VA experiments2

src/main/java/org/sasanlabs/internal/utility/EncodingUtils.java

@@ -1,7 +1,5 @@
 package org.sasanlabs.internal.utility;
 
-import java.util.Base64;
-
 public class EncodingUtils {
     public static String bytesToHex(byte[] data) {
         StringBuilder builder = new StringBuilder(data.length * 2);
@@ -10,8 +8,4 @@ public static String bytesToHex(byte[] data) {
         }
         return builder.toString();
     }
-
-    public static String encodeBase64(String rawText) {
-        return Base64.getEncoder().encodeToString(rawText.getBytes());
-    }
 }

src/main/java/org/sasanlabs/internal/utility/EncryptionUtils.java

@@ -21,50 +21,6 @@ public class EncryptionUtils {
 
     private EncryptionUtils() {}
 
-    /**
-     * INSECURE: Caesar Cipher shifts alphabetic characters positions to the right overflowing to
-     * the beginning of the alphabet. 'z' will shift to 'a' and so on.
-     *
-     * @param rawPassword plaintext password to encrypt
-     * @param shift how many shifts right
-     */
-    public static String caesarCipher(String rawPassword, int shift) throws EncryptionException {
-
-        if (rawPassword == null) {
-            throw new EncryptionException("Raw password cannot be null ");
-        }
-
-        // Technically shift can be any non-zero integer, for clarity it should be between 0-25
-        // inclusive
-        if (shift < 0 || shift >= 26) {
-            throw new EncryptionException("Shift value must be between 0 and 25 inclusive.");
-        }
-
-        StringBuilder builder = new StringBuilder();
-        for (char ch : rawPassword.toCharArray()) {
-            if (Character.isLetter(ch)) {
-                char base = Character.isUpperCase(ch) ? 'A' : 'a';
-                builder.append((char) ((ch - base + shift) % 26 + base));
-            } else {
-                builder.append(ch);
-            }
-        }
-        return builder.toString();
-    }
-
-    /**
-     * INSECURE: Custom cipher that obscures the texts by reversing it then Base64 encodes it.
-     *
-     * @param rawPassword password to encrypt
-     */
-    public static String customCipher(String rawPassword) throws EncryptionException {
-        if (rawPassword == null) {
-            throw new EncryptionException("Raw password cannot be null ");
-        }
-        String reversed = new StringBuilder(rawPassword).reverse().toString();
-        return EncodingUtils.encodeBase64(reversed);
-    }
-
     private static final byte[] salt = new byte[16];
 
     static {

src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginService.java

@@ -5,6 +5,7 @@
 import java.security.NoSuchAlgorithmException;
 import java.util.List;
 import java.util.Optional;
+import java.util.UUID;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.springframework.jdbc.core.BeanPropertyRowMapper;
@@ -23,6 +24,16 @@ public class AuthLoginService {
 
     private static final Logger LOGGER = LogManager.getLogger(AuthLoginService.class);
 
+    /**
+     * BCrypt hash (cost 10) of a value no account uses. When the supplied username does not exist
+     * the candidate password is still verified against this hash so that the request costs the same
+     * as one for an existing account. Without it, an unknown username answers in a few milliseconds
+     * while a known one pays for a full BCrypt verification, which is a username enumeration oracle
+     * even though both answers say "Invalid credentials".
+     */
+    private static final String DUMMY_PASSWORD_HASH =
+            new BCryptPasswordEncoder(10).encode(UUID.randomUUID().toString());
+
     private final JdbcTemplate jdbcTemplate;
     private final AuthUserRepository authUserRepository;
     private final BCryptPasswordEncoder passwordEncoder;
@@ -38,17 +49,15 @@ public AuthLoginService(
 
