Skip to content

Commit 299ef34

Browse files
zachroofseczachroofsec
committed
Updating for Clickjacking episode
1 parent 5b9ecb3 commit 299ef34

418 files changed

Lines changed: 103481 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎ep12-clickjacking/docker-compose.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
version: '3.3'
2+
services:
3+
juiceshop:
4+
build: ./juiceshop
5+
image: securingthestack/juiceshop:syntaxcon
6+
ports:
7+
- 3000:3000
8+
9+
networks:
10+
vulnerable-net:
11+
driver: bridge

‎ep12-clickjacking/juiceshop/.appveyor.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
version: '{build}'
2+
init:
3+
- 'git config --global core.autocrlf true'
4+
branches:
5+
except:
6+
- gh-pages
7+
- l10n_develop
8+
environment:
9+
matrix:
10+
- nodejs_version: 9
11+
- nodejs_version: 8
12+
platform:
13+
- x64
14+
install:
15+
- ps: 'Install-Product node $env:nodejs_version $env:platform'
16+
- 'node --version && npm --version'
17+
- 'if exist node_modules rd /Q /S node_modules'
18+
- 'npm install --production'
19+
- 'node_modules\.bin\grunt package'
20+
build: off
21+
test: off
22+
matrix:
23+
fast_finish: true
24+
artifacts:
25+
-
26+
path: 'dist\*'
27+
deploy:
28+
-
29+
provider: GitHub
30+
draft: true
31+
auth_token:
32+
secure: bFkucwU1Zoh4EgzKmTAwONzQxuWPWrPGa+yXgadKQRd2jz5JPDZEw1f1vz2r+7i1
33+
on:
34+
appveyor_repo_tag: true
35+
notifications:
36+
-
37+
provider: Slack
38+
incoming_webhook:
39+
secure: KzO8e88B0LKqAI0BQM6lNhCIn9rxAava3AcdVJDyTw420OLIAlK+qzzbLXaR0jSH9zIJz9zu0iGS1iaqu9Co+6owYUrHJlBGrUZ/lZNCsDo=
40+
on_build_success: false
41+
on_build_failure: false
42+
on_build_status_changed: true

‎ep12-clickjacking/juiceshop/.codeclimate.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
engines:
2+
eslint:
3+
enabled: true
4+
csslint:
5+
enabled: true
6+
fixme:
7+
enabled: true
8+
ratings:
9+
paths:
10+
- '**.js'
11+
- '**.css'
12+
checks:
13+
method-complexity:
14+
config:
15+
threshold: 7
16+
similar-code:
17+
enabled: false
18+
identical-code:
19+
enabled: false
20+
exclude_paths:
21+
- 'app/private/**/*'
22+
- 'app/css/geo-bootstrap/**/*'
23+
- 'data/datacreator.js'
24+
- 'vagrant/shake.js'
25+
- 'Gruntfile.js'
26+
- '*conf.js'

‎ep12-clickjacking/juiceshop/.dockerignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
.git/
2+
node_modules/
3+
screenshots/
4+
test/
5+
build/
6+
dist/
7+
vagrant/

‎ep12-clickjacking/juiceshop/.github/stale.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
daysUntilStale: 84
3+
daysUntilClose: 14
4+
exemptLabels:
5+
- bounty
6+
- challenge
7+
- enhancement
8+
- technical debt
9+
staleLabel: stale
10+
markComment: >
11+
This issue has been automatically marked as stale because it has not had
12+
recent activity. It will be _closed in two weeks_ if no further activity occurs.
13+
:heart: Thank you for your contributions to [OWASP Juice Shop](http://owasp-juice.shop)!
14+
closeComment: false

