Skip to content

Commit 4387879

Browse files
IdkWhatAmIDoinIdkWhatAmIDoin
committed
fix(crypto): md5 is for the weak
the core database was using md5 to hash, which is why?? i changed it to use password_hash() and password_verify() in login.php, MySQL/PGSQL.php, brute/impossible, captcha/impossible, and csrf/impossible.
1 parent dda6b12 commit 4387879

6 files changed

Lines changed: 53 additions & 57 deletions

File tree

‎dvwa/includes/DBMS/MySQL.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
dvwaPageReload();
4040
}
4141

42-
$create_tb = "CREATE TABLE users (user_id int(6),first_name varchar(15),last_name varchar(15), user varchar(15), password varchar(32),avatar varchar(70), last_login TIMESTAMP, failed_login INT(3), PRIMARY KEY (user_id));";
42+
$create_tb = "CREATE TABLE users (user_id int(6),first_name varchar(15),last_name varchar(15), user varchar(15), password varchar(255),avatar varchar(70), last_login TIMESTAMP, failed_login INT(3), PRIMARY KEY (user_id));";
4343
if( !mysqli_query($GLOBALS["___mysqli_ston"], $create_tb ) ) {
4444
dvwaMessagePush( "Table could not be created<br />SQL: " . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) );
4545
dvwaPageReload();
@@ -52,11 +52,11 @@
5252
$avatarUrl = $base_dir . 'hackable/users/';
5353

5454
$insert = "INSERT INTO users VALUES
55-
('1','admin','admin','admin',MD5('password'),'{$avatarUrl}admin.jpg', NOW(), '0'),
56-
('2','Gordon','Brown','gordonb',MD5('abc123'),'{$avatarUrl}gordonb.jpg', NOW(), '0'),
57-
('3','Hack','Me','1337',MD5('charley'),'{$avatarUrl}1337.jpg', NOW(), '0'),
58-
('4','Pablo','Picasso','pablo',MD5('letmein'),'{$avatarUrl}pablo.jpg', NOW(), '0'),
59-
('5','Bob','Smith','smithy',MD5('password'),'{$avatarUrl}smithy.jpg', NOW(), '0');";
55+
('1','admin','admin','admin','\$2y\$12\$rf2N1mIKbZu9NZWRzY7FfOYtqLGCNB8aw78xkGGHQyP5ZY2LJIs6u','{$avatarUrl}admin.jpg', NOW(), '0'),
56+
('2','Gordon','Brown','gordonb','\$2y\$12\$JVFYv1SekB3U8vyzNfAxU.PXXF1vEFhR6v.9vDSe9q2eoTMEyrpGC','{$avatarUrl}gordonb.jpg', NOW(), '0'),
57+
('3','Hack','Me','1337','\$2y\$12\$CiOXblIO7H8Vd2eRRQAmIO6VDxVuqSGiTxs6zJ75juL.rQWNAqxby','{$avatarUrl}1337.jpg', NOW(), '0'),
58+
('4','Pablo','Picasso','pablo','\$2y\$12\$S9O/dhbLvIDuMOIMXj2M4uf/Cjd3rzUvhfoHIqhEVuR7YpX6fvGk2','{$avatarUrl}pablo.jpg', NOW(), '0'),
59+
('5','Bob','Smith','smithy','\$2y\$12\$E.1K4MDsXvuei096MM.oHOQtYMEmGJmAvIoRaFOjm6K3t6U24HXLe','{$avatarUrl}smithy.jpg', NOW(), '0');";
6060
if( !mysqli_query($GLOBALS["___mysqli_ston"], $insert ) ) {
6161
dvwaMessagePush( "Data could not be inserted into 'users' table<br />SQL: " . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) );
6262
dvwaPageReload();

‎dvwa/includes/DBMS/PGSQL.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@
5858
$baseUrl = substr( $baseUrl, 0, $stripPos ).'dvwa/hackable/users/';
5959

