drek

Version:

A static-code-analysis tool that can be used to perform security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns.

github.com/chrisallenlane/drek

chrisallenlane/drek

593 lines (571 loc) • 1.21 MB

HTML

<!doctype html> <html> <head> <meta charset='utf-8'> <title>DVWA</title> <link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/Primer/3.0.1/css/primer.css'> <link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/prism/1.6.0/themes/prism-solarizedlight.min.css'> <style> /* colors */ /* highlighter helper function */ /* hide the notification headers by default */ header#no-matches, header#rendering { display: none; } /* applied while vue.js is rendering */ #app[v-cloak] { /* hide sidebar and "matches" space */ /* display a blankslate notification */ } #app[v-cloak] aside, #app[v-cloak] main { display: none; } #app[v-cloak] header#rendering { display: block; } /* applied when no matches are found */ #app.nomatches { /* hide sidebar and "matches" space */ /* display a blankslate notification */ } #app.nomatches aside, #app.nomatches main { display: none; } #app.nomatches header#no-matches { display: block; } /* sidebar */ aside li a[data-severity] { color: silver; } /* sidebar severity filters */ #app.showOk aside a[data-severity=ok] { color: #4078c0; } #app.showOk aside a[data-severity=ok]:hover { background-color: #4078c0; color: white; } #app.showWarn aside a[data-severity=warn] { color: orange; } #app.showWarn aside a[data-severity=warn]:hover { background-color: orange; color: white; } #app.showCritical aside a[data-severity=critical] { color: #bd2c00; } #app.showCritical aside a[data-severity=critical]:hover { background-color: #bd2c00; color: white; } #app.showUnknown aside a[data-severity=unknown] { color: #767676; } #app.showUnknown aside a[data-severity=unknown]:hover { background-color: #767676; color: white; } /* matches */ #app.showOk div.match[data-severity=ok], #app.showWarn div.match[data-severity=warn], #app.showCritical div.match[data-severity=critical], #app.showUnknown div.match[data-severity=unknown] { display: block; } #app main section[data-show='false'] h2 { color: silver; } #app main section[data-show='false'] div.match { display: none !important; /* kludge */ } #app main section a.show-hide { cursor: pointer; float: right; font-size: small; font-weight: normal; } div.match { border-left: 1px solid white; display: none; /* apply background colors by severity */ /* heading */ /* code blocks */ /* user notes */ } div.match:hover { border-left: 1px solid #e5e5e5; } div.match[data-severity=ok] { background-color: #f2f8fa; /* hide code samples and notes for "ok" severity matches */ } div.match[data-severity=ok] code, div.match[data-severity=ok] textarea { display: none; } div.match[data-severity=warn] { background-color: lightyellow; } div.match[data-severity=critical] { background-color: #ffccbd; } div.match span.match-id { float: left; } div.match h3 { color: darkgray; font-family: monospace; font-size: small; font-weight: normal; } div.match h3 span.line-number { color: #55a532; font-weight: bold; } div.match code { padding: 1rem; background-color: #f7f7f7; display: block; overflow-x: scroll; white-space: pre; } div.match code span.line-number { color: #999; padding-right: 1rem; } div.match code span.highlight { background-color: yellow; display: inline-block; min-width: 100%; } div.match textarea { color: #666; border: 1px solid #efefef; margin-top: 0.5rem; width: 100%; } /* match severity buttons */ p.severity { text-align: right; } p.severity a { background-color: white; border: 1px solid #e5e5e5; padding: 2px 10px; } p.severity a:hover { cursor: pointer; text-decoration: none; } p.severity a[data-severity=unknown] { display: