package org.owasp.webgoat.lessons;

import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.FileWriter;
import java.io.OutputStreamWriter;
import java.net.Socket;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.ResultSetMetaData;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;
import java.util.StringTokenizer;
import java.util.Vector;

import javax.servlet.http.Cookie;

import org.apache.ecs.Element;
import org.apache.ecs.ElementContainer;
import org.apache.ecs.StringElement;
import org.apache.ecs.html.B;
import org.apache.ecs.html.BR;
import org.apache.ecs.html.Center;
import org.apache.ecs.html.H1;
import org.apache.ecs.html.HR;
import org.apache.ecs.html.Input;
import org.apache.ecs.html.P;
import org.apache.ecs.html.TD;
import org.apache.ecs.html.TH;
import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table;
import org.owasp.webgoat.session.DatabaseUtilities;
import org.owasp.webgoat.session.ECSFactory;
import org.owasp.webgoat.session.WebSession;
import org.owasp.webgoat.util.Exec;
import org.owasp.webgoat.util.ExecResults;

/**
 *  Copyright (c) 2002 Free Software Foundation developed under the custody of the Open Web
 *  Application Security Project (http://www.owasp.org) This software package is published by OWASP
 *  under the GPL. You should read and accept the LICENSE before you use, modify and/or redistribute
 *  this software.
 *
 * @author     Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
 * @created    October 28, 2003
 */
public class Challenge2Screen extends LessonAdapter
{
	private static final String USER_COOKIE = "user";

	private static final String JSP = ".jsp";

	private static final String WEBGOAT_CHALLENGE = "webgoat_challenge";

	private static final String WEBGOAT_CHALLENGE_JSP = WEBGOAT_CHALLENGE + JSP;

	private static final String PROCEED_TO_NEXT_STAGE = "Proceed to the next stage...";

	/**
	 *  Description of the Field
	 */
	protected final static String CREDIT = "Credit";

	/**
	 *  Description of the Field
	 */
	protected final static String PROTOCOL = "File";

	/**
	 *  Description of the Field
	 */
	protected final static String MESSAGE = "Message";

	/**
	 *  Description of the Field
	 */
	protected final static String PARAM = "p";

	/**
	 *  Description of the Field
	 */
	protected final static String PASSWORD = "Password";

	/**
	 *  Description of the Field
	 */
	protected final static String USER = "s";

	/**
	 *  Description of the Field
	 */
	protected final static String USERNAME = "Username";
	private static Connection connection = null;
	private String pass = "goodbye";
	private String user = "youaretheweakestlink";


	/**
	 *  Description of the Method
	 *
	 * @param  s  Description of the Parameter
	 * @return    Description of the Return Value
	 */
	protected Element createContent( WebSession s )
	{
		return super.createStagedContent(s);
	}

	/**
	 *  Determine the username and password
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	protected Element doStage1( WebSession s ) throws Exception
	{
		setStage( s, 1 );

		String username = s.getParser().getStringParameter( USERNAME, "" );
		String password = s.getParser().getStringParameter( PASSWORD, "" );

		if ( username.equals( user ) && password.equals( pass ) )
		{
			s.setMessage( "Welcome to stage 2 -- get credit card numbers!" );
			setStage( s, 2 );

			return ( doStage2( s ) );
		}

		s.setMessage( "Invalid login" );

		ElementContainer ec = new ElementContainer();
		ec.addElement( makeLogin(s) );

		//<START_OMIT_SOURCE>
		// these are red herrings for the first stage
		Input input = new Input( Input.HIDDEN, USER, "White" );
		ec.addElement( input );
		
		Cookie newCookie = new Cookie( USER_COOKIE, "White" );
		s.getResponse().addCookie( newCookie );
		//<END_OMIT_SOURCE>

		return ( ec );
	}


	// get creditcards from database

	/**
	 *  Description of the Method
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	protected Element doStage2( WebSession s ) throws Exception
	{
		//<START_OMIT_SOURCE>

		Cookie newCookie = new Cookie( USER_COOKIE, "White" );
		s.getResponse().addCookie( newCookie );

