{"action":"created","issue":{"url":"https://api.github.com/repos/RandomStorm/DVWA/issues/23","labels_url":"https://api.github.com/repos/RandomStorm/DVWA/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/RandomStorm/DVWA/issues/23/comments","events_url":"https://api.github.com/repos/RandomStorm/DVWA/issues/23/events","html_url":"https://github.com/RandomStorm/DVWA/issues/23","id":52132758,"number":23,"title":"Making a better, safer, DVWA pull request","user":{"login":"Shinkurt","id":9161100,"avatar_url":"https://avatars.githubusercontent.com/u/9161100?v=3","gravatar_id":"","url":"https://api.github.com/users/Shinkurt","html_url":"https://github.com/Shinkurt","followers_url":"https://api.github.com/users/Shinkurt/followers","following_url":"https://api.github.com/users/Shinkurt/following{/other_user}","gists_url":"https://api.github.com/users/Shinkurt/gists{/gist_id}","starred_url":"https://api.github.com/users/Shinkurt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shinkurt/subscriptions","organizations_url":"https://api.github.com/users/Shinkurt/orgs","repos_url":"https://api.github.com/users/Shinkurt/repos","events_url":"https://api.github.com/users/Shinkurt/events{/privacy}","received_events_url":"https://api.github.com/users/Shinkurt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-12-16T16:17:24Z","updated_at":"2015-09-13T21:28:24Z","closed_at":null,"body":"Hey,\r\n\r\nI have talked with @ethicalhack3r and made changes to DVWA. fixing major unintended holes and some others that explained in http://www.paulosyibelo.com/2014/09/dvwa-unintended-security-issues.html\r\n\r\nOther than that, fixed the Rosetta Flash attack for the high level, added some extra protection layers as a \"high\" level, and modified the graphics a lot.\r\n\r\nI personally don't know how to use github to pull a request (*embarrassed*); neither do I have time. contacted ryan and he told me the same thing so, we were hoping some from here can do that for me and pull the newest, cooler, DVWA.\r\n\r\nHere: can you try https://www.dropbox.com/s/s0t8rjm4vhlkllu/dvwa-final.zip?dl=0\r\n\r\nThanks,"},"comment":{"url":"https://api.github.com/repos/RandomStorm/DVWA/issues/comments/139919051","html_url":"https://github.com/RandomStorm/DVWA/issues/23#issuecomment-139919051","issue_url":"https://api.github.com/repos/RandomStorm/DVWA/issues/23","id":139919051,"user":{"login":"g0tmi1k","id":535942,"avatar_url":"https://avatars.githubusercontent.com/u/535942?v=3","gravatar_id":"","url":"https://api.github.com/users/g0tmi1k","html_url":"https://github.com/g0tmi1k","followers_url":"https://api.github.com/users/g0tmi1k/followers","following_url":"https://api.github.com/users/g0tmi1k/following{/other_user}","gists_url":"https://api.github.com/users/g0tmi1k/gists{/gist_id}","starred_url":"https://api.github.com/users/g0tmi1k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/g0tmi1k/subscriptions","organizations_url":"https://api.github.com/users/g0tmi1k/orgs","repos_url":"https://api.github.com/users/g0tmi1k/repos","events_url":"https://api.github.com/users/g0tmi1k/events{/privacy}","received_events_url":"https://api.github.com/users/g0tmi1k/received_events","type":"User","site_admin":false},"created_at":"2015-09-13T21:28:24Z","updated_at":"2015-09-13T21:28:24Z","body":"This seems to be based on the v1.0.7 ZIP file from: http://sourceforge.net/projects/dvwa/files/DVWA-1.0.7.zip/download\r\nNote, this is not exactly the same as SVN revision 70 (https://svn.code.sf.net/p/dvwa/code/) - which only makes understanding what's what more of a pain...\r\n\r\nFrom what I can tell, @Shinkurt changes are:\r\n+ New theme \r\n  - Personally I like the layout more, and styling. However I don't like the background or the dark design - doesn't look as professional & harder on the eyes.\r\n+ `<form` in `./vulnerabilities/*/index.php` have been altered to be above the `<div` tags\r\n  -  Not sure why, as HTML ordering is out of sync now.\r\n+ `generateTokens()` on `./vulnerabilities/exec/index.php` - as well as `checkTokens($_POST['token'] , \"./\");` on all `/vulnerabilities/exec/source/*`.\r\n+ `./vulnerabilities/upload/index.php` has `enctype=\"multipart/form-data\"` set in the form tag.\r\n+ `./vulnerabilities/upload/{low|medium}.php` sets filenames to MD5 sums.\r\n  - Not sure if I agree with this on the low level.\r\n+  `./vulnerabilities/upload/high.php` - additional headers as well as other type check (as in medium level) and `getimagesize()`.\r\n+ `./vulnerabilities/view_help.php` - `xss_filter()` used on `$_GET[ 'id' ]` & additional headers.\r\n  - There's also what looks like 'left over' debug statements \r\n  - as well as a ` $_GET[ 'security' ]` (without the `xss_filter()`) & `challenges` that are not used?\r\n+ `./vulnerabilities/view_source_all.php` - `xss_filter()` used on `$_GET[ 'id' ]` & additional headers.\r\n+ `./vulnerabilities/view_source.php` - `xss_filter()` used on `$_GET[ 'id' ]`,` $_GET[ 'security' ]` & additional headers.\r\n  - `$security` looks like it is being defined twice.\r\n+ `./setup.php` - `generateTokens()` & `checkTokens($_POST['token'] , \"./\");` in \r\n+ `./security.php` - `generateTokens()` & `checkTokens($_POST['token'] , \"./\");`\r\n+ `new.php` - new file.\r\n  - Looks like 'left over' debug statements\r\n+ `./login.php` - additional headers \r\n+ `./hackable/uploads/*` - 5 new files\r\n  - Looks like 'left over' backdoor files.\r\n+ `./external/phpids/0.6/*` - various files (*.html?) have been removed from `docs` and `test`\r\n+ `./dvwa/includes/dvwaPage.inc.php` - `xss_filter()` on `dvwaPageReload()`, 4x new token functions, another redirect method (duplicated) & additional headers.\r\n+ `/dvwa/includes/dvwaHeaders.php` - various hardening headers"}}