# Damn Vulnerable Go Application - Security Vulnerabilities

⚠️ **WARNING**: This application contains intentional security vulnerabilities for educational purposes only. **DO NOT** deploy this in production environments!

## Overview

This Go application demonstrates common security vulnerabilities found in web applications. It's designed for:
- Security training and education
- Penetration testing practice
- Vulnerability assessment learning
- Secure coding awareness

## Vulnerabilities Included

### 1. SQL Injection (CWE-89)
**Location**: `authenticate()` function
**Description**: Direct string concatenation in SQL queries allows attackers to manipulate database queries.
**Example**: `/login?username=admin'--&password=anything`

### 2. Command Injection (CWE-78)
**Location**: `pingHandler()` function
**Description**: User input directly passed to system commands without sanitization.
**Example**: `/ping?host=google.com;cat /etc/passwd`

### 3. Path Traversal (CWE-22)
**Location**: `fileHandler()` function
**Description**: No path validation allows reading arbitrary files from the system.
**Example**: `/file?file=../../../etc/passwd`

### 4. Cross-Site Scripting (XSS) (CWE-79)
**Location**: `searchHandler()` function
**Description**: User input reflected in HTML without proper escaping.
**Example**: `/search?q=<script>alert('XSS')</script>`

### 5. Cross-Site Request Forgery (CSRF) (CWE-352)
**Location**: `deleteUserHandler()` function
**Description**: No CSRF tokens or validation for state-changing operations.
**Example**: Malicious site can trigger `/delete?id=1`

### 6. Information Disclosure (CWE-200)
**Location**: `debugHandler()` function
**Description**: Sensitive system information exposed to unauthorized users.
**Example**: `/debug` reveals environment variables, API keys, sessions

### 7. Insecure File Upload (CWE-434)
**Location**: `uploadHandler()` function
**Description**: No file type validation or content scanning allows malicious file uploads.
**Example**: Upload executable files or web shells

### 8. Weak Cryptography (CWE-327)
**Location**: `hashPassword()` function
**Description**: Using MD5 for password hashing (cryptographically broken).
**Impact**: Passwords can be easily cracked with rainbow tables

### 9. Hardcoded Credentials (CWE-798)
**Location**: Global `apiKey` variable
**Description**: API keys and secrets hardcoded in source code.
**Impact**: Credentials exposed in version control and deployments

### 10. Insecure Session Management (CWE-384)
**Location**: `createSession()` function and cookie settings
**Description**: Predictable session IDs and insecure cookie configuration.
**Issues**: 
- Predictable session tokens
- HttpOnly=false (XSS accessible)
- Secure=false (transmitted over HTTP)
- No SameSite protection

### 11. Race Conditions (CWE-362)
**Location**: `counterHandler()` function
**Description**: Shared global variable accessed without synchronization.
**Impact**: Data corruption in concurrent environments

### 12. Integer Overflow (CWE-190)
**Location**: `calculateHandler()` function
**Description**: No bounds checking on arithmetic operations.
**Example**: `/calculate?a=999999999&b=999999999`

### 13. Template Injection (CWE-94)
**Location**: `templateHandler()` function
**Description**: User input directly used in template parsing.
**Example**: `/template?template={{.}}`

### 14. Insecure Deserialization (CWE-502)
**Location**: `deserializeHandler()` function
**Description**: Unsafe processing of serialized data from untrusted sources.
**Example**: `/deserialize?data=exec:malicious_command`

### 15. Sensitive Data Exposure (CWE-200)
**Location**: `User` struct and database schema
**Description**: Sensitive information like SSN and passwords exposed in JSON responses.
**Impact**: PII and credentials leaked to clients

### 16. Insufficient Error Handling (CWE-754)
**Location**: Multiple functions
**Description**: Poor error handling reveals system information and causes crashes.
**Impact**: Information disclosure and denial of service

### 17. Insecure Direct Object References (CWE-639)
**Location**: `deleteUserHandler()` function
**Description**: Direct use of user-supplied input to access objects without authorization checks.
**Example**: `/delete?id=1` can delete any user

### 18. Missing Authentication (CWE-306)
**Location**: Most endpoints
**Description**: Critical functions accessible without authentication.
**Impact**: Unauthorized access to sensitive operations

### 19. Overly Permissive File Permissions (CWE-732)
**Location**: `main()` function - uploads directory creation
**Description**: Directory created with 0777 permissions (world-writable).
**Impact**: Any user can modify uploaded files

### 20. Weak Random Number Generation (CWE-338)
**Location**: `generateToken()` function
**Description**: Predictable token generation using time-based seeds.
**Impact**: Tokens can be predicted and forged

## Running the Application

```bash
# Install dependencies
go mod tidy

# Run the vulnerable application
go run vulnerable_app.go
```

The server will start on `http://localhost:8080`

## Testing Vulnerabilities

### SQL Injection Test
```bash
curl "http://localhost:8080/login?username=admin'--&password=anything"
```

### Command Injection Test
```bash
curl "http://localhost:8080/ping?host=google.com;whoami"
```

### Path Traversal Test
```bash
curl "http://localhost:8080/file?file=../../../etc/passwd"
```

### XSS Test
```bash
curl "http://localhost:8080/search?q=<script>alert('XSS')</script>"
```

## Remediation Guidelines

1. **Input Validation**: Validate and sanitize all user inputs
2. **Parameterized Queries**: Use prepared statements for database queries
3. **Output Encoding**: Properly encode output for the target context
4. **Authentication**: Implement proper authentication and authorization
5. **CSRF Protection**: Use CSRF tokens for state-changing operations
6. **Secure Headers**: Implement security headers (HSTS, CSP, etc.)
7. **Error Handling**: Implement proper error handling without information disclosure
8. **Cryptography**: Use strong, modern cryptographic algorithms
9. **Session Management**: Implement secure session handling
10. **File Upload Security**: Validate file types and scan for malware

## Educational Use Only

This application is created solely for educational purposes to demonstrate security vulnerabilities. It should never be deployed in production environments or used for malicious purposes.

## License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.