{'context_id': 373, 'vulnerable': True, 'processing': False, 'request': {'url': 'https://michael.com/tagsprivacy.html', 'method': 'DELETE', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_8_7) AppleWebKit/534.0 (KHTML, like Gecko) Chrome/59.0.826.0 Safari/534.0'}, 'body': b'csrfmiddlewaretoken=5460e934-58d8-45f0-bb8f-312e15fd914a&newpass1=JG9ty2QV&newpass2=jeA61TTk'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: "if request.method == 'GET':", 5: 'return idor_login_page(request, app)', 6: "return render_template('idor/idor_login.html')", 7: '{% extends "base.html" %}', 8: '{% block content %}', 9: '', 10: '<h1 class="title">IDOR - Login</h1>', 11: '<label class="label">Username</label>', 12: '</div>', 13: '</div>', 14: '', 15: '<div class="block">', 16: '<pre>', 17: 'Password: robso1980', 18: '</div>', 19: '', 20: '<div class="block">', 21: '', 22: '<div class="block">', 23: '', 24: '<form action="/idor/login" method="post" style="max-width: 300px;">', 25: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 26: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 27: '<title>Vuln Python App</title>', 28: '<body>', 29: '{% include "./components/navbar.html" %}', 30: '<section class="section">', 31: '{% block content %}{% endblock %}', 32: '</div>', 33: '</section>', 34: '', 35: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 36: '', 37: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 38: '<span aria-hidden="True"></span>', 39: '<span aria-hidden="True"></span>', 40: '</div> -->', 41: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 42: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 43: '', 44: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 45: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 46: '<div id="navbarBasicExample" class="navbar-menu">', 47: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 48: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 49: '<div class="navbar-start">', 50: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 51: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 52: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 53: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 54: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 55: 'Home', 56: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 57: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 58: '</a>', 59: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 60: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 61: '', 62: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 63: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 64: '<div class="navbar-item has-dropdown is-hoverable">', 65: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 66: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 67: '<a class="navbar-link">', 68: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 69: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 70: 'SQL Injection', 71: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 72: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 73: '</a>', 74: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 75: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 76: '', 77: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 78: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 79: '<div class="navbar-dropdown">', 80: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 81: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 82: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 83: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 84: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 85: 'Login', 86: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 87: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 88: '</a>', 89: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 90: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 91: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 92: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 93: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 94: 'Search', 95: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 96: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 97: '</a>', 98: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 99: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 100: '</div>', 101: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 102: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 103: '<script>', 104: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 105: '<div class="control">', 106: '<input class="input" name="username" type="text" placeholder="myuser" required>', 107: '</div>', 108: '<div class="field">', 109: '<div class="control">', 110: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 111: '', 112: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 113: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 114: '', 115: '</script>', 116: '', 117: '{% block js %}{% endblock %}', 118: '</body>', 119: '</html>', 120: 'None', 121: 'None', 122: 'None', 123: 'None', 124: 'None', 125: '</html>'}, 'response': {'status_code': '400', 'headers': {'Content-Type': 'application/json', 'Content-Length': '3984'}}}