o
    <ý¤h¿Å  ã                   @   s2  d Z ddlZddlm  mZ ddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ejjdd„ ƒZejjd	d
„ ƒZejjdd„ ƒZejjdd„ ƒZejjdd„ ƒZejjdd„ ƒZ ejjdd„ ƒZ!ejjdd„ ƒZ"ejjdd„ ƒZ#dS )a,  
test_security_penetration.py

Purpose:
  Red-team level security penetration testing suite for the Flask camera management application.
  This file implements comprehensive security vulnerability testing to validate protection against
  common attack vectors including timing attacks, SQL injection, session hijacking, privilege
  escalation, and malicious input fuzzing. Follows OWASP testing guidelines and industry
  security standards to ensure robust defense against sophisticated attacks.

Security Test Categories:
  - Timing attack resistance (username enumeration prevention)
  - SQL injection penetration testing with parameterized query validation
  - Session security (hijacking, fixation, token entropy)
  - CSRF token cryptographic strength analysis
  - File upload security and path traversal prevention
  - Rate limiting bypass techniques and header manipulation
  - Privilege escalation (horizontal and vertical)
  - Information disclosure through error messages and timing

Test Philosophy:
  Each test simulates real-world attack scenarios with malicious payloads designed to
  exploit specific vulnerabilities. Tests validate both that attacks are blocked AND
  that security measures don't interfere with legitimate usage. All tests follow
  red-team methodology with comprehensive edge case coverage.
é    N)Úpatch)Úsession)Úget_db)Úparse_ts_from_anyc              	   C   sH  |ƒ  |   ¡ }|d d }g d¢}g }tdƒD ]`}t ¡ }|jd|ddœd}	t ¡ }
| |
| ¡ |	j}d	}||k}|sqt d
|fd||f¡dt	 
¡ v sRt |	¡rWt |	¡ndt |¡t |¡dœ }dd|i }tt |¡ƒ‚d } }}qg }|D ]g}tdƒD ]`}t ¡ }|jd|ddœd}	t ¡ }
| |
| ¡ |	j}d	}||k}|sÜt d
|fd||f¡dt	 
¡ v s½t |	¡rÂt |	¡ndt |¡t |¡dœ }dd|i }tt |¡ƒ‚d } }}q‚q|t |¡}t |¡}t|| ƒ}td|d›d|d›d|d›dƒ |dkrtd|d›dƒ tdƒ dS td|d›dƒ dS )a  
    Test that login timing is consistent regardless of username validity to prevent username enumeration.
    
    Security Risk: Timing differences between valid vs invalid usernames can allow attackers
    to enumerate valid usernames by measuring response times. Valid usernames trigger bcrypt
    operations while invalid ones fail immediately.
    
    Attack Scenario: Attacker measures login response times with various usernames to identify
    which ones exist in the system, then focuses brute-force attacks on valid accounts.
    ÚregularÚusername)Únonexistent1Ú
fakeuser99Ú
notreal123é
   ú/loginÚwrongpassword123©r   Úpassword©Údataé.  ©ú==©z3%(py2)s
{%(py2)s = %(py0)s.status_code
} == %(py5)sÚresponse©Úpy0Úpy2Úpy5úassert %(py7)sÚpy7Né   zValid username avg: ú.4fzs, Invalid avg: z	s, Diff: Úsçš™™™™™©?u;   âš ï¸  SECURITY VULNERABILITY DETECTED: Timing difference zs allows username enumerationuT   ðŸ”§ Recommendation: Implement secure_password_check() from security_enhancements.pyu&   âœ… Timing attack protection working: zs difference)Útest_clientÚrangeÚtimeÚperf_counterÚpostÚappendÚstatus_codeÚ
@pytest_arÚ_call_reprcompareÚ@py_builtinsÚlocalsÚ_should_repr_global_nameÚ	_safereprÚAssertionErrorÚ_format_explanationÚ
statisticsÚmeanÚabsÚprint)ÚappÚ
test_usersÚclear_rate_limitsÚclientÚ
valid_userÚinvalid_usernamesÚvalid_timesÚ_Ú
start_timer   Úend_timeÚ@py_assert1Ú@py_assert4Ú@py_assert3Ú@py_format6Ú@py_format8Úinvalid_timesr   Ú	valid_avgÚinvalid_avgÚtiming_difference© rG   ú9/var/www/html/tests/security/test_security_penetration.pyÚ#test_login_timing_attack_resistance,   sF   
þŒ
þŒø

"
rI   c              	   C   s¤  |ƒ  |   ¡ }g d¢}|D ]À}|jd|ddœd}|j}g d¢}||v }	|	sft d|	fd||f¡d	t ¡ v s;t |¡r@t |¡nd	t |¡t |¡d
œ }
t 	d|j› d|› ¡d d|
i }t
t |¡ƒ‚d } }	}|jdd ¡ }g d¢}|D ]R}||v}|sÊt d|fd||f¡dt ¡ v s—t |¡rœt |¡nddt ¡ v s¨t |¡r­t |¡nddœ }t 	d|› d|› ¡d d|i }t
t |¡ƒ‚d}qzq|d }|jd|d |d dœd | d¡ | ¡ }| d d!¡}W d  ƒ n1 súw   Y  |dd"… D ]Ê}|jd#|› |d$|dd%… › d&œd'd(}|j}d)d*g}||v }	|	sht d|	fd||f¡d	t ¡ v sAt |¡rFt |¡nd	t |¡t |¡d
œ }
t 	d+|› ¡d d|
i }t
t |¡ƒ‚d } }	}|jd#|› d,|d&œd'd(}|j}g d-¢}||v }	|	sÈt d|	fd||f¡d	t ¡ v s¡t |¡r¦t |¡nd	t |¡t |¡d
œ }
t 	d.|› ¡d d|
i }t
t |¡ƒ‚d } }	}qdS )/aø  
    Test all endpoints against SQL injection attempts with sophisticated payloads.
    
    Security Risk: SQL injection allows attackers to manipulate database queries,
    potentially accessing sensitive data, escalating privileges, or destroying data.
    
