CSS, JS and HTML are all loaded to render the UI.
+ */
+ htmlTemplate = "LEVEL_1/SampleVulnerability")
+ public GenericVulnerabilityResponseBean
An attacker can use XSS to send a malicious script to an unsuspecting user. \
+ The end user\u2019s browser has no way to know that the script should not be trusted, and will execute the script. \
+ Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, \
+ or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content \
+ of the HTML page.
For more information on XSS:
+
+#### AttackVector description
+PERSISTENT_XSS_HTML_TAG_URL_PARAM_DIRECTLY_INJECTED_IN_DIV_TAG=\"comment\" query param's value is directly added to \"div\" tag.
+PERSISTENT_XSS_HTML_TAG_URL_PARAM_DIRECTLY_INJECTED_IN_DIV_TAG_REPLACING_IMG_AND_INPUT_TAG=\"comment\" query param's value is directly added to \"div\" tag after replacing "
An attacker can construct a URL within the application that \
+causes a redirection to an arbitrary external domain. This behavior can be leveraged to facilitate phishing attacks against users of the application.
\
+The ability to use an authentic application URL, targeting the correct domain and with a valid SSL certificate (if SSL is used), lends credibility to \
+the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain. \
+
RFC 2616 - "Hypertext Transfer Protocol - HTTP/1.1" target="_blank" defines a variety \
+ of 3xx status codes that will cause a browser to redirect to a specified location and this implementation is based on 3xx status codes
\
+ Important Links:\
+
\
+ Some myths: Are URL shorteners \u201Cvulnerable\u201D due to open redirects?
+
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER=\"returnTo\" query parameter's value is directly added to the \"Location\" header.
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER_IF_NOT_HTTP_HTTPS_WWW_OR_DOMAIN_IS_SAME=\"returnTo\" query parameter's value is directly added to the \"Location\" header if it doesn't starts with \"http\",\"www\" and \"https\" or domain is same as the application.
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER_IF_NOT_HTTP_HTTPS_WWW_//_OR_DOMAIN_IS_SAME=\"returnTo\" query parameter's value is directly added to the \"Location\" header if it doesn't starts with \"http\",\"www\", \"https\" and "//" or domain is same as the application.
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER_IF_NOT_HTTP_WWW_HTTPS_//_NULL_BYTE_OR_DOMAIN_IS_SAME=\"returnTo\" query parameter's value is directly added to the \"Location\" header if it doesn't starts with \"http\",\"www\", \"https\", "//" and Null Byte or domain is same as the application.
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER_IF_NOT_HTTP_HTTPS_//_WWW_%_OR_DOMAIN_IS_SAME=\"returnTo\" query parameter's value is directly added to the \"Location\" header if it doesn't starts with \"http\",\"www\", \"https\", "//" and character less than ascii value 33 or domain is same as the application.
+OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADDED_TO_LOCATION_HEADER_BY_ADDING_DOMAIN_AS_PREFIX=\"returnTo\" query parameter's value is directly added to the \"Location\" header by prefixing it will applications domain name.
+
+
+## Meta Tag based URL Redirection
+OPEN_REDIRECTION_VULNERABILITY_META_TAG_BASED=Open redirection vulnerabilities arise when an application incorporates user-controllable \
+data into the target of a redirection in an unsafe way.
An attacker can construct a URL within the application that \
+causes a redirection to an arbitrary external domain. This behavior can be leveraged to facilitate phishing attacks against users of the application.
\
+The ability to use an authentic application URL, targeting the correct domain and with a valid SSL certificate (if SSL is used), lends credibility to \
+the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain. \
+
An HTML meta element which specifies the time in seconds before the browser is to refresh the page. \
+Providing an alternate URI allows the element to be used as a timed URL redirector. \
+For example, in the following example the browser will redirect to example.com after 5 seconds:
\
+ <meta http-equiv="refresh" content="5;url=http://example.com">
\
+ Important Links:\
+
\
+ Some myths: Are URL shorteners \u201Cvulnerable\u201D due to open redirects?
+
+
+URL_REDIRECTION_META_TAG_BASED_INJECTION=Meta Tag based Url Redirection.
+URL_REDIRECTION_URL_PARAMETER_INJECTION_INTO_META_TAG=Url Parameter is directly added to Meta Tag.
+
+
+
+# UNRESTRICTED_FILE_UPLOAD_VULNERABILITY
+UNRESTRICTED_FILE_UPLOAD_VULNERABILITY=Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed.\
+
The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored.\
+
\
+Important Links:
\
+
+
+#### Attack Vector Description
+UNRESTRICTED_FILE_UPLOAD_NO_VALIDATION_FILE_NAME=There is no validation on uploaded file's name.
