andresriancho / django-moth Goto Github PK

View Code? Open in Web Editor NEW

31.0 31.0 15.0 706 KB

A Django vulnerable Web application for testing the w3af framework

Home Page: http://w3af.org/

License: GNU General Public License v2.0

Python 60.33% CSS 34.94% HTML 4.70% DIGITAL Command Language 0.03%

django-moth's People

Contributors

Stargazers

Watchers

Forkers

pombredanne nixwizard pombreda bahtiyarb-torba vicsanjinez sajibekanti ehooo conanjun 1010101012101 maxbyz bbhunter ekmixon mituring zero0netw0

django-moth's Issues

h1-h6 google fonts

Is it possible to download a google font to my project and include them to decorate h1-h6?

AttributeError: 'SimpleXSSView' object has no attribute 'request'

Internal Server Error: /audit/xss/simple_xss.py
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 115, in get_response
    response = callback(request, *callback_args, **callback_kwargs)
  File "/home/pablo/PycharmProjects/djmoth/moth/views/router.py", line 185, in __call__
    return view_obj.dispatch(request, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/utils/decorators.py", line 25, in _wrapper
    return bound_func(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 77, in wrapped_view
    return view_func(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/utils/decorators.py", line 21, in bound_func
    return func(self, *args2, **kwargs2)
  File "/home/pablo/PycharmProjects/djmoth/moth/views/base/vulnerable_template_view.py", line 45, in dispatch
    return super(VulnerableTemplateView, self).dispatch(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/views/generic/base.py", line 86, in dispatch
    return handler(request, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/views/generic/base.py", line 92, in http_method_not_allowed
    'request': self.request
AttributeError: 'SimpleXSSView' object has no attribute 'request'

Navigation bug: Query string is missing

http://127.0.0.1:8000/audit/xss/simple_xss.py

Define http://127.0.0.1:8000/audit/ pages

Define http://127.0.0.1:8000/audit/ pages , they should basically have some type of link to each "test suite".

Slash at the end bug

http://127.0.0.1:8000/grep/hash_find/ vs http://127.0.0.1:8000/grep/hash_find bug

Back button

Back button in index-of page and vulnerable page.

Make runserver work with SSL

Make runserver work with SSL, there are many tests which require SSL protocol. Here is a way to achieve it: http://www.ianlewis.org/en/testing-https-djangos-development-server

Most likely I'll have a .sh file that will do all those steps for me.

Create dynamic view for plugin families URLs

Create dynamic view for plugin families URLs like http://127.0.0.1:8000/grep , http://127.0.0.1:8000/audit , etc.

Improve dockerfile

Replace RUN git clone https://github.com/andresriancho/django-moth.git with an ADD

Navigation

Make sure I can manually navigate through the whole site, issues that we have right now are:

From home I can't navigate to /grep , this will be fixed by #3
The URLs for the grep tests are still http://127.0.0.1:8000/event_validation/ and should be http://127.0.0.1:8000/grep/event_validation/
From the index of page I can't access the test pages, the links are wrong. They should be relative links.

docker-compose memcached

https://github.com/andresriancho/django-moth/blob/master/moth/views/vulnerabilities/audit/memcache_injection.py

Add link to top level plugin names in home.html

{% comment %}
TODO: Add link to top level plugin names
{% comment %}

Show python source code

Add link to vulnerability page which shows source code for the django/python web application. Maybe there is a reusable app for this?

There seems to be an issue with my template, when I try to output a large piece of binary (as required for example by the ssh_version payload or the os_commanding attack plugin tests) the output simply "goes missing".

/g /gr /gre /grep !

/g /gr /gre /grep ! They all work 💃

That's an ugly bug which drives w3af's web_spider crazy

JavaScript show HTML source code

JavaScript show source code