    Attack Scenarios:
    - Union-based injection to extract password hashes
    - Boolean-based blind injection for data extraction  
    - Time-based blind injection for delayed responses
    - Second-order injection through stored data
    )z4' UNION SELECT password_hash FROM users WHERE '1'='1z51' UNION SELECT username, password_hash FROM users --z' OR '1'='1' --z' OR 1=1 --zadmin'--z'; WAITFOR DELAY '00:00:05' --zz' OR (SELECT COUNT(*) FROM users) > 0 AND (SELECT SUBSTRING(password_hash,1,1) FROM users WHERE username='admin') = 'a' --z'; DROP TABLE cameras; --z<'; UPDATE users SET is_admin=1 WHERE username='testuser'; --z' OR '1'='1' /*z"1'; DELETE FROM users WHERE '1'='1z%27%20OR%20%271%27%3D%271z&#39; OR &#39;1&#39;=&#39;1r   Útestpassr   r   )r   é  é­  ©Úin©z3%(py2)s
{%(py2)s = %(py0)s.status_code
} in %(py5)sr   r   zUnexpected response z for payload: ú
>assert %(py7)sr   NT©Úas_text)zsyntax errorÚsqliteÚdatabaseÚtableÚcolumnÚselectÚunionÚpassword_hash©únot in©z%(py0)s not in %(py2)sÚkeywordÚresponse_text©r   r   z)SQL injection may have occurred - found 'z' in response for payload: ú
>assert %(py4)sÚpy4r   r   r   ú/Ú
csrf_tokenÚ é   ú/api/kamere/add?csrf_token=zTest Camera r   ©Ú	camera_idÚcamera_nameúapplication/json©ÚjsonÚcontent_typerK   éô  z#Should reject malicious camera_id: Ú123456789012)éÈ   rK   i™  rn   z/Unexpected response for malicious camera_name: )r!   r%   r'   r(   r)   r*   r+   r,   r-   Ú_format_assertmsgr.   r/   Úget_dataÚlowerÚgetÚsession_transaction)r4   r5   r6   r7   Úmalicious_payloadsÚpayloadr   r>   r?   r@   rA   rB   r^   Údangerous_keywordsr]   Ú@py_format3Ú@py_format5ÚuserÚsessrc   rG   rG   rH   Útest_sql_injection_resistancej   sN   
þ¦¢ÿ
þ

ÿþû¤þû¨ìr}   c           -      C   s†  |ƒ  g }t dƒD ],}|  ¡ }| d¡}| ¡ }| dd¡}|r&| |¡ W d  ƒ n1 s0w   Y  q	t|ƒ}	t|	ƒ}
t|ƒ}|
|k}|sÉt d|fd|
|f¡dt	 
¡ v s]t t¡rbt t¡ndd	t	 
¡ v snt t¡rst t¡nd	d
t	 
¡ v st |¡r„t |¡nd
t |	¡t |
¡dt	 
¡ v s˜t t¡rt t¡ndd
t	 
¡ v s©t |¡r®t |¡nd
t |¡dœ }t d¡d d|i }tt |¡ƒ‚d }	 }
 }}|rždd„ |D ƒ}t|ƒ}d}
||
k}|s5t d|fd||
f¡dt	 
¡ v sþt t¡rt t¡nddt	 
¡ v st |¡rt |¡ndt |¡t |
¡dœ }t d¡d d|i }tt |¡ƒ‚d } }}
d |¡}i }|D ]}| |d¡d ||< qDt|ƒ}d}||k}|sšt d|fd||f¡dt	 
¡ v svt |¡r{t |¡ndt |¡d œ }t d!|› d"¡d# d$|i }tt |¡ƒ‚d }}|  ¡ }| d¡ | ¡ }t|ƒ}| dd¡}W d  ƒ n	1 sÁw   Y  |d% }|jd&|d' |d( d)œd*}|j}d+}||k}	|	st d|	fd,||f¡d-t	 
¡ v sût |¡r t |¡nd-t |¡t |¡d.œ }d/d0|i }tt |¡ƒ‚d } }	}| d¡ | ¡ }| dd¡} W d  ƒ n	1 s;w   Y  | sgt d1¡d2 d3d4t	 
¡ v sWt | ¡r\t | ¡nd4i }!tt |!¡ƒ‚| ¡ Q}| d5¡}"d}|"|u}|s±t d6|fd7|"|f¡d8t	 
¡ v s‘t |"¡r–t |"¡nd8t |¡d œ }t d9¡d# d$|i }tt |¡ƒ‚d }}W d  ƒ n	1 sÀw   Y  |  ¡ }#|d: }$|#jd&|$d' |$d( d)œd* | ¡ }%|% dd¡}&|% d5¡}'W d  ƒ n	1 söw   Y  |# ¡ }(|( dd¡})|( d5¡}*W d  ƒ n	1 sw   Y  |&|)k}|sht d;|fd<|&|)f¡d=t	 
¡ v s9t |&¡r>t |&¡nd=d>t	 
¡ v sLt |)¡rQt |)¡nd>d?œ }+t d@¡dA dB|+i },tt |,¡ƒ‚d}|'|*k}|s·t d;|fd<|'|*f¡dCt	 
¡ v sˆt |'¡rt |'¡ndCdDt	 
¡ v s›t |*¡r t |*¡ndDd?œ }+t dE¡dA dB|+i },tt |,¡ƒ‚d}d}|'|u}|sùt d6|fd7|'|f¡dCt	 
¡ v sÙt |'¡rÞt |'¡ndCt |¡d œ }t dF¡d# d$|i }tt |¡ƒ‚d }}d}|*|u}|s=t d6|fd7|*|f¡dDt	 
¡ v st |*¡r"t |*¡ndDt |¡d œ }t dG¡d# d$|i }tt |¡ƒ‚d }}dS )Haá  
    Test session tokens cannot be hijacked, predicted, or reused across different contexts.
    
    Security Risk: Weak session management allows attackers to impersonate users
    by stealing, predicting, or reusing session tokens.
    
    Attack Scenarios:
    - Session token prediction through weak random number generation
    - Session fixation attacks by forcing specific session IDs
    - Cross-browser session reuse
    - Session token extraction from URLs or logs
    é2   rb   rc   rd   Nr   )zn%(py6)s
{%(py6)s = %(py0)s(%(py4)s
{%(py4)s = %(py1)s(%(py2)s)
})
} == %(py11)s
{%(py11)s = %(py8)s(%(py9)s)
}ÚlenÚsetÚsession_tokens)r   Úpy1r   ra   Úpy6Úpy8Úpy9Úpy11zASession tokens are not unique - potential collision vulnerabilityz
>assert %(py13)sÚpy13c                 S   ó   g | ]}t |ƒ‘qS rG   ©r   ©Ú.0ÚtokenrG   rG   rH   Ú
<listcomp>ê   ó    z5test_session_hijacking_protection.<locals>.<listcomp>é    ©ú>=©z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} >= %(py6)sÚminÚtoken_lengths©r   r‚   Úpy3rƒ   z4Session tokens too short - vulnerable to brute forceú
>assert %(py8)sr„   r   é   r   ©ú>©z%(py0)s > %(py3)sÚunique_chars©r   r–   z-Poor character distribution in tokens - only z unique charactersú
>assert %(py5)sr   r   r   r   r   r   r   r   r   r   r   r   r   zNo CSRF token after loginz
>assert %(py0)sr   Úpost_login_csrfÚuser_id©úis not©z%(py0)s is not %(py3)sÚlogged_in_user_idz)User not logged in after successful loginÚlimited)ú!=)z%(py0)s != %(py2)sÚtoken1Útoken2r_   zGSession tokens shared between clients - critical security vulnerabilityr`   ra   Úuser1_idÚuser2_idz User IDs shared between sessionszUser1 session has no user_idzUser2 session has no user_id)r"   r!   rt   ru   r&   r€   r   r(   r)   r*   r+   r,   r-   rq   r.   r/   r“   ÚjoinÚidr%   r'   )-r4   r5   r6   r   Úir7   r   r|   rc   r@   Ú@py_assert5Ú@py_assert10Ú@py_assert7Ú@py_format12Ú@py_format14r”   Ú@py_assert2r?   Ú@py_format7Ú@py_format9Ú	all_charsÚchar_countsÚcharrœ   r>   Ú@py_format4rA   Úclient1Úinitial_session_idÚinitial_csrfr{   rB   rŸ   Ú@py_format1r¤   Úclient2Úuser2Úsess1r§   r©   Úsess2r¨   rª   ry   rz   rG   rG   rH   Ú!test_session_hijacking_protectionÊ   s|   


€ý€þ8 À


þ
þ

ÿN

Šþ
þ
þ
þžžˆŒrÂ   c           $   	      s(  |ƒ  g }g }t dƒD ]1}|  ¡ }| |¡ | d¡}| ¡ }| dd¡}|r-| |¡ W d  ƒ n1 s7w   Y  qt|ƒ}	d}
|	|
k}|s“t d|fd|	|
f¡d	t 	¡ v s^t 
t¡rct t¡nd	d
t 	¡ v sot 
|¡rtt |¡nd
t |	¡t |
¡dœ }t d¡d d|i }tt |¡ƒ‚d }	 }}
t|ƒ}dt|ƒt|ƒ  }d}	||	k}|sët d|fd||	f¡dt 	¡ v sÄt 
|¡rÉt |¡ndt |	¡dœ }t d|d d›d¡d d|i }tt |¡ƒ‚d }}	dd„ |D ƒ}t|ƒ}t|ƒ}d}	||	k}|sBt d|fd||	f¡dt 	¡ v st 
|¡r#t |¡ndt |	¡dœ }t d|› d ¡d d|i }tt |¡ƒ‚d }}	d!}	||	k}|sŠt d"|fd#||	f¡d$t 	¡ v sft 
|¡rkt |¡nd$t |	¡dœ }t d%|› d&¡d d|i }tt |¡ƒ‚d }}	d |¡}t|ƒ}ttjtj d' ƒ}|| }t|ƒ}	d}
|	|
k}|st d|fd(|	|
f¡d	t 	¡ v sÉt 
t¡rÎt t¡nd	d)t 	¡ v sÜt 
|¡rát |¡nd)t |	¡t |
¡dœ }t d*|› ¡d d|i }tt |¡ƒ‚d }	 }}
t|ƒ}	d+}
|	|
k}|sjt d|fd|	|
f¡d	t 	¡ v s-t 
t¡r2t t¡nd	d,t 	¡ v s@t 
|¡rEt |¡nd,t |	¡t |
¡dœ }t d-t|ƒ› d.¡d d|i }tt |¡ƒ‚d }	 }}
i }|D ]}| |d¡d ||< qtt|ƒ‰‡fd/d„| ¡ D ƒ}ddl‰ t‡ fd0d1„|D ƒƒ }ˆ  t|ƒ¡}|| }d2}	||	k}|sñt d3|fd4||	f¡d5t 	¡ v sÌt 
|¡rÑt |¡nd5t |	¡dœ }t d6|d7›d8¡d d|i }tt |¡ƒ‚d }}	|d }| ¡ }| dd¡} W d  ƒ n	1 sw   Y  |  ¡ }!|! ¡ }| |d< W d  ƒ n	1 s,w   Y  |!jd9| › d:d;d<œd=d>}|j}d?d@g}||v }"|"sŒt dA|"fdB||f¡dCt 	¡ v sdt 
|¡rit |¡ndCt |¡t |¡dDœ }t dE|j› ¡dF dG|i }#tt |#¡ƒ‚d } }"}dS )Hag  
    Test CSRF tokens are cryptographically secure with sufficient entropy.
    
    Security Risk: Weak CSRF tokens can be predicted or brute-forced,
    allowing attackers to bypass CSRF protection.
    
    Attack Scenarios:
    - Token prediction through weak randomness
    - Token collision through birthday attacks
    - Token extraction and reuse
    éd   rb   rc   rd   NéZ   r   r’   r   Útokensr•   z1Failed to generate sufficient tokens for analysisr—   r„   r˜   r   r   )z%(py0)s == %(py3)sÚcollision_rater   z CSRF token collision detected - z.2fz% collision raterž   r   c                 S   rˆ   rG   r‰   rŠ   rG   rG   rH   r   W  rŽ   z8test_csrf_token_entropy_and_strength.<locals>.<listcomp>r   )z%(py0)s >= %(py3)sÚ
min_lengthzCSRF tokens too short: z chars (minimum 32 required)é   )ú<=)z%(py0)s <= %(py3)sÚ
max_lengthzCSRF tokens too long: z  chars (maximum 256 recommended)z-_©z0%(py3)s
{%(py3)s = %(py0)s(%(py1)s)
} == %(py6)sÚunexpected_charsz+CSRF tokens contain unexpected characters: r   rœ   z"Insufficient character diversity: z unique charsc                    s   g | ]}|ˆ  ‘qS rG   rG   )r‹   Úcount)Útotal_charsrG   rH   r   p  rŽ   c                 3   s&    | ]}|d kr|ˆ   |¡ V  qdS )r   N)Úlog2)r‹   Úp)ÚmathrG   rH   Ú	<genexpr>t  s   €$ z7test_csrf_token_entropy_and_strength.<locals>.<genexpr>gš™™™™™é?r™   r›   Úentropy_ratiozLow entropy in CSRF tokens: z.3fz (should be > 0.8)rf   ro   ÚTestrg   rj   rk   r   é“  rM   rO   r   r   z*CSRF token reuse should be prevented, got rP   r   )r"   r!   r&   rt   ru   r   r(   r)   r*   r+   r,   r-   rq   r.   r/   r€   r“   Úmaxr«   ÚstringÚascii_lettersÚdigitsÚvaluesrÑ   ÚsumrÏ   r%   r'   )$r4   r6   rÅ   Úclientsr­   r7   r   r|   rŒ   r³   r®   r?   r´   rµ   Úunique_tokensrÆ   r>   r¹   rA   r”   rÇ   rÊ   r¶   rœ   Úexpected_charsrÌ   Ú	char_freqr¸   ÚfrequenciesÚentropyÚmax_entropyrÓ   Úoriginal_tokenÚ
new_clientr@   rB   rG   )rÑ   rÎ   rH   Ú$test_csrf_token_entropy_and_strength2  sh   



