Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit e199c33

Browse files
Vsnippet 43 - SSTI Ruby ERB
1 parent e923313 commit e199c33

File tree

6 files changed

+168
-0
lines changed

6 files changed

+168
-0
lines changed

‎SSTI/ssti-classic-erb/Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
FROM ruby:3
2+
3+
#Install and update system dependencies
4+
RUN apt update -y; apt install -y supervisor
5+
RUN gem install webrick erb
6+
7+
#Prepare and setup the working directory
8+
RUN mkdir -p /app
9+
WORKDIR /app
10+
COPY vsnippet .
11+
COPY config/supervisord.conf /etc/supervisord.conf
12+
13+
EXPOSE 1337
14+
15+
ENTRYPOINT [ "/usr/bin/supervisord", "-c", "/etc/supervisord.conf" ]
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[supervisord]
2+
user=root
3+
nodaemon=true
4+
logfile=/dev/null
5+
logfile_maxbytes=0
6+
pidfile=/run/supervisord.pid
7+
8+
[program:vsnippet]
9+
command=ruby /app/42-ssti-classic-erb.rb
10+
stdout_logfile=/dev/stdout
11+
stdout_logfile_maxbytes=0
12+
stderr_logfile=/dev/stderr
13+
stderr_logfile_maxbytes=0
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: '3.8'
2+
services:
3+
ruby:
4+
container_name: vsnippet-ssti-classic-erb-42
5+
build:
6+
context: .
7+
dockerfile: Dockerfile
8+
ports:
9+
- 1337:1337
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
require 'webrick'
2+
$TITLE = "Server-side template injection (SSTI) - Ruby ERB"
3+
$SOURCE_CODE = File.read(__FILE__)
4+
5+
6+
class SimpleServlet < WEBrick::HTTPServlet::AbstractServlet
7+
def do_GET(request, response)
8+
response.status = 200
9+
response.content_type = 'text/html'
10+
11+
if request.query.key?('email')
12+
@email = request.query['email']
13+
@message = ERB.new('An email with a reset link has been sent to: ' + @email).result(binding)
14+
else
15+
@message = ""
16+
end
17+
18+
# Render the template file and return it to the client
19+
response.body = ERB.new(File.read('views/index.html')).result(binding)
20+
end
21+
end
22+
23+
# Create a WEBrick server with the SimpleServlet
24+
server = WEBrick::HTTPServer.new(Port: 1337, BindAddress: '0.0.0.0')
25+
server.mount('/assets', WEBrick::HTTPServlet::FileHandler, './assets')
26+
server.mount('/', SimpleServlet)
27+
28+
# Shut down the server gracefully when terminated
29+
trap('INT') { server.shutdown }
30+
31+
# Start the server
32+
server.start
Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
@import url('https://fonts.googleapis.com/css2?family=Anta&family=Bungee+Shade&family=Clicker+Script&family=Fira+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Indie+Flower&family=Inter+Tight:ital,wght@0,100..900;1,100..900&family=Inter:wght@100..900&family=League+Spartan:wght@100..900&family=Madimi+One&family=Nabla&family=Sunflower:wght@300&display=swap');
2+
3+
:root {
4+
--color-bg: #27272a;
5+
--color-bg-btn: #2dd4bf;
6+
--color-bg-code: #1e1e1e;
7+
--color-bg-input: #18181b;
8+
--color-txt: #f3f4f6;
9+
--color-green: #2dd4bf;
10+
--rounded: 13px;
11+
--padding: 12px;
12+
}
13+
14+
body {
15+
font-family: "Inter", sans-serif;
16+
font-optical-sizing: auto;
17+
font-weight: 400;
18+
font-style: normal;
19+
background-color: var(--color-bg);
20+
color: var(--color-txt);
21+
}
22+
23+
input {
24+
border: none;
25+
padding: var(--padding);
26+
background-color: transparent;
27+
outline: none;
28+
-webkit-appearance: none;
29+
-moz-appearance: none;
30+
border-radius: var(--rounded);
31+
padding-left: 14px;
32+
padding-right: 14px;
33+
font-weight: 700;
34+
height: 50px;
35+
width: auto;
36+
}
37+
38+
input:not([type="submit"]) {
39+
background-color: var(--color-bg-input);
40+
color: var(--color-txt);
41+
border: 2px solid var(--color-green);
42+
43+
}
44+
45+
input[type="submit"] {
46+
background-color: var(--color-bg-btn);
47+
}
48+
49+
code {
50+
border-radius: var(--rounded);
51+
border: 2px solid var(--color-green);
52+
padding: var(--padding);
53+
font-size: 16px;
54+
}
55+
56+
.wrapper {
57+
position: fixed;
58+
transform: translate(-50%,-50%);
59+
left: 50%;
60+
top: 50%;
61+
display: block;
62+
justify-content: center;
63+
}
64+
65+
.sourcecode {
66+
width: 400px;
67+
height: auto;
68+
}
69+
70+
.hljs {
71+
background-color: var(--color-bg-code);
72+
}
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<html>
2+
<head>
3+
<meta charset="UTF-8">
4+
<title><%= $TITLE %></title>
5+
<link rel="stylesheet" href="/assets/styles.css">
6+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/atom-one-dark.css">
7+
<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
8+
</head>
9+
<body>
10+
<div class="wrapper">
11+
<div class="main">
12+
<h1><%= $TITLE %></h1>
13+
<form method="GET">
14+
<input type="email" name="email" placeholder="Ex: John@example.com">
15+
<input type="submit" value="Send">
16+
</form>
17+
<p><%= @message %></p>
18+
</div>
19+
20+
<!-- vsnippet source code -->
21+
<pre class="source_code">
22+
<code class="language-ruby"><%= $SOURCE_CODE %></code>
23+
</pre>
24+
</div>
25+
<script>hljs.highlightAll();</script>
26+
</body>
27+
</html>

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /