wewillrockyou 1.0.0

package/index.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+
+import { select } from '@inquirer/prompts';
+import fs from 'fs';
+import path from 'path';
+
+const codes = {
+  1: `# Experiment 1
+import hmac
+import hashlib
+
+secret_key = b"my_secret_key"
+message = b"Hello World!"
+
+signature = hmac.new( secret_key, message, hashlib.sha256).hexdigest()
+
+print("Message:", message.decode())
+print("HMAC Signature:", signature)
+`,
+  2: `# Experiment 2
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import rsa, padding
+private_key = rsa.generate_private_key(
+    public_exponent=65537,
+    key_size=2048)
+public_key = private_key.public_key()
+message = b"Welcome To API Security"
+signature = private_key.sign(
+    message,
+    padding.PSS(
+        mgf=padding.MGF1(hashes.SHA256()),
+        salt_length=padding.PSS.MAX_LENGTH),
+    hashes.SHA256())
+print("Original Message:", message.decode())
+print("\\nDigital Signature Generated Successfully!")
+print("\\nSignature (Hex):")
+print(signature.hex())
+try:
+    public_key.verify(
+        signature,
+        message,
+        padding.PSS(
+            mgf=padding.MGF1(hashes.SHA256()),
+            salt_length=padding.PSS.MAX_LENGTH),
+        hashes.SHA256())
+    print("\\nVerification Successful!")
+    print("The signature is valid.")
+except Exception:
+    print("\\nVerification Failed!")
+    print("The signature is invalid.")
+`,
+  3: `# Experiment 3
+import jwt
+import datetime
+SECRET_KEY = "my_secure_secret_key"
+
+# Payload data
+payload = {
+    "username": "Yashodhar",
+    "role": "student",
+    "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=5)
+}
+token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
+print("Generated JWT Token:")
+print(token)
+try:
+    decoded = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+    print("\\nToken Validation Successful!")
+    print("Decoded Payload:")
+    print(decoded)
+except jwt.ExpiredSignatureError:
+    print("Token has expired!")
+except jwt.InvalidTokenError:
+    print("Invalid Token!")
+`,
+  4: `# Experiment 4
+import jwt
+import datetime
+import time
+SECRET_KEY = "my_secret_key"
+payload = {
+    "username": "student",
+    "role": "user",
+    "exp": datetime.datetime.utcnow() + datetime.timedelta(seconds=10)
+}
+token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
+print("Generated JWT Token:")
+print(token)
+try:
+    decoded = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+    print("\\nToken Validation Successful")
+    print("Payload:", decoded)
+except jwt.InvalidTokenError:
+    print("Invalid Token")
+print("\\nWaiting for token to expire...")
+time.sleep(12)
+try:
+    decoded = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+    print("Token is still valid")
+except jwt.ExpiredSignatureError:
+    print("\\nToken Expired!")
+    print("Replay Attack Detected: Expired token reuse blocked")
+except jwt.InvalidTokenError:
+    print("Invalid Token")
+`,
+  5: `# Experiment 5
+import hmac
+import hashlib
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import rsa, padding
+message = input("Enter Message: ").encode()
+print("\\n===== SYMMETRIC AUTHENTICATION (HMAC) =====")
+secret_key = b"shared_secret_key"
+hmac_value = hmac.new(secret_key,message,hashlib.sha256).hexdigest()
+print("Generated HMAC:")
+print(hmac_value)
+verify_hmac = hmac.new(
+    secret_key,
+    message,
+    hashlib.sha256
+).hexdigest()
+if hmac.compare_digest(hmac_value, verify_hmac):
+    print("HMAC Verification Successful")
+else:
+    print("HMAC Verification Failed")
+print("\\n===== ASYMMETRIC AUTHENTICATION (RSA) =====")
+private_key = rsa.generate_private_key(
+    public_exponent=65537,
+    key_size=2048
+)
+public_key = private_key.public_key()
+signature = private_key.sign(
+    message,
+    padding.PSS(
+        mgf=padding.MGF1(hashes.SHA256()),
+        salt_length=padding.PSS.MAX_LENGTH
+    ),
+    hashes.SHA256()
+)
+print("Digital Signature Generated")
+try:
+    public_key.verify(
+        signature,
+        message,
+        padding.PSS(
+            mgf=padding.MGF1(hashes.SHA256()),
+            salt_length=padding.PSS.MAX_LENGTH
+        ),
+        hashes.SHA256()
+    )
+    print("Digital Signature Verification Successful")
+except Exception:
+    print("Digital Signature Verification Failed")
+print("\\n===== COMPARISON =====")
+print("Symmetric Authentication : Uses One Shared Secret Key")
+print("Asymmetric Authentication: Uses Public and Private Keys")
+print("HMAC is Faster")
+print("Digital Signature Provides Non-Repudiation")
+`
+};
+
+const fileNames = {
+  1: 'HMAC.py',
+  2: 'Digital signature.py',
+  3: 'JWT.py',
+  4: 'Token Expiry.py',
+  5: 'Symmetric and asymmetric mechanisms.py'
+};
+
+async function run() {
+  const subject = await select({
+    message: 'Select a subject:',
+    choices: [
+      {
+        name: 'API',
+        value: 'API',
+        description: 'API Security Experiments',
+      },
+      {
+        name: 'Other',
+        value: 'Other',
+        description: 'Other subjects (not available)',
+      },
+    ],
+  });
+
+  if (subject !== 'API') {
+    console.log('Only API is available right now.');
+    return;
+  }
+
+  const experiment = await select({
+    message: 'Select an experiment number:',
+    choices: [
+      { name: '1', value: 1, description: 'HMAC' },
+      { name: '2', value: 2, description: 'Digital signature' },
+      { name: '3', value: 3, description: 'JWT' },
+      { name: '4', value: 4, description: 'Token Expiry' },
+      { name: '5', value: 5, description: 'Symmetric and asymmetric mechanisms' },
+    ],
+  });
+
+  const code = codes[experiment];
+  const fileName = fileNames[experiment];
+  const filePath = path.join(process.cwd(), fileName);
+
+  fs.writeFileSync(filePath, code, 'utf8');
+  console.log(`Successfully created '${fileName}' in the current directory.`);
+}
+
+run().catch((err) => {
+  if (err.name === 'ExitPromptError') {
+    console.log('\nAborted by user.');
+  } else {
+    console.error(err);
+  }
+});

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "wewillrockyou",
+  "version": "1.0.0",
+  "description": "CLI to cheat on API Security experiments",
+  "main": "index.js",
+  "type": "module",
+  "bin": {
+    "wewillrockyou": "./index.js"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "^5.0.0"
+  }
+}