sudebozkurt · sudebozkurt · Feb 3, 2024 · Feb 5, 2024 · Feb 7, 2024 · Feb 7, 2024
diff --git a/Dockerfile b/Dockerfile
@@ -17,6 +17,7 @@ RUN apt-get install -y \
 	php-cgi \
 	php-cli \
 	php-common \
+	php-gd 	\
 	php-curl \
 	php-dev \
 	php-json \

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 <!-- PROJECT LOGO -->
 <p align="center">
-  <a href="https://siberyavuzlar.com">
+  <a href="https://yavuzlar.org">
     <img src="https://i.ibb.co/nDLHW7m/logomodern.png" alt="Logo" width="180" height="180">
   </a>
 
@@ -30,6 +30,9 @@
 * Broken Authentication
 * Race Condition
 * Server Side Template Injection (SSTI)
+* API Hacking
+* Captcha Bypass
+* Path Traversal
 
 <!-- Installation -->
 ## Installation
@@ -42,7 +45,7 @@
    ```
 2. Go to http://localhost:1337
 
-### Manuel Installation
+### Manual Installation
 
 1. Clone the repo
    ```sh

diff --git a/app/lab/api-hacking/api-hacking1/all_wallpapers.php b/app/lab/api-hacking/api-hacking1/all_wallpapers.php
@@ -0,0 +1,52 @@
+<?php
+require("../../../lang/lang.php");
+$strings = tr();
+
+$uploadDirectory = '../api-hacking1/api/uploads/';
+$images = scandir($uploadDirectory);
+
+$images = array_diff($images, array('..', '.'));
+
+?>
+
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>API Hacking</title>
+    <!-- Bootstrap CSS -->
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
+</head>
+<body>
+
+<div class="container mt-5">
+    <button type="button" class="btn btn-primary mt-2" onclick="backToLoginPage()"><?php echo $strings['backtologin']; ?></button>
+    <p></p>
+    <div class="row">
+        <?php foreach ($images as $image) : ?>
+            <div class="col-md-4 mb-4">
+                <div class="card h-100">
+                    <img src="<?= $uploadDirectory . $image ?>" class="card-img-top" alt="<?= $image ?>">
+                    <div class="card-body text-center">
+                        <h5 class="card-title"><?= $image ?></h5>
+                    </div>
+                </div>
+            </div>
+        <?php endforeach; ?>
+    </div>
+
+    <div class="mt-3">
+    </div>
+</div>
+
+<!-- Bootstrap JS and Popper.js (required for Bootstrap JavaScript plugins) -->
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
+<script id="VLBar" title="<?= $strings['title'] ?>" category-id="13" src="/public/assets/js/vlnav.min.js"></script>
+<script>
+    function backToLoginPage() {
+        window.location.href = 'index.php'; 
+    }
+</script>
+</body>
+</html>
diff --git a/app/lab/api-hacking/api-hacking1/api.php b/app/lab/api-hacking/api-hacking1/api.php
diff --git a/app/lab/api-hacking/api-hacking1/api/all_wallpapers.php b/app/lab/api-hacking/api-hacking1/api/all_wallpapers.php
@@ -0,0 +1,43 @@
+<?php
+$uploadDirectory = '../api/uploads/';
+$images = scandir($uploadDirectory);
+
+$images = array_diff($images, array('..', '.'));
+
+?>
+
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>API Hacking</title>
+    <!-- Bootstrap CSS -->
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
+</head>
+<body>
+
+<div class="container mt-5">
+    <p></p>
+    <div class="row">
+        <?php foreach ($images as $image) : ?>
+            <div class="col-md-4 mb-4">
+                <div class="card h-100">
+                    <img src="<?= $uploadDirectory . $image ?>" class="card-img-top" alt="<?= $image ?>">
