return render_template('register.html')
+
+        if not username or not password:
+            flash("Both fields are required.", "error")
+            return render_template('register.html')
+
+        admin_username = f"admin^{username}^{secrets.token_hex(5)}"
+        admin_password = secrets.token_hex(8)
+
+        try:
+            conn = sqlite3.connect(DATABASE)
+            cursor = conn.cursor()
+            cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
+                           (username, password, admin_username))
+            cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
+                           (admin_username, admin_password, None))
+            conn.commit()
+        except sqlite3.IntegrityError:
+            flash("Username already exists!", "error")
+            return render_template('register.html')
+        finally:
+            conn.close()
+
+        flash("Registration successful!", "success")
+        return redirect(url_for('login'))
+
+    return render_template('register.html')
+
+
+@app.route('/login', methods=['GET', 'POST'])
+def login():
+    """Handle user login."""
+    if request.method == 'POST':
+        username = request.form['username']
+        password = request.form['password']
+
+        user = get_user_by_username(username)
+
+        if user and user[2] == password:
+            session['username'] = username
+            return redirect(url_for('home'))
+        else:
+            flash("Invalid username or password.", "error")
+
+    return render_template('login.html')
+
+
+@app.route('/reset_password', methods=['GET', 'POST'])
+def reset_password():
+    """Handle reset password request."""
+    if request.method == 'POST':
+        username = request.form['username']
+
+        if username.startswith('admin'):
+            flash("Admin users cannot request a reset token.", "error")
+            return render_template('reset_password.html')
+
+        if not get_user_by_username(username):
+            flash("Username not found.", "error")
+            return render_template('reset_password.html')
+
+        reset_token = secrets.token_urlsafe(16)
+        update_reset_token(username, reset_token)
+
+        flash("Reset token generated!", "success")
+        return render_template('reset_password.html', reset_token=reset_token)
+
+    return render_template('reset_password.html')
+
+
+@app.route('/forgot_password', methods=['GET', 'POST'])
+def forgot_password():
+    """Handle password reset."""
+    if request.method == 'POST':
+        username = request.form['username']
+        reset_token = request.form['reset_token']
+        new_password = request.form['new_password']
+        confirm_password = request.form['confirm_password']
+
+        if new_password != confirm_password:
+            flash("Passwords do not match.", "error")
+            return render_template('forgot_password.html', reset_token=reset_token)
+
+        user = get_user_by_username(username)
+        if not user:
+            flash("User not found.", "error")
+            return render_template('forgot_password.html', reset_token=reset_token)
+
+        if not username.startswith('admin'):
+            token = get_reset_token_for_user(username)
+            if token and token[0] == reset_token:
+                update_password(username, new_password)
+                flash(f"Password reset successfully.", "success")
+                return redirect(url_for('login'))
+            else:
+                flash("Invalid reset token for user.", "error")
+        else:
+            username = username.split('^')[1]
+            token = get_reset_token_for_user(username)
+            if token and token[0] == reset_token:
+                update_password(request.form['username'], new_password)
+                flash(f"Password reset successfully.", "success")
+                return redirect(url_for('login'))
+            else:
+                flash("Invalid reset token for user.", "error")
+
+    return render_template('forgot_password.html', reset_token=request.args.get('token'))
+
+
+@app.route('/home')
+def home():
+    """Display home page with images."""
+    if 'username' not in session:
+        return redirect(url_for('login'))
+
+    username = session['username']
+
+    user = get_user_by_username(username)
+    admin_username = user[3] if user else None
+
+    image_names = ['ben1', 'ben2', 'ben3', 'ben4', 'ben5', 'ben6', 'ben7', 'ben8', 'ben9', 'ben10']
+    return render_template('home.html', username=username, admin_username=admin_username, image_names=image_names)
+
+
+@app.route('/image/<image_id>')
+def image(image_id):
+    """Display the image if user is admin or redirect with missing permissions."""
+    if 'username' not in session:
+        return redirect(url_for('login'))
+
+    username = session['username']
+
+    if image_id == 'ben10' and not username.startswith('admin'):
+        return redirect(url_for('missing_permissions'))
+
+    flag = None
+    if username.startswith('admin') and image_id == 'ben10':
+        flag = FLAG
+
+    return render_template('image_viewer.html', image_name=image_id, flag=flag)
+
+
+@app.route('/missing_permissions')
+def missing_permissions():
+    """Show a message when the user tries to access a restricted image."""
+    return render_template('missing_permissions.html')
+
+
+@app.route('/logout')
+def logout():
+    """Log the user out and clear the session."""
+    session.clear()
+    flash("You have been logged out successfully.", "success")
+    return redirect(url_for('login'))
+
+
+if __name__ == '__main__':
+    if not os.path.exists(DATABASE):
+        init_db()
+    app.run(debug=True)

