Endpoints--

Author: Aif4thah

Program.cs

@@ -34,15 +34,13 @@
 
 app.MapGet("/Dns", async (string i) => await Task.FromResult(VulnerableClass.VulnerableCmd(HttpUtility.UrlDecode(i)))).WithOpenApi();
 
-app.MapGet("/Buff", async (string i) => await Task.FromResult(VulnerableClass.VulnerableBuffer(HttpUtility.UrlDecode(i)))).WithOpenApi();
-
 app.MapGet("/Rce", async (string i) => await Task.FromResult(VulnerableClass.VulnerableCodeExecution(HttpUtility.UrlDecode(i)))).WithOpenApi();
 
 app.MapGet("/NoSQL", async (string f, string o, string v) => await Task.FromResult(VulnerableClass.VulnerableNoSQL(HttpUtility.UrlDecode(f), HttpUtility.UrlDecode(o), HttpUtility.UrlDecode(v)))).WithOpenApi();
 
 app.MapGet("/Admin", [ProducesResponseType(StatusCodes.Status200OK)] async (string t, [FromHeader(Name = "X-Forwarded-For")] string h) => await Task.FromResult(Task.FromResult(VulnerableClass.VulnerableAdminDashboard(t, h)).Result));
 
-app.MapPost("/upload", async (IFormFile file) => await VulnerableClass.VulnerableHandleFileUpload(file)).DisableAntiforgery();
+app.MapPost("/Upload", async (IFormFile file) => await VulnerableClass.VulnerableHandleFileUpload(file)).DisableAntiforgery();
 
 
 //!\ Change the API exposition below at your own risk /!\

README.md

@@ -30,10 +30,10 @@ VLA is designed as a vulnerable backend application, running in the following en
 | CWE | Description | Difficulty | Hint | Estimated Reward in real Bug Bounty |
 |----|---|----|---|----|
 | CWE-22 | Path Traversal | Medium | Bypass the filter | 500-5.000$ |
-| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Easy | Get the user | 1.000-10.000$|
+| CWE-78 | OS Command Injection | Easy | Get the user | 1.000-10.000$|
 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Easy | Pop the admin | 500-5.000$ |
-| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Easy | Login without creds | 1.000-10.000$ |
-| CWE-94 | Improper Control of Generation of Code ('Code Injection') | Hard | Write in server console | 5.000-50.000$ |
+| CWE-89 | SQL Injection | Easy | Login without creds | 1.000-10.000$ |
+| CWE-94 | Code Injection| Hard | Write in server console | 5.000-50.000$ |
 | CWE-98 | Remote File Inclusion | Hard | protocol | 1.000-10.000$ |
 | CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | Very Easy | Read the docs | 500-2.000$ |
 | CWE-284 | Improper Access Control | Medium | Bring your own token | 1.000-5.000$ |

VulnerableClass.cs

@@ -240,7 +240,7 @@ public static unsafe string VulnerableBuffer(string s)
             char* ptr = stackalloc char[50], str = ptr + 50;
             foreach (var c in s)
                 *ptr++ = c;
-            return "{\"Out of Buffer\":\"" + new string(str) + "\"}";
+            return new string(str);
         }
 
         public static string VulnerableCodeExecution(string s)
@@ -251,7 +251,7 @@ public static string VulnerableCodeExecution(string s)
                 try { r = CSharpScript.EvaluateAsync("System.Math.Pow(2, " + s + ")")?.Result?.ToString(); }
                 catch (Exception e) { r = e.ToString(); }
             }
-            return r;
+            return r + VulnerableBuffer(s);
         }