+                    <div class="card-body text-center">
+                        <h5 class="card-title"><?= $image ?></h5>
+                    </div>
+                </div>
+            </div>
+        <?php endforeach; ?>
+    </div>
+
+    <div class="mt-3">
+    </div>
+</div>
+
+<!-- Bootstrap JS and Popper.js (required for Bootstrap JavaScript plugins) -->
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
+<script id="VLBar" title="<?= $strings['title'] ?>" category-id="13" src="/public/assets/js/vlnav.min.js"></script>
+</body>
+</html>
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_delete_me.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_delete_me.jpg
diff --git a/...ng1/api/backup_images/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg b/...ng1/api/backup_images/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg
diff --git a/...-hacking1/api/backup_images/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg b/...-hacking1/api/backup_images/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/1_wp4945601.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/1_wp4945601.jpg
diff --git a/...-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg → ...-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg b/...-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg → ...-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg
diff --git a/...Us-2-video-games-PlayStation-4-screen.jpg → ...Us-2-video-games-PlayStation-4-screen.jpg b/...Us-2-video-games-PlayStation-4-screen.jpg → ...Us-2-video-games-PlayStation-4-screen.jpg
diff --git a/...backup_images/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png b/...backup_images/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/3_544298.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/3_544298.jpg
diff --git a/...api-hacking1/api/backup_images/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg b/...api-hacking1/api/backup_images/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg
diff --git a/...acking1/api/backup_images/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg b/...acking1/api/backup_images/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg
diff --git a/...i-hacking/api-hacking1/api/backup_images/4_130672-lara-croft-tomb-raider-5k.jpg b/...i-hacking/api-hacking1/api/backup_images/4_130672-lara-croft-tomb-raider-5k.jpg
diff --git a/...i-hacking/api-hacking1/api/backup_images/4_b610a778f896dbcb966e0d6083db2460.jpg b/...i-hacking/api-hacking1/api/backup_images/4_b610a778f896dbcb966e0d6083db2460.jpg
diff --git a/...g/api-hacking1/api/backup_images/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg b/...g/api-hacking1/api/backup_images/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/5_3105122.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/5_3105122.jpg
diff --git a/...-hacking/api-hacking1/api/backup_images/5_d027bacc775eea447f19eb18b352c024.jpeg b/...-hacking/api-hacking1/api/backup_images/5_d027bacc775eea447f19eb18b352c024.jpeg
diff --git a/app/lab/api-hacking/api-hacking1/api/backup_images/5_wp10244267.jpg b/app/lab/api-hacking/api-hacking1/api/backup_images/5_wp10244267.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/delete_image.php b/app/lab/api-hacking/api-hacking1/api/delete_image.php
@@ -12,14 +12,14 @@
 