training/srdnlenctf-2025/web_Ben10/src/docker-compose.yml

@@ -0,0 +1,9 @@
+services:
+  ben10:
+    build: .
+    restart: always
+    ports:
+      - "0.0.0.0:80:5000"
+    environment:
+      - FLASK_ENV=production
+      - FLAG=srdnlen{b3n_l0v3s_br0k3n_4cc355_c0ntr0l_vulns}

training/srdnlenctf-2025/web_Ben10/src/requirements.txt

@@ -0,0 +1 @@
+Flask==3.1.0

training/srdnlenctf-2025/web_Ben10/src/static/css/styles.css

@@ -0,0 +1,225 @@
+/*
+You’re better off not checking here to save time, this file sucks as it is, and I don’t even get how the hell it works
+
+Best Regards,
+the author (not a front-end engineer)
+*/
+
+/* Global styles */
+body {
+    font-family: 'Arial', sans-serif;
+    background-color: rgba(0, 0, 0, 0.5); /* Transparent background */
+    color: white;
+    margin: 0;
+    padding: 0;
+    height: 100vh;
+    background-image: url('/static/images/background.png'); /* Ensure the image path is correct */
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+}
+
+/* Header and text styles */
+h1, h2 {
+    text-align: center;
+    color: #071407;
+    text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
+    font-size: 50px;  /* Larger font size */
+    margin-bottom: 20px;
+    font-weight: bold;
+}
+
+.error {
+    text-align: center;
+    color: #f30a1e;
+    text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
+    font-size: 30px;  /* Larger font size */
+    margin-bottom: 20px;
+    font-weight: bold;
+}
+
+/* Button styles */
+button, input[type="submit"], .reset-token-info button {
+    background-color: #00FF00;
+    color: #1f1f1f;
+    font-size: 18px;
+    padding: 12px 24px;
+    border: none;
+    border-radius: 12px;
+    cursor: pointer;
+    transition: background-color 0.3s;
+    margin: 10px auto;
+    display: block;
+}
+
+button:hover, input[type="submit"]:hover, .reset-token-info button:hover {
+    background-color: #00cc00;
+}
+
+/* Link styles */
+a {
+    color: #140601;  /* Contrasting color for links */
+    text-decoration: none;
+    font-weight: bold;
+    font-size: 35px;
+    display: block;
+    text-align: center;
+    margin-top: 20px;
+    transition: color 0.3s;
+}
+
+a:hover {
+    color: #2ca009;  /* Slightly different shade for hover effect */
+}
+
+/* Form styles */
+form {
+    max-width: 450px;
+    margin: 20px auto;
+    padding: 30px;
+    background-color: rgba(0, 0, 0, 0.6); /* Semi-transparent background */
+    border-radius: 20px;
+    box-shadow: 0 4px 8px rgba(0, 0, 0, 0.8);
+}
+
+input[type="text"], input[type="password"], input[type="email"] {
+    width: 100%;
+    padding: 12px;
+    margin-bottom: 20px;
+    border: none;
+    border-radius: 10px;
+    font-size: 25px;
+    background-color: #333;
+    color: white;
+}
+
+input[type="submit"] {
+    background-color: #00FF00;
+    color: white;
+    font-size: 25px;
+    padding: 15px;
+    width: 100%;
+    margin-top: 10px;
+}
+
+input[type="submit"]:hover {
+    background-color: #009900;
+}
+
+/* Footer styles */
+footer {
+    text-align: center;
+    font-size: 25px;
+    margin-top: 50px;
+    color: #0e8f00;
+}
+
+footer a {
+    color: #44ff00;  /* Footer link color */
+    text-decoration: none;
+    font-weight: bold;
+    transition: color 0.3s;
+}
+
+footer a:hover {
+    color: #49ff01;
+}
+
+/* Centering links */
+.centered-link {
+    text-align: center;
+    display: block;
+    margin-top: 20px;
+    font-size: 25px;
+}
+
+/* Image Grid */
+#image-grid {
+    display: grid;
+    grid-template-columns: repeat(5, 1fr); /* 5 columns */
+    grid-gap: 20px;
+    padding: 20px;
+    justify-items: center;
+}
+
+#image-grid img {
+    width: 100%;
+    max-width: 200px;
+    border: 3px solid #fff;
+    background-color: white;
+    padding: 10px;
+    border-radius: 8px;
+    box-shadow: 0 4px 8px rgba(0, 0, 0, 0.3);
+    transition: transform 0.3s ease, box-shadow 0.3s ease;
+}
+
+#image-grid img:hover {
+    transform: scale(1.1);
+    box-shadow: 0 6px 12px rgba(0, 0, 0, 0.5);
+}
+
+/* Image container style */
+.image-container {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    text-align: center;
+    flex-direction: column;
+}
+
+.image-container img {
+    max-width: 90%;
+    height: auto;
+    border: 5px solid #ffffff;
+}
+
+/* Heading for image container */
+h2 {
+    font-size: 30px;
+    color: white;
+    text-shadow: 2px 2px 5px rgba(0, 255, 0, 0.8);
+    margin-bottom: 20px;
+}
+
+/* Reset Password Styles */
+.reset-password-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    text-align: center;
+}
+
+.reset-token-info {
+    text-align: center;
+    font-size: 24px;
+    margin-top: 20px;
+    padding: 20px;
+    background-color: rgba(0, 0, 0, 0.6);
+    border-radius: 10px;
+    color: white;
+    display: inline-block;
+    width: 60%;
+    max-width: 400px;
+}
+
+.reset-token-info p {
+    font-size: 28px;
+    font-weight: bold;
+}
+
+.reset-token-info button {
+    font-size: 18px;
+    padding: 10px 20px;
+    margin-top: 10px;
+    background-color: #00FF00;
+    border: none;
+    border-radius: 8px;
+    cursor: pointer;
+    transition: background-color 0.3s;
+}
+
+.reset-token-info button:hover {
+    background-color: #00cc00;
+}
+

