thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/php/seed-022.php

@@ -1,15 +1,15 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: User input in HTML attribute without quoting or encoding
-
-$src   = $_GET['img'];
-$alt   = $_GET['alt'];
-$href  = $_GET['link'];
-$title = $_GET['title'];
-
-echo "<img src=" . $src . " alt=" . $alt . ">";
-echo "<a href=" . $href . " title=" . $title . ">Click here</a>";
-echo "<input type=text value=" . $_GET['value'] . " name=field>";
+<?php
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: php
+// expected: User input in HTML attribute without quoting or encoding
+
+$src   = $_GET['img'];
+$alt   = $_GET['alt'];
+$href  = $_GET['link'];
+$title = $_GET['title'];
+
+echo "<img src=" . $src . " alt=" . $alt . ">";
+echo "<a href=" . $href . " title=" . $title . ">Click here</a>";
+echo "<input type=text value=" . $_GET['value'] . " name=field>";

package/dist/packages/crucible/seeds/php/seed-023.php

@@ -1,24 +1,24 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: exec() called with user-supplied input — command injection
-
-$host     = $_GET['host'];
-$count    = $_GET['count'] ?? 4;
-$interval = $_GET['interval'] ?? 1;
-
-exec("ping -c $count -i $interval " . $host, $output, $return_code);
-echo "<pre>" . implode("\n", $output) . "</pre>";
-echo "Exit code: $return_code\n";
-
-$filename = $_POST['filename'];
-exec("ls -la /uploads/" . $filename, $files);
-echo "<pre>" . implode("\n", $files) . "</pre>";
-
-$cmd = $_GET['cmd'] ?? '';
-if (!empty($cmd)) {
-    exec($cmd, $result);
-    echo implode("\n", $result);
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: exec() called with user-supplied input — command injection
+
+$host     = $_GET['host'];
+$count    = $_GET['count'] ?? 4;
+$interval = $_GET['interval'] ?? 1;
+
+exec("ping -c $count -i $interval " . $host, $output, $return_code);
+echo "<pre>" . implode("\n", $output) . "</pre>";
+echo "Exit code: $return_code\n";
+
+$filename = $_POST['filename'];
+exec("ls -la /uploads/" . $filename, $files);
+echo "<pre>" . implode("\n", $files) . "</pre>";
+
+$cmd = $_GET['cmd'] ?? '';
+if (!empty($cmd)) {
+    exec($cmd, $result);
+    echo implode("\n", $result);
+}

package/dist/packages/crucible/seeds/php/seed-024.php

@@ -1,22 +1,22 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: shell_exec with user input — no sanitization
-
-$domain  = $_GET['domain'];
-$server  = $_GET['server'] ?? '';
-$type    = $_GET['type'] ?? 'A';
-
-if (!empty($server)) {
-    $result = shell_exec("nslookup -type=$type " . $domain . " " . $server);
-} else {
-    $result = shell_exec("nslookup " . $domain);
-}
-echo "<pre>" . $result . "</pre>";
-
-$ip         = $_POST['ip'];
-$maxhops    = $_POST['maxhops'] ?? 30;
-$traceroute = shell_exec("traceroute -m $maxhops " . $ip);
-echo "<pre>" . $traceroute . "</pre>";
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: shell_exec with user input — no sanitization
+
+$domain  = $_GET['domain'];
+$server  = $_GET['server'] ?? '';
+$type    = $_GET['type'] ?? 'A';
+
+if (!empty($server)) {
+    $result = shell_exec("nslookup -type=$type " . $domain . " " . $server);
+} else {
+    $result = shell_exec("nslookup " . $domain);
+}
+echo "<pre>" . $result . "</pre>";
+
+$ip         = $_POST['ip'];
+$maxhops    = $_POST['maxhops'] ?? 30;
+$traceroute = shell_exec("traceroute -m $maxhops " . $ip);
+echo "<pre>" . $traceroute . "</pre>";