€ý€¸
ÈÎ’
ÿ

ÿþªrå   c           "      C   sü  |ƒ  |   ¡ }|d }|jd|d |d dœd | d¡ | ¡ }| dd	¡}W d
  ƒ n1 s3w   Y  g d¢}|D ]}	|jd|› d|	idd}
|
j}g d¢}||v }|s—t d|fd||f¡dt ¡ v spt 	|
¡rut 
|
¡ndt 
|¡t 
|¡dœ }t d|	› ¡d d|i }tt |¡ƒ‚d
 } }}|
jdd ¡ }g d¢}|
jdv rM|
 ¡ }|rMd|v rM|d  ¡ }d}||v}|st d|fd||f¡t 
|¡dt ¡ v sãt 	|¡rèt 
|¡ndd œ }t d!|	› ¡d" d#|i }tt |¡ƒ‚d
 }}d$}||v}|sIt d|fd||f¡t 
|¡dt ¡ v s*t 	|¡r/t 
|¡ndd œ }t d!|	› ¡d" d#|i }tt |¡ƒ‚d
 }}q>g d%¢}|D ]ñ}| d&|› ¡}
|
j}g d'¢}||v }|sªt d|fd||f¡dt ¡ v sƒt 	|
¡rˆt 
|
¡ndt 
|¡t 
|¡dœ }t d(|› ¡d d|i }tt |¡ƒ‚d
 } }}|
jdd}d)}||v}|sùt d|fd||f¡t 
|¡d*t ¡ v sÚt 	|¡rßt 
|¡nd*d œ }t d+|› ¡d" d#|i }tt |¡ƒ‚d
 }}d,}||v}|s@t d|fd||f¡t 
|¡d*t ¡ v s!t 	|¡r&t 
|¡nd*d œ }t d-|› ¡d" d#|i }tt |¡ƒ‚d
 }}qTd.}|jd/|› |d0d1œdd d2d3 }tj |d4|› d5¡}zzt|d6ƒ}| |¡ W d
  ƒ n	1 s|w   Y  d7|› d5}| d8|› ¡}
|
j}g d9¢}||v }|sØt d|fd||f¡dt ¡ v s´t 	|
¡r¹t 
|
¡ndt 
|¡t 
|¡dœ }t d:¡d d|i }tt |¡ƒ‚d
 } }}W n
 tyé   Y nw d7|› d5}z‚d;d<lm} ||ƒ}|d
d=… d> | d?d@¡dAd	g} | D ]b}!| dB|!› ¡}
|
j}g d¢}||v }|sht d|fd||f¡dt ¡ v s<t 	|
¡rAt 
|
¡ndt 
|¡t 
|¡dœ }t dC|!d
dD… › dE¡d d|i }tt |¡ƒ‚d
 } }}qW d
S  ty}   Y d
S w )FaÕ  
    Test file upload security including path traversal prevention and malicious file handling.
    
    Security Risk: Insecure file handling allows path traversal attacks, malicious file uploads,
    and potential remote code execution.
    
    Attack Scenarios:
    - Path traversal to access files outside allowed directories
    - Upload of executable files (PHP, JSP, etc.)
    - Filename injection with special characters
    - Oversized file uploads (DoS)
    r   r   r   r   r   r   rb   rc   rd   N)z../../../etc/passwdz$..\..\..\windows\system32\config\samz....//....//....//etc/passwdz$User-photos/../../sensitive_file.txtzUser-photos/../app.pyz'%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswdz#..%252f..%252f..%252fetc%252fpasswdú/api/image/delete?csrf_token=Úrelrj   rk   ©rK   rÕ   é”  rM   rO   r   r   zPath traversal not blocked: rP   r   TrQ   )zaccess deniedzpermission deniedzfile not foundÚ	forbidden)rK   rÕ   ÚmessageÚetcrZ   )z%(py1)s not in %(py3)s)r‚   r–   z.Path traversal response reveals system paths: rž   r   Úwindows)
ztest.phpztest.jspztest.aspztest.pyz!<script>alert('xss')</script>.jpgz'; DROP TABLE images; --.jpgz	test .jpgaC  very_long_filename_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.jpgz	.htaccessz
web.configz/slika?rel=User-photos/)rp   rK   rÕ   ré   z,Unexpected response for malicious filename: z<script>r^   z!XSS vulnerability with filename: z
DROP TABLEz+SQL injection vulnerability with filename: ro   rf   zSecurity Test Camerarg   ó   Xi    ÚPICT_20231201_120000_z.jpgÚwbz!User-photos/PICT_20231201_120000_ú/slika?rel=)rp   rK   rÕ   ré   i  rn   zLarge file handling failedr   )Úgenerate_media_tokenéûÿÿÿÚAAAAAÚAÚBÚfake_token_12345z/media/z"Manipulated media token accepted: é   z...)r!   r%   rt   ru   r'   r(   r)   r*   r+   r,   r-   rq   r.   r/   rr   rs   Úget_jsonÚosÚpathr«   ÚopenÚwriteÚOSErrorÚapp_modules.helpersrò   ÚreplaceÚImportError)"r4   r5   Útemp_staticr6   r7   r{   r|   rc   Úpath_traversal_payloadsrw   r   r>   r?   r@   rA   rB   r^   rx   r   rë   Ú@py_assert0r³   r¹   Úmalicious_filenamesÚfilenameÚtest_camera_idÚlarge_file_contentÚlarge_file_pathÚfÚrel_pathrò   Úlegitimate_tokenÚmanipulated_tokensÚ	bad_tokenrG   rG   rH   Ú,test_file_upload_security_and_path_traversal‘  s†   
þ

