thuban 0.4.9 → 0.4.11

package/packages/crucible/seeds/php/seed-013.php

@@ -1,23 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: php
-// expected: SQL built from multiple GET parameters concatenated directly
-
-$id        = $_GET['id'];
-$category  = $_GET['category'];
-$published = $_GET['published'];
-
-$query = "SELECT title, body, author FROM articles
-          WHERE id = $id
-          AND category = '$category'
-          AND published = $published";
-
-$conn   = getDbConnection();
-$result = mysqli_query($conn, $query);
-
-while ($row = mysqli_fetch_assoc($result)) {
-    echo "<h2>" . $row['title'] . "</h2>";
-    echo "<p>"  . $row['body']  . "</p>";
-}

package/packages/crucible/seeds/php/seed-014.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: php
-// expected: Table name from user input used in raw SQL query
-
-function queryTable(string $table, string $where): array {
-    $conn = getDbConnection();
-    $sql = "SELECT * FROM $table WHERE $where LIMIT 100";
-    $result = mysqli_query($conn, $sql);
-    return mysqli_fetch_all($result, MYSQLI_ASSOC);
-}
-
-function countRows(string $tableName, string $condition): int {
-    $conn = getDbConnection();
-    $result = mysqli_query($conn, "SELECT COUNT(*) as cnt FROM $tableName WHERE $condition");
-    $row = mysqli_fetch_assoc($result);
-    return (int) $row['cnt'];
-}

package/packages/crucible/seeds/php/seed-015.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: php
-// expected: Login form vulnerable to SQL injection via username field
-
-function authenticateUser(string $username, string $password): ?array {
-    $conn = getDbConnection();
-    $hashed = md5($password);
-    $query = "SELECT * FROM users
-              WHERE username = '$username'
-              AND password = '$hashed'
-              AND active = 1
-              LIMIT 1";
-    $result = mysqli_query($conn, $query);
-    return mysqli_fetch_assoc($result) ?: null;
-}

package/packages/crucible/seeds/php/seed-016.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: echo $_GET without htmlspecialchars — reflected XSS
-
-$name  = $_GET['name'];
-$query = $_GET['q'];
-$page  = $_GET['page'] ?? 1;
-$sort  = $_GET['sort'] ?? 'relevance';
-
-echo "<h1>Hello, " . $name . "!</h1>";
-echo "<p>You searched for: " . $query . "</p>";
-echo "<meta name='description' content='" . $query . "'>";
-echo "<p>Showing page " . $page . " sorted by " . $sort . "</p>";
-echo "<input type='hidden' name='last_query' value='" . $query . "'>";
-echo "<script>var searchQuery = '" . $query . "';</script>";

package/packages/crucible/seeds/php/seed-017.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: $_POST values echoed directly into HTML form — stored XSS vector
-
-$comment  = $_POST['comment'] ?? '';
-$username = $_POST['username'] ?? '';
-
-// Save to DB then render...
-echo "<div class='comment'>";
-echo "  <strong>" . $username . "</strong>";
-echo "  <p>" . $comment . "</p>";
-echo "</div>";
-
-echo "<input type='hidden' name='user' value='" . $username . "'>";
-echo "<script>var user = '" . $username . "';</script>";

package/packages/crucible/seeds/php/seed-018.php

@@ -1,17 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: print_r or var_dump of user input rendered in HTML context
-
-$data = $_REQUEST['debug'];
-echo "<pre>";
-print_r($data);
-echo "</pre>";
-
-$error = $_GET['error'];
-echo "<div class='error'>" . $error . "</div>";
-
-$redirect = $_GET['next'];
-echo "<a href='" . $redirect . "'>Continue</a>";

package/packages/crucible/seeds/php/seed-019.php

@@ -1,24 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: php
-// expected: JSON-encoded user input in JavaScript block — breaks out of string context
-
-$username = $_GET['user'];
-$profile  = $_GET['bio'];
-?>
-<html>
-<head><title>Profile</title></head>
-<body>
-<h1><?= $username ?></h1>
-<p><?= $profile ?></p>
-<script>
-    var userData = {
-        name: "<?= $username ?>",
-        bio: "<?= $profile ?>"
-    };
-    console.log(userData);
-</script>
-</body>
-</html>

package/packages/crucible/seeds/php/seed-020.php

@@ -1,19 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: header Location redirect with user input reflected in HTML fallback
-
-$url = $_GET['url'] ?? '/';
-header("Refresh: 0; url=" . $url);
-
-$message = $_GET['msg'];
-?>
-<!DOCTYPE html>
-<html>
-<body>
-<p>Redirecting to: <a href="<?= $url ?>"><?= $url ?></a></p>
-<div class="flash"><?= $message ?></div>
-</body>
-</html>

