commands.sh

#!/usr/bin/env bash
# Lab 27 - Exploit Fix Test
# Commands executed during the lab


# Install Required Tools

sudo apt update

sudo apt install -y python3 python3-pip python3-venv git sqlite3

mkdir -p ~/exploit-fix-lab
cd ~/exploit-fix-lab
python3 -m venv venv
source venv/bin/activate
python3 -m pip install --upgrade pip

pip install flask pytest requests pytest-cov bandit pip-audit


# Create dependency file used later in troubleshooting and CI checks

nano ~/exploit-fix-lab/requirements.txt


# Create a simple web application with a known SQL injection vulnerability

cd ~/exploit-fix-lab
nano vulnerable_app.py


# Quick syntax verification

python3 -m py_compile vulnerable_app.py
echo $?


# Step 2: Create Exploit Script

nano ~/exploit-fix-lab/exploit_test.py


# Syntax verification

python3 -m py_compile exploit_test.py
echo $?


# Terminal 1: Start the vulnerable application

cd ~/exploit-fix-lab
source venv/bin/activate
python3 vulnerable_app.py


# Terminal 2: Run exploit

cd ~/exploit-fix-lab
source venv/bin/activate
python3 exploit_test.py


# Document your findings

nano ~/exploit-fix-lab/exploit_report.md


# Steps to Reproduce

   python3 vulnerable_app.py
   ```
2. Run the exploit test:

   ```bash
   python3 exploit_test.py
   ```
3. Observe that the following payload bypasses authentication:

   ```json
   {
     "username": "admin' OR '1'='1",
     "password": "anything"
   }
   ```
4. The application returns a successful login response even though the password is invalid.

## Observed Result

The vulnerable application returned HTTP 200 and granted access to the admin user.

## Root Cause

User input was directly concatenated into the SQL query instead of using parameterized queries.


# Root Cause

cat exploit_report.md


# Steps to Reproduce

   python3 vulnerable_app.py
   ```
2. Run the exploit test:

   ```bash
   python3 exploit_test.py
   ```
3. Observe that the following payload bypasses authentication:

   ```json
   {
     "username": "admin' OR '1'='1",
     "password": "anything"
   }
   ```
4. The application returns a successful login response even though the password is invalid.

## Observed Result

The vulnerable application returned HTTP 200 and granted access to the admin user.

## Root Cause

User input was directly concatenated into the SQL query instead of using parameterized queries.


# Step 1: Create Secure Version

nano ~/exploit-fix-lab/secure_app.py


# Syntax verification

python3 -m py_compile secure_app.py
echo $?


# Step 2: Implement Input Validation

python3 - <<'PY'
from secure_app import validate_input
tests = [
    ("admin", "admin123"),
    ("ab", "admin123"),
    ("admin' OR '1'='1", "anything"),
    ("normal_user", "short"),
]
for username, password in tests:
    print((username, password), "=>", validate_input(username, password))
PY


# Stop vulnerable app

^C


# Start secure app

cd ~/exploit-fix-lab
source venv/bin/activate
python3 secure_app.py


# In Terminal 2, test that exploit no longer works

cd ~/exploit-fix-lab
source venv/bin/activate
BASE_URL=http://localhost:5001 python3 exploit_test.py


# Additional realistic direct API verification of the fix

curl -i -X POST http://localhost:5001/login \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"admin' OR '1'='1\",\"password\":\"anything\"}"


# Step 1: Create Comprehensive Test Suite

nano ~/exploit-fix-lab/test_security.py


# Syntax verification

python3 -m py_compile test_security.py
echo $?


# Run all tests

cd ~/exploit-fix-lab
source venv/bin/activate
pytest test_security.py -v


# Run with coverage report

pytest test_security.py --cov=secure_app --cov-report=html


# Verify coverage artifacts

ls -la htmlcov | head


# Step 3: Create CI/CD Integration Script

nano ~/exploit-fix-lab/run_security_tests.sh


# Security Testing Script for CI/CD Pipeline

chmod +x ~/exploit-fix-lab/run_security_tests.sh
cd ~/exploit-fix-lab
./run_security_tests.sh


# Verify generated CI artifacts

ls -l test-results.xml security-report.json


# Inspect Bandit JSON report

sed -n '1,80p' security-report.json


# Check exploit documentation exists

cd ~/exploit-fix-lab
cat exploit_report.md


# Steps to Reproduce

   python3 vulnerable_app.py
   ```
2. Run the exploit test:

   ```bash
   python3 exploit_test.py
   ```
3. Observe that the following payload bypasses authentication:

   ```json
   {
     "username": "admin' OR '1'='1",
     "password": "anything"
   }
   ```
4. The application returns a successful login response even though the password is invalid.

## Observed Result

The vulnerable application returned HTTP 200 and granted access to the admin user.

## Root Cause

User input was directly concatenated into the SQL query instead of using parameterized queries.


# Verify vulnerable app demonstrates the issue

python3 exploit_test.py


# Start the secure app

python3 secure_app.py


# Test secure app rejects SQL injection

curl -i -X POST http://localhost:5001/login \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"admin' OR '1'='1\",\"password\":\"anything\"}"


# You can also run the exploit script against the secure app

BASE_URL=http://localhost:5001 python3 exploit_test.py


# All tests should pass

cd ~/exploit-fix-lab
source venv/bin/activate
pytest test_security.py -v


# Check test coverage

pytest test_security.py --cov=secure_app


# Verify test results file created

ls -l test-results.xml


# Create Security Checklist

nano ~/exploit-fix-lab/security_checklist.md


# Security Checklist

cat security_checklist.md


# Find process using port

sudo lsof -i :5000
sudo lsof -i :5001


# Kill process

sudo kill -9 8124
sudo kill -9 8397

sudo lsof -i :5000
sudo lsof -i :5001


# Remove database files and reinitialize

cd ~/exploit-fix-lab
rm -f users.db users_secure.db
python3 secure_app.py


# Manual process check

ps aux | grep python


# Re-run automated tests without manually relying on the server

pytest test_security.py -v


# Verify virtual environment is activated

which python3
source ~/exploit-fix-lab/venv/bin/activate
which python3


# Reinstall dependencies

cd ~/exploit-fix-lab
pip install -r requirements.txt


# Final project snapshot

ls -la