ÿ

þžŠŽ€¤Ž’þÿ¢þ
ü²ýþr  c           !      C   sŒ  |ƒ  |d }g d¢}d}|D ]'}|   ¡ }tdƒD ]}|jd|d ddœd	|id
}	|	jdkr5|d7 } nqq|dkrCtdƒ tdƒ g d¢}
|ƒ  |   ¡ }d}tdƒD ]"}|
|t|
ƒ  }|jd|d ddœd|id
}	|	jdkrvd} nqT|s}tdƒ |ƒ  d}tdƒD ]$}|   ¡ }tdƒD ]}|jd|d ddœd}	|	jdkr©|d7 } nqq†|dkr³tdƒ |ƒ  |   ¡ }|jd|d |d dœd}	|	j}d}||k}|st d|fd||f¡dt 	¡ v sét 
|	¡rît |	¡ndt |¡t |¡dœ }t d¡d d|i }tt |¡ƒ‚d  } }}g }d!}|	j}||v }|}|s1|	j}|j}d"}||ƒ}|}|s²t d#|fd$||f¡t |¡dt 	¡ v sOt 
|	¡rTt |	¡ndt |¡d%œ }d&d'|i }| |¡ |s˜d(dt 	¡ v syt 
|	¡r~t |	¡ndt |¡t |¡t |¡t |¡d)œ }| |¡ t |d¡i  }t d*¡d+ d,|i } tt | ¡ƒ‚d  } } } } } } } }}d S )-aŠ  
    Test rate limiting cannot be bypassed via header manipulation or distributed techniques.
    
    Security Risk: Bypassable rate limiting allows brute force attacks, credential stuffing,
    and denial of service attacks.
    
    Attack Scenarios:
    - X-Forwarded-For header spoofing
    - User-Agent rotation
    - Multiple source IP simulation
    - Session-based bypass attempts
    r   )z1.2.3.4z5.6.7.8z
9.10.11.12z13.14.15.16z17.18.19.20r   é   r   r   Úwrongpasswordr   zX-Forwarded-For)r   ÚheadersrL   r˜   zLNote: Rate limiting may be disabled for localhost IPs (expected for testing)zOThis is acceptable - localhost exemption is intentional for testing environment)z<Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36zBMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36z2Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36zKMozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15zAMozilla/5.0 (Android 11; Mobile; rv:88.0) Gecko/88.0 Firefox/88.0Fé   z
User-AgentTr   é   r   r   r   r   r   r   r   z,Legitimate login blocked after rate limitingrP   r   Nú/selectrb   rM   ©z0%(py3)s in %(py7)s
{%(py7)s = %(py5)s.location
}©r–   r   r   ú%(py9)sr…   zi%(py19)s
{%(py19)s = %(py15)s
{%(py15)s = %(py13)s
{%(py13)s = %(py11)s.location
}.endswith
}(%(py17)s)
})r†   r‡   Úpy15Úpy17Úpy19zLogin redirect failedz
>assert %(py22)sÚpy22)r!   r"   r%   r'   r3   r   r(   r)   r*   r+   r,   r-   rq   r.   r/   ÚlocationÚendswithr&   Ú_format_boolop)!r4   r5   r6   r{   Úspoofed_ipsÚfailed_attemptsÚ
spoofed_ipr7   Úattemptr   Úuser_agentsÚrate_limitedr­   Ú
user_agentÚrate_limited_sessionsÚsession_numÚfresh_clientr>   r?   r@   rA   rB   r³   Ú@py_assert6r  Ú@py_assert12Ú@py_assert14Ú@py_assert16Ú@py_assert18Ú@py_format10Ú@py_format20Ú@py_format21Ú@py_format23rG   rG   rH   Ú"test_rate_limiting_bypass_attempts!  sv   þ
þ€	þ
þÿ
þ€
þ–þh r3  c           "         s	  |ƒ  |d }|d }|   ¡ }|   ¡ }|jd|d |d dœd |jd|d |d dœd | d¡ | ¡ }| d	d
¡}W d  ƒ n1 sIw   Y  | d¡ | ¡ }| d	d
¡}	W d  ƒ n1 shw   Y  d‰ |jd|› ˆ ddœdd}
|
jdkrtd|
j› dƒ dS d}|jd|	› |ddœdd}
|
jdkr­td|
j› dƒ dS | d¡}
|
jdkrb|
 ¡ }dd„ | dg ¡D ƒ}||v }|st d|fd||f¡dt	 
¡ v sãt |¡rèt |¡nddt	 
¡ v sôt |¡rùt |¡ndd œ }t d!¡d" d#|i }tt |¡ƒ‚d}ˆ |v}|s_t d$|fd%ˆ |f¡d&t	 
¡ v s0t ˆ ¡r5t ˆ ¡nd&dt	 
¡ v sCt |¡rHt |¡ndd œ }t d'¡d" d#|i }tt |¡ƒ‚d}n|
jd(krwtd)|
j› d*ƒ td+ƒ dS td,|
j› d-ƒ |jd.|	› ˆ d/dœdd}
|
j}d0d1g}||v }|s×t d|fd2||f¡d3t	 
¡ v s³t |
¡r¸t |
¡nd3t |¡t |¡d4œ }t d5¡d6 d7|i }tt |¡ƒ‚d } }}|jd8|	› d9ˆ idd}
|
j}d0d1g}||v }|s3t d|fd2||f¡d3t	 
¡ v st |
¡rt |
¡nd3t |¡t |¡d4œ }t d:¡d6 d7|i }tt |¡ƒ‚d } }}| d¡}
|
j}d}||k}|s€t d;|fd<||f¡d3t	 
¡ v sat |
¡rft |
¡nd3t |¡t |¡d4œ }d=d7|i }tt |¡ƒ‚d } }}|
 ¡ }d>d„ | dg ¡D ƒ}ˆ |v }|sât d|fdˆ |f¡d&t	 
¡ v s³t ˆ ¡r¸t ˆ ¡nd&d?t	 
¡ v sÆt |¡rËt |¡nd?d œ }t d@¡d" d#|i }tt |¡ƒ‚d}t‡ fdAdB„|d D ƒdƒ}d}||u}|s2t dC|fdD||f¡dEt	 
¡ v st |¡rt |¡ndEt |¡dFœ }t dG¡dH dI|i }tt |¡ƒ‚d }}dJ}|dK }||v}|skt d$|fdL||f¡t |¡t |¡dMœ }t dN¡dO dP|i }tt |¡ƒ‚d } }}dQdRlm} |  ¡ I dSdTi}| j dUdV¡}z||ˆ |ƒ}||||ƒ} W n' ttfy¼ }! ztdW|!› ƒ tdXƒ W Y d}!~!W d  ƒ dS d}!~!ww W d  ƒ n	1 sÈw   Y  | dY|› ¡}
|
j}d0d1g}||v }|st d|fd2||f¡d3t	 
¡ v sút |
¡rÿt |
¡nd3t |¡t |¡d4œ }t dZ¡d6 d7|i }tt |¡ƒ‚d } }}|jd[|	› d\|idd}
|
j}g d]¢}||v }|szt d|fd2||f¡d3t	 
¡ v sVt |
¡r[t |
¡nd3t |¡t |¡d4œ }t d^¡d6 d7|i }tt |¡ƒ‚d } }}dS )_aŠ  
    Test users cannot access other users' data via parameter manipulation.
    
