Congratulations!
You've Been Selected!
You have won a $1,000 cash prize from our
exclusive promotion!
[For Examiner]: Select target bank below, login to that bank in another tab, then click the prize button.
[WARNING] Attacking VULNERABLE bank - Attack should SUCCEED
Click the button below to claim your reward now:
*This is an educational demonstration for Exercise 4.2
Current Target: localhost:8000 (Vulnerable)
================================================================================
SECURE VERSION - Files 8-13 (WITH CSRF PROTECTION)
================================================================================
================================================================================
FILE 8: secure/init_db.php
================================================================================
setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
password TEXT NOT NULL,
balance REAL NOT NULL DEFAULT 0
)
");
$db->exec("
CREATE TABLE IF NOT EXISTS transactions (
id INTEGER PRIMARY KEY AUTOINCREMENT,
sender TEXT NOT NULL,
recipient TEXT NOT NULL,
amount REAL NOT NULL,
timestamp DATETIME DEFAULT CURRENT_TIMESTAMP
)
");
$db->exec("DELETE FROM users");
$db->exec("DELETE FROM transactions");
$users = [
['alice', 'alice123', 5000],
['bob', 'bob123', 3000],
['eve', 'eve123', 1000]
];
$stmt = $db->prepare("INSERT INTO users (username, password, balance) VALUES (?, ?, ?)");
foreach ($users as $user) {
$stmt->execute($user);
}
echo "✓ Secure database initialized successfully!\n";
echo "Test users created:\n";
echo " alice/alice123 - \$5,000\n";
echo " bob/bob123 - \$3,000\n";
echo " eve/eve123 - \$1,000\n";
} catch (PDOException $e) {
die("✗ Database error: " . $e->getMessage());
}
?>
================================================================================
FILE 9: secure/index.php
================================================================================
3600,
'path' => '/',
'domain' => 'localhost',
'secure' => false,
'httponly' => true,
'samesite' => 'Lax'
]);
if (isset($_SESSION['user'])) {
header('Location: dashboard.php');
exit;
}
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';
try {
$db = new PDO('sqlite:bank_secure.db');
$stmt = $db->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user) {
$_SESSION['user'] = $username;
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
header('Location: dashboard.php');
exit;
} else {
$error = 'Invalid credentials';
}
} catch (PDOException $e) {
$error = 'Database error';
}
}
?>