update feat/learning-hacking-with-golang-20240708 1148

tainguyenbp · Jul 8, 2024 · e72f650 · e72f650
1 parent 064d95e
commit e72f650
Show file tree

Hide file tree

Showing 6 changed files with 207 additions and 0 deletions.
diff --git a/hacking-go/cross-site-request-forgery/index.html b/hacking-go/cross-site-request-forgery/index.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Money Transfer</title>
+</head>
+<body>
+    <h1>Money Transfer</h1>
+    <form action="/" method="post">
+        <label for="amount">Amount:</label>
+        <input type="text" id="amount" name="amount" required>
+        <br>
+        <label for="account">Account:</label>
+        <input type="text" id="account" name="account" required>
+        <br>
+        <input type="submit" value="Transfer">
+    </form>
+</body>
+</html>
diff --git a/hacking-go/cross-site-request-forgery/main.go b/hacking-go/cross-site-request-forgery/main.go
@@ -0,0 +1,45 @@
+package main
+
+import (
+	"fmt"
+	"html/template"
+	"log"
+	"net/http"
+)
+
+var (
+	templates = template.Must(template.ParseFiles("index.html"))
+)
+
+func main() {
+	http.HandleFunc("/", indexHandler)
+	http.HandleFunc("/transfer", transferHandler)
+	log.Fatal(http.ListenAndServe(":8080", nil))
+}
+
+func indexHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		templates.ExecuteTemplate(w, "index.html", nil)
+	} else if r.Method == http.MethodPost {
+		amount := r.FormValue("amount")
+		account := r.FormValue("account")
+
+		// Perform the money transfer
+		if transferMoney(amount, account) {
+			fmt.Fprintln(w, "Transfer successful!")
+		} else {
+			fmt.Fprintln(w, "Transfer failed!")
+		}
+	}
+}
+
+func transferHandler(w http.ResponseWriter, r *http.Request) {
+	// Process transfer request
+	// ...
+}
+
+func transferMoney(amount, account string) bool {
+	// Perform money transfer logic
+	// ...
+	return false
+}
diff --git a/hacking-go/cross-site-request-forgery/main1.go b/hacking-go/cross-site-request-forgery/main1.go
@@ -0,0 +1,43 @@
+package main
+
+import (
+	"fmt"
+	"html/template"
+	"log"
+	"net/http"
+)
+
+var (
+	templates = template.Must(template.ParseFiles("index.html"))
+)
+
+func main() {
+	http.HandleFunc("/", indexHandler)
+	http.HandleFunc("/transfer", transferHandler)
+	log.Fatal(http.ListenAndServe(":8080", nil))
+}
+
+func indexHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		templates.ExecuteTemplate(w, "index.html", nil)
+	} else if r.Method == http.MethodPost {
+		amount := r.FormValue("amount")
+		account := r.FormValue("account")
+
+		// Perform the money transfer
+		if transferMoney(amount, account) {
+			fmt.Fprintln(w, "Transfer successful!")
+		} else {
+			fmt.Fprintln(w, "Transfer failed!")
+		}
+	}
+}
+
+func transferHandler(w http.ResponseWriter, r *http.Request) {
+	// Additional transfer processing logic can be placed here if needed
+}
+
+func transferMoney(amount, account string) bool {
+	// Simulate a successful transfer
+	return true
+}
diff --git a/hacking-go/cross-site-request-forgery/main2.go b/hacking-go/cross-site-request-forgery/main2.go
@@ -0,0 +1,64 @@
+package main
+
+import (
+	"fmt"
+	"html/template"
+	"log"
+	"net/http"
+
+	"github.com/gorilla/csrf"
+)
+
+var (
+	templates = template.Must(template.ParseFiles("index.html"))
+)
+
+func main() {
+	http.HandleFunc("/", indexHandler)
+	http.HandleFunc("/transfer", transferHandler)
+	log.Fatal(http.ListenAndServe(":8080", csrf.Protect([]byte("32-byte-long-auth-key"))(nil)))
+}
+
+func indexHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		token := csrf.Token(r)
+		data := struct {
+			Token string
+		}{
+			Token: token,
+		}
+		templates.ExecuteTemplate(w, "index.html", data)
+	} else if r.Method == http.MethodPost {
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, "Bad Request", http.StatusBadRequest)
+			return
+		}
+
+		// Validate CSRF token
+		if err := csrf.Protect([]byte("32-byte-long-auth-key")).VerifyToken(csrf.Token(r)); err != nil {
+			http.Error(w, "Invalid CSRF token", http.StatusForbidden)
+			return
+		}
+
+		amount := r.FormValue("amount")
+		account := r.FormValue("account")
+
+		// Perform the money transfer
+		if transferMoney(amount, account) {
+			fmt.Fprintln(w, "Transfer successful!")
+		} else {
+			fmt.Fprintln(w, "Transfer failed!")
+		}
+	}
+}
+
+func transferHandler(w http.ResponseWriter, r *http.Request) {
+	// Process transfer request
+	// ...
+}
+
+func transferMoney(amount, account string) bool {
+	// Perform money transfer logic
+	// ...
+	return false
+}
diff --git a/hacking-go/cross-site-request-forgery/main3.go b/hacking-go/cross-site-request-forgery/main3.go
diff --git a/hacking-go/cross-site-request-forgery/readme.md b/hacking-go/cross-site-request-forgery/readme.md
@@ -0,0 +1,35 @@
+### go run main.go
+```
+go run main.go
+
+curl http://localhost:8080
+
+curl -X POST -d "amount=100" -d "account=12345" http://localhost:8080
+
+
+```
+
+### go run main1.go
+```
+go run main1.go
+curl http://localhost:8080
+
+curl -X POST -d "amount=100" -d "account=12345" http://localhost:8080
+
+```
+### go run main2.go
+```
+go run main2.go
+curl http://localhost:8080
+
+curl -X POST -d "amount=100" -d "account=12345" http://localhost:8080
+
+```
+### go run main3.go
+```
+go run main3.go
+curl http://localhost:8080
+
+curl -X POST -d "amount=100" -d "account=12345" http://localhost:8080
+
+```