Skip to content

sctf2020/acme-no-login

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

 _______                                     
(_______)                                    
 _______  ____ ____  _____                   
|  ___  |/ ___)    \| ___ |                  
| |   | ( (___| | | | ____|                  
|_|   |_|\____)_|_|_|_____)                  
                                         
 _______          _                  _       
(_______)        (_)                (_)      
 _     _  ___     _       ___   ____ _ ____  
| |   | |/ _ \   | |     / _ \ / _  | |  _ \ 
| |   | | |_| |  | |____| |_| ( (_| | | | | |
|_|   |_|\___/   |_______)___/ \___ |_|_| |_|
                              (_____|        

by Websecurify (pdp)

The following application, written on top of MongoDB and NodeJS, demonstrates a simple but not too obvious vulnerability in the this particular technology stack that can be used to successfully bypass the login prompt.

System Requirements

You will need docker installed and fully functional.

How To Build

Run the following command:

make docker-build

How To Use

Run the following command:

make docker-run

The application will be available on localhost:49090.

About

Demonstrates a login bypass attack against a sample MongoDB/NodeJS application

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • JavaScript 59.7%
  • Makefile 23.5%
  • HTML 16.8%