Skip to content

Commit 5e6c3fa

Browse files
author
Gregor Spagnolo
committed
first commit
1 parent c28d54a commit 5e6c3fa

File tree

327 files changed

+99843
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

327 files changed

+99843
-1
lines changed

‎.gitignore

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
################################################################################
2+
# This .gitignore file was automatically created by Microsoft(R) Visual Studio.
3+
################################################################################
4+
5+
/BankWebPortal/.vs/BankWebPortal/v16
6+
/BankWebPortal/BankWebPortal/bin/Debug/netcoreapp2.2
7+
/BankWebPortal/BankWebPortal/obj
8+
*.user
9+
/BankWebPortal/.vs
10+
.vs/
11+
bin/
12+
obj/

‎README.md

+33-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,33 @@
1-
# SecureBank
1+
# SecureBank
2+
3+
SecureBank is a FinTech application which contains all OWASP TOP 10 security vulnerabilities along with some other security flaws found in real-world applications.
4+
5+
![alt text](preview.gif "SecureBankPreview")
6+
7+
# Setup
8+
> You can setup SecureBank application from source code or just pull from docker hub
9+
10+
## From source
11+
> Make sure that you have Microsoft SQL Server DB available you can install it or run inside docker
12+
13+
1. Install [.NET Core 3.1 SDK](https://dotnet.microsoft.com/download/dotnet-core/3.1)
14+
2. Install [Visual Studio 2019](https://visualstudio.microsoft.com/downloads/) or just run with [Visual Studio Code](https://code.visualstudio.com/download)
15+
3. Clone from GitHub
16+
4. Navigate to directory SecureBank -> src
17+
5. `dotnet run` or open solution in IDE and run there
18+
19+
## From Docker
20+
1. Install [Docker](https://docs.docker.com/get-docker/)
21+
2. Run `docker run -p 80:80 -p 5000:5000 -p 1080:1080 ssrd/securebank`
22+
3. Browse to [http://localhost:80](http://localhost:80)
23+
24+
## Docker with multiply containers
25+
1. Install [Docker](https://docs.docker.com/get-docker/)
26+
2. Install [Docker Compose](https://docs.docker.com/compose/install/)
27+
3. Run `docker-compose up`
28+
29+
30+
## CTF-Mode
31+
If you want to run SecureBank in CTF mode we have also prepared this option. It will crate CTFd compatible export file.
32+
33+
Run `docker run -p 80:80 -p 5000:5000 -e 'AppSettings:Ctf:Enabled=true' -e 'AppSettings:Ctf:Seed=example' ssrd/securebank`

‎docker-compose.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
version: '3'
2+
3+
services:
4+
securebank:
5+
build: ./src/securebank
6+
container_name: securebank
7+
environment:
8+
- AppSettings:StoreEndpoint:ApiUrl=storeapi/api/Store/
9+
- AppSettings:StoreEndpoint:ApiToken=-
10+
- AppSettings:SmtpCredentialsIp=maildev
11+
- AppSettings:SmtpCredentials:Port=1025
12+
- AppSettings:SmtpCredentials:Username=-
13+
- AppSettings:SmtpCredentials:Password=-
14+
- AppSettings:Ctf:Enabled=false
15+
- AppSettings:Ctf:Seed=example
16+
- DatabaseConnections:SecureBankMSSQL:UserId=sa
17+
- DatabaseConnections:SecureBankMSSQL:UserPass=Your_Password123
18+
- DatabaseConnections:SecureBankMSSQL:Server=mssql
19+
- DatabaseConnections:SecureBankMSSQL:1433
20+
- DatabaseConnections:SecureBankMSSQL:securebank
21+
volumes:
22+
- ./logs/storeapi:/var/log/storeapi
23+
ports:
24+
- 7000:80
25+
26+
storeapi:
27+
build: ./src/storeapi
28+
container_name: storeapi
29+
environment:
30+
- DatabaseConnections:StoreMSSQL:UserId=sa
31+
- DatabaseConnections:StoreMSSQL:UserPass=Your_Password123
32+
- DatabaseConnections:StoreMSSQL:Server=mssql
33+
- DatabaseConnections:StoreMSSQL:ServerPort=1433
34+
- DatabaseConnections:StoreMSSQL:Database=store
35+
volumes:
36+
- ./logs/storeapi:/var/log/storeapi
37+
ports:
38+
- 7010:80
39+
40+
mssql:
41+
image: mcr.microsoft.com/mssql/server:2019-CU3-ubuntu-16.04
42+
container_name: mssql
43+
environment:
44+
- ACCEPT_EULA=y
45+
- SA_PASSWORD=Your_Password123
46+
# ports:
47+
# - 1433:1433
48+
volumes:
49+
- .data:/var/opt/mssql/data
50+
51+
maildev:
52+
image: maildev/maildev:1.1.0
53+
container_name: maildev
54+
ports:
55+
- 1080:1080
56+
57+
ftp:
58+
image: inanimate/vsftpd-anon
59+
container_name: ftp
60+
ports:
61+
- 20-21:20-21
62+
- 65500-65515:65500-65515
63+
volumes: :
64+
- ./ftp-files:/var/ftp:ro