package/packages/crucible/seeds/php/seed-021.php

@@ -1,22 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: User-controlled CSS class or style injected into page template
-
-$theme  = $_GET['theme'];
-$color  = $_GET['color'];
-$font   = $_GET['font'];
-?>
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-    body { background-color: <?= $color ?>; font-family: <?= $font ?>; }
-</style>
-</head>
-<body class="theme-<?= $theme ?>">
-    <p style="color: <?= $color ?>">Welcome!</p>
-</body>
-</html>

package/packages/crucible/seeds/php/seed-022.php

@@ -1,15 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: php
-// expected: User input in HTML attribute without quoting or encoding
-
-$src   = $_GET['img'];
-$alt   = $_GET['alt'];
-$href  = $_GET['link'];
-$title = $_GET['title'];
-
-echo "<img src=" . $src . " alt=" . $alt . ">";
-echo "<a href=" . $href . " title=" . $title . ">Click here</a>";
-echo "<input type=text value=" . $_GET['value'] . " name=field>";

package/packages/crucible/seeds/php/seed-023.php

@@ -1,24 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: exec() called with user-supplied input — command injection
-
-$host     = $_GET['host'];
-$count    = $_GET['count'] ?? 4;
-$interval = $_GET['interval'] ?? 1;
-
-exec("ping -c $count -i $interval " . $host, $output, $return_code);
-echo "<pre>" . implode("\n", $output) . "</pre>";
-echo "Exit code: $return_code\n";
-
-$filename = $_POST['filename'];
-exec("ls -la /uploads/" . $filename, $files);
-echo "<pre>" . implode("\n", $files) . "</pre>";
-
-$cmd = $_GET['cmd'] ?? '';
-if (!empty($cmd)) {
-    exec($cmd, $result);
-    echo implode("\n", $result);
-}

package/packages/crucible/seeds/php/seed-024.php

@@ -1,22 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: shell_exec with user input — no sanitization
-
-$domain  = $_GET['domain'];
-$server  = $_GET['server'] ?? '';
-$type    = $_GET['type'] ?? 'A';
-
-if (!empty($server)) {
-    $result = shell_exec("nslookup -type=$type " . $domain . " " . $server);
-} else {
-    $result = shell_exec("nslookup " . $domain);
-}
-echo "<pre>" . $result . "</pre>";
-
-$ip         = $_POST['ip'];
-$maxhops    = $_POST['maxhops'] ?? 30;
-$traceroute = shell_exec("traceroute -m $maxhops " . $ip);
-echo "<pre>" . $traceroute . "</pre>";

package/packages/crucible/seeds/php/seed-025.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: system() with user-controlled filename for image conversion
-
-$src    = $_FILES['image']['tmp_name'];
-$dest   = $_POST['output_name'];
-$width  = $_POST['width'] ?? 800;
-$height = $_POST['height'] ?? 600;
-$quality = $_POST['quality'] ?? 85;
-
-system("convert " . $src . " -resize {$width}x{$height} -quality $quality /uploads/" . $dest, $ret);
-echo "Convert exited with: $ret\n";
-
-$format  = $_POST['format'];
-$file    = $_GET['file'];
-$bitrate = $_GET['bitrate'] ?? '128k';
-system("ffmpeg -i /uploads/$file -b:a $bitrate -f $format /tmp/out.$format");

package/packages/crucible/seeds/php/seed-026.php

@@ -1,22 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: passthru() with user-controlled archive extraction path
-
-$archive  = $_POST['archive'];
-$dest_dir = $_POST['dest'];
-$strip    = $_POST['strip_components'] ?? 0;
-
-echo "Extracting $archive to $dest_dir...\n";
-passthru("tar -xzf /uploads/" . $archive . " --strip-components=$strip -C " . $dest_dir, $ret);
-echo "Exit: $ret\n";
-
-$zip      = $_GET['file'];
-$password = $_GET['password'] ?? '';
-if (!empty($password)) {
-    passthru("unzip -o -P $password /var/uploads/" . $zip . " -d /tmp/extract/");
-} else {
-    passthru("unzip -o /var/uploads/" . $zip . " -d /tmp/extract/");
-}

package/packages/crucible/seeds/php/seed-027.php

@@ -1,15 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: popen() pipe to shell with user-supplied grep pattern
-
-$pattern = $_GET['pattern'];
-$logfile = $_GET['logfile'] ?? 'app.log';
-
-$handle = popen("grep -n '" . $pattern . "' /var/log/" . $logfile, 'r');
-while (!feof($handle)) {
-    echo fread($handle, 2096);
-}
-pclose($handle);