+UNRESTRICTED_FILE_UPLOAD_IF_NOT_HTML_FILE_EXTENSION=All file extensions are allowed except .html extensions.
+UNRESTRICTED_FILE_UPLOAD_IF_NOT_HTML_NOT_HTM_FILE_EXTENSION=All file extensions are allowed except .html and .htm extensions.
+UNRESTRICTED_FILE_UPLOAD_IF_NOT_HTML_NOT_HTM_FILE_EXTENSION_CASE_INSENSITIVE=All file extensions are allowed except case insensitive .html, .htm extensions.
+UNRESTRICTED_FILE_UPLOAD_IF_FILE_NAME_NOT_CONTAINS_.PNG_OR_.JPEG_CASE_INSENSITIVE=Only file name is allowed if it contains case insensitive .jpeg or .png.
+UNRESTRICTED_FILE_UPLOAD_IF_FILE_NAME_NOT_ENDS_WITH_.PNG_OR_.JPEG_CASE_INSENSITIVE_AND_FILE_NAMES_CONSIDERED_BEFORE_NULL_BYTE=Only file name is allowed if it ends with case insensitive .jpeg or .png and it is considered before Null Bytes only.
+UNRESTRICTED_FILE_UPLOAD_IF_FILE_NAME_NOT_ENDS_WITH_.PNG_OR_.JPEG_CASE_INSENSITIVE=Only file name is allowed if it ends with case insensitive .jpeg or .png.
+
+
+# XXE Vulnerability
+XXE_VULNERABILITY=An XML External Entity attack is a type of attack against an \
+application that parses XML input. This attack occurs when XML input containing \
+a reference to an external entity is processed by a weakly configured XML parser. \
+This attack may lead to the disclosure of confidential data, denial of service, \
+server side request forgery, port scanning from the perspective of the machine where \
+the parser is located, and other system impacts.\
+
\
+Important Links:
\
+
+#### Attack Vector Description
+XXE_NO_VALIDATION=There is no validation on the XML passed in request body.
+XXE_DISABLE_GENERAL_ENTITY=Parser is disabled from processing general external entities.
+XXE_DISABLE_GENERAL_AND_PARAMETER_ENTITY=Parser is disabled from processing general and parameter entities.
+
+# Path Traversal Attack
+PATH_TRAVERSAL_VULNERABILITY=A directory traversal (or path traversal) consists in exploiting insufficient security validation/sanitization of user-supplied input file names, \
+such that characters representing "traverse to parent directory" are passed through to the file APIs. \
+
\
+The goal of this attack is to use an affected application to gain unauthorized access to the file system.
\
+Important Links:
\
+
+
+#### AttackVector description
+PATH_TRAVERSAL_URL_PARAM_DIRECTLY_INJECTED=\"fileName\" query param's value is directly appended to path to read the file.
+PATH_TRAVERSAL_URL_PARAM_IF_DOT_DOT_PATH_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value is directly appended if it doesn't contains "..".
+PATH_TRAVERSAL_URL_PARAM_IF_DOT_DOT_PATH_OR_%2F_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value is directly appended if it doesn't contains ".." or "%2f" which is URL encoding of "/".
+PATH_TRAVERSAL_URL_PARAM_IF_DOT_DOT_PATH_OR_%2F_CASE_INSENSITIVE_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value is directly appended if it doesn't contains ".." or "%2f" or "%2F" which is URL encoding of "/".
+PATH_TRAVERSAL_URL_PARAM_IF_DOT_DOT_PATH_WITH_OR_WITHOUT_URL_ENCODING_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value is directly appended if it doesn't contains "..", takes care of URL encoding too.
+
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended to path to read the file.
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_IF_PARENT_DIRECTORY_PATH_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended if it doesn't contains "../".
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_IF_DOT_DOT_PATH_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended if it doesn't contains "..".
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_IF_DOT_DOT_PATH_OR_%2F_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended if it doesn't contains ".." or "%2f" which is URL encoding of "/".
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_IF_DOT_DOT_PATH_OR_%2F_CASE_INSENSITIVE_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended if it doesn't contains ".." or "%2f" or "%2F" which is URL encoding of "/".
+PATH_TRAVERSAL_URL_PARAM_BEFORE_NULL_BYTE_IF_DOT_DOT_PATH_WITH_OR_WITHOUT_URL_ENCODING_NOT_PRESENT_DIRECTLY_INJECTED=\"fileName\" query param's value before Null Byte is directly appended if it doesn't contains "..", takes care of URL encoding too.
+
+
+# Command Injection Attack
+COMMAND_INJECTION_VULNERABILITY=Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system \
+via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) \
+to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. \
+Command injection attacks are possible largely due to insufficient input validation.
