<?php
$user = $_COOKIE['user:'];
echo "<a onclick='showHint();'>Show Hints</a>";
if($user == "guest")
{
echo "<center><p>Guests are not allowed to edit this blog, please sign up for an account or login<br /><a href='index.php'>Login</a></p></center>";	
echo "<div>";
echo "<p id='hint' style='visibility: hidden'><br />admin wrote: Welcome to my blog, this page is vulnerable to a few different things.<br />1) Of course Xss<br />Yes the textarea is vulnerable try it out.<br />2) RFI - Remote File Inclusion<br />Through the use of RFI an attacker can specify an external file to be included in the page through the address bar.  Misconfigured servers that allow URL page access will allow you to access a page stored on another website. For instance erase everything after the = sign, and type http://www.milw0rm.com.<br />It should look like this: <b>http://owaspbwa/ghost/iframe.php?page=http://www.milw0rm.com</b><br />As you can see, milw0rm loads in this page.<br />3)LFI - Local File Inclusion<br />Through the use of LFI, an attacker could possibly view pages that they weren't meant to see. For instance this string from your address bar right now: ?page=form.php. If you everything after the = sign and type in the name of another file on the site it will load in the browser. Let's try it. Type in ?page=index.php. As you can see the original textarea is still there, and it loads the login page.<br />4) Iframe Injection - The whole site is vulnerable to iframe injection. This will be the first spot that I will cover it. Iframe injection is very simple let's give it a go. In the text area type <b>&lt;iframe src='http://www.milw0rm.com'&gt;&lt;/iframe&gt;</b><br />As you can see there is a new frame inside of the page with milw0rm loaded inside of it. Many iframe injections cannot be seen, this can be done by adding visibility='hidden' or height='0' and width='0'. Invisible iframes riddle many websites, they are used to inject viruses, spread worms, clickjacking, credential stealing, or possibly to gain a shell through exploit code that implements reverse tcp connections or possibly uploads a backdoor to a visitors computer. More about this on many websites that cover using netcat, or metasploit.<br />5) Html / Form Injection - You can inject a form, or any other html tag into this blog. I tested it with the cookieMonster.php program I made, this can be a way for an attacker to steal credentials, perform click jacking, or just about any other attack one could think of.</div></p>".include('blogSub.php');
}

else if($user == "admin")
{
echo "<p>Welcome admin use the form below to add to the blog";
echo "<center><form method='post' action='blogView.php'>";
echo "<textarea name='vuln' height='300px' width='400px'></textarea><br />";
echo "<input type='hidden' name='user' value='".$user."' />";
echo "<input type='submit'>";
echo "</form></center></p>";
echo "<div>";
echo "<p id='hint' style='visibility: hidden'><br />admin wrote: Welcome to my blog, this page is vulnerable to a few different things.<br />1) Of course Xss<br />Yes the textarea is vulnerable try it out.<br />2) RFI - Remote File Inclusion<br />Through the use of RFI an attacker can specify an external file to be included in the page through the address bar.  Misconfigured servers that allow URL page access will allow you to access a page stored on another website. For instance erase everything after the = sign, and type http://www.milw0rm.com.<br />It should look like this: <b>http://owaspbwa/ghost/iframe.php?page=http://www.milw0rm.com</b><br />As you can see, milw0rm loads in this page.<br />3)LFI - Local File Inclusion<br />Through the use of LFI, an attacker could possibly view pages that they weren't meant to see. For instance this string from your address bar right now: ?page=form.php. If you everything after the = sign and type in the name of another file on the site it will load in the browser. Let's try it. Type in ?page=index.php. As you can see the original textarea is still there, and it loads the login page.<br />4) Iframe Injection - The whole site is vulnerable to iframe injection. This will be the first spot that I will cover it. Iframe injection is very simple let's give it a go. In the text area type <b>&lt;iframe src='http://www.milw0rm.com'&gt;&lt;/iframe&gt;</b><br />As you can see there is a new frame inside of the page with milw0rm loaded inside of it. Many iframe injections cannot be seen, this can be done by adding visibility='hidden' or height='0' and width='0'. Invisible iframes riddle many websites, they are used to inject viruses, spread worms, clickjacking, credential stealing, or possibly to gain a shell through exploit code that implements reverse tcp connections or possibly uploads a backdoor to a visitors computer. More about this on many websites that cover using netcat, or metasploit.<br />5) Html / Form Injection - You can inject a form, or any other html tag into this blog. I tested it with the cookieMonster.php program I made, this can be a way for an attacker to steal credentials, perform click jacking, or just about any other attack one could think of.</div></p>".include('blogSub.php');
}