		ElementContainer ec = new ElementContainer();
		if ( s.getParser().getStringParameter(Input.SUBMIT, "").equals(PROCEED_TO_NEXT_STAGE + "(3)"))
		{
			s.setMessage( "Welcome to stage 3 -- deface the site" );
			setStage( s, 3 );
			// Reset the defaced webpage so the lesson can start over
			resetWebPage(s);
			return doStage3(s);
		}

		if ( connection == null )
		{
			connection = DatabaseUtilities.makeConnection( s );
		}

		Statement statement3 = connection.createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
		// pull the USER_COOKIE from the cookies
		String user = getCookie(s);
		String query = "SELECT * FROM user_data WHERE last_name = '" + user +"'";
		Vector v = new Vector();
		try 
		{ 
			ResultSet results = statement3.executeQuery( query );

			while ( results.next() )
			{
				String type = results.getString( "cc_type" );
				String num = results.getString( "cc_number" );
				v.addElement( type + "-" + num );
			}
			if ( v.size() > 2 )
			{
				ResultSetMetaData resultsMetaData = results.getMetaData();
				ec.addElement( DatabaseUtilities.writeTable( results, resultsMetaData ) );
				ec.addElement(ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE + "(3)"));
			}
			else 
			{
				s.setMessage("Try to get all the credit card numbers");
				ec.addElement( buildCart(s));

				//Table t = ECSFactory.makeTable( s.isColor(), HtmlColor.ALICEBLUE );
				Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setBorder( 0 ).setWidth( "90%" ).setAlign(
				"center" );
				
				ec.addElement( new BR() );
				TR tr = new TR();
				tr.addElement( new TD().addElement( "Please select credit card for this purchase: " ) );
				Element p = ECSFactory.makePulldown( CREDIT, v );
				tr.addElement( new TD().addElement( p ).setAlign( "right" ));
				t.addElement( tr );
				
				tr = new TR();
				Element b = ECSFactory.makeButton( "Buy Now!" );
				tr.addElement( new TD().addElement( b ) );
				t.addElement( tr );
				ec.addElement(t);
				
				ec.addElement( new BR() );
				Input input = new Input( Input.HIDDEN, USER, "White" );
				ec.addElement( input );
			}
		}
		catch ( Exception e )
		{
			s.setMessage("An error occurred in the woods");
		}



		return ( ec );
		//<END_OMIT_SOURCE>
	}

	/**
	 *  Description of the Method
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	/* (non-Javadoc)
	 * @see lessons.LessonAdapter#doStage3(session.WebSession)
	 */
	protected Element doStage3( WebSession s ) throws Exception
	{
		//<START_OMIT_SOURCE>

		ElementContainer ec = new ElementContainer();
		if ( s.getParser().getStringParameter(Input.SUBMIT, "").equals(PROCEED_TO_NEXT_STAGE +"(4)"))
		{
			setStage( s, 4 );
			// Reset the defaced webpage so the lesson can start over
			resetWebPage(s);
			return doStage4(s);
		}

		// execute the possible attack first to determine if site is defaced.
		ElementContainer netstatResults = getNetstatResults(s);
		if (isDefaced(s))
	    {
			ec.addElement( new HR() );
			s.setMessage( "CONGRATULATIONS - You have defaced the site!" );
			Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setWidth("90%").setAlign("center");
			if ( s.isColor() )
			{
				t.setBorder( 1 );
			}
			TR tr = new TR();
			tr.addElement( new TD().setAlign("center").addElement(ECSFactory.makeButton(PROCEED_TO_NEXT_STAGE + "(4)")));
			t.addElement(tr);
			tr = new TR();
			tr.addElement( new TD().addElement( showDefaceAttempt(s) ));
			t.addElement(tr);
			ec.addElement( t );
			return ec;
	    }
	    else 
	    {
	        // Setup the screen content
			try
			{
			    ec.addElement( new H1("Current Network Status:") );
				ec.addElement( netstatResults );

				Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setWidth("90%").setAlign("center");
				if ( s.isColor() )
				{
					t.setBorder( 1 );
				}
				String[] list = {"TCP", "TCPv6", "IP", "IPv6", "UDP", "UDPv6"};

