diff --git a/Dockerfile b/Dockerfile
index 2014659..3ea9aa0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,6 +17,7 @@ RUN apt-get install -y \
php-cgi \
php-cli \
php-common \
+ php-gd \
php-curl \
php-dev \
php-json \
diff --git a/README.md b/README.md
index f5e8849..3cbf61d 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
-
+
@@ -30,6 +30,9 @@
* Broken Authentication
* Race Condition
* Server Side Template Injection (SSTI)
+* API Hacking
+* Captcha Bypass
+* Path Traversal
## Installation
@@ -42,7 +45,7 @@
```
2. Go to http://localhost:1337
-### Manuel Installation
+### Manual Installation
1. Clone the repo
```sh
diff --git a/app/lab/api-hacking/api-hacking1/all_wallpapers.php b/app/lab/api-hacking/api-hacking1/all_wallpapers.php
new file mode 100644
index 0000000..20c5825
--- /dev/null
+++ b/app/lab/api-hacking/api-hacking1/all_wallpapers.php
@@ -0,0 +1,52 @@
+
+
+
+
+
+
+
+ API Hacking
+
+
+
+
+
+
+
+
+
+
+
+
+

+
+
= $image ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/app/lab/api-hacking/api-hacking1/api.php b/app/lab/api-hacking/api-hacking1/api.php
deleted file mode 100644
index 451cc73..0000000
--- a/app/lab/api-hacking/api-hacking1/api.php
+++ /dev/null
@@ -1,57 +0,0 @@
- $email,
- "type" => "email"
- ];
- http_response_code(200);
- echo json_encode($response);
- exit;
- } else {
- $response = [
- "error" => "User not found",
- "message" => "User with the provided username does not exist."
- ];
- http_response_code(404);
- echo json_encode($response);
- exit;
- }
- } else {
- $response = [
- "error" => "Invalid action",
- "message" => "Invalid action specified in the request."
- ];
- http_response_code(400);
- echo json_encode($response);
- exit;
- }
-} else {
- $response = [
- "error" => "Invalid request method",
- "message" => "Invalid request method. Only POST requests are allowed."
- ];
- http_response_code(405);
- echo json_encode($response);
- exit;
-}
-?>
diff --git a/app/lab/api-hacking/api-hacking1/api/all_wallpapers.php b/app/lab/api-hacking/api-hacking1/api/all_wallpapers.php
new file mode 100644
index 0000000..b4e90bb
--- /dev/null
+++ b/app/lab/api-hacking/api-hacking1/api/all_wallpapers.php
@@ -0,0 +1,43 @@
+
+
+
+
+
+
+
+ API Hacking
+
+
+
+
+
+
+
+
+
+
+
+

+
+
= $image ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_delete_me.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_delete_me.jpg
new file mode 100644
index 0000000..a503e7f
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/1_delete_me.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg
new file mode 100644
index 0000000..90386d4
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg
new file mode 100644
index 0000000..e5cfe16
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_wp4945601.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_wp4945601.jpg
new file mode 100644
index 0000000..6a92e20
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/1_wp4945601.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/2_1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg
similarity index 100%
rename from app/lab/api-hacking/api-hacking1/api/uploads/1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg
rename to app/lab/api-hacking/api-hacking1/api/backup_images/2_1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/2_1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg
similarity index 100%
rename from app/lab/api-hacking/api-hacking1/api/uploads/1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg
rename to app/lab/api-hacking/api-hacking1/api/backup_images/2_1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png b/app/lab/api-hacking/api-hacking1/api/backup_images/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png
new file mode 100644
index 0000000..ae60c2b
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/3_544298.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/3_544298.jpg
new file mode 100644
index 0000000..6a8137f
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/3_544298.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg
new file mode 100644
index 0000000..8bf89ed
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg
new file mode 100644
index 0000000..3afc020
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/4_130672-lara-croft-tomb-raider-5k.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/4_130672-lara-croft-tomb-raider-5k.jpg
new file mode 100644
index 0000000..7a0bdb7
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/4_130672-lara-croft-tomb-raider-5k.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/4_b610a778f896dbcb966e0d6083db2460.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/4_b610a778f896dbcb966e0d6083db2460.jpg
new file mode 100644
index 0000000..0f6ac49
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/4_b610a778f896dbcb966e0d6083db2460.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg
new file mode 100644
