diff --git a/.gitignore b/.gitignore deleted file mode 100644 index cd61d06..0000000 --- a/.gitignore +++ /dev/null @@ -1 +0,0 @@ -connect.php \ No newline at end of file diff --git a/README.md b/README.md index 44c56c3..fc0896f 100644 --- a/README.md +++ b/README.md @@ -4,22 +4,21 @@ Build In | Contributors | Live version --- | --- | --- **PHP/SQL/HTML/CSS** | [@philip-hub](https://github.com/philip-hub) | Clone and run with your local SQL server -![SQL Server Hacking](https://i.giphy.com/media/TOWeGr70V2R1K/giphy.webp) - # Description and Setup +A modified version of [sql-injectiono-hack-workshop](https://github.com/philip-hub/sql-injection-hack-workshop) to run on a Debian or Ubuntu machine hosting a LAMP stack application. -This is a dummy bank website with poor security to teach people about the basics of SQL injection. In order to use this you will need a PHP server and you will need to create a SQL server, database, and table. Both of these tasks can easliy be done with [MAMP](https://www.mamp.info/en/). Once MAMP is instaled clone this repo to the desired path on your machine. MAMP Preferences then Web Server and navigate to the path that you cloned this repo too. Start MAMP up and should bring you to a MAMP homepage on your local host where you can access myPHPAdmin. Use myPHPadmin to create a SQL database and table. This [video](https://www.youtube.com/watch?v=s7p5aS8m57k) is a good guide for this task. Name your table "mhc_bank" without the quotes. In your table create the columns "username" , "password", and "amount" as type TEXT all as those are spelled without the quotes. Use the insert command in the menu bar to add some fake users with passwords and amounts. Then open the your repo path in your favorite a text or code editor. Create a connect.php file. Put the following code in connect.php.
+This is a dummy bank website with poor security to teach people about the basics of SQL injection. This website requires a PHP server and a SQL server with a database as well as a table both named mhc_bank. The mhc_bank table has three TEXT columns labeled "username" , "password", and "amount". You can setup the website and install all of its dependences by running this repo's installation script. In a terminal, run ```sudo ./install.sh```. After the installation script is done running, modifiy ```connect.php``` in ```/var/www/html``` with your favorite text editor under root privileges. Edit the following code.
``` + ``` -

Try signing in to one user's account then refernce the article below and the source code and try some SQL injection commands. -W3 Schools has a great article about SQL injection here

+

Verify the website is working by opening a web browser and going to http://localhost/. Once at the login page, try signing in to a user's account. Reference the article below and try some SQL injection commands. W3 Schools has a great article about SQL injection here.

--- diff --git a/connect.php b/connect.php new file mode 100644 index 0000000..32991f5 --- /dev/null +++ b/connect.php @@ -0,0 +1,6 @@ + diff --git a/index.html b/index.html index d6b8cc5..10e5fd4 100644 --- a/index.html +++ b/index.html @@ -1,47 +1,32 @@ + - - The Secure Bank + The Secure Bank + body { + width: 100%; + min-height: 100%; + background-color: rgb(65, 64, 64); + color: #f0f0f0; + box-shadow: 0 20000px rgba(15, 15, 15, .96) inset; + } + +
-

Sign into your bank secure account today


-

-


-


-
-
-
-
-
-
- - - -
- - - - - -
+

Sign into your bank secure account today


+

+


+


+
+
+
+
+ \ No newline at end of file diff --git a/index.php b/index.php index 11b9346..807d20c 100644 --- a/index.php +++ b/index.php @@ -10,7 +10,12 @@ // Make a SQL query $username=$_POST["username"]; $password = $_POST["password"]; -$sql = 'SELECT * FROM userinfo WHERE username ="'.$username.'" AND password ="'.$password.'";'; + +// Sanitize input +// $username=filter_var($username, FILTER_SANITIZE_STRING); +// $password=filter_var($password, FILTER_SANITIZE_STRING); + +$sql = 'SELECT * FROM mhc_bank WHERE username ="'.$username.'" AND password ="'.$password.'";'; // echo $sql; $result = mysqli_query($conn, $sql); @@ -31,29 +36,25 @@ } } } else { - $bank_info = "

Sorry This Account does not exsist
Return to Sign In

"; + $bank_info = " + +

Sorry This Account does not exsist

Return to Sign In

"; } - ?> - *Your* Secure Info @@ -61,22 +62,12 @@ +


-
- - - - - -
-
