CSPJ Application

Services

• 3331: Apache + ModSecurity
• 3332: Suricata
• 3333: Backend server
• 3334: Python backend server
• 3335: PostgreSQL

backend-for-frontend server

!remember to set the environment variables !include this in the setup instructions !should we use a .env file and let the user set the variables?

PGHOST=localhost PGPORT=5432 PGDATABASE=asdfdb PGUSER=asdfuser PGPASSWORD=asdfpassword

Server

!only listening on localhost is supported. DO NOT run this on a public ip.

• /health
• /health-db
• /setup-demo-db
• /nuke-db
• /fetch-all-users

SQL Injection

Use ' OR 1=1; --
Use tohyouxuan@gmail.com' UNION SELECT id, email, password FROM users WHERE email = 'tohyouxuan@gmail.com'; --

• /unsecure-register-sql
• /secure-register-sql
• /unsecure-login-sql
• /secure-login-sql

1. Parameterization of Queries

Used pool.Query() with a parameterized query, instead of dynamically constructing the SQL query by directly inserting the user input.
Parameterized queries separate the SQL code from the data, so user input is never directly put into the query's structure. Placeholders are used instead, and the data is passed as parameters. The DB will treat them as data, not executable code.

ZAP

Content-Type: application/json

{ "email": "tohyouxuan@gmail.com", "password": "testpassword" }