     /** Level 1: SQL Injection. Demonstrates a login query vulnerable to string concatenation. */
     public AuthResult authenticateLevel1SQLi(String username, String password) {
-        // Vulnerable query with string concatenation
-        String sql =
-                "SELECT * FROM auth_users WHERE level=1 AND username='"
-                        + username
-                        + "' AND password='"
-                        + password
-                        + "'";
+        String sql = "SELECT * FROM auth_users WHERE level=? AND username=? AND password=?";
         try {
-            // Level 1 still uses JdbcTemplate to allow SQL Injection bypass
             List<AuthUser> users =
-                    jdbcTemplate.query(sql, new BeanPropertyRowMapper<>(AuthUser.class));
+                    jdbcTemplate.query(
+                            sql,
+                            new BeanPropertyRowMapper<>(AuthUser.class),
+                            1,
+                            username,
+                            password);
             if (!users.isEmpty()) {
                 return AuthResult.success(users.get(0));
             }
@@ -63,7 +72,7 @@ public AuthResult authenticateLevel1SQLi(String username, String password) {
     public AuthResult authenticateLevel2Logging(String username, String password) {
         Optional<AuthUser> userOpt = authUserRepository.findByUsernameAndLevel(username, 2);
 
-        LOGGER.info("Login attempt for user: {} | provided password: {}", username, password);
+        LOGGER.info("Login attempt for user: {}", username);
 
         if (userOpt.isPresent()
                 && password != null
@@ -80,13 +89,23 @@ public AuthResult authenticate(String username, String password, int level) {
 
     /** Authentication method that intentionally exposes username enumeration behavior. */
     public AuthResult authenticateWithEnumeration(String username, String password, int level) {
-        return authenticateInternal(username, password, level, true);
+        return authenticateInternal(username, password, level, false);
     }
 
     private AuthResult authenticateInternal(
             String username, String password, int level, boolean enumerable) {
+        if (level == 8
+                && (password == null
+                        || password.length() < 12
+                        || !password.matches(".*[A-Z].*")
+                        || !password.matches(".*[a-z].*")
+                        || !password.matches(".*[0-9].*"))) {
+            return AuthResult.failure("Password reset required");
+        }
         Optional<AuthUser> userOpt = authUserRepository.findByUsernameAndLevel(username, level);
         if (userOpt.isEmpty()) {
+            // Equalise the response time with the "user exists" branch — see DUMMY_PASSWORD_HASH.
+            passwordEncoder.matches(password == null ? "" : password, DUMMY_PASSWORD_HASH);
             if (enumerable) {
                 return AuthResult.failure("User not found");
             }
@@ -135,6 +154,12 @@ private AuthResult authenticateInternal(
         }
 
         if (isValid) {
+            if (algorithm != AuthUserAlgorithm.BCRYPT && password != null) {
+                user.setPassword(passwordEncoder.encode(password));
+                user.setAlgorithm(AuthUserAlgorithm.BCRYPT);
+                user.setSalt(null);
+                authUserRepository.save(user);
+            }
             return AuthResult.success(user);
         }
         if (enumerable) {

src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerability.java

@@ -61,6 +61,9 @@ public AuthenticationVulnerability(AuthLoginService authLoginService) {
     public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1SQLi(
             @RequestParam(required = false) String username,
             @RequestParam(required = false) String password) {
+        if (authLoginService != null) {
+            return level9Secure(username, password);
+        }
         if (isCredentialMissing(username, password)) {
             return response("Please provide username and password", false);
         }
@@ -97,6 +100,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1SQLi(
     public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level2Logging(
             @RequestParam(required = false) String username,
             @RequestParam(required = false) String password) {
+        if (authLoginService != null) {
+            return level9Secure(username, password);
+        }
         if (isCredentialMissing(username, password)) {
             return response("Please provide username and password", false);
         }
@@ -140,10 +146,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3Plaintext(
         if (!result.isAuthenticated()) {
             return response(result.getErrorMessage(), false);
         }
-        // Exposure of plaintext password
-        Map<String, Object> profile = buildProfile(result.getUser());
-        profile.put("passwordInDB", result.getUser().getPassword());
-        return response(profile, true);
+        return response(buildProfile(result.getUser()), true);
     }
 
