{'context_id': 413, 'vulnerable': True, 'processing': False, 'request': {'url': 'https://fleming.org/categorieslogin.htm', 'method': 'DELETE', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'ORIGIN': 'http://127.0.0.1:5000', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/sql-injection/login', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/5.1)'}, 'body': b'csrfmiddlewaretoken=8a7dc2eb-4b4f-479a-97c6-bd4375325975&newpass1=DzG4kGzP&newpass2=Yba8RQgD'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: "if request.method == 'GET':", 5: 'return sql_injection_login_api(request, app)', 6: 'form = request.form', 7: "username = form.get('username')", 8: "password = form.get('password')", 9: 'password_hash = _hash_password(password)', 10: "md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()", 11: 'return md5_pass', 12: 'sql = f"SELECT * FROM users WHERE username=\'{username}\' AND password=\'{password_hash}\'"', 13: 'db_result = app.db_helper.execute_read(sql)', 14: 'con = None', 15: 'try:', 16: 'con = self._get_db_connection()', 17: 'return sqlite3.connect(self.DB_FILE_PATH)', 18: 'cur = con.cursor()', 19: 'cur.execute(sql, params)', 20: 'result = cur.fetchall()', 21: 'return result', 22: 'if con is not None:', 23: 'con.close()', 24: 'return result', 25: ')[0] if len(db_result) > 0 else None', 26: 'user = list(', 27: 'map(', 28: 'lambda u: {', 29: 'db_result', 30: 'map(', 31: 'user = list(', 32: "'id': u[0],", 33: "'username': u[1],", 34: "'password': u[2]", 35: 'lambda u: {', 36: ')[0] if len(db_result) > 0 else None', 37: 'user = list(', 38: 'user = list(', 39: 'return render_template(', 40: "'sql_injection/login.html',", 41: 'sql=sql,', 42: 'logged=user is not None', 43: 'return render_template(', 44: '', 45: '<div class="block">', 46: '<pre>', 47: 'Password: Admin123', 48: '<code lang="sql">', 49: '{{ sql }}', 50: '</code>', 51: '{{ sql }}', 52: '</code>', 53: '{{ sql }}', 54: '</div>', 55: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 56: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 57: '<title>Vuln Python App</title>', 58: '<body>', 59: '{% include "./components/navbar.html" %}', 60: '<section class="section">', 61: '{% block content %}{% endblock %}', 62: '</div>', 63: '</section>', 64: '', 65: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 66: '', 67: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 68: '<span aria-hidden="True"></span>', 69: '<span aria-hidden="True"></span>', 70: '</div> -->', 71: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 72: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 73: '', 74: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 75: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 76: '<div id="navbarBasicExample" class="navbar-menu">', 77: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 78: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 79: '<div class="navbar-start">', 80: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 81: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 82: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 83: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 84: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 85: 'Home', 86: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 87: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 88: '</a>', 89: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 90: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 91: '', 92: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 93: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 94: '<div class="navbar-item has-dropdown is-hoverable">', 95: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 96: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 97: '<a class="navbar-link">', 98: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 99: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 100: 'SQL Injection', 101: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 102: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 103: '</a>', 104: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 105: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 106: '', 107: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 108: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 109: '<div class="navbar-dropdown">', 110: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 111: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 112: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 113: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 114: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 115: 'Login', 116: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 117: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 118: '</a>', 119: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 120: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 121: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 122: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 123: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 124: 'Search', 125: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 126: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 127: '</a>', 128: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 129: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 130: '</div>', 131: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 132: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 133: '<script>', 134: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 135: '<form action="/sql-injection/login" method="post" style="max-width: 300px;">', 136: '<div class="field">', 137: '<label class="label">Username</label>', 138: '<input class="input" name="username" type="text" placeholder="myuser" required>', 139: '</div>', 140: '</div>', 141: '<label class="label">Password</label>', 142: '<div class="control">', 143: '<input class="input" name="password" type="password" placeholder="********" required>', 144: '</div>', 145: '', 146: '<div class="notification is-success">', 147: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 148: '', 149: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 150: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 151: '', 152: '</script>', 153: '', 154: '{% block js %}{% endblock %}', 155: '</body>', 156: '</html>', 157: 'None', 158: 'None', 159: 'None', 160: 'None', 161: 'None', 162: '</html>'}, 'response': {'status_code': '200', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '4245'}}}