Base website security demo

• designed for Intraworlds security workshop

Development

Installation

1. Install Docker
2. Install Docker Compose
3. Clone this repository git clone https://github.com/intraworlds/workshop-hackthisweb.git or download ZIP file

Run

1. before run check if your ports localhost:80 and localhost:8080 are "free", not running app using these ports

2. run docker-compose up and you access the website

   • app: https://localhost/
   • username: [email protected]
   • password: richie
   • adminer: http://localhost:8080/?server=mysql&username=admin&db=demo
   • password: 1234

Let's go hacking... :-)

• ... need any inspiration?

attacks

• Full list of attacks

XSS (Cross-site Scripting)

• OWASP XSS
• OWASP testing for XSS
• PHP triky: Cross Site Scripting (czech only)

HTTP Headers

• X-XSS-Protection
• Content-Security-Policy

SQL injection

• OWASP SQL injection
• Soom: SQL Injection (Full Paper) (czech only)
• PHP triky: Obrana proti SQL Injection (czech only)

CSFR (Cross-Site Request Forgery)

• OWASP CSFR
• Soom (czech only)
• PHP triky: Cross-Site Request Forgery (czech only)
• Co je Cross-Site Request Forgery a jak se mu bránit (czech only)

Path (Directory) Traversal

• OWASP Path Traversal

Others

• Self tweeting tweet