Debug++

Author: Aif4thah

Program.cs

@@ -24,11 +24,11 @@
 
 app.MapGet("/Json", async (string i) => await Task.FromResult(VulnerableClass.VulnerableDeserialize(HttpUtility.UrlDecode(i)))).WithOpenApi();
 
-app.MapPost("/Auth", [ProducesResponseType(StatusCodes.Status200OK)] async (HttpRequest request, [FromBody] VulnerableClass.Creds login) => await Task.FromResult(Task.FromResult(VulnerableClass.VulnerableQuery(login.user, login.passwd)).Result)).WithOpenApi();
+app.MapPost("/Auth", [ProducesResponseType(StatusCodes.Status200OK)] async (HttpRequest request, [FromBody] VulnerableClass.Creds login) => await Task.FromResult(VulnerableClass.VulnerableQuery(login.user, login.passwd)).Result).WithOpenApi();
 
 app.MapGet("/Jwt", async (string i) => await Task.FromResult(VulnerableClass.VulnerableValidateToken(i))).WithOpenApi();
 
-app.MapGet("/Req", async (string i) => await Task.FromResult(VulnerableClass.VulnerableWebRequest(i))).WithOpenApi();
+app.MapGet("/Req", async (string? i) => await VulnerableClass.VulnerableWebRequest(i)).WithOpenApi();
 
 app.MapGet("/Addr", async (int i, string t) => await Task.FromResult(VulnerableClass.VulnerableObjectReference(i, t))).WithOpenApi();
 

VulnerableClass.cs

@@ -163,27 +163,24 @@ public static string VulnerableValidateToken(string token)
 
         }
 
-        public static async Task<string> VulnerableWebRequest(string uri = "https://localhost:3000/")
+        public static async Task<string> VulnerableWebRequest(string uri="https://localhost:3000/")
         {
-            string rep = "{\"Result\":";
-
-            if (uri.Contains("https://localhost"))
+            if (uri.IsNullOrEmpty()) uri = "https://localhost:3000/";
+            if (System.Text.RegularExpressions.Regex.IsMatch(uri, @"^https://localhost"))
             {
                 using HttpClient client = new();
-                client.DefaultRequestHeaders.Accept.Clear();
                 client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("text/html"));
-                client.DefaultRequestHeaders.Add("User-Agent", "VulnerableApp");
-
-                await exec(client, uri);
 
-                static async Task exec(HttpClient client, string uri)
+                var resp = await exec(client, uri);
+                static async Task<string> exec(HttpClient client, string uri)
                 {
                     var r = client.GetAsync(uri);
                     r.Result.EnsureSuccessStatusCode();
-                    Console.WriteLine(await r.Result.Content.ReadAsStringAsync());
+                    return r.Result.StatusCode.ToString();
                 }
+                return "{\"Result\":" + resp + "}";
             }
-            return rep + "}";
+            else { return "{\"Result\": \"Fordidden\"}"; }       
         }
 
         public static string VulnerableObjectReference(int id, string token)