				TR tr = new TR();
				tr.addElement( new TD().addElement( ECSFactory.makeButton( "View Network" )));
				tr.addElement( new TD().setWidth("35%").addElement( ECSFactory.makePulldown( PROTOCOL, list, "", 5 )));
				t.addElement(tr);
				
				ec.addElement( t );
			}
			catch ( Exception e )
			{
				ec.addElement( new P().addElement( "Select a message to read from the Message List below" ) );
			}

			ec.addElement( new HR() );
			Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setWidth("90%").setAlign("center");
			if ( s.isColor() )
			{
				t.setBorder( 1 );
			}
			TR tr = new TR();
			tr.addElement( new TD().addElement( showDefaceAttempt(s) ));
			t.addElement(tr);
			ec.addElement( t );
		}
		return ( ec );
		//<END_OMIT_SOURCE>
	}

	
	private boolean isDefaced(WebSession s)
	{
		//<START_OMIT_SOURCE>
		boolean defaced = false;
		try
        {
		    // get current text and compare to the new text
			String origpath = s.getContext(). getRealPath( WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP );
			String masterFilePath = s.getContext().getRealPath( WEBGOAT_CHALLENGE_JSP );
			String defacedText = getFileText( new BufferedReader( new FileReader( origpath ) ), false );
			String origText = getFileText( new BufferedReader( new FileReader( masterFilePath ) ), false ); 
			
			defaced = ( !origText.equals(defacedText) );
        } 
		catch ( Exception e )
        {
            e.printStackTrace();
        }
	    return defaced;
		//<END_OMIT_SOURCE>
	}
	
	private Element showDefaceAttempt( WebSession s ) throws Exception
	{
	    ElementContainer ec = new ElementContainer();
	    
	    // get current text and compare to the new text
		String origpath = s.getContext(). getRealPath( WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP );
		String defaced = getFileText( new BufferedReader( new FileReader( origpath ) ), false );
		String origText = getFileText( new BufferedReader( new FileReader( s.getContext(). getRealPath( WEBGOAT_CHALLENGE_JSP ))), false);

		// show webgoat.jsp text
		ec.addElement( new H1().addElement( "Original Website Text" ) );
		ec.addElement( new P().addElement( origText ) );
		ec.addElement( new HR() );
		ec.addElement( new H1().addElement( "Defaced Website Text" ) );
		ec.addElement( new P().addElement( defaced ) );
		ec.addElement( new HR() );
	    
		return ec;
	}



	private void resetWebPage(WebSession s) 
	{
		try 
		{
			// get current text and compare to the new text
			String defacedpath = s.getContext(). getRealPath( WEBGOAT_CHALLENGE + "_" + s.getUserName() + JSP );
			String masterFilePath = s.getContext().getRealPath( WEBGOAT_CHALLENGE_JSP );
	
			// replace the defaced text with the original
			File usersFile = new File( defacedpath );
			FileWriter fw = new FileWriter( usersFile );
			fw.write( getFileText( new BufferedReader( new FileReader( masterFilePath ) ), false ) );
			fw.close();
//			System.out.println("webgoat_guest replaced: " + getFileText( new BufferedReader( new FileReader( defacedpath ) ), false ) );
		}
		catch (Exception e)
		{
			e.printStackTrace();
		}
	}

	protected Category getDefaultCategory()
	{
		return CHALLENGE;
	}
	
	/**
	 *  Description of the Method
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	protected Element doStage4( WebSession s ) throws Exception
	{
		makeSuccess( s );
		ElementContainer ec = new ElementContainer();
		ec.addElement(new H1().addElement( "Thanks for coming!" ));
		ec.addElement(new BR());
		ec.addElement(new H1().addElement( "Please remember that you will be caught and fired if you use these techniques for evil." ));
		
		return ( ec ) ;
	}


	/**
	 *  Description of the Method
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	protected Element doStage5( WebSession s ) throws Exception
	{
		//<START_OMIT_SOURCE>
	    ElementContainer ec = new ElementContainer();
	    return ( ec );
		//<END_OMIT_SOURCE>
	}


	/**
	 *  Description of the Method
	 *
	 * @param  s              Description of the Parameter
	 * @return                Description of the Return Value
	 * @exception  Exception  Description of the Exception
	 */
	protected Element doStage6( WebSession s ) throws Exception
	{
		return ( new StringElement( "not yet" ) );
	}


	/**
	 *  Gets the hints attribute of the ChallengeScreen object
	 *
	 * @return    The hints value
	 */
	protected List getHints(WebSession s)
	{
		//<START_OMIT_SOURCE>