index 0000000..36ede13
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/5_3105122.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/5_3105122.jpg
new file mode 100644
index 0000000..f8d0eec
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/5_3105122.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/5_d027bacc775eea447f19eb18b352c024.jpeg b/app/lab/api-hacking/api-hacking1/api/backup_images/5_d027bacc775eea447f19eb18b352c024.jpeg
new file mode 100644
index 0000000..3d440b7
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/5_d027bacc775eea447f19eb18b352c024.jpeg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/5_wp10244267.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/5_wp10244267.jpg
new file mode 100644
index 0000000..ddc59cd
Binary files /dev/null and b/app/lab/api-hacking/api-hacking1/api/backup_images/5_wp10244267.jpg differ
diff --git a/app/lab/api-hacking/api-hacking1/api/delete_image.php b/app/lab/api-hacking/api-hacking1/api/delete_image.php
index b314ee9..3f3bcc3 100644
--- a/app/lab/api-hacking/api-hacking1/api/delete_image.php
+++ b/app/lab/api-hacking/api-hacking1/api/delete_image.php
@@ -12,14 +12,14 @@
if (file_exists($targetFile) && unlink($targetFile)) {
$response['success'] = true;
- $response['message'] = "Image deleted successfully.";
+ $response['message'] = $strings['success2'];
} else {
$response['success'] = false;
- $response['message'] = "Error deleting the image.";
+ $response['message'] = $strings['deleteerr'];
}
} else {
$response['success'] = false;
- $response['message'] = "Invalid request method.";
+ $response['message'] = $strings['requestmethod'];
}
echo json_encode($response);
diff --git a/app/lab/api-hacking/api-hacking1/api/get_images.php b/app/lab/api-hacking/api-hacking1/api/get_images.php
index 2a5a433..fa216b5 100644
--- a/app/lab/api-hacking/api-hacking1/api/get_images.php
+++ b/app/lab/api-hacking/api-hacking1/api/get_images.php
@@ -1,7 +1,19 @@
diff --git a/app/lab/api-hacking/api-hacking1/api/logout.php b/app/lab/api-hacking/api-hacking1/api/logout.php
new file mode 100644
index 0000000..632e419
--- /dev/null
+++ b/app/lab/api-hacking/api-hacking1/api/logout.php
@@ -0,0 +1,8 @@
+ true);
+echo json_encode($response);
diff --git a/app/lab/api-hacking/api-hacking1/api/reset_images.php b/app/lab/api-hacking/api-hacking1/api/reset_images.php
new file mode 100644
index 0000000..25e6680
--- /dev/null
+++ b/app/lab/api-hacking/api-hacking1/api/reset_images.php
@@ -0,0 +1,35 @@
+
diff --git a/app/lab/api-hacking/api-hacking1/api/top_secret/top_secret.txt b/app/lab/api-hacking/api-hacking1/api/top_secret/top_secret.txt
deleted file mode 100644
index 2c565df..0000000
--- a/app/lab/api-hacking/api-hacking1/api/top_secret/top_secret.txt
+++ /dev/null
@@ -1,34 +0,0 @@
-This file is highly classified. PLEASE DON'T DELETE.
-
-GTA 5 CHEAT CODES FOR PC
-Become Invincible PAINKILLER
-Get all Weapons TOOLUP
-Full Health and Armour TURTLE
-Spawn a Motorcycle ROCKET
-Spawn a sports car COMET
-Swim Faster GOTGILLS
-Spawn an Armed Helicopter BUZZOFF
-Get a Parachute SKYDIVE
-Decrease Wanted Level LAWYERUP
-Improve Aiming DEADEYE
-Recharge Special Ability POWERUP
-Run Faster CATCHME
-Jump Higher GOTGILLS
-Increase Wanted Level FUGITIVE
-Exploding Punch HOTHANDS
-Bullets that explode HIGHEX
-Flaming Bullets INCENDIARY
-Get Character Drunk LIQUOR
-Fall from the Sky SKYFALL
-Change Weather MAKEITRAIN
-Slippery Cars on the Road SNOWDAY
-Activate Low Gravity FLOATER
-Play the Game in Slow Motion SLOWMO
-Spawn a Garbage Truck TRASHED
-Spawn a Stunt Plane BARNSTORM
-Spawn a BMW Bicycle BANDIT
-Spawn a Crop Duster Plane FLYSPRAY
-Spawn a Golf Cart HOLEIN1
-Spawn a different Sports Car RAPIDGT
-Spawn a Limousine VINEWOOD
-Spawn a Dirt Bike OFFROAD
\ No newline at end of file
diff --git a/app/lab/api-hacking/api-hacking1/api/upload.php b/app/lab/api-hacking/api-hacking1/api/upload.php
index 4799fa4..ef7d96c 100644
--- a/app/lab/api-hacking/api-hacking1/api/upload.php
+++ b/app/lab/api-hacking/api-hacking1/api/upload.php
@@ -1,23 +1,48 @@
'1',
+ 'username' => 'admin',
+ 'password' => 'admin'
+);
+$userInfo2 = array(
+ 'id' => '2',
+ 'username' => 'user',
+ 'password' => 'user'
+);
+$userInfo = array(
+ 'id' => '3',
+ 'username' => 'user2',
+ 'password' => 'user2'
+);
+$userInfo = array(
+ 'id' => '4',
+ 'username' => 'user3',
+ 'password' => 'user3'
+);
+$userInfo = array(
+ 'id' => '5',
+ 'username' => 'user3',
+ 'password' => 'user3'
+);
+
+$userData = array($userInfo);
+
+$jsonData = json_encode($userData);
+
+file_put_contents('users.json', $jsonData);
+
+?>
\ No newline at end of file
diff --git a/app/lab/api-hacking/api-hacking1/dashboard.php b/app/lab/api-hacking/api-hacking1/dashboard.php
index 916cceb..c317c08 100644
--- a/app/lab/api-hacking/api-hacking1/dashboard.php
+++ b/app/lab/api-hacking/api-hacking1/dashboard.php
@@ -1,6 +1,7 @@
@@ -23,6 +44,10 @@