diff --git a/app/lab/api-hacking/api-1/Indexupdatepassword.php b/app/lab/api-hacking/api-1/Indexupdatepassword.php new file mode 100644 index 0000000..e6a0f6a --- /dev/null +++ b/app/lab/api-hacking/api-1/Indexupdatepassword.php @@ -0,0 +1,26 @@ + + + + + + + <?php echo $strings["updatePassword"] ?> + + + + +
+

+

+
+ +
+ +
+
+ + + diff --git a/app/lab/api-hacking/api-1/adminindex.php b/app/lab/api-hacking/api-1/adminindex.php new file mode 100644 index 0000000..c086556 --- /dev/null +++ b/app/lab/api-hacking/api-1/adminindex.php @@ -0,0 +1,30 @@ + + + + + + + <?php echo $strings["adminAccount"] ?> + + + + +
+

+

+

+
+
+ + +
+ +
+
+ + + + diff --git a/app/lab/api-hacking/api-1/api.php b/app/lab/api-hacking/api-1/api.php new file mode 100644 index 0000000..052958e --- /dev/null +++ b/app/lab/api-hacking/api-1/api.php @@ -0,0 +1,67 @@ + $user) { + if ($user['username'] === $username) { + unset($users[$key]); + $userFound = true; + break; + } + } + if ($userFound) { + writeData($users); + echo "Kullanıcı başarıyla silindi."; + } else { + echo "Kullanıcı bulunamadı. Kullanıcı adı: $username"; + } +} diff --git a/app/lab/api-hacking/api-1/en.ini b/app/lab/api-hacking/api-1/en.ini new file mode 100644 index 0000000..2a5d101 --- /dev/null +++ b/app/lab/api-hacking/api-1/en.ini @@ -0,0 +1,17 @@ +title="API Hacking" +login="Login" +username="Username:" +password="Password:" +defaultLogin="Default Login:" +adminAccount="Admin Account" +userAccount="User Account" +adminLogin="Hello Admin." +userLogin="Hello User Account." +welcomeSystem="Welcome to System!" +updatePassword="Update Password" +enterNewPassword="Enter New Password:" +reset="Reset" +logOut="Log out" +passwordUpdated="Password Updated" + SuccesfulPassword="Password successfully updated" + NewSuccesfulPassword="Your new password has been successfully updated." \ No newline at end of file diff --git a/app/lab/api-hacking/api-1/fr.ini b/app/lab/api-hacking/api-1/fr.ini new file mode 100644 index 0000000..3b649a4 --- /dev/null +++ b/app/lab/api-hacking/api-1/fr.ini @@ -0,0 +1,17 @@ +title="Piratage de l'API" +login="Connexion" +username="Nom d'utilisateur" +password="Mot de passe" +defaultLogin="Connexion par défaut" +adminAccount="Compte administratif" +userAccount="User Account" +adminLogin="Bonjour Utilisateur Admin" +userLogin="Bonjour compte utilisateur." +welcomeSystem="Bienvenue dans le système !" +updatePassword="Mise à jour du mot de passe" +enterNewPassword="Entrez votre nouveau mot de passe :" +reset="réinitialiser" +logOut="Sortie" +passwordUpdated="Mise à jour du mot de passe" + SuccesfulPassword="Mise à jour du mot de passe réussie" + NewSuccesfulPassword="Votre nouveau mot de passe a été mis à jour avec succès." \ No newline at end of file diff --git a/app/lab/api-hacking/api-1/index.php b/app/lab/api-hacking/api-1/index.php new file mode 100644 index 0000000..e67aa07 --- /dev/null +++ b/app/lab/api-hacking/api-1/index.php @@ -0,0 +1,35 @@ + + + + + + + <?php echo $strings["login"] ?> + + + + +
+

