bodhi - GitLite

KO | EN

gitlite — search

#python #hacktoberfest #typescript #go #android #machine-learning #linux #docker #macos #windows #cli #kubernetes #mcp #ios

bodhi

(★ 122)

Bodhi - Client-side Vulnerability Playground

파일 탐색기

최종 버전 다운로드 (.zip)

- - click1.txt
  - click2.txt
  - cors1.txt
  - csrf1.txt
  - csrf2.txt
  - csrf3.txt
  - csrf4.txt
  - csrf5.txt
  - csrf6.txt
- - __init__.py
  - forms.py
  - routes.py
- - __init__.py
  - forms.py
  - routes.py
- - __init__.py
  - forms.py
  - routes.py
- - __init__.py
  - forms.py
  - routes.py
- - admin_bot.py
  - server_8000.py
- - 500.htm
  - layout.html
- - __init__.py
  - forms.py
  - routes.py
- app_database.db
- models.py
- requirements.txt
- routes.py
- run.sh
.gitignore
Dockerfile
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/amolnaik4/bodhi

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd bodhi

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

$ docker pull amolnaik4/bodhi_app

이 명령어를 터미널에 그대로 입력해 실행하세요.

$ docker run -p 80:80 -p 8000:8000 amolnaik4/bodhi_app

빌드된 이미지를 실제 컨테이너로 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Python

쉬움

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Python 3 설치 시 'Add Python to PATH' 옵션을 꼭 체크하세요 (Windows).

$ pip install -r requirements.txt

requirements.txt 등에 명시된 파이썬 라이브러리를 설치합니다.

✅ 에러 메시지 없이 실행되고 터미널에 안내 문구가 출력되면 정상입니다.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Bodhi - Client-Side Vulnerability Playground
Bodhi is a playground focused on learning the exploitation of client-side web vulnerabilities. The playground has vulnerable application & a bot program which simulates the real-world victim. An attacker will have knowledge of the vunerability and will send crafted payload which will be accessed by victim. The attacker need to complete objective by exploiting these vulnerabilities.

The playground is a CTF style application where the objective is to read the flag available for each vulnerablity. Main vulnerability page has detailed information about scenarios & test accounts to be used.

## Videos
- GET CSRF exploitation with XSS: https://www.youtube.com/watch?v=8LN56u8RtEY
- GET CSRF exploitation with Attacker Site: https://www.youtube.com/watch?v=x4g0H8rKS7M
- Clickjacking exploitation: https://www.youtube.com/watch?v=LQF6-97b8Ys

## Setup Instructions
### Docker
There is a docker available for this. Follow below commands to set it up:
```sh
$ docker pull amolnaik4/bodhi_app
$ docker run -p 80:80 -p 8000:8000 amolnaik4/bodhi_app
```
Once docker is running, access the application at http://MACHINE_IP
### Using Code
**The code is used to build Docker. It is higly recommended to use Docker. This code can be used as reference. If you want to build it from source, you will need to change code to be able to work.**

Bodhi uses Google Chrome in headless mode with selenium. We need to install Google Chrome & ChromeDriver. Following commands are used for installation on Ubuntu:
```sh
$ mkdir temp
$ cd temp/
$ wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
$ sudo dpkg -i --force-depends google-chrome-stable_current_amd64.deb
# chromedriver installation
$ wget https://chromedriver.storage.googleapis.com/2.35/chromedriver_linux64.zip
$ unzip chromedriver_linux64.zip
$ sudo cp chromedriver /usr/bin/
```

Next steps:
```sh
$ git clone https://github.com/amolnaik4/bodhi.git
$ cd bodhi
$ pip install -r requirements.txt
$ ./run.sh
```
Browse to http://MACHINE_IP

## TODOs
Following vulnerabilities will be added in future releases of Bodhi
- ~~CORS~~
- Websocket
- postMessage
- WebWorker
- ~~localStorage~~
- WebSQL
- self-xss (drag-drop)
- side-channel attack

**If you want to contribute, please send PR**

**Happy Learning !!**