`
w.Header().Set("Content-Type", "text/html")
w.Write([]byte(html))
})
// 3. The Hardened (but still vulnerable) Login Endpoint
http.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
username := r.FormValue("username")
password := r.FormValue("password")
ua := r.Header.Get("User-Agent")
if ua != "Secure-CTF-Browser/1.0" {
http.Error(w, "Security Alert: Browser not authorized. Please use 'Secure-CTF-Browser/1.0'", http.StatusForbidden)
return
}
if username == "admin" {
http.Error(w, "Direct login as 'admin' is disabled for security reasons.", http.StatusForbidden)
return
}
if strings.Contains(username, " ") || strings.Contains(password, " ") {
http.Error(w, "WAF Detection: Spaces are not allowed in input fields.", http.StatusBadRequest)
return
}
db, err := connectDB()
if err != nil {
http.Error(w, "Database connection failed", http.StatusInternalServerError)
log.Println("DB Error:", err)
return
}
defer db.Close()
query := fmt.Sprintf("SELECT id, username, flag FROM users WHERE username = '%s' AND password = '%s'", username, password)
log.Printf("Executing Query: %s\n", query)
var user User
err = db.QueryRow(query).Scan(&user.ID, &user.Username, &user.Flag)
if err != nil {
if err == sql.ErrNoRows {
w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte("Invalid credentials."))
} else {
http.Error(w, "Query error: "+err.Error(), http.StatusInternalServerError)
}
return
}
w.WriteHeader(http.StatusOK)
fmt.Fprintf(w, `