    Security Risk: Insufficient authorization allows users to access data belonging
    to other users by manipulating request parameters.
    
    Attack Scenarios:
    - Camera ID enumeration to access other users' cameras
    - User ID manipulation in admin functions
    - Direct object reference attacks
    r   r¥   r   r   r   r   r   rb   rc   rd   NÚ111111111111rf   zUser1 Private Camerarg   rj   rk   rp   z"User1 camera creation failed with z" - this may indicate system issuesÚ222222222222zUser2 Private Cameraz"User2 camera creation failed with ú/api/kamerec                 S   ó   g | ]}|d  ‘qS ©rh   rG   ©r‹   ÚcamrG   rG   rH   r   Ó  rŽ   z8test_horizontal_privilege_escalation.<locals>.<listcomp>ÚcamerasrM   )z%(py0)s in %(py2)sÚuser2_camera_idÚ
camera_idsr_   z!User2 cannot see their own camerar`   ra   rZ   r\   Úuser1_camera_idzLUser2 can see User1's camera - horizontal privilege escalation vulnerabilityrn   zAPI returned server error (z() - skipping privilege escalation checkszLThis might indicate a legitimate server issue rather than a security problemzCamera API returned z( - may require additional authenticationz/api/kamere/rename?csrf_token=zHACKED BY USER2rÕ   ré   rO   r   r   zAUser2 can modify User1's camera - critical security vulnerabilityrP   r   z/api/kamere/delete?csrf_token=rh   zAUser2 can delete User1's camera - critical security vulnerabilityr   r   r   c                 S   r7  r8  rG   r9  rG   rG   rH   r   ÷  rŽ   Úuser1_camera_idsz.User1's camera was affected by User2's actionsc                 3   s     | ]}|d  ˆ kr|V  qdS )rh   NrG   r9  ©r>  rG   rH   rÒ   ü  s   € z7test_horizontal_privilege_escalation.<locals>.<genexpr>r¡   r£   Úuser1_camerar   zUser1's camera not foundrž   r   ÚHACKEDri   )z%(py1)s not in %(py4)s©r‚   ra   z$User1's camera was modified by User2ú
>assert %(py6)srƒ   r   )Úcreate_test_image_filer   s!   ‰PNG

   IHDR         wSÞÚUSER_PHOTOS_DIR_REALz/tmpzImage file creation failed: zISkipping image-based privilege escalation tests due to file system issuesrñ   z?User2 can view User1's images - horizontal privilege escalationræ   rç   rè   z8User2 can delete User1's images - critical vulnerability)r!   r%   rt   ru   r'   r3   rù   r(   r)   r*   r+   r,   r-   rq   r.   r/   ÚnextÚtests.functional.test_imagesrE  Úapp_contextÚconfigrþ   ÚFileNotFoundError)"r4   r5   r6   Úuser1r¿   rº   r¾   r|   Úcsrf_token1Úcsrf_token2r   r<  Úcameras_datar=  r>   ry   rz   r?   r@   rA   rB   Úuser1_camerasr?  rA  r³   r¹   r  r´   rE  Úsample_image_dataÚtemp_dirÚuser1_image_pathÚuser2_image_pathÚerG   r@  rH   Ú$test_horizontal_privilege_escalation”  s¦   

