Merge pull request #8 from swisstxt/repush-source

Revert "Remove all sources"
swisstxt · Aug 18, 2023 · a0c6652 · a0c6652
2 parents 88346a5 + 3f78e24
commit a0c6652
Show file tree

Hide file tree

Showing 8 changed files with 124 additions and 0 deletions.
diff --git a/Pipfile b/Pipfile
@@ -0,0 +1,12 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+django = "1.3.0"
+
+[dev-packages]
+
+[requires]
+python_version = "3.11"
diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/bicep/test.bicep b/bicep/test.bicep
@@ -0,0 +1,12 @@
+resource symbolicname 'Microsoft.KeyVault/vaults@2022-07-01' = {
+ name: 'hackme'
+ location: 'eastus'
+ properties: {
+ publicNetworkAccess: 'enabled'
+ sku: {
+ family: 'A'
+ name: 'standard'
+ }
+ tenantId: '[subscription().tenantId]'
+ }
+}
diff --git a/go.mod b/go.mod
@@ -0,0 +1,5 @@
+module github.com/swisstxt/secscan-demo
+
+go 1.19
+
+require golang.org/x/net v0.12.0
diff --git a/go.sum b/go.sum
@@ -0,0 +1,2 @@
+golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
+golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
diff --git a/go/test.go b/go/test.go
@@ -0,0 +1,18 @@
+package main
+
+import (
+ "bytes"
+ "math/rand"
+ "golang.org/x/net/html"
+)
+
+func main() {
+ source := bytes.NewBufferString(`<html><body><p>&</p></body></html>`)
+ parsed, err := html.Parse(source)
+ if err != nil {
+ panic(err)
+ }
+ buffer := &bytes.Buffer{}
+ html.Render(buffer, parsed)
+ rand.Int()
+}
diff --git a/python/test.py b/python/test.py
@@ -0,0 +1,17 @@
+import hashlib
+from django.forms import formsets
+from django.db import connection
+
+try:
+ suppressed_exception()
+except Exception:
+ pass
+
+formsets.formset_factory("vulnerable")
+
+hashlib.md5('invalid').hexdigest()
+
+user = "hackme"
+with connection.cursor() as cursor:
+ cursor.execute(f"SELECT * FROM users WHERE username = {user}")
+ user = cursor.fetchone()
diff --git a/terraform/main.tf b/terraform/main.tf
@@ -0,0 +1,30 @@
+terraform {
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ }
+ }
+}
+
+provider "aws" {
+ region = "us-east-1"
+}
+
+resource "aws_s3_account_public_access_block" "this" {
+ block_public_acls = false
+ block_public_policy = false
+ ignore_public_acls = false
+ restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket" "vulnerable" {
+ bucket = "i-am-vulnerable"
+}
+
+resource "aws_s3_bucket_public_access_block" "vulnerable" {
+ bucket = aws_s3_bucket.vulnerable.id
+ block_public_acls = false
+ block_public_policy = false
+ ignore_public_acls = false
+ restrict_public_buckets = false
+}