none; color: silver; } p.severity a[data-severity=ok] { color: #4078c0; } p.severity a[data-severity=ok]:hover { border: 1px solid #4078c0; background-color: #4078c0; color: white; } p.severity a[data-severity=warn] { color: orange; } p.severity a[data-severity=warn]:hover { border: 1px solid orange; background-color: orange; color: white; } p.severity a[data-severity=critical] { color: #bd2c00; } p.severity a[data-severity=critical]:hover { border: 1px solid #bd2c00; background-color: #bd2c00; color: white; } .match[data-severity=ok] p.severity a[data-severity=ok] { background-color: #4078c0; color: white; border: 1px solid #4078c0; } .match[data-severity=warn] p.severity a[data-severity=warn] { background-color: orange; color: white; border: 1px solid orange; } .match[data-severity=critical] p.severity a[data-severity=critical] { background-color: #bd2c00; color: white; border: 1px solid #bd2c00; } /* print stylesheet */ @media print { /* hide the navigation */ aside { display: none; } /* go full-width */ main.three-fourths.column { margin: 0 auto; width: 100%; } /* hide the "show/hide" links */ section h2 a.show-hide { display: none; } /* hide sections marked as "hidden" */ section[data-show='false'] { display: none; } /* match style */ .match { /* don't break match divs */ /* @BUG: this seems poorly supported in Chrome :( */ break-inside: avoid; /* hide the scrollbars */ /* hide borders */ } .match code { -webkit-print-color-adjust: exact; overflow-x: hidden; } .match textarea { border: none; /* hide textareas that contain no notes */ } .match textarea:placeholder-shown { display: none; } /* hide the "severity" buttons */ .match p.severity a { display: none; border: none; } /* ... except for one serving as a label */ .match[data-severity='ok'] a[data-severity='ok'], .match[data-severity='warn'] a[data-severity='warn'], .match[data-severity='critical'] a[data-severity='critical'], .match[data-severity='unknown'] a[data-severity='unknown'] { -webkit-print-color-adjust: exact; display: inline-block; } /* DO show "ok" matches on the PDF */ .match[data-severity='ok'] code, .match[data-severity='ok'] textarea { display: block !important; /* kludge */ } } </style> </head> <body class='container'> <header class='blankslate blankslate-clean-background'> <h1>DVWA</h1> 20 June 2017, 10:29 AM </header> <div id='app' class='columns' :class='{ nomatches : matches.length === 0, showOk : show.ok, showWarn : show.warn, showCritical : show.critical, showUnknown : show.unknown, }' v-cloak>  <header id='rendering' class='blankslate'> <h2>Rendering...</h2> Large documents may take a moment to render. </header> <header id='no-matches' class='blankslate' v-cloak> <h2>No Matches</h2> The scanned files match no signatures. </header> <aside class='one-fourth column'>  Filetype: <ul class='filter-list mb-5'> <li v-for='pair in filetypes'> <a @click='filterFiletype' :data-filetype='pair[0]' :class='{ selected: filetype === pair[0] }' class='filter-item'> {{ pair[1] }} {{ pair[0] }} </a> </li> </ul> Severity: <ul class='filter-list mb-5'> <li v-for='severity in severities'> <a @click='filterSeverity' :data-severity='severity' class='filter-item active'> {{ severity }} </a> </li> </ul>  <nav class='menu'> Matches <a v-once v-for='search in filteredSearches' :href='"#" + search.search' class='menu-item'> <code>{{ search.search }}</code> {{ search.count }} </a> </nav> </aside> <main class='three-fourths column'>  <section v-for='group in groups' data-show='true'> <a :name='group[0]'></a> <h2 class='border-bottom p-3'>{{ group[0] }} <a class='show-hide' @click='hideSection'>Hide</a> </h2>  <matches v-for='match in group[1]' :key='match.id' :match='match' v-on:annotate='save' v-on:severity='save' ></matches> </section> </main> </div>  <template id='match'> <div class='match p-3' :data-severity='match.severity'> ID: {{ match.id }} <a data-severity='unknown'>unknown</a> <a data-severity='ok' @click='severity("ok")'>ok</a> <a data-severity='warn' @click='severity("warn")'>warn</a> <a data-severity='critical' @click='severity("critical")'>critical</a> <h3>{{ match.file }}:{{ match.line }}</h3> <code v-html='match.match'></code> <textarea placeholder='Notes' v-model='match.note' v-on:change='annotate()'>{{ match.note }}</textarea> </div> </template> <script type='text/javascript' src='https://cdnjs.cloudflare.com/ajax/libs/vue/2.2.4/vue.min.js'></script> <script type='text/javascript' src='https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.4/lodash.min.js'></script> <script type='text/javascript'> var filetype = 'all'; var filetypes = [ [ "all", 311 ], [ "js", 1 ], [ "php", 310 ] ]; var matches = [ { "id": 37, "file": "/home/chris/src/DVWA-master/dvwa/js/dvwaPage.js", "filetype": "js", "search": "\\seval\\s*\\(", "match": "1: /* Help popup */\n2: \n3: function popUp(URL) {\n4: \tday = new Date();\n5: \tid = day.getTime();\n6: \teval(\"page\" + id + \" = window.open(URL, '\" + id + \"', 'toolbar=0,scrollbars=1,location=0,statusbar=0,menubar=0,resizable=1,width=500,height=300,left = 540,top = 250');\");\n7: }\n8: \n9: /* Form validation */\n10: \n11: function validate_required(field,alerttxt)", "line": 6, "start": 1, "end": 12, "severity": "unknown", "note": "" }, { "id": 14, "file": "/home/chris/src/DVWA-master/dvwa/includes/dvwaPage.inc.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "16: \t$html = \"\";\n17: }\n18: \n19: // Valid security levels\n20: $security_levels = array('low', 'medium', 'high', 'impossible');\n21: if( !isset( $_COOKIE[ 'security' ] ) || !in_array( $_COOKIE[ 'security' ], $security_levels ) ) {\n22: \t// Set security cookie to impossible if no cookie exists\n23: \tif( in_array( $_DVWA[ 'default_security_level' ], $security_levels) ) {\n24: \t\tdvwaSecurityLevelSet( $_DVWA[ 'default_security_level' ] );\n25: \t}\n26: \telse {", "line": 21, "start": 16, "end": 27, "severity": "unknown", "note": "" }, { "id": 15, "file": "/home/chris/src/DVWA-master/dvwa/includes/dvwaPage.inc.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "127: \treturn $returnArray;\n128: }\n129: \n130: \n131: function dvwaSecurityLevelGet() {\n132: \treturn isset( $_COOKIE[ 'security' ] ) ? $_COOKIE[ 'security' ] : 'impossible';\n133: }\n134: \n135: \n136: function dvwaSecurityLevelSet( $pSecurityLevel ) {\n137: \tif( $pSecurityLevel == 'impossible' ) {", "line": 132, "start": 127, "end": 138, "severity": "unknown", "note": "" }, { "id": 31, "file": "/home/chris/src/DVWA-master/dvwa/includes/dvwaPhpIds.inc.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "60: \t\t*/\n61: \t\t$request = array(\n62: \t\t\t'REQUEST' => $_REQUEST,\n63: \t\t\t'GET' => $_GET,\n64: \t\t\t'POST' => $_POST,\n65: \t\t\t'COOKIE' => $_COOKIE\n66: \t\t);\n67: \n68: \t\t$init = IDS_Init::init( DVWA_WEB_PAGE_TO_PHPIDS . 'lib/IDS/Config/Config.ini' );\n69: \n70: \t\t$init->config[ 'General' ][ 'base_path' ] = DVWA_WEB_PAGE_TO_PHPIDS . 'lib/IDS/';", "line": 65, "start": 60, "end": 71, "severity": "unknown", "note": "" }, { "id": 62, "file": "/home/chris/src/DVWA-master/vulnerabilities/brute/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'brute';\n13: dvwaDatabaseConnect();\n14: \n15: $method = 'GET';\n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 90, "file": "/home/chris/src/DVWA-master/vulnerabilities/captcha/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "13: $page[ 'source_button' ] = 'captcha';\n14: \n15: dvwaDatabaseConnect();\n16: \n17: $vulnerabilityFile = '';\n18: switch( $_COOKIE[ 'security' ] ) {\n19: \tcase 'low':\n20: \t\t$vulnerabilityFile = 'low.php';\n21: \t\tbreak;\n22: \tcase 'medium':\n23: \t\t$vulnerabilityFile = 'medium.php';", "line": 18, "start": 13, "end": 24, "severity": "unknown", "note": "" }, { "id": 141, "file": "/home/chris/src/DVWA-master/vulnerabilities/csrf/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'csrf';\n13: \n14: dvwaDatabaseConnect();\n15: \n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 172, "file": "/home/chris/src/DVWA-master/vulnerabilities/exec/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'exec';\n13: \n14: dvwaDatabaseConnect();\n15: \n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 198, "file": "/home/chris/src/DVWA-master/vulnerabilities/fi/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'fi';\n13: \n14: dvwaDatabaseConnect();\n15: \n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 235, "file": "/home/chris/src/DVWA-master/vulnerabilities/sqli/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "13: \n14: dvwaDatabaseConnect();\n15: \n16: $method = 'GET';\n17: $vulnerabilityFile = '';\n18: switch( $_COOKIE[ 'security' ] ) {\n19: \tcase 'low':\n20: \t\t$vulnerabilityFile = 'low.php';\n21: \t\tbreak;\n22: \tcase 'medium':\n23: \t\t$vulnerabilityFile = 'medium.php';", "line": 18, "start": 13, "end": 24, "severity": "unknown", "note": "" }, { "id": 213, "file": "/home/chris/src/DVWA-master/vulnerabilities/sqli_blind/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "13: \n14: dvwaDatabaseConnect();\n15: \n16: $method = 'GET';\n17: $vulnerabilityFile = '';\n18: switch( $_COOKIE[ 'security' ] ) {\n19: \tcase 'low':\n20: \t\t$vulnerabilityFile = 'low.php';\n21: \t\tbreak;\n22: \tcase 'medium':\n23: \t\t$vulnerabilityFile = 'medium.php';", "line": 18, "start": 13, "end": 24, "severity": "unknown", "note": "" }, { "id": 214, "file": "/home/chris/src/DVWA-master/vulnerabilities/sqli_blind/source/high.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "1: <?php\n2: \n3: if( isset( $_COOKIE[ 'id' ] ) ) {\n4: \t// Get input\n5: \t$id = $_COOKIE[ 'id' ];\n6: \n7: \t// Check database\n8: \t$getid = \"SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;\";", "line": 3, "start": 1, "end": 9, "severity": "unknown", "note": "" }, { "id": 215, "file": "/home/chris/src/DVWA-master/vulnerabilities/sqli_blind/source/high.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "1: <?php\n2: \n3: if( isset( $_COOKIE[ 'id' ] ) ) {\n4: \t// Get input\n5: \t$id = $_COOKIE[ 'id' ];\n6: \n7: \t// Check database\n8: \t$getid = \"SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;\";\n9: \t$result = mysqli_query($GLOBALS[\"___mysqli_ston\"], $getid ); // Removed 'or die' to suppress mysql errors\n10: ", "line": 5, "start": 1, "end": 11, "severity": "unknown", "note": "" }, { "id": 251, "file": "/home/chris/src/DVWA-master/vulnerabilities/upload/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'upload';\n13: \n14: dvwaDatabaseConnect();\n15: \n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 282, "file": "/home/chris/src/DVWA-master/vulnerabilities/xss_r/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'xss_r';\n13: \n14: dvwaDatabaseConnect();\n15: \n16: $vulnerabilityFile = '';\n17: switch( $_COOKIE[ 'security' ] ) {\n18: \tcase 'low':\n19: \t\t$vulnerabilityFile = 'low.php';\n20: \t\tbreak;\n21: \tcase 'medium':\n22: \t\t$vulnerabilityFile = 'medium.php';", "line": 17, "start": 12, "end": 23, "severity": "unknown", "note": "" }, { "id": 293, "file": "/home/chris/src/DVWA-master/vulnerabilities/xss_s/index.php", "filetype": "php", "search": "\\s\\$_COOKIE", "match": "12: $page[ 'source_button' ] = 'xss_s';\n13: \n14: dvwaDatabaseConnect();\n15: \n16:</span