package/packages/crucible/seeds/php/seed-028.php

@@ -1,15 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: command_injection
-// severity: critical
-// language: php
-// expected: backtick operator with user-controlled command string
-
-$cmd    = $_GET['cmd'];
-$output = `$cmd`;
-echo htmlspecialchars($output);
-
-$host  = $_POST['host'];
-$port  = $_POST['port'];
-$check = `nc -zv $host $port 2>&1`;
-echo "<pre>$check</pre>";

package/packages/crucible/seeds/php/seed-029.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: include() with user-supplied path — local file inclusion / RFI
-
-$page = $_GET['page'];
-include($page . '.php');
-
-$template = $_GET['template'];
-include('/var/www/templates/' . $template);
-
-$lang   = $_COOKIE['lang'] ?? 'en';
-$locale = $_GET['locale'] ?? $lang;
-include_once('locales/' . $locale . '/messages.php');
-
-$plugin = $_POST['plugin'];
-if (!empty($plugin)) {
-    include('plugins/' . $plugin . '/init.php');
-}

package/packages/crucible/seeds/php/seed-030.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: require() with user-controlled module name — LFI
-
-$module = $_REQUEST['module'];
-require('modules/' . $module . '/index.php');
-
-$lang = $_COOKIE['lang'] ?? 'en';
-require_once('locales/' . $lang . '/strings.php');
-
-$view    = $_GET['view'] ?? 'default';
-$section = $_GET['section'] ?? 'main';
-require_once('views/' . $section . '/' . $view . '.php');
-
-$component = $_POST['component'];
-if (!empty($component)) {
-    require('components/' . $component . '.php');
-}

package/packages/crucible/seeds/php/seed-031.php

@@ -1,23 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: file_get_contents with user-controlled path — arbitrary file read
-
-$filename = $_GET['file'];
-$encoding = $_GET['encoding'] ?? 'UTF-8';
-$content  = file_get_contents('/var/app/data/' . $filename);
-
-if ($content === false) {
-    http_response_code(404);
-    echo "File not found: $filename";
-} else {
-    header("Content-Type: text/plain; charset=$encoding");
-    echo $content;
-}
-
-$logFile = $_POST['log'];
-$offset  = (int) ($_POST['offset'] ?? 0);
-$lines   = file_get_contents('/var/log/' . $logFile, false, null, $offset);
-echo "<pre>" . htmlspecialchars($lines) . "</pre>";

package/packages/crucible/seeds/php/seed-032.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: php
-// expected: readfile() with user-supplied filename — arbitrary file download
-
-$file = $_GET['download'];
-$base = '/var/www/downloads/';
-$path = $base . $file;
-
-if (file_exists($path)) {
-    header('Content-Type: application/octet-stream');
-    header('Content-Disposition: attachment; filename="' . basename($path) . '"');
-    readfile($path);
-} else {
-    echo "File not found";
-}

package/packages/crucible/seeds/php/seed-033.php

@@ -1,18 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: critical
-// language: php
-// expected: fopen() with user-controlled path allows reading sensitive files
-
-$report  = $_GET['report'];
-$section = $_GET['section'] ?? 'main';
-
-$filepath = "/var/reports/$section/$report";
-$handle   = fopen($filepath, 'r');
-if ($handle) {
-    while (!feof($handle)) {
-        echo fread($handle, 4096);
-    }
-    fclose($handle);
-}

package/packages/crucible/seeds/php/seed-034.php

@@ -1,24 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: php
-// expected: md5() used for password hashing — broken, no salt
-
-function hashPassword(string $password): string {
-    return md5($password);
-}
-
-function verifyPassword(string $password, string $stored): bool {
-    return md5($password) === $stored;
-}
-
-function hashWithUsername(string $password, string $username): string {
-    return md5($username . ':' . $password);
-}
-
-$user_pass = $_POST['password'];
-$stored    = getUserHash($_POST['username']);
-if (md5($user_pass) === $stored) {
-    echo "Login successful";
-}

package/packages/crucible/seeds/php/seed-035.php

@@ -1,22 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: rand() used for security token generation — not cryptographically secure
-
-function generateToken(): string {
-    return md5(rand());
-}
-
-function generateResetToken(): string {
-    return sha1(rand() . time() . $_SERVER['REMOTE_ADDR']);
-}
-
-function generateOtp(): string {
-    return str_pad(rand(0, 999999), 6, '0', STR_PAD_LEFT);
-}
-
-function generateSessionId(): string {
-    return base64_encode(rand() . rand() . rand());
-}

