lifedebugger/sql-injection-1
0
1package main2 3import (4 "database/sql"5 "fmt"6 "io/ioutil"7 "log"8 "net/http"9 "os"10 "strings"11 12 _ "github.com/lib/pq"13)14 15type User struct {16 ID int17 Username string18 Flag string19}20 21func connectDB() (*sql.DB, error) {22 connStr := os.Getenv("DATABASE_URL")23 if connStr == "" {24 return nil, fmt.Errorf("DATABASE_URL environment variable is not set")25 }26 return sql.Open("postgres", connStr)27}28 29func main() {30 // 1. Endpoint to View Source Code (Crucial for the CTF)31 http.HandleFunc("/source", func(w http.ResponseWriter, r *http.Request) {32 content, err := ioutil.ReadFile("main.go")33 if err != nil {34 http.Error(w, "Could not read source code.", http.StatusInternalServerError)35 return36 }37 w.Header().Set("Content-Type", "text/plain")38 w.Write(content)39 })40 41 // 2. Login Page42 http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {43 html := `44 <!DOCTYPE html>45 <html>46 <head>47 <title>Secure Login System v2.0</title>48 <link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">49 </head>50 <body class="bg-gray-900 text-white flex flex-col items-center justify-center h-screen">51 <div class="bg-gray-800 p-8 rounded shadow-lg w-96 border-t-4 border-blue-500">52 <h1 class="text-2xl mb-2 text-center font-bold text-blue-400">SECURE GATEWAY</h1>53 <p class="text-gray-400 mb-6 text-center text-xs">Protected by GoWAF™ technology</p>54 55 <form action="/login" method="POST" class="space-y-4">56 <div>57 <label class="block text-sm font-medium text-gray-300">Username</label>58 <input type="text" name="username" class="w-full p-2 bg-gray-700 rounded border border-gray-600 focus:border-blue-500 outline-none" placeholder="Enter username">59 </div>60 <div>61 <label class="block text-sm font-medium text-gray-300">Password</label>62 <input type="password" name="password" class="w-full p-2 bg-gray-700 rounded border border-gray-600 focus:border-blue-500 outline-none" placeholder="••••••">63 </div>64 <button type="submit" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded transition">AUTHENTICATE</button>65 </form>66 67 <div class="mt-6 border-t border-gray-700 pt-4 text-center">68 <p class="text-xs text-gray-500">Developers only:</p>69 <a href="/source" class="text-sm text-blue-400 hover:underline">View Source Code</a>70 </div>71 </div>72 </body>73 </html>74 `75 w.Header().Set("Content-Type", "text/html")76 w.Write([]byte(html))77 })78 79 // 3. The Hardened (but still vulnerable) Login Endpoint80 http.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {81 if r.Method != http.MethodPost {82 http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)83 return84 }85 86 username := r.FormValue("username")87 password := r.FormValue("password")88 89 90 ua := r.Header.Get("User-Agent")91 if ua != "Secure-CTF-Browser/1.0" {92 http.Error(w, "Security Alert: Browser not authorized. Please use 'Secure-CTF-Browser/1.0'", http.StatusForbidden)93 return94 }95 96 97 if username == "admin" {98 http.Error(w, "Direct login as 'admin' is disabled for security reasons.", http.StatusForbidden)99 return100 }101 102 if strings.Contains(username, " ") || strings.Contains(password, " ") {103 http.Error(w, "WAF Detection: Spaces are not allowed in input fields.", http.StatusBadRequest)104 return105 }106 107 db, err := connectDB()108 if err != nil {109 http.Error(w, "Database connection failed", http.StatusInternalServerError)110 log.Println("DB Error:", err)111 return112 }113 defer db.Close()114 115 116 query := fmt.Sprintf("SELECT id, username, flag FROM users WHERE username = '%s' AND password = '%s'", username, password)117 118 log.Printf("Executing Query: %s\n", query)119 120 var user User121 122 err = db.QueryRow(query).Scan(&user.ID, &user.Username, &user.Flag)123 124 if err != nil {125 if err == sql.ErrNoRows {126 w.WriteHeader(http.StatusUnauthorized)127 w.Write([]byte("Invalid credentials."))128 } else {129 http.Error(w, "Query error: "+err.Error(), http.StatusInternalServerError)130 }131 return132 }133 134 135 w.WriteHeader(http.StatusOK)136 fmt.Fprintf(w, `137 <div style="font-family: monospace; background: #111; color: #4ade80; padding: 20px; text-align: center;">138 <h1>SYSTEM BREACHED</h1>139 <p>User: %s</p>140 <p style="font-size: 24px; border: 1px dashed #4ade80; display: inline-block; padding: 10px;">FLAG: %s</p>141 </div>142 `, user.Username, user.Flag)143 })144 145 port := os.Getenv("PORT")146 if port == "" {147 port = "7860"148 }149 150 log.Printf("CTF Hard Mode listening on port %s", port)151 log.Fatal(http.ListenAndServe(":"+port, nil))152}