	    List hints = new ArrayList();
		hints.add( "You need to gain access to the Java source code for this lesson." );	
		hints.add( "Seriously, no more hints -- it's a CHALLENGE!" );
		hints.add( "Come on -- give it a rest!" );
		if (getStage(s) != 1);
		{
		    hints.add("Persistance is always rewarded");
		}

		return hints;

		//<END_OMIT_SOURCE>
	}

	protected Element makeLogin( WebSession s )
	{
		ElementContainer ec = new ElementContainer();

		ec.addElement( new H1().addElement( "Sign In " ));
		Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setBorder( 0 ).setWidth("90%").setAlign("center");

		if ( s.isColor() )
		{
			t.setBorder( 1 );
		}
		
		TR tr = new TR();
		tr.addElement( new TH().addElement("Please sign in to your account.  See the OWASP admin if you do not have an account.")
				.setColSpan(2).setAlign("left"));
		t.addElement( tr );

		tr = new TR();
		tr.addElement( new TD().addElement("*Required Fields").setWidth("30%"));
		t.addElement( tr );
		
		tr = new TR();
		tr.addElement( new TD().addElement("&nbsp;").setColSpan(2));
		t.addElement( tr );
		
		TR row1 = new TR();
		TR row2 = new TR();
		row1.addElement( new TD( new B( new StringElement( "*User Name: " ) ) ));
		row2.addElement( new TD( new B(new StringElement( "*Password: " ) ) ));

		Input input1 = new Input( Input.TEXT, USERNAME, "" );
		Input input2 = new Input( Input.PASSWORD, PASSWORD, "" );
		row1.addElement( new TD( input1 ) );
		row2.addElement( new TD( input2 ) );
		t.addElement( row1 );
		t.addElement( row2 );

		Element b = ECSFactory.makeButton( "Login" );
		t.addElement( new TR( new TD( b ) ) );
		ec.addElement( t );

		return ( ec );
	}

	/**
	 *  Gets the instructions attribute of the ChallengeScreen object
	 *
	 * @return    The instructions value
	 */
	public String getInstructions(WebSession s)
	{
		String instructions = "Your mission is to break the authentication scheme, " +
			"steal all the credit cards from the database, and then deface the website. " +
			"You will have to use many of the techniques you have learned in the other lessons. " +
			"The main webpage for this site is 'webgoat_challenge_&lt;username&gt;.jsp'";

		return ( instructions );
	}



	/**
	 *  Gets the ranking attribute of the ChallengeScreen object
	 *
	 * @return    The ranking value
	 */
	protected Integer getDefaultRanking()
	{
		return new Integer( 130 );
	}


	/**
	 *  Gets the title attribute of the ChallengeScreen object
	 *
	 * @return    The title value
	 */
	public String getTitle()
	{
		return ( "The CHALLENGE!" );
	}


	/**
	 *  Description of the Method
	 *
	 * @param  text  Description of the Parameter
	 * @return       Description of the Return Value
	 */
	protected ElementContainer getNetstatResults( WebSession s )
	{
		//<START_OMIT_SOURCE>
	    
	    ElementContainer ec = new ElementContainer();
	    
		Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setBorder( 1 ).setWidth("90%").setAlign("center");

		if ( s.isColor() )
		{
			t.setBorder( 1 );
		}
		
		TR tr = new TR();
		tr.addElement( new TH().addElement("Protocol").setWidth("7%"));
		tr.addElement( new TH().addElement("Local Address").setWidth("80%"));
		tr.addElement( new TH().addElement("Foreign Address").setWidth("10%"));
		tr.addElement( new TH().addElement("State").setWidth("3%"));
		t.addElement( tr );

	    String protocol = s.getParser().getRawParameter( PROTOCOL, "tcp" );

		String osName = System.getProperty( "os.name" );
		ExecResults er = null;
	    if ( osName.indexOf( "Windows" ) != -1 )
		{
			String cmd = "cmd.exe /c netstat -a -p " + protocol;
			er = Exec.execSimple( cmd );
		}
		else
		{
			String[] cmd = {"/bin/sh", "-c", "netstat -a -p " + protocol};
			er = Exec.execSimple( cmd );
		}
		
