Added Broken Access Control Module

.gitignore

@@ -14,3 +14,5 @@ tests/__pycache__/
 
 # Don't include any uploaded images
 hackable/uploads/*
+.DS_Store
+.DS_Store

config/config.inc.php.dist → config/config.inc.php

@@ -1,56 +1,56 @@
-<?php
-
-# If you are having problems connecting to the MySQL database and all of the variables below are correct
-# try changing the 'db_server' variable from localhost to 127.0.0.1. Fixes a problem due to sockets.
-#   Thanks to @digininja for the fix.
-
-# Database management system to use
-$DBMS = getenv('DBMS') ?: 'MySQL';
-#$DBMS = 'PGSQL'; // Currently disabled
-
-# Database variables
-#   WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup.
-#   Please use a database dedicated to DVWA.
-#
-# If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user.
-#   See README.md for more information on this.
-$_DVWA = array();
-$_DVWA[ 'db_server' ]   = getenv('DB_SERVER') ?: '127.0.0.1';
-$_DVWA[ 'db_database' ] = getenv('DB_DATABASE') ?: 'dvwa';
-$_DVWA[ 'db_user' ]     = getenv('DB_USER') ?: 'dvwa';
-$_DVWA[ 'db_password' ] = getenv('DB_PASSWORD') ?: 'p@ssw0rd';
-$_DVWA[ 'db_port']      = getenv('DB_PORT') ?: '3306';
-
-# ReCAPTCHA settings
-#   Used for the 'Insecure CAPTCHA' module
-#   You'll need to generate your own keys at: https://www.google.com/recaptcha/admin
-$_DVWA[ 'recaptcha_public_key' ]  = getenv('RECAPTCHA_PUBLIC_KEY') ?: '';
-$_DVWA[ 'recaptcha_private_key' ] = getenv('RECAPTCHA_PRIVATE_KEY') ?: '';
-
-# Default security level
-#   Default value for the security level with each session.
-#   The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'.
-$_DVWA[ 'default_security_level' ] = getenv('DEFAULT_SECURITY_LEVEL') ?: 'impossible';
-
-# Default locale
-#   Default locale for the help page shown with each session.
-#   The default is 'en'. You may wish to set this to either 'en' or 'zh'.
-$_DVWA[ 'default_locale' ] = getenv('DEFAULT_LOCALE') ?: 'en';
-
-# Disable authentication
-#   Some tools don't like working with authentication and passing cookies around
-#   so this setting lets you turn off authentication.
-$_DVWA[ 'disable_authentication' ] = getenv('DISABLE_AUTHENTICATION') ?: false;
-
-define ('MYSQL', 'mysql');
-define ('SQLITE', 'sqlite');
-
-# SQLi DB Backend
-#   Use this to switch the backend database used in the SQLi and Blind SQLi labs.
-#   This does not affect the backend for any other services, just these two labs.
-#   If you do not understand what this means, do not change it.
-$_DVWA['SQLI_DB'] = getenv('SQLI_DB') ?: MYSQL;
-#$_DVWA['SQLI_DB'] = SQLITE;
-#$_DVWA['SQLITE_DB'] = 'sqli.db';
-
-?>
+<?php
+
+# If you are having problems connecting to the MySQL database and all of the variables below are correct
+# try changing the 'db_server' variable from localhost to 127.0.0.1. Fixes a problem due to sockets.
+#   Thanks to @digininja for the fix.
+
+# Database management system to use
+$DBMS = getenv('DBMS') ?: 'MySQL';
+#$DBMS = 'PGSQL'; // Currently disabled
+
+# Database variables
+#   WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup.
+#   Please use a database dedicated to DVWA.
+#
+# If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user.
+#   See README.md for more information on this.
+$_DVWA = array();
+$_DVWA[ 'db_server' ]   = getenv('DB_SERVER') ?: '127.0.0.1';
+$_DVWA[ 'db_database' ] = getenv('DB_DATABASE') ?: 'dvwa';
+$_DVWA[ 'db_user' ]     = getenv('DB_USER') ?: 'dvwa';
+$_DVWA[ 'db_password' ] = getenv('DB_PASSWORD') ?: 'p@ssw0rd';
+$_DVWA[ 'db_port']      = getenv('DB_PORT') ?: '3306';
+
+# ReCAPTCHA settings
+#   Used for the 'Insecure CAPTCHA' module
+#   You'll need to generate your own keys at: https://www.google.com/recaptcha/admin
+$_DVWA[ 'recaptcha_public_key' ]  = getenv('RECAPTCHA_PUBLIC_KEY') ?: '';
+$_DVWA[ 'recaptcha_private_key' ] = getenv('RECAPTCHA_PRIVATE_KEY') ?: '';
+
+# Default security level
+#   Default value for the security level with each session.
+#   The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'.
+$_DVWA[ 'default_security_level' ] = getenv('DEFAULT_SECURITY_LEVEL') ?: 'impossible';
+
+# Default locale
+#   Default locale for the help page shown with each session.
+#   The default is 'en'. You may wish to set this to either 'en' or 'zh'.
+$_DVWA[ 'default_locale' ] = getenv('DEFAULT_LOCALE') ?: 'en';
+
+# Disable authentication
+#   Some tools don't like working with authentication and passing cookies around
+#   so this setting lets you turn off authentication.
+$_DVWA[ 'disable_authentication' ] = getenv('DISABLE_AUTHENTICATION') ?: false;
+
+define ('MYSQL', 'mysql');
+define ('SQLITE', 'sqlite');
+
+# SQLi DB Backend
+#   Use this to switch the backend database used in the SQLi and Blind SQLi labs.
+#   This does not affect the backend for any other services, just these two labs.
+#   If you do not understand what this means, do not change it.
+$_DVWA['SQLI_DB'] = getenv('SQLI_DB') ?: MYSQL;
+#$_DVWA['SQLI_DB'] = SQLITE;
+#$_DVWA['SQLITE_DB'] = 'sqli.db';
+
+?>

database/bac_setup.sql

@@ -0,0 +1,30 @@
+-- Create tables for Broken Access Control module
+
+-- Table for access logging
+CREATE TABLE IF NOT EXISTS access_log (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    user_id INT NOT NULL,
+    target_id INT NOT NULL,
+    action VARCHAR(50) NOT NULL,
+    timestamp DATETIME NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(user_id),
+    FOREIGN KEY (target_id) REFERENCES users(user_id)
+) ENGINE=InnoDB;
+
+-- Table for security logging (unauthorized attempts)
+CREATE TABLE IF NOT EXISTS security_log (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    user_id INT NOT NULL,
+    target_id INT NOT NULL,
+    action VARCHAR(50) NOT NULL,
+    timestamp DATETIME NOT NULL,
+    ip_address VARCHAR(45) NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(user_id),
+    FOREIGN KEY (target_id) REFERENCES users(user_id)
+) ENGINE=InnoDB;
+
+-- Add role column to users table if it doesn't exist
+ALTER TABLE users ADD COLUMN IF NOT EXISTS role VARCHAR(20) DEFAULT 'user';
+
+-- Update admin user to have admin role
+UPDATE users SET role = 'admin' WHERE user = 'admin';