+ - \ No newline at end of file + diff --git a/install.sh b/install.sh new file mode 100755 index 0000000..8ffa8f1 --- /dev/null +++ b/install.sh @@ -0,0 +1,113 @@ +#!/bin/bash +# Colors +RED='\033[0;31m' +GREEN='\u001b[32m' +YELLOW='\u001b[33m' +NC='\033[0m' + +# Ensure Script is executed under root privileges. +if [ "$EUID" -ne 0 ] +then echo -e "${RED}-RUN AS ROOT-${NC}" +exit +fi + +# Update & Upgrade System +echo -e "Update System? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + apt update && apt upgrade -y + apt autoremove -y + echo -e "${GREEN}-SYSTEM UPDATED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-SYSTEM NOT UPDATED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + +# Install Apache +echo -e "Install Apache? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + apt install apache2 apache2-utils -y + systemctl enable apache2 + systemctl start apache2 + echo -e "${GREEN}-APACHE INSTALLED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-APACHE NOT INSTALLED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + + +# Install MySQL (MariaDB) +echo -e "Install MySQL? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + apt install mariadb-server -y + systemctl enable mariadb + systemctl start mariadb + echo -e "${GREEN}-MYSQL INSTALLED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-MYSQL NOT INSTALLED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + +# Configure MySQL Service +echo -e "Configure MySQL Service? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + mysql_secure_installation + echo -e "${GREEN}-MYSQL SERVICE CONFIGURED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-MYSQL SERVICE NOT CONFIGURED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + +# Configure MySQL Database +echo -e "Configure MySQL Database? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + echo "Enter password for MySQL root account." + mysql -u root -p < setupDatabase.sql + echo -e "${GREEN}-MYSQL DATABASE CONFIGURED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-MYSQL DATABASE NOT CONFIGURED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + +# Install PHP +echo -e "Install PHP? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + apt install php php-cli php-mysql libapache2-mod-php php-gd php-xml php-curl php-common -y + echo -e "${GREEN}-PHP INSTALLED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-PHP NOT INSTALLED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + +# Install Website +echo -e "Install Website? ${GREEN}Y${YELLOW}/${RED}N${NC}" +read input + +if [[ $input == Y ]] || [[ $input == y ]] || [[ $input == yes ]]; then + # Move files to /var/www/html + echo "cp index.html index.php style.css connect.php /var/www/html/" + cp index.html index.php style.css connect.php /var/www/html/ + echo -e "${GREEN}-WEBSITE INSTALLED-${NC}" +elif [[ $input == N ]] || [[ $input == n ]] || [[ $input == no ]]; then + echo -e "${RED}-WEBSITE NOT INSTALLED-${NC}" +else + echo -e "${RED}-INVALID INPUT-${NC}" +fi + diff --git a/setupDatabase.sql b/setupDatabase.sql new file mode 100644 index 0000000..3e38a3a --- /dev/null +++ b/setupDatabase.sql @@ -0,0 +1,23 @@ +-- Create database mhc_bank, and use it. +CREATE DATABASE mhc_bank; +USE mhc_bank; + +-- Create table mhc_bank and three text columns named username, password, amount. +CREATE TABLE mhc_bank ( + username TEXT(255), + password TEXT(255), + amount TEXT(255) +); + +-- Insert data into mhc_bank table. +INSERT INTO mhc_bank (username, password, amount) +VALUES ("alice", "apples123", "500"); + +INSERT INTO mhc_bank (username, password, amount) +VALUES ("bob", "banana321", "250"); + +INSERT INTO mhc_bank (username, password, amount) +VALUES ("carol", "coconut231", "750"); + +-- Showcase data in mhc_bank. +SELECT * FROM mhc_bank; diff --git a/style.css b/style.css index 812df8f..a8ebe6c 100644 --- a/style.css +++ b/style.css @@ -1,48 +1,43 @@ -@import url('https://fonts.googleapis.com/css2?family=Fira+Sans:wght@300&display=swap'); - -body{ +body { width: 100%; - /* height: -webkit-fill-available; */ - min-height: 100%; - background-image: url("https://i.giphy.com/media/9SJ0zZnGVQSajeSMZ2/giphy.webp"); - background-size: cover; - background-position-x: center; + background-image: rgb(65, 64, 64); color: #f0f0f0; - font-family: 'Fira Sans', sans-serif; - box-shadow: 0 20000px rgba(15, 15, 15, .96) inset; - + font-family: Arial, Helvetica, sans-serif; + box-shadow: 0 20000px rgba(15, 15, 15, .96) inset; + } -form, #bankinfo{ - background-color:#2E2E2E; +form, +#bankinfo { + background-color: #2E2E2E; text-align: center; margin-right: 20%; margin-left: 20%; border-radius: 1em; - font-family: 'Fira Sans', sans-serif; + font-family: Arial, Helvetica, sans-serif; font-size: 1.5em; } -h1{ - +h1 { + text-align: center; } -input{ - - background-color: #868686; +input { + + background-color: #f0f0f0; font-size: 1em; border-radius: .25em; } - -p{ + +p { text-align: center; font-size: 1.5em; } -a{ - color:#FF3374; +a { + color: #FF3374; text-align: center; font-size: 1.5em; } @@ -50,29 +45,29 @@ a{ .fa { font-size: 2.5em; text-align: center; - color:#33D1FF; + color: #33D1FF; padding: 20px; font-size: 30px; width: 10px; text-decoration: none; margin: 5px 2px; border-radius: 50%; - - } - - .fa:hover { - opacity: 0.7; - - } - - #money { - color:#FFCB1B; - } - - #name{ - color:#FF3374; - } - #password{ - color:#09FF36; - } +} + +.fa:hover { + opacity: 0.7; + +} + +#money { + color: #FFCB1B; +} + +#name { + color: #FF3374; +} + +#password { + color: #09FF36; +} \ No newline at end of file