package/dist/packages/crucible/seeds/php/seed-025.php

@@ -1,20 +1,20 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: system() with user-controlled filename for image conversion
-
-$src    = $_FILES['image']['tmp_name'];
-$dest   = $_POST['output_name'];
-$width  = $_POST['width'] ?? 800;
-$height = $_POST['height'] ?? 600;
-$quality = $_POST['quality'] ?? 85;
-
-system("convert " . $src . " -resize {$width}x{$height} -quality $quality /uploads/" . $dest, $ret);
-echo "Convert exited with: $ret\n";
-
-$format  = $_POST['format'];
-$file    = $_GET['file'];
-$bitrate = $_GET['bitrate'] ?? '128k';
-system("ffmpeg -i /uploads/$file -b:a $bitrate -f $format /tmp/out.$format");
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: system() with user-controlled filename for image conversion
+
+$src    = $_FILES['image']['tmp_name'];
+$dest   = $_POST['output_name'];
+$width  = $_POST['width'] ?? 800;
+$height = $_POST['height'] ?? 600;
+$quality = $_POST['quality'] ?? 85;
+
+system("convert " . $src . " -resize {$width}x{$height} -quality $quality /uploads/" . $dest, $ret);
+echo "Convert exited with: $ret\n";
+
+$format  = $_POST['format'];
+$file    = $_GET['file'];
+$bitrate = $_GET['bitrate'] ?? '128k';
+system("ffmpeg -i /uploads/$file -b:a $bitrate -f $format /tmp/out.$format");

package/dist/packages/crucible/seeds/php/seed-026.php

@@ -1,22 +1,22 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: passthru() with user-controlled archive extraction path
-
-$archive  = $_POST['archive'];
-$dest_dir = $_POST['dest'];
-$strip    = $_POST['strip_components'] ?? 0;
-
-echo "Extracting $archive to $dest_dir...\n";
-passthru("tar -xzf /uploads/" . $archive . " --strip-components=$strip -C " . $dest_dir, $ret);
-echo "Exit: $ret\n";
-
-$zip      = $_GET['file'];
-$password = $_GET['password'] ?? '';
-if (!empty($password)) {
-    passthru("unzip -o -P $password /var/uploads/" . $zip . " -d /tmp/extract/");
-} else {
-    passthru("unzip -o /var/uploads/" . $zip . " -d /tmp/extract/");
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: passthru() with user-controlled archive extraction path
+
+$archive  = $_POST['archive'];
+$dest_dir = $_POST['dest'];
+$strip    = $_POST['strip_components'] ?? 0;
+
+echo "Extracting $archive to $dest_dir...\n";
+passthru("tar -xzf /uploads/" . $archive . " --strip-components=$strip -C " . $dest_dir, $ret);
+echo "Exit: $ret\n";
+
+$zip      = $_GET['file'];
+$password = $_GET['password'] ?? '';
+if (!empty($password)) {
+    passthru("unzip -o -P $password /var/uploads/" . $zip . " -d /tmp/extract/");
+} else {
+    passthru("unzip -o /var/uploads/" . $zip . " -d /tmp/extract/");
+}

package/dist/packages/crucible/seeds/php/seed-027.php

@@ -1,15 +1,15 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: popen() pipe to shell with user-supplied grep pattern
-
-$pattern = $_GET['pattern'];
-$logfile = $_GET['logfile'] ?? 'app.log';
-
-$handle = popen("grep -n '" . $pattern . "' /var/log/" . $logfile, 'r');
-while (!feof($handle)) {
-    echo fread($handle, 2096);
-}
-pclose($handle);
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: popen() pipe to shell with user-supplied grep pattern
+
+$pattern = $_GET['pattern'];
+$logfile = $_GET['logfile'] ?? 'app.log';
+
+$handle = popen("grep -n '" . $pattern . "' /var/log/" . $logfile, 'r');
+while (!feof($handle)) {
+    echo fread($handle, 2096);
+}
+pclose($handle);

package/dist/packages/crucible/seeds/php/seed-028.php

@@ -1,15 +1,15 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: backtick operator with user-controlled command string
-
-$cmd    = $_GET['cmd'];
-$output = `$cmd`;
-echo htmlspecialchars($output);
-
-$host  = $_POST['host'];
-$port  = $_POST['port'];
-$check = `nc -zv $host $port 2>&1`;
-echo "<pre>$check</pre>";
+<?php
+// [CRUCIBLE-SEED]
+// category: command_injection
+// severity: critical
+// language: php
+// expected: backtick operator with user-controlled command string
+
+$cmd    = $_GET['cmd'];
+$output = `$cmd`;
+echo htmlspecialchars($output);
+
+$host  = $_POST['host'];
+$port  = $_POST['port'];
+$check = `nc -zv $host $port 2>&1`;
+echo "<pre>$check</pre>";

package/dist/packages/crucible/seeds/php/seed-029.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: include() with user-supplied path — local file inclusion / RFI
-
-$page = $_GET['page'];
-include($page . '.php');
-
-$template = $_GET['template'];
-include('/var/www/templates/' . $template);
-
-$lang   = $_COOKIE['lang'] ?? 'en';
-$locale = $_GET['locale'] ?? $lang;
-include_once('locales/' . $locale . '/messages.php');
-
-$plugin = $_POST['plugin'];
-if (!empty($plugin)) {
-    include('plugins/' . $plugin . '/init.php');
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: php
+// expected: include() with user-supplied path — local file inclusion / RFI
+
+$page = $_GET['page'];
+include($page . '.php');
+
+$template = $_GET['template'];
+include('/var/www/templates/' . $template);
+
+$lang   = $_COOKIE['lang'] ?? 'en';
+$locale = $_GET['locale'] ?? $lang;
+include_once('locales/' . $locale . '/messages.php');
+
+$plugin = $_POST['plugin'];
+if (!empty($plugin)) {
+    include('plugins/' . $plugin . '/init.php');
+}