training/srdnlenctf-2025/web_Ben10/src/templates/base.html

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="it">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>OWASP Ben 10 App</title>
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/styles.css') }}">
+</head>
+<body>
+    <header>
+        <div class="header">
+            <h1>OWASP Ben 10</h1>
+        </div>
+    </header>
+    
+    <div class="container">
+        {% block content %}
+        {% endblock %}
+    </div>
+
+    <footer>
+        <h4>&copy; 2024 OWASP Ben 10 App</h4>
+    </footer>
+</body>
+</html>

training/srdnlenctf-2025/web_Ben10/src/templates/forgot_password.html

@@ -0,0 +1,47 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="forgot-password-container">
+        <h2>Reset Password</h2>
+        
+        <form method="POST">
+            <div>
+                <label for="username">Username</label>
+                <input type="text" name="username" id="username" required>
+            </div>
+            
+            <div>
+                <label for="reset_token">Reset Token</label>
+                <!-- Check if a token is passed in the GET request, if so, fill it in the input field -->
+                <input type="text" name="reset_token" id="reset_token" value="{{ request.args.get('token') }}" required>
+            </div>
+            
+            <div>
+                <label for="new_password">New Password</label>
+                <input type="password" name="new_password" id="new_password" required>
+            </div>
+            
+            <div>
+                <label for="confirm_password">Confirm New Password</label>
+                <input type="password" name="confirm_password" id="confirm_password" required>
+            </div>
+
+            <button type="submit">Reset Password</button>
+        </form>
+
+        <!-- Display error or success messages -->
+        {% with messages = get_flashed_messages(with_categories=true) %}
+        {% if messages %}
+            <div class="message-container">
+                {% for category, message in messages %}
+                    <p class="error">{{ message }}</p>
+                {% endfor %}
+            </div>
+            {% endif %}
+        {% endwith %}
+
+    <br>
+
+    <a href="{{ url_for('login') }}">Back to Login</a>
+    </div>
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/home.html