‎ep12-clickjacking/juiceshop/.gitignore‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
*.log*
2+
*.out
3+
.audit.json
4+
build/
5+
.stryker-tmp/
6+
.nyc_output/
7+
vagrant/.vagrant/
8+
juiceshop.sqlite
9+
10+
# Intellij
11+
.idea/
12+
*.iml
13+
*.iws
14+
*.eml
15+
out/
16+
17+
# VIM swap files
18+
*.swp
19+
20+
# Vs Code
21+
.vscode/
22+
23+
# Orig from merges
24+
*.orig
25+
26+
# NPM
27+
node_modules/
28+
npm-debug.log.*
29+
package-lock.json
30+
31+
# App
32+
dist/
33+
order_*.pdf
34+
app/index.html
35+
app/private/threejs-demo.html
36+
37+
# GitHub-Pages Branch
38+
assets/
39+
40+
# Favicons downloaded during customizazion
41+
app/public/*.*
42+
!app/public/favicon_ctf.ico
43+
!app/public/favicon_v2.ico
44+
45+
# Logos downloaded during customizazion
46+
app/public/images/*.*
47+
!app/public/images/JuiceShop*.*
48+
!app/public/images/ribbons/forkme_right_orange.png
49+
50+
# Product images downloaded during customizazion
51+
app/public/images/products/*.*
52+
!app/public/images/products/apple_juice.jpg
53+
!app/public/images/products/artwork.jpg
54+
!app/public/images/products/apple_pressings.jpg
55+
!app/public/images/products/banana_juice.jpg
56+
!app/public/images/products/eggfruit_juice.jpg
57+
!app/public/images/products/fan_girlie.jpg
58+
!app/public/images/products/fan_hoodie.jpg
59+
!app/public/images/products/fan_mug.jpg
60+
!app/public/images/products/fan_shirt.jpg
61+
!app/public/images/products/fruit_press.jpg
62+
!app/public/images/products/green_smoothie.jpg
63+
!app/public/images/products/lemon_juice.jpg
64+
!app/public/images/products/orange_juice.jpg
65+
!app/public/images/products/owasp_osaft.jpg
66+
!app/public/images/products/owasplogo.png
67+
!app/public/images/products/quince.jpg
68+
!app/public/images/products/raspberry_juice.jpg
69+
!app/public/images/products/sticker.png
70+
!app/public/images/products/undefined.png
71+
!app/public/images/products/white_raffards.jpg
72+
!app/public/images/products/woodruff_syrup.jpg
73+
!app/public/images/products/carrot_juice.jpeg
74+
!app/public/images/products/strawberry_juice.jpeg
75+
!app/public/images/products/melon_bike.jpeg
76+
!app/public/images/products/3d_keychain.jpg
77+
!app/public/images/products/waspy.png
78+
!app/public/images/products/jawa_script.jpg
79+
!app/public/images/products/thingie1.jpg
80+
!app/public/images/products/Wooden-crutch.jpg
81+
!app/public/images/products/JuiceShop.stl
82+
!app/public/images/products/squareBox1-40x40x40.stl
83+
!app/public/images/products/crutch.123dx
84+
!app/public/images/products/stickersheet_se.png
85+
!app/public/images/products/cover_small.jpg
86+
!app/public/images/products/iron-on.jpg
87+
!app/public/images/products/magnets.jpg
88+
!app/public/images/products/sticker_page.jpg
89+
!app/public/images/products/sticker_single.jpg
90+
!app/public/images/products/tattoo.jpg
91+
!app/public/images/products/velcro-patch.jpg
92+
93+
!app/public/country-mapping.json
94+
95+
# Custom configuration files
96+
config/*.yml
97+
!config/bodgeit.yml
98+
!config/ctf.yml
99+
!config/fbctf.yml
100+
!config/default.yml
101+
!config/sickshop.yml
102+
!config/juicebox.yml
103+
!config/quiet.yml
104+
!config/test.yml
105+
!config/7ms.yml
106+
!config/mozilla.yml
107+
108+
# Custom easter egg planetary texture files
109+
app/private/*.jpg
110+
app/private/*.jpeg
111+
app/private/*.png
112+
app/private/*.gif
113+
!app/private/earth_normalmap_flat4k.jpg
114+
!app/private/earthspec4k.jpg
115+
!app/private/fair_clouds_4k.png
116+
!app/private/orangemap2k.jpg
117+
!app/private/starry_background.jpg
118+
!app/private/under-construction.gif