package/packages/crucible/seeds/php/seed-036.php

@@ -1,17 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: mcrypt_encrypt with weak DES algorithm and hardcoded key
-
-function encryptData(string $data): string {
-    $key    = "weakkey1";
-    $iv     = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_CBC), MCRYPT_RAND);
-    return mcrypt_encrypt(MCRYPT_DES, $key, $data, MCRYPT_MODE_CBC, $iv);
-}
-
-function decryptData(string $ciphertext, string $iv): string {
-    $key = "weakkey1";
-    return mcrypt_decrypt(MCRYPT_DES, $key, $ciphertext, MCRYPT_MODE_CBC, $iv);
-}

package/packages/crucible/seeds/php/seed-037.php

@@ -1,19 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: php
-// expected: SHA1 used for CSRF token and password reset link generation
-
-function generateCsrfToken(): string {
-    return sha1(session_id() . time());
-}
-
-function generatePasswordResetUrl(string $email): string {
-    $token = sha1($email . time() . rand());
-    return "https://example.com/reset?token=$token";
-}
-
-function hashApiKey(string $key): string {
-    return sha1("prefix:" . $key);
-}

package/packages/crucible/seeds/php/seed-038.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: php
-// expected: openssl_encrypt with ECB mode — no IV, deterministic encryption
-
-function encryptSecret(string $data): string {
-    $key = '0123456789abcdef';
-    return openssl_encrypt($data, 'AES-128-ECB', $key);
-}
-
-function decryptSecret(string $data): string {
-    $key = '0123456789abcdef';
-    return openssl_decrypt($data, 'AES-128-ECB', $key);
-}
-
-function encryptWithDes(string $plaintext, string $key): string {
-    return openssl_encrypt($plaintext, 'DES-ECB', $key);
-}

package/packages/crucible/seeds/php/seed-039.php

@@ -1,15 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: File upload with no extension or MIME type validation
-
-$target_dir  = "/var/www/uploads/";
-$target_file  = $target_dir . basename($_FILES["file"]["name"]);
-
-if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
-    echo "File uploaded: " . htmlspecialchars(basename($_FILES["file"]["name"]));
-} else {
-    echo "Upload failed";
-}

package/packages/crucible/seeds/php/seed-040.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: MIME type validated from user-supplied Content-Type header — bypassable
-
-function handleUpload(): string {
-    $mime      = $_FILES['upload']['type'];
-    $tmp_path  = $_FILES['upload']['tmp_name'];
-    $filename  = $_FILES['upload']['name'];
-
-    $allowed = ['image/jpeg', 'image/png', 'image/gif'];
-    if (!in_array($mime, $allowed)) {
-        die("Invalid file type");
-    }
-
-    $dest = '/var/www/uploads/' . $filename;
-    move_uploaded_file($tmp_path, $dest);
-    return $dest;
-}

package/packages/crucible/seeds/php/seed-041.php

@@ -1,20 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: Uploaded file stored with original filename preserving PHP extension
-
-function saveUpload(array $file): string {
-    $upload_dir = '/var/www/html/uploads/';
-    $filename   = $file['name'];
-    $tmp        = $file['tmp_name'];
-
-    $destination = $upload_dir . $filename;
-    move_uploaded_file($tmp, $destination);
-
-    return "https://example.com/uploads/" . urlencode($filename);
-}
-
-$url = saveUpload($_FILES['document']);
-echo "Accessible at: $url";

package/packages/crucible/seeds/php/seed-042.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: high
-// language: php
-// expected: Extension check performed on full filename — bypassable with double extension
-
-function isAllowedExtension(string $filename): bool {
-    $ext      = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
-    $allowed  = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
-    return in_array($ext, $allowed);
-}
-
-$filename = $_FILES['upload']['name'];
-if (!isAllowedExtension($filename)) {
-    die("Extension not allowed");
-}
-
-$dest = '/var/www/uploads/' . $filename;
-move_uploaded_file($_FILES['upload']['tmp_name'], $dest);
-echo "Uploaded: " . $filename;

package/packages/crucible/seeds/php/seed-043.php

@@ -1,21 +0,0 @@
-<?php
-// [CRUCIBLE-SEED]
-// category: file_upload
-// severity: critical
-// language: php
-// expected: Upload directory is web-accessible and no .htaccess protection
-
-define('UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/uploads/');
-define('UPLOAD_URL', 'https://' . $_SERVER['HTTP_HOST'] . '/uploads/');
-
-function uploadAvatar(array $file): string {
-    $ext      = pathinfo($file['name'], PATHINFO_EXTENSION);
-    $newName  = uniqid() . '.' . $ext;
-    $path     = UPLOAD_PATH . $newName;
-
-    if (!move_uploaded_file($file['tmp_name'], $path)) {
-        throw new RuntimeException("Upload failed");
-    }
-
-    return UPLOAD_URL . $newName;
-}