@@ -0,0 +1,20 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <h1>Welcome, {{ username }}</h1>
+    <h2>Do you like the aliens on my Omnitrix?</h2>
+    
+    <!-- secret admin username -->
+    <div style="display:none;" id="admin_data">{{ admin_username }}</div>
+    
+    <div id="image-grid">
+        {% for image_name in image_names %}
+            <div>
+                <img src="{{ url_for('static', filename='images/' + image_name + '.webp') }}" alt="{{ image_name }}" 
+                    onclick="window.location.href='/image/{{ image_name }}'" style="cursor:pointer;">
+            </div>
+        {% endfor %}
+    </div>
+
+    <a href="{{ url_for('logout') }}" style="margin-top: 20px; display: block;">Logout</a>
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/image_viewer.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="image-container">
+        <h2>Ben10 presents you:</h2>
+        <h1>{{ image_name }}</h1>
+        <!-- Display the image -->
+        <img src="{{ url_for('static', filename='images/' + image_name + '.webp') }}" alt="{{ image_name }}" style="max-width: 100%; height: auto;">
+    
+
+        {% if flag %}
+        <div class="flag-container">
+            <p class="error">Flag: {{ flag }}</p>
+        </div>
+        {% endif %}
+        <br>
+
+        <!-- Link to go back to the home page -->
+        <a href="{{ url_for('home') }}">Back to Home</a>
+    </div>
+
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/login.html

@@ -0,0 +1,36 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="login-container">
+        <h2>Login</h2>
+        
+        <form method="POST">
+            <div>
+                <label for="username">Username</label>
+                <input type="text" name="username" id="username" required>
+            </div>
+            
+            <div>
+                <label for="password">Password</label>
+                <input type="password" name="password" id="password" required>
+            </div>
+
+            <button type="submit">Login</button>
+        </form>
+
+        {% with messages = get_flashed_messages(with_categories=true) %}
+        {% if messages %}
+            <div class="message-container">
+                {% for category, message in messages %}
+                    <p class="error">{{ message }}</p>
+                {% endfor %}
+            </div>
+            {% endif %}
+        {% endwith %}
+
+        <br>
+        
+        <p><a href="{{ url_for('register') }}">Sign Up</a></p>
+        <p><a href="{{ url_for('reset_password') }}">Forgot Password?</a></p>
+    </div>
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/missing_permissions.html

@@ -0,0 +1,10 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="missing-permission">
+        <h2>Error - Missing Permissions</h2>
+        <h1>Only Admins can access Ben10!</h1>
+        <br>
+        <a href="{{ url_for('home') }}">Go to Home</a>
+    </div>
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/register.html

@@ -0,0 +1,35 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="register-container">
+        <h2>Sign Up</h2>
+        
+        <form method="POST">
+            <div>
+                <label for="username">Username</label>
+                <input type="text" name="username" id="username" required>
+            </div>
+            
+            <div>
+                <label for="password">Password</label>
+                <input type="password" name="password" id="password" required>
+            </div>
+
+            <button type="submit">Sign Up</button>
+        </form>
+
+        {% with messages = get_flashed_messages(with_categories=true) %}
+        {% if messages %}
+            <div class="message-container">
+                {% for category, message in messages %}
+                    <p class="error">{{ message }}</p>
+                {% endfor %}
+            </div>
+            {% endif %}
+        {% endwith %}
+
+        <br>
+        
+        <a href="{{ url_for('login') }}">Login</a></h2>
+    </div>
+{% endblock %}

training/srdnlenctf-2025/web_Ben10/src/templates/reset_password.html

@@ -0,0 +1,31 @@
+{% extends "base.html" %}
+
+{% block content %}
+    <div class="reset-password-container">
+        <h2>Get Reset Token</h2>
+        
+        {% if not reset_token %}
+            <form method="POST">
+                <input type="text" name="username" placeholder="Enter your username" required><br>
+                <button type="submit">Get Reset Token</button>
+            </form>
+        {% endif %}
+
+        {% if reset_token %}
+            <div class="reset-token-info">
+                <p>Your reset token is: <strong>{{ reset_token }}</strong></p>
+                <a href="{{ url_for('forgot_password', token=reset_token) }}">
+                    <button>Reset your password</button>
+                </a>
+            </div>
+        {% endif %}
+
+        {% with messages = get_flashed_messages(with_categories=true) %}
+            {% for category, message in messages %}
+                <p class="error">{{ message }}</p>
+            {% endfor %}
+        {% endwith %}
+
+        <a href="{{ url_for('login') }}">Back to Login</a>
+    </div>
+{% endblock %}