{'context_id': 474, 'vulnerable': True, 'processing': False, 'request': {'url': 'http://www.arias.com/categorieslogin.php', 'method': 'POST', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'ORIGIN': 'http://127.0.0.1:5000', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/xss/stored', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Linux; Android 6.0) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/45.0.831.0 Safari/534.1'}, 'body': b'csrfmiddlewaretoken=bc91fc84-8100-4c4f-b6da-c249619fcd93&newpass1=64AQJCOD&newpass2=SyAH9K8D'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: "if request.method == 'GET':", 5: 'return xss_stored_api(request, app)', 6: "message = request.form['message']", 7: "result = app.db_helper.execute_write('INSERT INTO messages (message) VALUES (:msg)', { 'msg': message })", 8: 'con = None', 9: 'try:', 10: 'con = self._get_db_connection()', 11: 'return sqlite3.connect(self.DB_FILE_PATH)', 12: 'cur = con.cursor()', 13: 'result = cur.execute(sql, params)', 14: 'con.commit()', 15: 'return result', 16: 'if con is not None:', 17: 'con.close()', 18: 'return result', 19: 'return xss_stored_page(request, app)', 20: "messages = app.db_helper.execute_read('SELECT * FROM messages', {})", 21: 'con = None', 22: 'try:', 23: 'con = self._get_db_connection()', 24: 'return sqlite3.connect(self.DB_FILE_PATH)', 25: 'cur = con.cursor()', 26: 'cur.execute(sql, params)', 27: 'result = cur.fetchall()', 28: 'return result', 29: 'if con is not None:', 30: 'con.close()', 31: 'return result', 32: 'messages = list(map(lambda it: it[0], messages))', 33: 'messages = list(map(lambda it: it[0], messages))', 34: 'messages = list(map(lambda it: it[0], messages))', 35: "return render_template('xss-stored.html', messages=messages)", 36: '', 37: '<div class="block">', 38: '', 39: '<form action="/xss/stored" method="post">', 40: '<label class="label">Name</label>', 41: '<div class="control">', 42: '<input class="input" type="text" placeholder="Text input" id="message" name="message" required minlength="3">', 43: '<div class="control">', 44: '<input class="input" type="text" placeholder="Text input" id="message" name="message" required minlength="3">', 45: '<div class="control">', 46: '</div>', 47: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 48: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 49: '<title>Vuln Python App</title>', 50: '<body>', 51: '{% include "./components/navbar.html" %}', 52: '<section class="section">', 53: '{% block content %}{% endblock %}', 54: '</div>', 55: '</section>', 56: '', 57: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 58: '', 59: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 60: '<span aria-hidden="True"></span>', 61: '<span aria-hidden="True"></span>', 62: '</div> -->', 63: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 64: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 65: '', 66: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 67: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 68: '<div id="navbarBasicExample" class="navbar-menu">', 69: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 70: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 71: '<div class="navbar-start">', 72: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 73: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 74: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 75: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 76: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 77: 'Home', 78: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 79: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 80: '</a>', 81: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 82: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 83: '', 84: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 85: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 86: '<div class="navbar-item has-dropdown is-hoverable">', 87: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 88: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 89: '<a class="navbar-link">', 90: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 91: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 92: 'SQL Injection', 93: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 94: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 95: '</a>', 96: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 97: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 98: '', 99: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 100: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 101: '<div class="navbar-dropdown">', 102: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 103: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 104: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 105: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 106: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 107: 'Login', 108: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 109: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 110: '</a>', 111: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 112: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 113: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 114: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 115: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 116: 'Search', 117: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 118: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 119: '</a>', 120: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 121: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 122: '</div>', 123: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 124: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 125: '<script>', 126: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 127: '<div class="control">', 128: '<button class="button is-link" type="submit">Submit</button>', 129: '</div>', 130: '</form>', 131: '', 132: '<div class="block">', 133: '<h2 class="subtitle">Messages</h2>', 134: '<div class="content">', 135: '{% autoescape False %}', 136: '{% for msg in messages %}', 137: '<article class="message">', 138: '{{ msg }}', 139: '</div>', 140: '</article>', 141: '{% for msg in messages %}', 142: '<article class="message">', 143: '{{ msg }}', 144: '</div>', 145: '</article>', 146: '{% for msg in messages %}', 147: '{% endfor %}', 148: '{% endautoescape %}', 149: '</div>', 150: '</div>', 151: '</section>', 152: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 153: '', 154: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 155: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 156: '', 157: '</script>', 158: '', 159: '{% block js %}{% endblock %}', 160: '</body>', 161: '</html>', 162: 'None', 163: 'None', 164: 'None', 165: 'None', 166: 'None', 167: '</html>'}, 'response': {'status_code': '403', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '4170'}}}