{'context_id': 451, 'vulnerable': True, 'processing': False, 'request': {'url': 'http://ingram.net/posts/searchhomepage.htm', 'method': 'PATCH', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (iPod; U; CPU iPhone OS 3_2 like Mac OS X; ur-PK) AppleWebKit/535.8.4 (KHTML, like Gecko) Version/3.0.5 Mobile/8B114 Safari/6535.8.4'}, 'body': b'csrfmiddlewaretoken=d9de5f5d-9791-44c0-9385-8150e2646aed&newpass1=xnEEmReF&newpass2=GPyBmJU7'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: 'return xss_reflected_page(request, app)', 5: "search = request.args.get('search')", 6: 'products = app.db_helper.execute_read(', 7: 'f"SELECT * FROM products WHERE name LIKE :search",', 8: "{ 'search': f'%{search}%' }", 9: 'products = app.db_helper.execute_read(', 10: 'con = None', 11: 'try:', 12: 'con = self._get_db_connection()', 13: 'return sqlite3.connect(self.DB_FILE_PATH)', 14: 'cur = con.cursor()', 15: 'cur.execute(sql, params)', 16: 'result = cur.fetchall()', 17: 'return result', 18: 'if con is not None:', 19: 'con.close()', 20: 'return result', 21: 'products = list(', 22: 'map(', 23: 'lambda p: {', 24: 'products', 25: 'map(', 26: 'products = list(', 27: "'id': p[0],", 28: "'name': p[1],", 29: "'price': p[2]", 30: 'lambda p: {', 31: "'id': p[0],", 32: "'name': p[1],", 33: "'price': p[2]", 34: 'lambda p: {', 35: 'return render_template(', 36: "'xss-reflected.html',", 37: 'products=products', 38: 'return render_template(', 39: '{% extends "base.html" %}', 40: '{% block content %}', 41: '', 42: '<h1 class="title">XSS - Reflected</h1>', 43: '</div>', 44: '<td>{{ product.name }}</td>', 45: '<td>{{ product.price }}</td>', 46: '', 47: '', 48: '', 49: '<p>', 50: '', 51: '{% autoescape False %}', 52: "{{ request.args.get('search') }}", 53: '{% autoescape False %}', 54: "{{ request.args.get('search') }}", 55: '{% autoescape False %}', 56: '{% endautoescape %}', 57: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 58: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 59: '<title>Vuln Python App</title>', 60: '<body>', 61: '{% include "./components/navbar.html" %}', 62: '<section class="section">', 63: '{% block content %}{% endblock %}', 64: '</div>', 65: '</section>', 66: '', 67: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 68: '', 69: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 70: '<span aria-hidden="True"></span>', 71: '<span aria-hidden="True"></span>', 72: '</div> -->', 73: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 74: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 75: '', 76: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 77: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 78: '<div id="navbarBasicExample" class="navbar-menu">', 79: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 80: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 81: '<div class="navbar-start">', 82: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 83: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 84: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 85: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 86: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 87: 'Home', 88: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 89: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 90: '</a>', 91: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 92: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 93: '', 94: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 95: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 96: '<div class="navbar-item has-dropdown is-hoverable">', 97: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 98: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 99: '<a class="navbar-link">', 100: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 101: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 102: 'SQL Injection', 103: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 104: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 105: '</a>', 106: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 107: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 108: '', 109: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 110: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 111: '<div class="navbar-dropdown">', 112: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 113: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 114: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 115: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 116: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 117: 'Login', 118: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 119: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 120: '</a>', 121: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 122: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 123: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 124: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 125: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 126: 'Search', 127: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 128: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 129: '</a>', 130: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 131: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 132: '</div>', 133: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 134: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 135: '<script>', 136: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 137: '', 138: '<div class="block">', 139: '<form action="/xss/reflected" method="get" style="max-width: 300px;">', 140: '<label class="label">Search</label>', 141: '<div class="control">', 142: '</div>', 143: '</div>', 144: '<div class="field is-grouped">', 145: '<div class="control">', 146: '<button class="button is-link">Search</button>', 147: '</div>', 148: '</div>', 149: '</form>', 150: '</div>', 151: '', 152: '<div class="block">', 153: '<table class="table is-striped">', 154: '<tr>', 155: '<th>ID</th>', 156: '<th>Name</th>', 157: '<th>Price</th>', 158: '</tr>', 159: '</thead>', 160: '<tbody>', 161: '<div class="block">', 162: '<table class="table is-striped">', 163: '<tr>', 164: '<th>ID</th>', 165: '<th>Name</th>', 166: '<th>Price</th>', 167: '</tr>', 168: '</thead>', 169: '<tbody>', 170: '<div class="block">', 171: '{% for product in products %}', 172: '<tr>', 173: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 174: '', 175: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 176: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 177: '', 178: '</script>', 179: '', 180: '{% block js %}{% endblock %}', 181: '</body>', 182: '</html>', 183: 'None', 184: 'None', 185: 'None', 186: 'None', 187: 'None', 188: '</html>'}, 'response': {'status_code': '403', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '4243'}}}