‎exampledata/xxe_linux.xml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE foo
3+
[
4+
<!ELEMENT foo ANY >
5+
<!ENTITY xxe SYSTEM "file:///etc/passwd" >
6+
]>
7+
<foo>&xxe;</foo>

‎exampledata/xxe_win.xml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE foo
3+
[
4+
<!ELEMENT foo ANY >
5+
<!ENTITY xxe SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts" >
6+
]>
7+
<foo>&xxe;</foo>

‎preview.gif

383 KB
Loading

‎src/SecureBank.sln

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.28922.388
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "SecureBank", "SecureBank\SecureBank.csproj", "{AB331573-5EB0-4277-9D70-B986EC5C09CD}"
7+
EndProject
8+
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "StoreAPI", "StoreAPI\StoreAPI.csproj", "{1FD26B43-39A2-4FF4-A1A1-3291DF83C422}"
9+
EndProject
10+
Global
11+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
12+
Debug|Any CPU = Debug|Any CPU
13+
Release|Any CPU = Release|Any CPU
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{AB331573-5EB0-4277-9D70-B986EC5C09CD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
17+
{AB331573-5EB0-4277-9D70-B986EC5C09CD}.Debug|Any CPU.Build.0 = Debug|Any CPU
18+
{AB331573-5EB0-4277-9D70-B986EC5C09CD}.Release|Any CPU.ActiveCfg = Release|Any CPU
19+
{AB331573-5EB0-4277-9D70-B986EC5C09CD}.Release|Any CPU.Build.0 = Release|Any CPU
20+
{1FD26B43-39A2-4FF4-A1A1-3291DF83C422}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
21+
{1FD26B43-39A2-4FF4-A1A1-3291DF83C422}.Debug|Any CPU.Build.0 = Debug|Any CPU
22+
{1FD26B43-39A2-4FF4-A1A1-3291DF83C422}.Release|Any CPU.ActiveCfg = Release|Any CPU
23+
{1FD26B43-39A2-4FF4-A1A1-3291DF83C422}.Release|Any CPU.Build.0 = Release|Any CPU
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {17EDF5D4-93D4-47AE-B98F-EF2B30CE3ABD}
30+
EndGlobalSection
31+
EndGlobal

‎src/SecureBank/.dockerignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
bin\
2+
obj\

‎src/SecureBank/Authorization/Attributes/AuthenticateAttribute.cs

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
using Microsoft.AspNetCore.Authorization;
2+
using Microsoft.AspNetCore.Mvc.Filters;
3+
using System;
4+
using System.Collections.Generic;
5+
using System.Linq;
6+
using System.Threading.Tasks;
7+
8+
namespace SecureBank.Helpers.Authorization.Attributes
9+
{
10+
/// <summary>
11+
/// Only checks if user has Autheticatio cookie and sets claims.
12+
/// </summary>
13+
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
14+
public sealed class AuthenticateAttribute : AuthorizeAttribute, IAuthorizationFilter
15+
{
16+
public void OnAuthorization(AuthorizationFilterContext context)
17+
{
18+
IAuthorizeService authorizeService = (IAuthorizeService)context.HttpContext.RequestServices.GetService(typeof(IAuthorizeService));
19+
authorizeService.AuthorizeNormal(context);
20+
}
21+
}
22+
}