else if($user == "test")
{
echo "<p>Welcome developer use the form below to add to the blog";
echo "<center><form method='post' action='blogView.php'>";
echo "<textarea name='vuln' height='300px' width='400px'></textarea><br />";
   echo "<input type='hidden' name='user' value='".$user."' />";
echo "<input type='submit'>";
echo "</form></center></p>";
echo "<div>";
echo "<p id='hint' style='visibility: hidden'><br />admin wrote: Welcome to my blog, this page is vulnerable to a few different things.<br />1) Of course Xss<br />Yes the textarea is vulnerable try it out.<br />2) RFI - Remote File Inclusion<br />Through the use of RFI an attacker can specify an external file to be included in the page through the address bar.  Misconfigured servers that allow URL page access will allow you to access a page stored on another website. For instance erase everything after the = sign, and type http://www.milw0rm.com.<br />It should look like this: <b>http://owaspbwa/ghost/iframe.php?page=http://www.milw0rm.com</b><br />As you can see, milw0rm loads in this page.<br />3)LFI - Local File Inclusion<br />Through the use of LFI, an attacker could possibly view pages that they weren't meant to see. For instance this string from your address bar right now: ?page=form.php. If you everything after the = sign and type in the name of another file on the site it will load in the browser. Let's try it. Type in ?page=index.php. As you can see the original textarea is still there, and it loads the login page.<br />4) Iframe Injection - The whole site is vulnerable to iframe injection. This will be the first spot that I will cover it. Iframe injection is very simple let's give it a go. In the text area type <b>&lt;iframe src='http://www.milw0rm.com'&gt;&lt;/iframe&gt;</b><br />As you can see there is a new frame inside of the page with milw0rm loaded inside of it. Many iframe injections cannot be seen, this can be done by adding visibility='hidden' or height='0' and width='0'. Invisible iframes riddle many websites, they are used to inject viruses, spread worms, clickjacking, credential stealing, or possibly to gain a shell through exploit code that implements reverse tcp connections or possibly uploads a backdoor to a visitors computer. More about this on many websites that cover using netcat, or metasploit.<br />5) Html / Form Injection - You can inject a form, or any other html tag into this blog. I tested it with the cookieMonster.php program I made, this can be a way for an attacker to steal credentials, perform click jacking, or just about any other attack one could think of.</div></p>".include('blogSub.php');
}

else if($user == "anonymous")
{
echo "<p>Welcome " . $user . " use the form below to add to the blog";
echo "<center><form method='post' action='blogView.php'>";
echo "<textarea name='vuln' height='300px' width='400px'></textarea><br />";
   echo "<input type='hidden' name='user' value='".$user."' />";
echo "<input type='submit'>";
echo "</form></center></p>";
echo "<div>";
echo "<p id='hint' style='visibility: hidden'><br />admin wrote: Welcome to my blog, this page is vulnerable to a few different things.<br />1) Of course Xss<br />Yes the textarea is vulnerable try it out.<br />2) RFI - Remote File Inclusion<br />Through the use of RFI an attacker can specify an external file to be included in the page through the address bar.  Misconfigured servers that allow URL page access will allow you to access a page stored on another website. For instance erase everything after the = sign, and type http://www.milw0rm.com.<br />It should look like this: <b>http://owaspbwa/ghost/iframe.php?page=http://www.milw0rm.com</b><br />As you can see, milw0rm loads in this page.<br />3)LFI - Local File Inclusion<br />Through the use of LFI, an attacker could possibly view pages that they weren't meant to see. For instance this string from your address bar right now: ?page=form.php. If you everything after the = sign and type in the name of another file on the site it will load in the browser. Let's try it. Type in ?page=index.php. As you can see the original textarea is still there, and it loads the login page.<br />4) Iframe Injection - The whole site is vulnerable to iframe injection. This will be the first spot that I will cover it. Iframe injection is very simple let's give it a go. In the text area type <b>&lt;iframe src='http://www.milw0rm.com'&gt;&lt;/iframe&gt;</b><br />As you can see there is a new frame inside of the page with milw0rm loaded inside of it. Many iframe injections cannot be seen, this can be done by adding visibility='hidden' or height='0' and width='0'. Invisible iframes riddle many websites, they are used to inject viruses, spread worms, clickjacking, credential stealing, or possibly to gain a shell through exploit code that implements reverse tcp connections or possibly uploads a backdoor to a visitors computer. More about this on many websites that cover using netcat, or metasploit.<br />5) Html / Form Injection - You can inject a form, or any other html tag into this blog. I tested it with the cookieMonster.php program I made, this can be a way for an attacker to steal credentials, perform click jacking, or just about any other attack one could think of.</div></p>".include('blogSub.php');
}
else
{
echo "<center><p>Guests are not allowed to edit this blog, please sign up for an account or login<br /><a href='index.php'>Login</a></p></center>";	
echo "<div>";
echo "<p id='hint' style='visibility: hidden'><br />admin wrote: Welcome to my blog, this page is vulnerable to a few different things.<br />1) Of course Xss<br />Yes the textarea is vulnerable try it out.<br />2) RFI - Remote File Inclusion<br />Through the use of RFI an attacker can specify an external file to be included in the page through the address bar.  Misconfigured servers that allow URL page access will allow you to access a page stored on another website. For instance erase everything after the = sign, and type http://www.milw0rm.com.<br />It should look like this: <b>http://owaspbwa/ghost/iframe.php?page=http://www.milw0rm.com</b><br />As you can see, milw0rm loads in this page.<br />3)LFI - Local File Inclusion<br />Through the use of LFI, an attacker could possibly view pages that they weren't meant to see. For instance this string from your address bar right now: ?page=form.php. If you everything after the = sign and type in the name of another file on the site it will load in the browser. Let's try it. Type in ?page=index.php. As you can see the original textarea is still there, and it loads the login page.<br />4) Iframe Injection - The whole site is vulnerable to iframe injection. This will be the first spot that I will cover it. Iframe injection is very simple let's give it a go. In the text area type <b>&lt;iframe src='http://www.milw0rm.com'&gt;&lt;/iframe&gt;</b><br />As you can see there is a new frame inside of the page with milw0rm loaded inside of it. Many iframe injections cannot be seen, this can be done by adding visibility='hidden' or height='0' and width='0'. Invisible iframes riddle many websites, they are used to inject viruses, spread worms, clickjacking, credential stealing, or possibly to gain a shell through exploit code that implements reverse tcp connections or possibly uploads a backdoor to a visitors computer. More about this on many websites that cover using netcat, or metasploit.<br />5) Html / Form Injection - You can inject a form, or any other html tag into this blog. I tested it with the cookieMonster.php program I made, this can be a way for an attacker to steal credentials, perform click jacking, or just about any other attack one could think of.</div></p>".include('blogSub.php');	
}

?>
