coolervoid / codecat Goto Github PK

Little improvement in validation. One tip is to follow this library
https://pypi.org/project/sanitizy/
and
https://pypi.org/project/pyAntiSSRF/ in frontend API crawlers...

The codecat is a tool to use in localhost...
Need a resource to block all users of another machines...

I don't like this resource, i need refactor... maybe make changes in sha512 to AES 256 GCM for example...
https://github.com/CoolerVoid/codecat/blob/master/Frontend/helper/tokenform.py

Insert additional resources to hide JWT.

Maybe lib sodium resource
https://libsodium.gitbook.io/doc/

Need extra validation in auth to prevent IDOR
https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html

I was wondering why you don't upload it to PyPI. Do you need help with that? Should I do it?

Looking at the source code is not possible to see a proper resource to prevent path traversal.

Remember, codecat have a function to recursive reading in the directory. This function with user input is a dangerous issue called "path traversal". Use this tool in a controlled place. My machine is a local virtual machine to run a codecat. Looking at the firewall context, you can block different IP addresses to limit access of codecat for example.
https://github.com/CoolerVoid/codecat/blob/master/Backend/application/engine_controller.py#L77

Reference:
https://cwe.mitre.org/data/definitions/22.html

So I followed you installation instructions and for some reason the curl post keeps timing out. Not sure what the issue might be.

/tools/codecat/Backend# python3 wsgi.py &
[1] 1745
root@kali:~/tools/codecat/Backend# * Serving Flask app "application" (lazy loading)

• Environment: production
  WARNING: This is a development server. Do not use it in a production deployment.
  Use a production WSGI server instead.
• Debug mode: on
• Running on https://0.0.0.0:5001/ (Press CTRL+C to quit)
• Restarting with stat
• Debugger is active!
• Debugger PIN: 149-731-841

/tools/codecat/Backend# python3 wsgi.py &
[1] 1745
root@kali:~/tools/codecat/Backend# * Serving Flask app "application" (lazy loading)

• Environment: production
  WARNING: This is a development server. Do not use it in a production deployment.
  Use a production WSGI server instead.
• Debug mode: on
• Running on https://0.0.0.0:5001/ (Press CTRL+C to quit)
• Restarting with stat
• Debugger is active!
• Debugger PIN: 149-731-841

~/tools/codecat# curl -i -X POST -H "Content-Type: application/json" -d '{"email":"[email protected]","username":"admin","password":"rubrik123"}' https://0.0.0.0:5001/api/users -k
curl: (28) Operation timed out after 300644 milliseconds with 0 out of 0 bytes received

An encoding error occurred when clicking on the View function

A coding error was reported

What I tried to audit was a content management system with Chinese
Thank you for working it out

When prismjs mark lines need to use a bold with strong color... like red for example...

This turn to easy to view critical points.