	    String results = er.getOutput();
	    StringTokenizer lines = new StringTokenizer( results, "\n");
	    String line = lines.nextToken();
	    //System.out.println(line);
	    int start = 0;
	    while ( start == 0  && lines.hasMoreTokens() )
	    {
	    	if (( line.indexOf("Proto") != -1 ) )
	    	{
	    		start++;
	    	} 
	    	else
	    	{
	    		line = lines.nextToken();
	    	}
	    }
		while ( start > 0 && lines.hasMoreTokens() )
	    {
			// in order to avoid a ill-rendered screen when the user performs
			// command injection, we will wrap the screen at 4 columns
			int columnCount = 4;
	    	tr = new TR();
	    	StringTokenizer tokens = new StringTokenizer( lines.nextToken(), "\t ");
	    	while( tokens.hasMoreTokens() && columnCount-- > 0 )
	    	{
	    		tr.addElement( new TD().addElement(tokens.nextToken()));
	    	}
	    	t.addElement( tr );
	    }
	    // parse the results
	    ec.addElement( t );
		return ( ec );
		//<END_OMIT_SOURCE>

	}


	/**
	 *  Description of the Method
	 *
	 * @param  s  Description of the Parameter
	 * @return    Description of the Return Value
	 */
	protected Element makeClues( WebSession s )
	{
		return new StringElement( "Clues not Available :)" );
	}

	
	protected Element makeHints( WebSession s )
	{
	    return new StringElement("Hint: Find the hints");
	}


	/**
	 *  Description of the Method
	 *
	 * @param  s        Description of the Parameter
	 * @param  message  Description of the Parameter
	 */
	protected void sendMessage( Socket s, String message )
	{
		try
		{
			OutputStreamWriter osw = new OutputStreamWriter( s.getOutputStream() );
			osw.write( message );
		}
		catch ( Exception e )
		{
			System.out.println( "Couldn't write " + message + " to " + s );
			e.printStackTrace();
		}
	}

	protected Element buildCart( WebSession s )
	{
		ElementContainer ec = new ElementContainer();

		ec.addElement( new HR().setWidth("90%") );
		ec.addElement( new Center().addElement( new H1().addElement( "Shopping Cart " )));
		Table t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setBorder( 1 ).setWidth("90%").setAlign("center");

		if ( s.isColor() )
		{
			t.setBorder( 1 );
		}
		
		TR tr = new TR();
		tr.addElement( new TH().addElement("Shopping Cart Items -- To Buy Now").setWidth("80%"));
		tr.addElement( new TH().addElement("Price:").setWidth("10%"));
		tr.addElement( new TH().addElement("Quantity:").setWidth("3%"));
		tr.addElement( new TH().addElement("Total").setWidth("7%"));
		t.addElement( tr );
		
		tr = new TR();
		tr.addElement( new TD().addElement("Sympathy Bouquet"));
		tr.addElement( new TD().addElement("59.99").setAlign("right"));
		tr.addElement( new TD().addElement(" 1 ").setAlign( "right" ));
		tr.addElement( new TD().addElement("59.99"));
		t.addElement( tr );
		
		ec.addElement(t);
		
		t = new Table().setCellSpacing( 0 ).setCellPadding( 2 ).setBorder( 0 ).setWidth("90%").setAlign("center");

		if ( s.isColor() )
		{
			t.setBorder( 1 );
		}
		
		ec.addElement( new BR() );
		tr = new TR();
		tr.addElement( new TD().addElement( "The total charged to your credit card:" ) );
		tr.addElement( new TD().addElement( "59.99"));
		t.addElement( tr );
		
		ec.addElement(t);

		return ( ec );
	}

	public boolean canHaveClues()
	{
		return false;
	}
	
	/**
	 *  Gets the cookie attribute of the CookieScreen object
	 *
	 * @param  s  Description of the Parameter
	 * @return    The cookie value
	 */
	protected String getCookie( WebSession s )
	{
		Cookie[] cookies = s.getRequest().getCookies();

		for ( int i = 0; i < cookies.length; i++ )
		{
			if ( cookies[i].getName().equalsIgnoreCase( USER_COOKIE ) )
			{
				return ( cookies[i].getValue() );
			}
		}

		return ( null );
	}

}