Add more challenges

Author: Xychic

index.js

@@ -1,6 +1,7 @@
 "use strict";
 const express = require("express");
 const path = require("path");
+const mysql = require('mysql');
 const { exec } = require("child_process");
 
 const app = express();
@@ -9,6 +10,37 @@ const PORT = process.env.PORT || 3000;
 
 const pagesDir = path.join(__dirname, "public/");
 
+let connection2 = mysql.createConnection({
+	host: 'localhost',
+	user: 'web2',
+	password: 'HyXrA56ESnzUKrW',
+	database: 'web2'
+
+});
+
+connection2.connect(function(err) {
+	if (err) {
+		return console.error('error: ' + err.message);
+	}
+
+	console.log('Web2 connected to the MySQL server.');
+});
+
+let connection3 = mysql.createConnection({
+	host: 'localhost',
+	user: 'web3',
+	password: 'wi8228Sc',
+	database: 'web3'
+});
+
+connection3.connect(function(err) {
+	if (err) {
+		return console.error('error: ' + err.message);
+	}
+
+	console.log('Web3 connected to the MySQL server.');
+});
+
 app.use(
 	express.static(path.join(__dirname, "public")),
 	express.urlencoded({ extended: true })
@@ -18,8 +50,16 @@ app.get("/1", (_, res) => {
 	return res.sendFile(path.join(pagesDir, "web1.html"));
 });
 
+app.get("/2", (_, res) => {
+	return res.sendFile(path.join(pagesDir, "web2.html"));
+});
+
+app.get("/3", (_, res) => {
+	return res.sendFile(path.join(pagesDir, "web3.html"));
+});
+
 app.post("/api", (req, res) => {
-	const ipAddress = req.body.ipaddress;
+	const ipAddress = req.body.ipaddress.replaceAll("'", "");
 
 	exec(`runuser -l web_user -c '/bin/rbash -r -c "ping -c 1 ${ipAddress}"'`, 
 	(err, stdout, stderr) => {
@@ -29,7 +69,38 @@ app.post("/api", (req, res) => {
 			return res.send(stdout);
 
 		}
-	);
+	});
+});
+
+app.post("/api2", (req, res) => {
+	const item = req.body.item;
+
+	connection2.query(`SELECT * FROM Products WHERE item_name LIKE "%${item}%";`, function (err, result, fields) {
+		if (err) {
+			console.error('error: ' + err.message);
+			return res.send(err.message);
+		} else {
+			return res.send(result);
+		}
+	});
+
+});
+
+app.post("/api3", (req, res) => {
+	const key = req.body.key;
+        
+	connection3.query(`SELECT * FROM SECRETS WHERE name='flag' AND value='${key}';`, function (err, result, fields) {
+            if (err) {
+		    return res.send(err);
+	    } else {
+		    if (result.length === 0) {
+		            return res.send(`"${key}" is not the flag`)
+		    } else {
+			    return res.send(`"${key}" is the flag! Well done!`);
+		    }
+	    }
+	});
+
 });
 
 app.listen(3000);

package-lock.json

@@ -5,7 +5,8 @@
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {
-		"express": "^4.17.1"
+		"express": "^4.17.1",
+		"mysql": "^2.18.1"
 	},
 	"scripts": {
 		"start": "node index.js"