‎src/SecureBank/Authorization/Attributes/AuthorizeAdminAttribute.cs

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
using Microsoft.AspNetCore.Authorization;
2+
using Microsoft.AspNetCore.Mvc;
3+
using Microsoft.AspNetCore.Mvc.Filters;
4+
using System;
5+
6+
namespace SecureBank.Helpers.Authorization.Attributes
7+
{
8+
9+
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
10+
public sealed class AuthorizeAdminAttribute : AuthorizeAttribute, IAuthorizationFilter
11+
{
12+
private readonly AuthorizeAttributeTypes _authorizeAttributeType;
13+
14+
public AuthorizeAdminAttribute(AuthorizeAttributeTypes authorizeAttributeType)
15+
{
16+
_authorizeAttributeType = authorizeAttributeType;
17+
}
18+
19+
public void OnAuthorization(AuthorizationFilterContext context)
20+
{
21+
IAuthorizeService authorizeService = (IAuthorizeService)context.HttpContext.RequestServices.GetService(typeof(IAuthorizeService));
22+
bool result = authorizeService.AuthorizeAdmin(context);
23+
if (!result)
24+
{
25+
switch (_authorizeAttributeType)
26+
{
27+
case AuthorizeAttributeTypes.Mvc:
28+
{
29+
context.Result = new RedirectToActionResult("Login", "Auth", null);
30+
return;
31+
}
32+
case AuthorizeAttributeTypes.Api:
33+
{
34+
35+
context.Result = new UnauthorizedResult();
36+
return;
37+
}
38+
default:
39+
{
40+
throw new Exception($"Unsupported AuthorizeAttributeType");
41+
}
42+
}
43+
}
44+
}
45+
}
46+
}

‎src/SecureBank/Authorization/Attributes/AuthorizeAttributeTypes.cs

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Threading.Tasks;
5+
6+
namespace SecureBank.Helpers.Authorization.Attributes
7+
{
8+
public enum AuthorizeAttributeTypes
9+
{
10+
Mvc = 1,
11+
Api = 2,
12+
}
13+
}

‎src/SecureBank/Authorization/Attributes/AuthorizeMissingAttribute.cs

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
using Microsoft.AspNetCore.Authorization;
2+
using Microsoft.AspNetCore.Mvc.Filters;
3+
using System;
4+
using System.Collections.Generic;
5+
using System.Linq;
6+
using System.Threading.Tasks;
7+
8+
namespace SecureBank.Helpers.Authorization.Attributes
9+
{
10+
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
11+
public sealed class AuthorizeMissing : AuthorizeAttribute, IAuthorizationFilter
12+
{
13+
public void OnAuthorization(AuthorizationFilterContext context)
14+
{
15+
IAuthorizeService authorizeService = (IAuthorizeService)context.HttpContext.RequestServices.GetService(typeof(IAuthorizeService));
16+
bool result = authorizeService.AuthorizeMissing(context);
17+
}
18+
}
19+
}

‎src/SecureBank/Authorization/Attributes/AuthorizeNormalAttribute.cs

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
using Microsoft.AspNetCore.Authorization;
2+
using Microsoft.AspNetCore.Mvc;
3+
using Microsoft.AspNetCore.Mvc.Filters;
4+
using System;
5+
6+
namespace SecureBank.Helpers.Authorization.Attributes
7+
{
8+
9+
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
10+
public sealed class AuthorizeNormalAttribute : AuthorizeAttribute, IAuthorizationFilter
11+
{
12+
private readonly AuthorizeAttributeTypes _authorizeAttributeType;
13+
14+
public AuthorizeNormalAttribute(AuthorizeAttributeTypes authorizeAttributeType)
15+
{
16+
_authorizeAttributeType = authorizeAttributeType;
17+
}
18+
19+
public void OnAuthorization(AuthorizationFilterContext context)
20+
{
21+
IAuthorizeService authorizeService = (IAuthorizeService)context.HttpContext.RequestServices.GetService(typeof(IAuthorizeService));
22+
bool result = authorizeService.AuthorizeNormal(context);
23+
if (!result)
24+
{
25+
switch (_authorizeAttributeType)
26+
{
27+
case AuthorizeAttributeTypes.Mvc:
28+
{
29+
context.Result = new RedirectToActionResult("Login", "Auth", null);
30+
return;
31+
}
32+
case AuthorizeAttributeTypes.Api:
33+
{
34+
35+
context.Result = new UnauthorizedResult();
36+
return;
37+
}
38+
default:
39+
{
40+
throw new Exception($"Unsupported AuthorizeAttributeType");
41+
}
42+
}
43+
}
44+
}
45+
}
46+
}

0 commit comments

Comments
 (0)