{'context_id': 401, 'vulnerable': True, 'processing': False, 'request': {'url': 'http://www.mccarthy.com/main/list/tagshome.html', 'method': 'POST', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'ORIGIN': 'http://127.0.0.1:5000', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/ssrf', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/json', 'User-Agent': 'Opera/9.86.(X11; Linux i686; cs-CZ) Presto/2.9.171 Version/11.00'}, 'body': b'csrfmiddlewaretoken=c519be56-95f4-427c-b96e-9710edd85fee&newpass1=ggAvizLR&newpass2=5FzU5Fwq'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: "if request.method == 'GET':", 5: 'return ssrf_api(request, app)', 6: 'form = request.form', 7: "name = form['name']", 8: "email = form['email']", 9: "original_picture_url = form['imageUrl']", 10: 'downloaded_url = _download_image(original_picture_url, app)', 11: 'if not url:', 12: "download_image_path = ''", 13: 'with urllib.request.urlopen(url) as f:', 14: 'download_image_path = f"{app.config[\'PUBLIC_UPLOAD_FOLDER\']}/downloaded-image.png"', 15: "with open(download_image_path, 'wb') as file:", 16: 'file_content = f.read()', 17: 'file.write(file_content)', 18: 'file.close()', 19: 'public_url = f"{app.config[\'PUBLIC_UPLOADS_URL\']}/downloaded-image.png"', 20: 'return public_url', 21: 'return render_template(', 22: "'ssrf.html',", 23: 'email=email,', 24: 'name=name,', 25: 'original_url=original_picture_url,', 26: 'profile_picture_url=downloaded_url', 27: 'return render_template(', 28: '', 29: '', 30: '<div class="block">', 31: '<input class="input" type="email" name="email" id="email" placeholder="E-mail" required>', 32: '<input class="input" type="url" name="imageUrl" id="imageUrl" placeholder="Profile Picture Url" required>', 33: '<input class="button" type="submit" value="Send">', 34: '</form>', 35: '<input class="button" type="submit" value="Send">', 36: '</form>', 37: '<input class="button" type="submit" value="Send">', 38: '</div>', 39: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 40: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 41: '<title>Vuln Python App</title>', 42: '<body>', 43: '{% include "./components/navbar.html" %}', 44: '<section class="section">', 45: '{% block content %}{% endblock %}', 46: '</div>', 47: '</section>', 48: '', 49: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 50: '', 51: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 52: '<span aria-hidden="True"></span>', 53: '<span aria-hidden="True"></span>', 54: '</div> -->', 55: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 56: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 57: '', 58: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 59: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 60: '<div id="navbarBasicExample" class="navbar-menu">', 61: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 62: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 63: '<div class="navbar-start">', 64: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 65: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 66: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 67: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 68: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 69: 'Home', 70: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 71: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 72: '</a>', 73: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 74: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 75: '', 76: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 77: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 78: '<div class="navbar-item has-dropdown is-hoverable">', 79: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 80: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 81: '<a class="navbar-link">', 82: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 83: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 84: 'SQL Injection', 85: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 86: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 87: '</a>', 88: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 89: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 90: '', 91: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 92: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 93: '<div class="navbar-dropdown">', 94: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 95: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 96: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 97: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 98: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 99: 'Login', 100: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 101: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 102: '</a>', 103: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 104: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 105: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 106: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 107: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 108: 'Search', 109: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 110: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 111: '</a>', 112: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 113: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 114: '</div>', 115: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 116: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 117: '<script>', 118: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 119: '<pre>', 120: 'Email: {{ email }}', 121: 'Name: {{ name }}', 122: 'Local URL: {{ profile_picture_url }}', 123: '</pre>', 124: '</div>', 125: '', 126: '<div class="block">', 127: '</div>', 128: '', 129: '</section>', 130: '{% endblock %}', 131: '{% endblock %}', 132: '{% endblock %}', 133: '{% endblock %}', 134: '{% endblock %}', 135: '{% endblock %}', 136: '{% endblock %}', 137: '{% endblock %}', 138: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 139: '', 140: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 141: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 142: '', 143: '</script>', 144: '', 145: '{% block js %}{% endblock %}', 146: '</body>', 147: '</html>', 148: 'None', 149: 'None', 150: 'None', 151: 'None', 152: 'None', 153: '</html>'}, 'response': {'status_code': '204', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '3897'}}}