+
+
+ + +
+
+ + +
+ +


user / user

+
+
+ +
+
+ + + diff --git a/app/lab/api-hacking/api-1/login.php b/app/lab/api-hacking/api-1/login.php new file mode 100644 index 0000000..d8c890b --- /dev/null +++ b/app/lab/api-hacking/api-1/login.php @@ -0,0 +1,34 @@ + "admin", "password" => "admin"), + array("username" => "user", "password" => "user") +); + +// Convert to JSON format +$defaultData = json_encode($defaultUsers, JSON_PRETTY_PRINT); + +// Write to main1.json +file_put_contents('main1.json', $defaultData); + +// Redirect to Index page +header("Location: index.php"); +exit; diff --git a/app/lab/api-hacking/api-1/style.css b/app/lab/api-hacking/api-1/style.css new file mode 100644 index 0000000..a569173 --- /dev/null +++ b/app/lab/api-hacking/api-1/style.css @@ -0,0 +1,42 @@ + body { + + height: 100vh; + margin: 0; + } + + .container { + width: 300px; + padding: 20px; + border: 1px solid #ccc; + border-radius: 5px; + background-color: #f9f9f9; + text-align: center; + } + + .input-group { + margin-bottom: 20px; + } + + input[type="text"], + input[type="password"] { + width: calc(100% - 16px); /* Düğme genişliğini ayarlamak için */ + padding: 8px; + margin-bottom: 10px; + border: 1px solid #203069; + border-radius: 4px; + box-sizing: border-box; + } + + button { + width: calc(100% - 16px); /* Düğme genişliğini ayarlamak için */ + padding: 10px; + border: none; + border-radius: 4px; + background-color: #203069; + color: white; + cursor: pointer; + } + + button:hover { + background-color: #203069; + } diff --git a/app/lab/api-hacking/api-1/tr.ini b/app/lab/api-hacking/api-1/tr.ini new file mode 100644 index 0000000..195da94 --- /dev/null +++ b/app/lab/api-hacking/api-1/tr.ini @@ -0,0 +1,17 @@ +title="API Zaafiyeti" +login="Giriş" +username="Kullanıcı Adı:" +password="Şifre:" +defaultLogin="Varsayılan Giriş:" +adminAccount="Admin Kullanıcı" +userAccount="User Kullanıcı" +adminLogin="Merhaba Admin Kullanıcısı" +userLogin="Merhaba User Kullanıcısı." +welcomeSystem="Sisteme Hoşgeldiniz!" +updatePassword="Parolayı Güncelle" +enterNewPassword="Yeni Şifrenizi Giriniz:" +reset="Değişiklikleri Sıfırla" +logOut="Çıkış Yap" +passwordUpdated="Şifre Güncellendi" +SuccesfulPassword="Şifre Başarıyla Güncellendi" +NewSuccesfulPassword="Yeni şifreniz başarıyla güncellenmiştir." \ No newline at end of file diff --git a/app/lab/api-hacking/api-1/updatepassword.php b/app/lab/api-hacking/api-1/updatepassword.php new file mode 100644 index 0000000..b84d5c8 --- /dev/null +++ b/app/lab/api-hacking/api-1/updatepassword.php @@ -0,0 +1,37 @@ + $username, + 'newpassword' => $newPassword + ); + + // Send request to API + $response = sendRequest($apiUrl, $data); + + // Print the response from the API to the screen + echo $response; +} + diff --git a/app/lab/api-hacking/api-1/userFound.php b/app/lab/api-hacking/api-1/userFound.php new file mode 100644 index 0000000..9022380 --- /dev/null +++ b/app/lab/api-hacking/api-1/userFound.php @@ -0,0 +1,24 @@ + + + + + + + <?php echo $strings["passwordUpdated"] ?> + + + + +
+

+

+
+ +
+
+ + + \ No newline at end of file diff --git a/app/lab/api-hacking/api-1/userindex.php b/app/lab/api-hacking/api-1/userindex.php new file mode 100644 index 0000000..6d43d75 --- /dev/null +++ b/app/lab/api-hacking/api-1/userindex.php @@ -0,0 +1,29 @@ + + + + + + + <?php echo $strings["userAccount"] ?> + + + + +
+

+

+

+
+
+ + +
+ +
+
+ + + diff --git a/app/main.json b/app/main.json index 7a5356b..37dbcbf 100644 --- a/app/main.json +++ b/app/main.json @@ -996,5 +996,41 @@ } ] + }, + { + "id": 13, + "title": { + "en": "API Hacking", + "tr": "API Zaafiyeti", + "fr": "Piratage de l'API", + "ar": "" + }, + "description": { + "en": "API hacking simply refers to malicious attacks on the APIs of an application or a system. APIs (Application Programming Interface) are interfaces that allow software applications to communicate with each other. Many web services and applications exchange data and extend their functionality through APIs.", + "tr": "API hacking, kısaca bir uygulamanın veya bir sistemin API'ları üzerinden yapılan kötü niyetli saldırıları ifade eder. API'lar (Application Programming Interface), yazılım uygulamalarının birbirleriyle iletişim kurmasını sağlayan arayüzlerdir. Birçok web hizmeti ve uygulama, API'ler aracılığıyla veri alışverişi yapar ve işlevselliğini genişletir.", + "fr": "Le piratage d'API fait brièvement référence aux attaques malveillantes sur les API d'une application ou d'un système. Les API (Application Programming Interface) sont des interfaces qui permettent aux applications logicielles de communiquer entre elles. De nombreux services web et applications échangent des données et étendent leurs fonctionnalités par le biais d'API.", + "ar": "" + }, + "imgURL": "public/assets/img/vulns/api.png", + "labs": [ + { + "id": 1, + "title": { + "en": "IDOR with API Vulnerability", + "tr": "API Zaafiyeti ile IDOR", + "fr": "IDOR avec vulnérabilité de l'API", + "ar": "" + }, + "description": { + "en": "Create IDOR by exploiting API Vulnerability. Manipulate the password information of User User and Admin User.", + "tr": "API Zaafiyetini istismar ederek IDOR oluştur. User Kullanıcısı ile Admin Kullanıcısının password bilgisini manipüle et.", + "fr": "Créer un IDOR en exploitant la vulnérabilité de l'API. Manipuler les informations de mot de passe de l'utilisateur et de l'administrateur.", + "ar": "" + }, + "url": "/lab/api-hacking/api-1", + "vulnID": 13 + } + ] } + ] \ No newline at end of file diff --git a/app/public/assets/img/vulns/API.png b/app/public/assets/img/vulns/API.png new file mode 100644 index 0000000..3faf2ab Binary files /dev/null and b/app/public/assets/img/vulns/API.png differ