VulnerableLightApp

[!WARNING]
This repository and its tools are provided “as is” without warranty of any kind, either express or implied, including but not limited to, any warranties of merchantability, fitness for a particular purpose, and non-infringement. The authors shall not be liable for any claims, damages, or other liabilities arising from, out of, or in connection with the use of this tool. The user is solely responsible for ensuring their use of this tool complies with all applicable laws and regulations. The authors disclaim any liability for illegal or unethical use.

🎱 Attack Surface

flowchart TD
    A{**.NET REST API**}
    A --> B[SQL DB]
    A --> C[File System]
    A --> D[Host services]
    A --> F[GraphQL]
    A --> G[App Services]
    A --> H[Memory]

    B --> I(*Identities*)
    C --> J(*Logs*)
    C --> K(*Secrets*)
    D --> L(*DNS*)
    F --> M(*Sensitive Data*)
    G --> O(*Serialized Data*)
    G --> R(*Business Logic*)
    H --> P(*Variables and functions*)

🏢 Business Value

🐞 Vulnerabilities

🔑 Hint & Write Up

• Try reading Dojo-101, this project contains all you need to hack this app.

• Become a sponsor and get access to the full methodology and complete write-up.

⬇️ Download

git clone https://github.com/Aif4thah/VulnerableLightApp.git
cd .\VulnerableLightApp\

🔧🔥 Build and Run

You can use Dotnet or Docker

Dotnet

Check .csproj file to get the current dotnet version and install .NET SDK

dotnet run [--url=<url>]

Alternatively, you can use bin files :

dotnet build
.\bin\Debug\net8.0\VulnerableWebApplication.exe [--url=<url>]

Docker

docker build -t vulnerablelightapp .
docker run -p 3000:3000 vulnerablelightapp 

first request

Default : 127.0.0.1:3000

curl -k https://127.0.0.1:3000

🛠️ Debug

Dotnet install on Linux

Ubuntu / Debian exemple

wget https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
dpkg -i packages-microsoft-prod.deb
apt update && apt install -y dotnet-sdk-8.0 dotnet-runtime-8.0

Dotnet Framework

Verify you use the intended .NET Framework

where dotnet
dotnet --version
dotnet --list-sdks

Certificates

To trust the certificate

dotnet dev-certs https --trust

Dependancies

dependancies have to be dowloaded from standard sources

dotnet nuget add source "https://api.nuget.org/v3/index.json" --name "Microsoft"

💜 Crédits

• Special thanks to all the hackers and students who pushed me to improve this work

• Project maintened by Michael Vacarella

• Support this effort and give back by sponsoring on GitHub!