ÿ

ÿþ
þ

– þžþž
žˆv

ô€	ÿøžþ¢rV  c           /      C   sò  |ƒ  |d }|d }|   ¡ }|   ¡ }|jd|d |d dœd}|j}d}	||	k}
|
s`t d	|
fd
||	f¡dt ¡ v sAt |¡rFt |¡ndt |¡t |	¡dœ }dd|i }t	t 
|¡ƒ‚d } }
}	|jd|d |d dœd}|j}d}	||	k}
|
s³t d	|
fd
||	f¡dt ¡ v s”t |¡r™t |¡ndt |¡t |	¡dœ }dd|i }t	t 
|¡ƒ‚d } }
}	| d¡ | ¡ }| dd¡}W d  ƒ n1 sÓw   Y  | d¡ | ¡ }| dd¡}W d  ƒ n1 sòw   Y  | d¡}|j}ddg}	||	v }
|
sEt d|
fd||	f¡dt ¡ v s!t |¡r&t |¡ndt |¡t |	¡dœ }t d¡d d|i }t	t 
|¡ƒ‚d } }
}	|jdkrQd}|j}	||	v}|s˜t d|fd||	f¡t |¡dt ¡ v sxt |¡r}t |¡ndt |	¡dœ }t d¡d d|i }t	t 
|¡ƒ‚d } }}	g }d}|j}||v }	|	}|	s¹d}|j}||v }|}|sAt d|	fd||f¡t |¡dt ¡ v s×t |¡rÜt |¡ndt |¡d œ }d!d"|i }| |¡ |	s't d|fd#||f¡t |¡dt ¡ v st |¡rt |¡ndt |¡d$œ }d%d&|i }| |¡ t |d'¡i  }t d(¡d) d*|i }t	t 
|¡ƒ‚d } } } }	 } } }}|jd+|› d,d-dœd}|j}g d.¢}	||	v }
|
s§t d|
fd||	f¡dt ¡ v sƒt |¡rˆt |¡ndt |¡t |	¡dœ }t d/¡d d|i }t	t 
|¡ƒ‚d } }
}	|  ¡ W tƒ }| d0d1¡ ¡ }d}||u }|sýt d2|fd3||f¡d4t ¡ v sÝt |¡rât |¡nd4t |¡d5œ }t d6¡d7 d8|i }t	t 
|¡ƒ‚d }}W d  ƒ n	1 sw   Y  d9d:|d; › d<d:|d; › d=g}|D ]%}| |¡}|j}g d.¢}	||	v }
|
sxt d|
fd||	f¡dt ¡ v sQt |¡rVt |¡ndt |¡t |	¡dœ }t d>|› ¡d d|i }t	t 
|¡ƒ‚d } }
}	|jd?krI| ¡ } g }d}	| |	u }
|
}|
s¡t| ƒ}d@}!||!k}|}|s;t d2|
fdA| |	f¡dBt ¡ v s»t | ¡rÀt | ¡ndBt |	¡dCœ }dDd|i }| |¡ |
st d	|fdE||!f¡dFt ¡ v sît t¡rót t¡ndFdBt ¡ v st | ¡rt | ¡ndBt |¡t |!¡dGœ }"dHdI|"i }#| |#¡ t |d'¡i  }t dJ|› ¡dK dL|i }$t	t 
|$¡ƒ‚d } } }
 }	 } }}!q$|d; }%dMdN|%› i fdMdO|%› dPdQifdMd:|%› dR|› dSdTifg}&|&D ]m\}'}(} |'dMkr|j|(| d}n| |(¡}|j}g d.¢}	||	v }
|
sÕt d|
fd||	f¡dt ¡ v s«t |¡r°t |¡ndt |¡t |	¡dœ }t dU|'› dV|(› ¡d d|i }t	t 
|¡ƒ‚d } }
}	qo|  ¡ ¶ tƒ }| d0|d f¡ ¡ })|)du r	tdW|d › ƒ | dX|d f¡ ¡ })d}|)|u}|sOt dY|fdZ|)|f¡d[t ¡ v s)t |)¡r.t |)¡nd[t |¡d5œ }t d\|d › d]¡d7 d8|i }t	t 
|¡ƒ‚d }}|)d }|d }
||
k}|sŠt d	|fd^||
f¡t |¡t |
¡d_œ }*t d`¡da db|*i }+t	t 
|+¡ƒ‚d } }}
W d  ƒ n	1 s›w   Y  | ¡ }| dc¡},dd|de< dd|d< d|df< W d  ƒ n	1 sÁw   Y  | d¡}|jd?kr„|jd+|› dgdgdœd}|j}g d.¢}	||	v }
|
s't d|
fd||	f¡dt ¡ v st |¡rt |¡ndt |¡t |	¡dœ }t dh¡d d|i }t	t 
|¡ƒ‚d } }
}	|  ¡ J tƒ }| d0di¡ ¡ }-|-durttdjƒ tdkƒ tdlƒ | dmdi¡ | ¡  dn}|srt do¡dp dqt |¡i }.t	t 
|.¡ƒ‚d}W d  ƒ n	1 sw   Y  | ¡ }|,|dc< de|v r•|de= W d  ƒ n	1 s w   Y  | d¡}|j}d?}	||	k}
|
sñt d	|
fd
||	f¡dt ¡ v sÍt |¡rÒt |¡ndt |¡t |	¡dœ }t dr¡d d|i }t	t 
|¡ƒ‚d } }
}	dS )sa¤  
    Test regular users cannot access admin functions via direct URLs or parameter manipulation.
    
    Security Risk: Insufficient privilege checks allow regular users to access
    administrative functions, potentially compromising the entire system.
    
    Attack Scenarios:
    - Direct access to admin URLs
    - Admin function calls via API manipulation
    - Role modification through parameter tampering
    r   Úadminr   r   r   r   r   r   r   r   r   r   r   r   Nrb   rc   rd   z/adminrÕ   rM   rO   z#Regular user can access admin panelrP   rZ   )z4%(py1)s not in %(py5)s
{%(py5)s = %(py3)s.location
})r‚   r–   r   z%Regular user redirected to admin arear  Úloginr  r  r  r…   )z4%(py12)s in %(py16)s
{%(py16)s = %(py14)s.location
})Úpy12Úpy14Úpy16z%(py18)sÚpy18r˜   z.Invalid redirect for unauthorized admin accessz
>assert %(py21)sÚpy21z/admin/add_user?csrf_token=Úhackeduser123Úhackedpass123)r   rÕ   ré   z0Regular user can create users via admin endpointz&SELECT * FROM users WHERE username = ?)r^  )Úis)z%(py0)s is %(py3)sÚhacked_userr   zHRegular user successfully created a user - critical privilege escalationrž   r   z/admin/users.jsonz/admin/user/r¬   z/cameras.jsonz/images.jsonz#Regular user can access admin API: rp   r   )z%(py2)s is %(py5)sr   )r   r   z%(py7)s)z4%(py12)s
{%(py12)s = %(py9)s(%(py10)s)
} == %(py15)sr   )r…   Úpy10rY  r  z%(py17)sr  z"Regular user got admin data from: z
>assert %(py20)sÚpy20ÚPOSTz/admin/remove_user/z/admin/change_password/Únew_passwordÚ	hacked123z/cameras/delete?csrf_token=rh   ro   z'Regular user can perform admin action: ú z5Admin user check by ID failed, checking by username: z7SELECT * FROM users WHERE username = ? AND is_admin = 1r¡   r£   Úadmin_checkzAdmin user 'z(' was affected by regular user's actions)z%(py1)s == %(py4)srC  zAdmin user data corruptedrD  rƒ   r    TÚis_adminÚroleÚsessionhack123z*Session manipulation allowed admin actions)rk  uQ   ðŸš¨ CRITICAL SECURITY VULNERABILITY: Session manipulation allowed user creation!z]The application should validate admin privileges against the database, not just session data.z:This is a real security issue that needs immediate fixing.z$DELETE FROM users WHERE username = ?FzCSession manipulation allowed user creation - CRITICAL VULNERABILITYz
>assert %(py1)sr‚   z<Admin functionality broken during privilege escalation tests)r!   r%   r'   r(   r)   r*   r+   r,   r-   r.   r/   rt   ru   rq   r  r&   r  rI  r   ÚexecuteÚfetchonerù   r   r3   Úcommit)/r4   r5   r6   Úregular_userÚ
admin_userÚregular_clientÚadmin_clientr   r>   r?   r@   rA   rB   r|   Úregular_csrfÚ
admin_csrfr  r³   r*  Ú@py_assert11Ú@py_assert15Ú@py_assert13r/  Ú@py_format17Ú@py_format19r0  Ú@py_format22Údbra  r¹   Úadmin_endpointsÚendpointr   r,  Ú@py_format16Ú@py_format18r1  Útarget_user_idÚadmin_actionsÚmethodÚurlrh  rz   r´   Úoriginal_user_idÚsession_hack_userÚ@py_format2rG   rG   rH   Ú"test_vertical_privilege_escalation#  sÒ   
þŠ
þŠ