‎ep12-clickjacking/juiceshop/.lgtm.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
path_classifiers:
2+
library:
3+
- app/private
4+
- vagrant/shake.js
5+
queries:
6+
-
7+
exclude: js/missing-token-validation

‎ep12-clickjacking/juiceshop/.nsprc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"exceptions": [
3+
"https://nodesecurity.io/advisories/122",
4+
"https://nodesecurity.io/advisories/33",
5+
"https://nodesecurity.io/advisories/55",
6+
"https://nodesecurity.io/advisories/42",
7+
"https://nodesecurity.io/advisories/3",
8+
"https://nodesecurity.io/advisories/28",
9+
"https://nodesecurity.io/advisories/29",
10+
"https://nodesecurity.io/advisories/56",
11+
"https://nodesecurity.io/advisories/32",
12+
"https://nodesecurity.io/advisories/134",
13+
"https://nodesecurity.io/advisories/135",
14+
"https://nodesecurity.io/advisories/118",
15+
"https://nodesecurity.io/advisories/120",
16+
"https://nodesecurity.io/advisories/106",
17+
"https://nodesecurity.io/advisories/109",
18+
"https://nodesecurity.io/advisories/112",
19+
"https://nodesecurity.io/advisories/102",
20+
"https://nodesecurity.io/advisories/154",
21+
"https://nodesecurity.io/advisories/17",
22+
"https://nodesecurity.io/advisories/88",
23+
"https://nodesecurity.io/advisories/532",
24+
"https://nodesecurity.io/advisories/548",
25+
"https://nodesecurity.io/advisories/566"
26+
]
27+
}