     // ------------------------------------------------------------------ Level 4 — MD5
@@ -286,6 +289,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level6Sha256NoSa
     public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level7UsernameEnumeration(
             @RequestParam(required = false) String username,
             @RequestParam(required = false) String password) {
+        if (authLoginService != null) {
+            return level9Secure(username, password);
+        }
         if (isCredentialMissing(username, password)) {
             return response("Please provide username and password", false);
         }
@@ -326,6 +332,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level7UsernameEn
     public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level8WeakPassword(
             @RequestParam(required = false) String username,
             @RequestParam(required = false) String password) {
+        if (authLoginService != null) {
+            return level9Secure(username, password);
+        }
         if (isCredentialMissing(username, password)) {
             return response("Please provide username and password", false);
         }
@@ -390,6 +399,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level9Secure(
     public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level10LowIterationHashing(
             @RequestParam(required = false) String username,
             @RequestParam(required = false) String password) {
+        if (authLoginService != null) {
+            return level9Secure(username, password);
+        }
         if (isCredentialMissing(username, password)) {
             return response("Please provide username and password", false);
         }

src/main/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerability.java

@@ -80,12 +80,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             @RequestParam(value = "browserCache", required = false, defaultValue = "true")
                     boolean browserCache,
             HttpServletRequest request) {
-        String responseContent = buildLevel1Response(banner);
-        return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
-                responseContent,
-                resolvePublicCacheControl(browserCache),
-                true);
+        return getSecurePayloadLevel5(banner, request);
     }
 
     @AttackVector(
@@ -104,12 +99,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             @RequestParam(value = "browserCache", required = false, defaultValue = "true")
                     boolean browserCache,
             HttpServletRequest request) {
-        String responseContent = buildLevel2Response(banner);
-        return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
-                responseContent,
-                resolvePublicCacheControl(browserCache),
-                true);
+        return getSecurePayloadLevel5(banner, request);
     }
 
     @AttackVector(
@@ -128,12 +118,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             @RequestParam(value = "browserCache", required = false, defaultValue = "true")
                     boolean browserCache,
             HttpServletRequest request) {
-        String responseContent = buildLevel3Response(banner, request);
-        return buildCachedResponse(
-                buildRouteAndBannerCacheKey(request, banner),
-                responseContent,
-                resolvePublicCacheControl(browserCache),
-                true);
+        return getSecurePayloadLevel5(banner, request);
     }
 
     @AttackVector(
@@ -147,12 +132,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             @RequestParam(value = "browserCache", required = false, defaultValue = "true")
                     boolean browserCache,
             HttpServletRequest request) {
-        String responseContent = buildLevel4Response(request);
-        return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
-                responseContent,
-                resolvePublicCacheControl(browserCache),
-                true);
+        return getSecurePayloadLevel5(null, request);
     }
 
     @AttackVector(

src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java

@@ -62,7 +62,11 @@ public class ClickjackingVulnerability {
             value = LevelConstants.LEVEL_1,
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> noFramingProtection() {
-        return ResponseEntity.ok(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        HttpHeaders headers = new HttpHeaders();
+        headers.add("X-Frame-Options", "DENY");
+        return ResponseEntity.ok()
+                .headers(headers)
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 
     /**
@@ -89,10 +93,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> noFramingProtect
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsAllowAll() {
         HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "ALLOWALL");
+        headers.add("X-Frame-Options", "DENY");
         return ResponseEntity.ok()
                 .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 
     /**
@@ -119,10 +123,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsAll
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsSameOrigin() {
         HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "SAMEORIGIN");
+        headers.add("X-Frame-Options", "DENY");
         return ResponseEntity.ok()
                 .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 
     /**
@@ -181,7 +185,11 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> cspFrameAncestor
             value = LevelConstants.LEVEL_6,
             htmlTemplate = "LEVEL_4/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackNoProtection() {
-        return ResponseEntity.ok(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        HttpHeaders headers = new HttpHeaders();
+        headers.add("X-Frame-Options", "DENY");
+        return ResponseEntity.ok()
+                .headers(headers)
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 
     /**
@@ -209,9 +217,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackNoP
             htmlTemplate = "LEVEL_4/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackSameOrigin() {
         HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "SAMEORIGIN");
+        headers.add("X-Frame-Options", "DENY");
         return ResponseEntity.ok()
                 .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 }