\
+Important Links on Command Injection Vulnerability :
\
+
+
+#### Attack vectors
+COMMAND_INJECTION_URL_PARAM_DIRECTLY_EXECUTED=\"ipaddress\" query param's value is directly executed.
+COMMAND_INJECTION_URL_PARAM_DIRECTLY_EXECUTED_IF_SEMICOLON_SPACE_LOGICAL_AND_NOT_PRESENT=\"ipaddress\" query param's value is directly executed if \";\", \"&\" or space characters are not present in it.
+COMMAND_INJECTION_URL_PARAM_DIRECTLY_EXECUTED_IF_SEMICOLON_SPACE_LOGICAL_AND_%26_%3B_NOT_PRESENT=\"ipaddress\" query param's value is directly executed if \";\", \"&\", \"%26\", \"%3B\" or space characters are not present in it.
+COMMAND_INJECTION_URL_PARAM_DIRECTLY_EXECUTED_IF_SEMICOLON_SPACE_LOGICAL_AND_%26_%3B_CASE_INSENSITIVE_NOT_PRESENT=\"ipaddress\" query param's value is directly executed if \";\", \"&\", \"%26\", \"%3B\", \"%3b\" or space characters are not present in it.
+COMMAND_INJECTION_URL_PARAM_DIRECTLY_EXECUTED_IF_SEMICOLON_SPACE_LOGICAL_AND_%26_%3B_%7C_CASE_INSENSITIVE_NOT_PRESENT=\"ipaddress\" query param's value is directly executed if \";\", \"&\", \"%26\", \"%3B\", \"%3b\", \"%7C\", \"%7c\" or space characters are not present in it.
+
+
+# Local File Injection
+#URL_BASED_LFI_INJECTION=Url based Local File Injection attack.
+#LFI_URL_PARAM_BASED_DIRECT_INJECTION=Url Parameter \"fileName\" is directly passed to the include file.
+#LFI_URL_PARAM_BASED_INJECTION_WITH_VALIDATION_ON_FILE=Url Parameter \"fileName\" is validated and passed to include file.
+
+# Local File Injection with Null Byte
+#URL_WITH_NULL_BYTE_BASED_LFI_INJECTION=Url with Null Byte Injection based Local File Injection attack.
+#LFI_URL_PARAM_AND_NULL_BYTE_BASED_DIRECT_INJECTION=Url Parameter \"fileName\" is directly passed to the include file if containing Null Byte.
+#LFI_URL_PARAM_BASED_INJECTION_WITH_VALIDATION_ON_FILE=Url Parameter \"fileName\" is validated and passed to include file.
+
+# Remote File Injection
+URL_BASED_RFI_INJECTION=Url based Local File Injection attack.
+
+# JWT Injection
+JWT_INJECTION_VULNERABILITY=JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for \
+securely transmitting information between parties as a JSON object. This information can be verified and trusted because \
+it is digitally signed.There can be multiple things that can go wrong with the implementation of JWT and that can impact the Authentication or Authorization \
+of the application and result in complete compromise of the system.
Important Links on JWT : \
+ Important Links on Vulnerable implementations in JWT : \
+ \
+
+#### AttackVector description
+JWT_URL_EXPOSING_SECURE_INFORMATION=The request contains JWT token which is leaked in the URL. This can violate PCI and most organizational compliance policies.
+COOKIE_CONTAINING_JWT_TOKEN_SECURITY_ATTRIBUTES_MISSING=Cookie based JWT token but without Secure/HttpOnly flags and also without cookie prefixes.
+COOKIE_WITH_HTTPONLY_WITHOUT_SECURE_FLAG_BASED_JWT_VULNERABILITY=Cookie based JWT token but with HttpOnly flag but without Secure flag and also without cookie prefixes.
+COOKIE_BASED_LOW_KEY_STRENGTH_JWT_VULNERABILITY=Cookie based JWT token signed using Weak key vulnerability.
+COOKIE_BASED_NULL_BYTE_JWT_VULNERABILITY=Cookie based Null byte vulnerable JWT token validator.
+COOKIE_BASED_NONE_ALGORITHM_JWT_VULNERABILITY=Cookie based None algorithm vulnerable JWT token validator.
+COOKIE_BASED_KEY_CONFUSION_JWT_VULNERABILITY=Cookie based JWT token with Key confusion vulnerability.
+COOKIE_BASED_FOR_JWK_HEADER_BASED_JWT_VULNERABILITY=Cookie based JWT token validator vulnerable to trusting JWK field without checking if public key provided is present in truststore or not.