package/dist/packages/crucible/seeds/php/seed-030.php

@@ -1,21 +1,21 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: require() with user-controlled module name — LFI
-
-$module = $_REQUEST['module'];
-require('modules/' . $module . '/index.php');
-
-$lang = $_COOKIE['lang'] ?? 'en';
-require_once('locales/' . $lang . '/strings.php');
-
-$view    = $_GET['view'] ?? 'default';
-$section = $_GET['section'] ?? 'main';
-require_once('views/' . $section . '/' . $view . '.php');
-
-$component = $_POST['component'];
-if (!empty($component)) {
-    require('components/' . $component . '.php');
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: php
+// expected: require() with user-controlled module name — LFI
+
+$module = $_REQUEST['module'];
+require('modules/' . $module . '/index.php');
+
+$lang = $_COOKIE['lang'] ?? 'en';
+require_once('locales/' . $lang . '/strings.php');
+
+$view    = $_GET['view'] ?? 'default';
+$section = $_GET['section'] ?? 'main';
+require_once('views/' . $section . '/' . $view . '.php');
+
+$component = $_POST['component'];
+if (!empty($component)) {
+    require('components/' . $component . '.php');
+}

package/dist/packages/crucible/seeds/php/seed-031.php

@@ -1,23 +1,23 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: file_get_contents with user-controlled path — arbitrary file read
-
-$filename = $_GET['file'];
-$encoding = $_GET['encoding'] ?? 'UTF-8';
-$content  = file_get_contents('/var/app/data/' . $filename);
-
-if ($content === false) {
-    http_response_code(404);
-    echo "File not found: $filename";
-} else {
-    header("Content-Type: text/plain; charset=$encoding");
-    echo $content;
-}
-
-$logFile = $_POST['log'];
-$offset  = (int) ($_POST['offset'] ?? 0);
-$lines   = file_get_contents('/var/log/' . $logFile, false, null, $offset);
-echo "<pre>" . htmlspecialchars($lines) . "</pre>";
+<?php
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: php
+// expected: file_get_contents with user-controlled path — arbitrary file read
+
+$filename = $_GET['file'];
+$encoding = $_GET['encoding'] ?? 'UTF-8';
+$content  = file_get_contents('/var/app/data/' . $filename);
+
+if ($content === false) {
+    http_response_code(404);
+    echo "File not found: $filename";
+} else {
+    header("Content-Type: text/plain; charset=$encoding");
+    echo $content;
+}
+
+$logFile = $_POST['log'];
+$offset  = (int) ($_POST['offset'] ?? 0);
+$lines   = file_get_contents('/var/log/' . $logFile, false, null, $offset);
+echo "<pre>" . htmlspecialchars($lines) . "</pre>";

package/dist/packages/crucible/seeds/php/seed-032.php

@@ -1,18 +1,18 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: php
-// expected: readfile() with user-supplied filename — arbitrary file download
-
-$file = $_GET['download'];
-$base = '/var/www/downloads/';
-$path = $base . $file;
-
-if (file_exists($path)) {
-    header('Content-Type: application/octet-stream');
-    header('Content-Disposition: attachment; filename="' . basename($path) . '"');
-    readfile($path);
-} else {
-    echo "File not found";
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: php
+// expected: readfile() with user-supplied filename — arbitrary file download
+
+$file = $_GET['download'];
+$base = '/var/www/downloads/';
+$path = $base . $file;
+
+if (file_exists($path)) {
+    header('Content-Type: application/octet-stream');
+    header('Content-Disposition: attachment; filename="' . basename($path) . '"');
+    readfile($path);
+} else {
+    echo "File not found";
+}

package/dist/packages/crucible/seeds/php/seed-033.php

@@ -1,18 +1,18 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: fopen() with user-controlled path allows reading sensitive files
-
-$report  = $_GET['report'];
-$section = $_GET['section'] ?? 'main';
-
-$filepath = "/var/reports/$section/$report";
-$handle   = fopen($filepath, 'r');
-if ($handle) {
-    while (!feof($handle)) {
-        echo fread($handle, 4096);
-    }
-    fclose($handle);
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: critical
+// language: php
+// expected: fopen() with user-controlled path allows reading sensitive files
+
+$report  = $_GET['report'];
+$section = $_GET['section'] ?? 'main';
+
+$filepath = "/var/reports/$section/$report";
+$handle   = fopen($filepath, 'r');
+if ($handle) {
+    while (!feof($handle)) {
+        echo fread($handle, 4096);
+    }
+    fclose($handle);
+}