6060
$insert = "INSERT INTO users VALUES
61-
('1','admin','admin','admin',MD5('password'),'{$baseUrl}admin.jpg'),
62-
('2','Gordon','Brown','gordonb',MD5('abc123'),'{$baseUrl}gordonb.jpg'),
63-
('3','Hack','Me','1337',MD5('charley'),'{$baseUrl}1337.jpg'),
64-
('4','Pablo','Picasso','pablo',MD5('letmein'),'{$baseUrl}pablo.jpg'),
65-
('5','bob','smith','smithy',MD5('password'),'{$baseUrl}smithy.jpg');";
61+
('1','admin','admin','admin','\$2y\$12\$rf2N1mIKbZu9NZWRzY7FfOYtqLGCNB8aw78xkGGHQyP5ZY2LJIs6u','{$baseUrl}admin.jpg'),
62+
('2','Gordon','Brown','gordonb','\$2y\$12\$JVFYv1SekB3U8vyzNfAxU.PXXF1vEFhR6v.9vDSe9q2eoTMEyrpGC','{$baseUrl}gordonb.jpg'),
63+
('3','Hack','Me','1337','\$2y\$12\$CiOXblIO7H8Vd2eRRQAmIO6VDxVuqSGiTxs6zJ75juL.rQWNAqxby','{$baseUrl}1337.jpg'),
64+
('4','Pablo','Picasso','pablo','\$2y\$12\$S9O/dhbLvIDuMOIMXj2M4uf/Cjd3rzUvhfoHIqhEVuR7YpX6fvGk2','{$baseUrl}pablo.jpg'),
65+
('5','Bob','Smith','smithy','\$2y\$12\$E.1K4MDsXvuei096MM.oHOQtYMEmGJmAvIoRaFOjm6K3t6U24HXLe','{$baseUrl}smithy.jpg');";
6666
if( !pg_query( $insert ) ) {
6767
dvwaMessagePush( "Data could not be inserted into 'users' table<br />SQL: " . pg_last_error() );
6868
dvwaPageReload();

‎login.php‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
$pass = $_POST[ 'password' ];
2525
$pass = stripslashes( $pass );
2626
$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
27-
$pass = md5( $pass );
2827

2928
$query = ("SELECT table_schema, table_name, create_time
3029
FROM information_schema.tables
@@ -35,13 +34,18 @@
3534
dvwaMessagePush( "First time using DVWA.<br />Need to run 'setup.php'." );
3635
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'setup.php' );
3736
}
38-
39-
$query = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
37+
38+
$query = "SELECT * FROM `users` WHERE user='{$user}';";
4039
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );
41-
if( $result && mysqli_num_rows( $result ) == 1 ) { // Login Successful...
42-
dvwaMessagePush( "You have logged in as '{$user}'" );
43-
dvwaLogin( $user );
44-
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
40+
41+
if( $result && mysqli_num_rows( $result ) == 1 ) {
42+
$row = mysqli_fetch_assoc( $result );
43+
44+
if( password_verify( $pass, $row['password'] ) ) {
45+
dvwaMessagePush( "You have logged in as '{$user}'" );
46+
dvwaLogin( $user );
47+
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
48+
}
4549
}
4650

4751
// Login failed

‎vulnerabilities/brute/source/impossible.php‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
$pass = $_POST[ 'password' ];
1414
$pass = stripslashes( $pass );
1515
$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
16-
$pass = md5( $pass );
1716

1817
// Default values
1918
$total_failed_login = 3;
@@ -50,14 +49,13 @@
5049
}
5150

5251
// Check the database (if username matches the password)
53-
$data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
52+
$data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) LIMIT 1;' );
5453
$data->bindParam( ':user', $user, PDO::PARAM_STR);
55-
$data->bindParam( ':password', $pass, PDO::PARAM_STR );
5654
$data->execute();
5755
$row = $data->fetch();
5856