+COOKIE_BASED_EMPTY_TOKEN_JWT_VULNERABILITY=Cookie based JWT token, vulnerable to empty token vulnerability attack.
+
+
+
+# SQL Injection Vulnerability
+SQL_INJECTION_VULNERABILITY=A SQL injection attack consists of insertion or "injection" of a SQL query via the input data \
+from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), \
+execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present \
+on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, \
+in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.
\ Important Links on Prevention techniques : \
+
+
+#### AttackVector description
+ERROR_SQL_INJECTION_URL_PARAM_APPENDED_DIRECTLY_TO_QUERY=Query param is directly appended to the SQL Query causing exception in certain scenarios \
+ and hence exposes the application data.
+ERROR_SQL_INJECTION_URL_PARAM_WRAPPED_WITH_SINGLE_QUOTE_APPENDED_TO_QUERY=Query param is wrapped around "'" and then appended to the SQL Query causing exception in certain scenarios \
+ and hence exposes the application data.
+ERROR_SQL_INJECTION_URL_PARAM_REMOVES_SINGLE_QUOTE_WRAPPED_WITH_SINGLE_QUOTE_APPENDED_TO_QUERY=Single Quote is removed from Query param and then appended to SQL Query by wrapping \
+ with "'".
+ERROR_SQL_INJECTION_URL_PARAM_APPENDED_TO_PARAMETERIZED_QUERY=Query param is appended directly to the SQL Query and then a parameterized query is formed. This is to depict that \
+ proper usage of PreparedStatement is important.
+
+UNION_SQL_INJECTION_URL_PARAM_APPENDED_DIRECTLY_TO_QUERY=Query param is directly appended to the Query and hence \"Union\" keyword can be used to club the results and \
+extract the application data.
+UNION_SQL_INJECTION_URL_PARAM_WRAPPED_WITH_SINGLE_QUOTE_APPENDED_TO_QUERY=Query param is wrapped around "'" and then appended to the Query and hence \"Union\" keyword can be used to club the results and \
+extract the application data.
+UNION_SQL_INJECTION_URL_PARAM_REMOVES_SINGLE_QUOTE_WITH_SINGLE_QUOTE_APPENDED_TO_QUERY=Single Quote is removed from Query param and then appended to SQL Query by wrapping around "'"\
+ hence \"Union\" keyword can be used to club the results and extract the application data.
+
+BLIND_SQL_INJECTION_URL_PARAM_APPENDED_DIRECTLY_TO_QUERY=Query param is directly appended to the Query hence Query can be manipulated.
+BLIND_SQL_INJECTION_URL_PARAM_WRAPPED_WITH_SINGLE_QUOTE_APPENDED_TO_QUERY=Query param is wrapped around "'" and then appended to the SQL Query hence query can be manipulated.
+
+
+#### SSRF Vulnerability
+SSRF_VULNERABILITY=In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to \
+read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read \
+or submit data to, and by carefully selecting the URLs, the attacker may be able to read server \
+configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests \
+towards internal services which are not intended to be exposed. \
+Important Links on SSRF : \
+ \
+
+SSRF_VULNERABILITY_URL_WITHOUT_CHECK=No validation on the provided URL.
+SSRF_VULNERABILITY_URL_IF_NOT_FILE_PROTOCOL=file:// protocol is not allowed for the provided URL.
+SSRF_VULNERABILITY_URL_IF_NOT_FILE_PROTOCOL_AND_169.254.169.254=file:// protocol as well as access to internal metadata service IP 169.254.169.254 is not allowed.
+SSRF_VULNERABILITY_URL_IF_NOT_FILE_PROTOCOL_AND_INTERNAL_METADATA_URL=file:// protocol as well as access to internal metadata service is not allowed.
+SSRF_VULNERABILITY_URL_ONLY_IF_IN_THE_WHITELIST=Only Whitelisted URL is allowed.
\ No newline at end of file
diff --git a/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.css b/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.css
new file mode 100644
index 00000000..e5d57b25
--- /dev/null
+++ b/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.css
@@ -0,0 +1,16 @@
+#SampleVulnerability {
+ color: black;
+ text-align: center;
+}
+
+#fetchDetails {
+ background: blueviolet;
+ display: inline-block;
+ padding: 8px 8px;
+ margin: 10px;
+ border: 2px solid transparent;
+ border-radius: 3px;
+ transition: 0.2s opacity;
+ color: #FFF;
+ font-size: 12px;
+}
\ No newline at end of file
diff --git a/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.html b/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.html
new file mode 100644
index 00000000..dddeea7d
--- /dev/null
+++ b/src/main/resources/static/templates/SampleVulnerability/LEVEL_1/SampleVulnerability.html
@@ -0,0 +1,9 @@
+