ÿ

ÿ
žšþh þÿž
Šýý

¤þ„ €ý

®

”|÷


û
þÿž

8€ö

€ý
žr‡  c           5      C   sx  |ƒ  |   ¡ }ddddddifddddd	œfddd
ddœfg}g d¢}|D ]¡^}}}|r0|d nd}	|dkr>|j||	d}
n| |¡}
|
jdd ¡ }ddl}|D ]t}| ||¡}t|ƒ}d}||k}|s¿t 	d|fd||f¡dt
 ¡ v szt t¡rt t¡nddt
 ¡ v s‹t |¡rt |¡ndt |¡t |¡dœ }t d|› d|› d|› d|dd… › ¡d d|i }tt |¡ƒ‚d } }}qQq%| d¡}
|
j}d d!g}|D ]m}||v rB||  ¡ }g d"¢}|D ]Y}||v}|s?t 	d#|fd$||f¡d%t
 ¡ v st |¡rt |¡nd%d&t
 ¡ v st |¡r t |¡nd&d'œ }t d(|› d)|| › ¡d* d+|i }tt |¡ƒ‚d}qèqÕ|d, d- }g d.¢}g d/¢}|D ]§} g }!td0ƒD ]}"t ¡ }#|j| d-|id1}
t ¡ }$|! |$|# ¡ q[g }%|D ]}&t ¡ }#|j| d-|&id1}
t ¡ }$|% |$|# ¡ q{|!rù|%rùt |!¡}'t |%¡}(t|'|( ƒ})d2}|)|k }|sõt 	d3|fd4|)|f¡d5t
 ¡ v sÍt |)¡rÒt |)¡nd5t |¡d6œ }*t d7| › d8|)d9›d:¡d; d<|*i }+tt |+¡ƒ‚d }}qS|jd|d, d- |d, d= d	œd1 | d¡ | ¡ },|, d>d¡}-W d  ƒ n	1 s(w   Y  g d?¢}.g d@¢}/|.D ]è} | | ¡}
|
jdAkrzk|
 ¡ }	|	r­t|	ƒ ¡ }0|/D ]X}1|1|0v}|s©t 	d#|fd$|1|0f¡dBt
 ¡ v stt |1¡ryt |1¡ndBdCt
 ¡ v s‡t |0¡rŒt |0¡ndCd'œ }t dD|1› dE| › ¡d* d+|i }tt |¡ƒ‚d}qTW q7 ty   |
jdd ¡ }|/D ]X}1|1|v}|st 	d#|fd$|1|f¡dBt
 ¡ v sát |1¡ræt |1¡ndBdFt
 ¡ v sôt |¡rùt |¡ndFd'œ }t dD|1› dE| › ¡d* d+|i }tt |¡ƒ‚d}qÁY q7w q7dGdHdIdddddœfg}2|2D ]‹^}}}|r:|d nd}	|dkrI|j||	d}
n| |¡}
|
jdd ¡ }g dJ¢}3|3D ][}4|4|v}|s´t 	d#|fd$|4|f¡dKt
 ¡ v s|t |4¡rt |4¡ndKdFt
 ¡ v st |¡r”t |¡ndFd'œ }t dL|› d|› d8|4› ¡d* d+|i }tt |¡ƒ‚d}q\q.dS )Ma½  
    Test for information disclosure through error messages, timing, and metadata leakage.
    
    Security Risk: Applications may leak sensitive information through detailed error messages,
    timing differences, or metadata exposure.
    
    Attack Scenarios:
    - Error message analysis to reveal system information
    - Timing analysis to infer system state
    - Metadata extraction from responses
    - Debug information exposure
    )ÚGETz/nonexistent_endpoint)rd  z/api/invalid_apird  z/api/kamere/addÚinvalidrl   r   Áè  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxr   ro   rd   rg   )rS   rT   rU   rV   Ú
constraintzforeign keyz/usr/z/etc/z/var/zc:\\Úsystem32Ú	tracebackÚ	exceptionÚdebugzstack tracezline \d+ÚflaskÚwerkzeugÚpythonÚ__file__r   N)rl   TrQ   r   rË   r   Úmatchesr•   zInformation disclosure in rg  z	: found 'z' - r   r—   r„   rb   ÚServerzX-Powered-By)r  r‘  r’  ÚapacheÚnginxrZ   r\   Údangerous_valueÚheader_valuer_   zHeader z reveals technology: r`   ra   r   r   )r   Ú	fakeuser2Únotreal3)z/reset_passwordz/forgot_passwordz
/api/resetre   r   r    )ú<)z%(py0)s < %(py3)sÚtiming_diffr   zTiming difference in z: r   zs (user enumeration possible)rž   r   r   rc   )r6  z/get_available_camerasz/get_marker_locations)
r   rY   ÚsecretrŒ   ÚkeyÚsaltÚhashÚinternal_idÚsystem_pathÚdatabase_pathrp   Úsensitive_fieldÚresponse_strzSensitive field 'z' exposed in r^   )rˆ  z/debug)rˆ  z/_debug)rˆ  z/console)z
debug modezwerkzeug debuggerÚconsoler  Úinteractivezpython shellÚ	indicatorzDebug information exposed via )r!   r%   rt   rr   rs   ÚreÚfindallr   r(   r)   r*   r+   r,   r-   rq   r.   r/   r  r"   r#   r$   r&   r0   r1   r2   ru   r'   rù   ÚstrÚ	Exception)5r4   r5   r6   r7   Úerror_inducing_requestsÚdangerous_info_patternsr‚  rƒ  Úargsr   r   r^   rª  Úpatternr”  r³   r®   r?   r´   rµ   r  Údangerous_headersÚheaderr™  Údangerous_valuesr˜  r>   ry   rz   Úexisting_userÚnon_existing_usersÚpassword_reset_endpointsr}  Úexisting_timesr;   ÚstartÚendÚnonexisting_timesr   Úexisting_avgÚnonexisting_avgr  r¹   rA   r|   rc   Úapi_endpointsÚsensitive_fieldsr¦  r¥  Údebug_triggersÚdebug_indicatorsr©  rG   rG   rH   Ú+test_information_disclosure_vulnerabilitiesÌ  sÂ   ö
Úþ
þ
°€

˜€


þ

ÿ
®€®ÿý÷ü

	´ÿìrÂ  )$Ú__doc__Úbuiltinsr*   Ú_pytest.assertion.rewriteÚ	assertionÚrewriter(   Úpytestr#   Úrandomr×   ÚhashlibÚhmacrú   ÚtempfileÚsqlite3r0   Úunittest.mockr   r  r   Úapp_modules.dbr   rÿ   r   ÚmarkÚsecurityrI   r}   rÂ   rå   r  r3  rV  r‡  rÂ  rG   rG   rG   rH   Ú<module>   sH    "
=
_
g
^
 
r
 
 )