[rootsec61]

Here I am releasing the source code for dakar.com the home of rallying.

In the source code you can find:
- Hard Coded credentials for a couple accounts
- SMTP Creds
- Mongodb/SQL Creds

At least thats what I could find, you might be able to find some more.

The code is in .NET  and can be opened as a visual studio project. It is pretty vulnerable to all sorts. Mainly path-traversal and SQLI.
I used a couple of static code scanners and theyre reporting ~71 Issues, 34 being high severity Path traversals lol.

Total size:
- 220MB
- 1,492 Files 109 Folders

Hidden Content

You must register or login to view this content.

Snippets:

public partial class Logon : BackOfficePageMgmt {     protected void Page_Load(object sender, EventArgs e)     {         SetInfoMessage(lblMessInfo, "");         txbID.Focus();         if(!Page.IsPostBack)         {             if (Request["m"] != null)             {                 SetInfoMessage(lblMessInfo, GetLocalResourceObject("MdpChange").ToString(), enInfoMessageSeverity.Validation);             }         }         /* if (HttpContext.Current.Request.Url.AbsoluteUri.Contains("localhost"))         {             txbID.Text = "ctrladministratif";             //txbPwd.Text = "86207cceebe2d60794083c05ed524423";//Dakar             txbPwd.Text = "6fc791b5c1cf3bab55b1a57c984bbc72";//Dakar2020*             btnIdenification_Click(null, null);         } */     }

    public string[] RechercheTeam(string prefixText, int count)     {         securite();         if (prefixText != "")         {             List<SqlParameter> parametres = new List<SqlParameter>();             parametres.Add(Tools.set_parameter("TEA_NOM", DbType.String, prefixText));             DataSet teams = Tools.GetDataSet("TeamSelectListByNom", parametres);             if (teams.Tables[0].Rows.Count < count)                 count = teams.Tables[0].Rows.Count;             List<string> items = new List<string>(count);             for (int i = 0; i < count; i++)             {                 if (teams.Tables[0].Rows[i]["TEA_NOM"].ToString() != "")                 {                     string str = AutoCompleteExtender.CreateAutoCompleteItem(teams.Tables[0].Rows[i]["TEA_NOM"].ToString(), teams.Tables[0].Rows[i]["TEA_ID"].ToString());                     items.Add(str);                 }             }              return items.ToArray();         }         return null;     }