‎ep12-clickjacking/juiceshop/.travis.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
language: node_js
2+
node_js:
3+
- 9
4+
- 8
5+
branches:
6+
except:
7+
- gh-pages
8+
- l10n_develop
9+
addons:
10+
apt:
11+
packages:
12+
- xvfb
13+
chrome: stable
14+
code_climate:
15+
repo_token:
16+
secure: NC3ew4c92DO4SAdbJvaZkaRnEZaZcAr9NcxOeraqAKHRXY3COnerWGR8+kIE9KiadcRdatmu0sSjWldDcAZfmMwOraMI9CDkqdPSjtjciCVEFdGi+OPOvMY/gOJU6XeM7lsO5MvYD7mqChl2gR6s7IO/klPahf53c97PPDo3C90=
17+
env:
18+
global:
19+
- 'DISPLAY=:99'
20+
before_install:
21+
- 'rm -rf node_modules'
22+
before_script:
23+
- 'npm install grunt-cli -g'
24+
- 'sh -e /etc/init.d/xvfb start'
25+
- 'sleep 3'
26+
script:
27+
- 'travis_wait npm test && npm run frisby && NODE_ENV=ctf npm run protractor'
28+
after_success:
29+
- './node_modules/.bin/lcov-result-merger ''build/reports/coverage/*/lcov.info'' ''build/reports/coverage/lcov_merged.info'''
30+
- './node_modules/.bin/codeclimate-test-reporter < ./build/reports/coverage/lcov_merged.info'
31+
notifications:
32+
email:
33+
- secure: ADLqaNm7lR8sgCkSz7eWtWdm8zZ9OsbkcQAi2nm7hQPWAkTWPfr9qeOBh39Z3PZvkgDdlUpNZc/uPlcEGEILznJRF3HlQjWrWksNNtY3xaRc01B4uXlDbODjttb6v9mOqkwUqRfQLeerOqNynNSkT129+mz4FANn0+oucZ3EuQc=
34+
- secure: HhhSoqY87yd8Hkt+cfXk9XXDJeWViYQoPq8f7SJofkwSWtxfOS9GNbOUehZJDqjBMARoGi3SJBImRbisnwfMcEhKpSZs2S4Osdwk2Ayy0h8V/O+qHhiEuJq1mPbAWrYNGQerz16Ec4SbX6hPnAEle2SUwjbPUnfRRCROsJqfm0o=
35+
webhooks:
36+
urls:
37+
- secure: QZ3/2h7hThg527PX1z7kTTRGL5jEbTTHRbetYHt8Gzgdhvtruq4cjxMQZdUcmxKlncAhoB976iFl/Ja9EpExgrXnt/Tj0Aft6JDc7g8y0kuD/SiQpFT7d46R7vOTJeFHyMzfQN9M/h81DXrG+VO5OPGR/QYNa39kMzkTc86tt1E=
38+
on_success: always
39+
on_failure: always
40+
on_start: never
41+
slack:
42+
rooms:
43+
secure: bQlLJ6OvyWUWO51eYjPlEwuGApdYEsqBa8He4gKcTFdjTE6lLxrdu0QE6y1iIroN5+QOk4QpwIYaeWxhgrtVqTNrq9iWnhRR8agcXMPBh1cHnh8EZO6yuC3JE1dd2syKe5Vds67w6KbJedX5GNRg2SVLrL2mHq2syvWAD17BcoI=
44+
on_success: change
45+
on_failure: change
46+
on_start: never
47+
on_pull_requests: false
48+
before_deploy:
49+
- 'rm -rf node_modules'
50+
- 'npm install --production'
51+
- 'grunt package'
52+
deploy:
53+
- provider: heroku
54+
api_key:
55+
secure: faVT3Ne/O7lVo0+pTm6RcXss0ivvSoODaxMkiVwdpk/51/EsRd4+/Gjmp3RGPmW5H5luOephsI8uFMMhgKiu5i3NV58ZSx29Z0aby+bfIhesZGZqJQvxeW8B0J8vlQFnEHP6xc6SAlXSdNjNpDeBaV7WSFSGKGp4Nh5QyO2ySLI=
56+
app:
57+
master: juice-shop
58+
develop: juice-shop-staging
59+
on:
60+
repo: bkimminich/juice-shop
61+
node: 9
62+
- provider: releases
63+
overwrite: true
64+
api_key:
65+
secure: fHybcH65ZdS5ITVKH2tIVBITVSiRQJ1AuWqLP16gyAz5pdmWbLM5gA/74zCozanRmuB+7pGFbhDNm075JWoEDVrWSFDLnNiXvfgUYa4oVEiWZlLvOfSARaU3AQPlVvFVhIbG9SA5IEwTtNFbyHjqLjGn/DSBpiIDqqxhF57vw7Q=
66+
file: dist/*
67+
skip_cleanup: true
68+
file_glob: true
69+
draft: true
70+
tag_name: $TRAVIS_TAG
71+
on:
72+
repo: bkimminich/juice-shop
73+
tags: true

‎ep12-clickjacking/juiceshop/CODE_OF_CONDUCT.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
6+
7+
## Our Standards
8+
9+
Examples of behavior that contributes to creating a positive environment include:
10+
11+
* Using welcoming and inclusive language
12+
* Being respectful of differing viewpoints and experiences
13+
* Gracefully accepting constructive criticism
14+
* Focusing on what is best for the community
15+
* Showing empathy towards other community members
16+
17+
Examples of unacceptable behavior by participants include:
18+
19+
* The use of sexualized language or imagery and unwelcome sexual attention or advances
20+
* Trolling, insulting/derogatory comments, and personal or political attacks
21+
* Public or private harassment
22+
* Publishing others' private information, such as a physical or electronic address, without explicit permission
23+
* Other conduct which could reasonably be considered inappropriate in a professional setting
24+
25+
## Our Responsibilities
26+
27+
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
28+
29+
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
30+
31+
## Scope
32+
33+
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
34+
35+
## Enforcement
36+
37+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [email protected]. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
38+
39+
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
40+
41+
## Attribution
42+
43+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
44+
45+
[homepage]: http://contributor-covenant.org
46+
[version]: http://contributor-covenant.org/version/1/4/

0 commit comments

Comments
 (0)