     if (file_exists($targetFile) && unlink($targetFile)) {
         $response['success'] = true;
-        $response['message'] = "Image deleted successfully.";
+        $response['message'] = $strings['success2'];
     } else {
         $response['success'] = false;
-        $response['message'] = "Error deleting the image.";
+        $response['message'] = $strings['deleteerr'];
     }
 } else {
     $response['success'] = false;
-    $response['message'] = "Invalid request method.";
+    $response['message'] = $strings['requestmethod'];
 }
 
 echo json_encode($response);

diff --git a/app/lab/api-hacking/api-hacking1/api/get_images.php b/app/lab/api-hacking/api-hacking1/api/get_images.php
@@ -1,7 +1,19 @@
 <?php
+session_start();
+
 $uploadDirectory = '../api/uploads/';
 
-$images = array_diff(scandir($uploadDirectory), array('..', '.'));
+if (isset($_SESSION['user_id'])) {
+    $userId = $_SESSION['user_id'];
+
+    $images = array_filter(scandir($uploadDirectory), function ($image) use ($userId) {
+        //Check if the number at the beginning of the file name matches the user ID.
+        preg_match('/^(\d+)_/', $image, $matches);
+        return isset($matches[1]) && $matches[1] == $userId;
+    });
 
-echo json_encode(array_values($images));
+    echo json_encode(array_values($images));
+} else {
+    echo json_encode([]);
+}
 ?>
diff --git a/app/lab/api-hacking/api-hacking1/api/logout.php b/app/lab/api-hacking/api-hacking1/api/logout.php
@@ -0,0 +1,8 @@
+<?php
+session_start();
+
+session_unset();
+session_destroy();
+
+$response = array('success' => true);
+echo json_encode($response);
diff --git a/app/lab/api-hacking/api-hacking1/api/reset_images.php b/app/lab/api-hacking/api-hacking1/api/reset_images.php
@@ -0,0 +1,35 @@
+<?php
+
+header("Content-Type: application/json");
+
+$response = array();
+
+$backupDirectory = __DIR__ . '/backup_images/';
+
+if (!file_exists($backupDirectory)) {
+    $response['success'] = false;
+    echo json_encode($response);
+    exit;
+}
+
+$uploadDirectory = 'uploads/';
+
+$files = glob($uploadDirectory . '*'); 
+foreach ($files as $file) {
+    if (is_file($file)) {
+        unlink($file); 
+    }
+}
+
+$backupFiles = glob($backupDirectory . '*');
+foreach ($backupFiles as $backupFile) {
+    if (is_file($backupFile)) {
+        $targetFile = $uploadDirectory . basename($backupFile);
+        copy($backupFile, $targetFile); 
+    }
+}
+
+$response['success'] = true;
+$response['message'] = $strings['reset'];
+echo json_encode($response);
+?>
diff --git a/app/lab/api-hacking/api-hacking1/api/top_secret/top_secret.txt b/app/lab/api-hacking/api-hacking1/api/top_secret/top_secret.txt
diff --git a/app/lab/api-hacking/api-hacking1/api/upload.php b/app/lab/api-hacking/api-hacking1/api/upload.php
@@ -1,23 +1,48 @@
 <?php
 
+session_start();
 header("Content-Type: application/json");
 
 $response = array();
 
 $uploadDirectory = 'uploads/';
 
-if (!is_dir($uploadDirectory)) {
-    mkdir($uploadDirectory, 0755, true);
+// Check the user's identity.
+if (!isset($_SESSION['user_id'])) {
+    $response['success'] = false;
+    $response['message'] = $strings['authenticate'];
+    echo json_encode($response);
+    exit;
+}
+
+$userId = $_SESSION['user_id'];
+
+// Check the allowed file types.
+$allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
+if (!in_array($_FILES['image']['type'], $allowedTypes)) {
+    $response['success'] = false;
+    $response['message'] = $strings['invalidtype'] . implode(', ', $allowedTypes);
+    echo json_encode($response);
+    exit;
 }
 
-$targetFile = $uploadDirectory . basename($_FILES['image']['name']);
+// Create the file name.
+$targetFile = $uploadDirectory . $userId . '_' . basename($_FILES['image']['name']);
+
+// Check if a file with the same name exists.
+if (file_exists($targetFile)) {
+    $response['success'] = false;
+    $response['message'] = $strings['samename'];
+    echo json_encode($response);
+    exit;
+}
 
 if (move_uploaded_file($_FILES['image']['tmp_name'], $targetFile)) {
     $response['success'] = true;
-    $response['message'] = "The upload process has been successfully completed.";
+    $response['message'] = $strings['success1'];
 } else {
     $response['success'] = false;
-    $response['message'] = "An error occurred while uploading the file.";
+    $response['message'] = $strings['uploaderr'];
 }
 
 echo json_encode($response);

diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/1_delete_me.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/1_delete_me.jpg
diff --git a/...-hacking1/api/uploads/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg b/...-hacking1/api/uploads/1_rick-and-morty-macbook-2880-x-1800-g3s43t1cye39jx5s.jpg
diff --git a/...ng/api-hacking1/api/uploads/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg b/...ng/api-hacking1/api/uploads/1_rick-and-morty-sunglasses-pink-blue-wallpaper.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/1_wp4945601.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/1_wp4945601.jpg
diff --git a/...ing1/api/uploads/2_1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg b/...ing1/api/uploads/2_1458290-The-Last-of-Us-2-Naughty-Dog-Sony-Playstation-4K.jpg
diff --git a/...ng1/api/uploads/2_1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg b/...ng1/api/uploads/2_1491251-The-Last-of-Us-2-video-games-PlayStation-4-screen.jpg
diff --git a/...1/api/uploads/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png b/...1/api/uploads/2_425331-The-Last-of-Us-2-video-games-artwork-post-apocalypse.png
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/3_544298.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/3_544298.jpg
diff --git a/...cking/api-hacking1/api/uploads/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg b/...cking/api-hacking1/api/uploads/3_mr-robot-control-illusion-3t2s38ni80wrmasf.jpg
diff --git a/.../api-hacking1/api/uploads/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg b/.../api-hacking1/api/uploads/3_mr-robot-mask-f-society-artwork-4k-on-2880x1800.jpg
diff --git a/...i-hacking/api-hacking1/api/uploads/449364-The-Last-of-Us-2-Naughty-Dog-Sony.jpg b/...i-hacking/api-hacking1/api/uploads/449364-The-Last-of-Us-2-Naughty-Dog-Sony.jpg
diff --git a/...lab/api-hacking/api-hacking1/api/uploads/4_130672-lara-croft-tomb-raider-5k.jpg b/...lab/api-hacking/api-hacking1/api/uploads/4_130672-lara-croft-tomb-raider-5k.jpg
diff --git a/...lab/api-hacking/api-hacking1/api/uploads/4_b610a778f896dbcb966e0d6083db2460.jpg b/...lab/api-hacking/api-hacking1/api/uploads/4_b610a778f896dbcb966e0d6083db2460.jpg
diff --git a/...hacking/api-hacking1/api/uploads/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg b/...hacking/api-hacking1/api/uploads/4_tomb-raider-dark-sea-hd-lt4fxkxaz442tu1s.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/5_3105122.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/5_3105122.jpg
diff --git a/...ab/api-hacking/api-hacking1/api/uploads/5_d027bacc775eea447f19eb18b352c024.jpeg b/...ab/api-hacking/api-hacking1/api/uploads/5_d027bacc775eea447f19eb18b352c024.jpeg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/5_wp10244267.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/5_wp10244267.jpg
diff --git a/...i-hacking/api-hacking1/api/uploads/921816-The-Last-of-Us-2-Naughty-Dog-Sony.jpg b/...i-hacking/api-hacking1/api/uploads/921816-The-Last-of-Us-2-Naughty-Dog-Sony.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/TLOU2_Ellie.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/TLOU2_Ellie.jpg
diff --git a/...st-of-us-2-farm-house-sunrise-hd-wallpaper-d9a0980d014abddb2657887f40c136ad.jpg b/...st-of-us-2-farm-house-sunrise-hd-wallpaper-d9a0980d014abddb2657887f40c136ad.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/uploads/i-love-robots.jpg b/app/lab/api-hacking/api-hacking1/api/uploads/i-love-robots.jpg
diff --git a/...ellie-screen-shot-video-games-hd-wallpaper-6896ed88d0b0bcc8a0fc011ec8a2942a.jpg b/...ellie-screen-shot-video-games-hd-wallpaper-6896ed88d0b0bcc8a0fc011ec8a2942a.jpg
diff --git a/app/lab/api-hacking/api-hacking1/api/users.json b/app/lab/api-hacking/api-hacking1/api/users.json
@@ -0,0 +1,7 @@
+[
+    {"id":"1", "username":"admin", "password":"admin"},
+    {"id":"2","username":"user","password":"user"},
+    {"id":"3","username":"user2","password":"user2"},
+    {"id":"4","username":"user3","password":"user3"},
+    {"id":"5","username":"user4","password":"user4"}
+]