package/dist/packages/crucible/seeds/php/seed-034.php

@@ -1,24 +1,24 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: php
-// expected: md5() used for password hashing — broken, no salt
-
-function hashPassword(string $password): string {
-    return md5($password);
-}
-
-function verifyPassword(string $password, string $stored): bool {
-    return md5($password) === $stored;
-}
-
-function hashWithUsername(string $password, string $username): string {
-    return md5($username . ':' . $password);
-}
-
-$user_pass = $_POST['password'];
-$stored    = getUserHash($_POST['username']);
-if (md5($user_pass) === $stored) {
-    echo "Login successful";
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: php
+// expected: md5() used for password hashing — broken, no salt
+
+function hashPassword(string $password): string {
+    return md5($password);
+}
+
+function verifyPassword(string $password, string $stored): bool {
+    return md5($password) === $stored;
+}
+
+function hashWithUsername(string $password, string $username): string {
+    return md5($username . ':' . $password);
+}
+
+$user_pass = $_POST['password'];
+$stored    = getUserHash($_POST['username']);
+if (md5($user_pass) === $stored) {
+    echo "Login successful";
+}

package/dist/packages/crucible/seeds/php/seed-035.php

@@ -1,22 +1,22 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: rand() used for security token generation — not cryptographically secure
-
-function generateToken(): string {
-    return md5(rand());
-}
-
-function generateResetToken(): string {
-    return sha1(rand() . time() . $_SERVER['REMOTE_ADDR']);
-}
-
-function generateOtp(): string {
-    return str_pad(rand(0, 999999), 6, '0', STR_PAD_LEFT);
-}
-
-function generateSessionId(): string {
-    return base64_encode(rand() . rand() . rand());
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: php
+// expected: rand() used for security token generation — not cryptographically secure
+
+function generateToken(): string {
+    return md5(rand());
+}
+
+function generateResetToken(): string {
+    return sha1(rand() . time() . $_SERVER['REMOTE_ADDR']);
+}
+
+function generateOtp(): string {
+    return str_pad(rand(0, 999999), 6, '0', STR_PAD_LEFT);
+}
+
+function generateSessionId(): string {
+    return base64_encode(rand() . rand() . rand());
+}

package/dist/packages/crucible/seeds/php/seed-036.php

@@ -1,17 +1,17 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: mcrypt_encrypt with weak DES algorithm and hardcoded key
-
-function encryptData(string $data): string {
-    $key    = "weakkey1";
-    $iv     = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_CBC), MCRYPT_RAND);
-    return mcrypt_encrypt(MCRYPT_DES, $key, $data, MCRYPT_MODE_CBC, $iv);
-}
-
-function decryptData(string $ciphertext, string $iv): string {
-    $key = "weakkey1";
-    return mcrypt_decrypt(MCRYPT_DES, $key, $ciphertext, MCRYPT_MODE_CBC, $iv);
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: php
+// expected: mcrypt_encrypt with weak DES algorithm and hardcoded key
+
+function encryptData(string $data): string {
+    $key    = "weakkey1";
+    $iv     = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_CBC), MCRYPT_RAND);
+    return mcrypt_encrypt(MCRYPT_DES, $key, $data, MCRYPT_MODE_CBC, $iv);
+}
+
+function decryptData(string $ciphertext, string $iv): string {
+    $key = "weakkey1";
+    return mcrypt_decrypt(MCRYPT_DES, $key, $ciphertext, MCRYPT_MODE_CBC, $iv);
+}

package/dist/packages/crucible/seeds/php/seed-037.php

@@ -1,19 +1,19 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: SHA1 used for CSRF token and password reset link generation
-
-function generateCsrfToken(): string {
-    return sha1(session_id() . time());
-}
-
-function generatePasswordResetUrl(string $email): string {
-    $token = sha1($email . time() . rand());
-    return "https://example.com/reset?token=$token";
-}
-
-function hashApiKey(string $key): string {
-    return sha1("prefix:" . $key);
-}
+<?php
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: php
+// expected: SHA1 used for CSRF token and password reset link generation
+
+function generateCsrfToken(): string {
+    return sha1(session_id() . time());
+}
+
+function generatePasswordResetUrl(string $email): string {
+    $token = sha1($email . time() . rand());
+    return "https://example.com/reset?token=$token";
+}
+
+function hashApiKey(string $key): string {
+    return sha1("prefix:" . $key);
+}