starting web variants

web-security/path-traversal-2/_0/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/shared", methods=["GET"])
+@app.route("/shared/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_1/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/assets", methods=["GET"])
+@app.route("/assets/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_10/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/filebank", methods=["GET"])
+@app.route("/filebank/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_11/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/serve", methods=["GET"])
+@app.route("/serve/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_12/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/data", methods=["GET"])
+@app.route("/data/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_13/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/serve", methods=["GET"])
+@app.route("/serve/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_14/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/content", methods=["GET"])
+@app.route("/content/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_15/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/dump", methods=["GET"])
+@app.route("/dump/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_2/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/deliverables", methods=["GET"])
+@app.route("/deliverables/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_3/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/content", methods=["GET"])
+@app.route("/content/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/server → web-security/path-traversal-2/_4/server

@@ -6,8 +6,8 @@ import os
 app = flask.Flask(__name__)
 
 
-@app.route("/", methods=["GET"])
-@app.route("/<path:path>", methods=["GET"])
+@app.route("/cdn", methods=["GET"])
+@app.route("/cdn/<path:path>", methods=["GET"])
 def challenge(path="index.html"):
     requested_path = app.root_path + "/files/" + path.strip("/.")
     print(f"DEBUG: {requested_path=}")

web-security/path-traversal-2/_5/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/items", methods=["GET"])
+@app.route("/items/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_6/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/downloads", methods=["GET"])
+@app.route("/downloads/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_7/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/archive", methods=["GET"])
+@app.route("/archive/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)

web-security/path-traversal-2/_8/server

@@ -0,0 +1,26 @@
+#!/opt/pwn.college/python
+
+import flask
+import os
+
+app = flask.Flask(__name__)
+
+
+@app.route("/repository", methods=["GET"])
+@app.route("/repository/<path:path>", methods=["GET"])
+def challenge(path="index.html"):
+    requested_path = app.root_path + "/files/" + path.strip("/.")
+    print(f"DEBUG: {requested_path=}")
+    try:
+        return open(requested_path).read()
+    except PermissionError:
+        flask.abort(403, requested_path)
+    except FileNotFoundError:
+        flask.abort(404, f"No {requested_path} from directory {os.getcwd()}")
+    except Exception as e:
+        flask.abort(500, requested_path + ":" + str(e))
+
+
+app.secret_key = os.urandom(8)
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
+app.run("challenge.localhost", 80)