5957
// If its a valid login...
60-
if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
58+
if( $row && password_verify( $pass, $row['password'] ) && ( $account_locked == false ) ) {
6159
// Get users details
6260
$avatar = $row[ 'avatar' ];
6361
$failed_login = $row[ 'failed_login' ];

‎vulnerabilities/captcha/source/impossible.php‎

Lines changed: 24 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,13 @@
1010
// Get input
1111
$pass_new = $_POST[ 'password_new' ];
1212
$pass_new = stripslashes( $pass_new );
13-
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
14-
$pass_new = md5( $pass_new );
1513

1614
$pass_conf = $_POST[ 'password_conf' ];
1715
$pass_conf = stripslashes( $pass_conf );
18-
$pass_conf = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_conf ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
19-
$pass_conf = md5( $pass_conf );
16+
2017

2118
$pass_curr = $_POST[ 'password_current' ];
2219
$pass_curr = stripslashes( $pass_curr );
23-
$pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
24-
$pass_curr = md5( $pass_curr );
2520

2621
// Check CAPTCHA from 3rd party
2722
$resp = recaptcha_check_answer(
@@ -36,29 +31,32 @@
3631
$hide_form = false;
3732
}
3833
else {
39-
// Check that the current password is correct
40-
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
41-
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
42-
$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
43-
$data->execute();
34+
// Check that the current password is correct
35+
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) LIMIT 1;' );
36+
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
37+
$data->execute();
38+
$row = $data->fetch();
39+
40+
// Do both new password match and was the current password correct?
41+
if( ( $pass_new == $pass_conf ) && $row && password_verify( $pass_curr, $row['password'] ) ) {
42+
// Hash the new password
43+
$pass_new = password_hash( $pass_new, PASSWORD_BCRYPT );
4444

45-
// Do both new password match and was the current password correct?
46-
if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
4745
// Update the database
48-
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
49-
$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
50-
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
51-
$data->execute();
46+
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
47+
$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
48+
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
49+
$data->execute();
5250

53-
// Feedback for the end user - success!
54-
$html .= "<pre>Password Changed.</pre>";
55-
}
56-
else {
57-
// Feedback for the end user - failed!
58-
$html .= "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
59-
$hide_form = false;
60-
}
61-
}
51+
// Feedback for the end user - success!
52+
$html .= "<pre>Password Changed.</pre>";
53+
}
54+
else {
55+
// Feedback for the end user - failed!
56+
$html .= "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
57+
$hide_form = false;
58+
}
59+
}
6260
}
6361

6462
// Generate Anti-CSRF token

‎vulnerabilities/csrf/source/impossible.php‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,19 @@
1111

1212
// Sanitise current password input
1313
$pass_curr = stripslashes( $pass_curr );
14-
$pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
15-
$pass_curr = md5( $pass_curr );
1614

1715
// Check that the current password is correct
18-
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
16+
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) LIMIT 1;' );
1917
$current_user = dvwaCurrentUser();
2018
$data->bindParam( ':user', $current_user, PDO::PARAM_STR );
21-
$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
2219
$data->execute();
20+
$row = $data->fetch();
2321

2422
// Do both new passwords match and does the current password match the user?
25-
if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) {
23+
if( ( $pass_new == $pass_conf ) && $row && password_verify( $pass_curr, $row['password'] ) ) {
2624
// It does!
2725
$pass_new = stripslashes( $pass_new );
28-
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
29-
$pass_new = md5( $pass_new );
26+
$pass_new = password_hash( $pass_new, PASSWORD_BCRYPT );
3027

3128
// Update database with new password
3229
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
@@ -43,8 +40,7 @@
4340
$html .= "<pre>Passwords did not match or current password incorrect.</pre>";
4441
}
4542
}
46-
4743
// Generate Anti-CSRF token
4844
generateSessionToken();
4945

50-
?>
46+
?>

0 commit comments

Comments
 (0)