Add basic card game

Author: ruelalarcon

.env.example

@@ -1,2 +1,3 @@
 SESSION_SECRET=random_string
-DICEGAME_FLAG=your_flag
+DICEGAME_FLAG=your_flag
+CARDGAME_FLAG=your_flag

cardgame.js

@@ -0,0 +1,212 @@
+require('dotenv').config();
+const express = require('express');
+const session = require('express-session');
+const WebSocket = require('ws');
+const http = require('http');
+const crypto = require('crypto');
+const app = express();
+const server = http.createServer(app);
+const wss = new WebSocket.Server({ server });
+
+app.use(express.json());
+app.use(express.static('public'));
+
+// Session configuration
+const sessionParser = session({
+ secret: process.env.SESSION_SECRET,
+ resave: false,
+ saveUninitialized: true,
+ cookie: { secure: false }
+});
+
+app.use(sessionParser);
+
+// In-memory storage (intentionally vulnerable)
+const users = new Map(); // username -> {password, cards}
+const activeConnections = new Map(); // username -> WebSocket
+
+// Card generation utilities
+function generateUniqueCard(username) {
+ const id = `unique_${username}_${crypto.randomBytes(8).toString('hex')}`;
+ return {
+ id,
+ name: `${username}'s Identity Card`,
+ type: 'IDENTITY',
+ description: 'A unique card that proves your identity. There should only ever be ONE of these for your account.',
+ rarity: 'UNIQUE',
+ soulbound: true,
+ created_at: Date.now()
+ };
+}
+
+function generateStarterCards() {
+ return [
+ { id: crypto.randomBytes(8).toString('hex'), name: 'Basic Sword', type: 'WEAPON', rarity: 'COMMON' },
+ { id: crypto.randomBytes(8).toString('hex'), name: 'Basic Shield', type: 'ARMOR', rarity: 'COMMON' },
+ { id: crypto.randomBytes(8).toString('hex'), name: 'Health Potion', type: 'CONSUMABLE', rarity: 'COMMON' }
+ ];
+}
+
+// Check for duplicated unique cards
+function checkForDuplication(username) {
+ const playerCards = users.get(username).cards;
+ const identityCards = playerCards.filter(card => card.type === 'IDENTITY');
+ if (identityCards.length > 1) {
+ const uniqueIds = new Set(identityCards.map(card => card.id));
+ if (uniqueIds.size < identityCards.length) {
+ return process.env.CARDGAME_FLAG;
+ }
+ }
+ return null;
+}
+
+// Broadcast active players to all connected clients
+function broadcastActivePlayers() {
+ const activePlayers = Array.from(activeConnections.keys());
+ const message = JSON.stringify({
+ type: 'activePlayers',
+ players: activePlayers
+ });
+
+ activeConnections.forEach(ws => {
+ if (ws.readyState === WebSocket.OPEN) {
+ ws.send(message);
+ }
+ });
+}
+
+// Authentication endpoints
+app.post('/register', (req, res) => {
+ const { username, password } = req.body;
+ if (!username || !password) {
+ return res.status(400).json({ error: 'Username and password required' });
+ }
+
+ if (users.has(username)) {
+ return res.status(400).json({ error: 'Username already taken' });
+ }
+
+ const cards = [
+ generateUniqueCard(username),
+ ...generateStarterCards()
+ ];
+
+ users.set(username, { password, cards });
+ req.session.username = username;
+
+ res.json({ success: true });
+});
+
+app.post('/login', (req, res) => {
+ const { username, password } = req.body;
+ const user = users.get(username);
+
+ if (!user || user.password !== password) {
+ return res.status(401).json({ error: 'Invalid credentials' });
+ }
+
+ req.session.username = username;
+ res.json({ success: true });
+});
+
+app.post('/logout', (req, res) => {
+ const ws = activeConnections.get(req.session.username);
+ if (ws) {
+ ws.close();
+ activeConnections.delete(req.session.username);
+ }
+
+ req.session.destroy();
+ res.json({ success: true });
+});
+
+// Game endpoints
+app.get('/inventory', (req, res) => {
+ if (!req.session.username) {
+ return res.status(401).json({ error: 'Not authenticated' });
+ }
+
+ const user = users.get(req.session.username);
+ res.json({ cards: user.cards });
+});
+
+// WebSocket handling
+wss.on('connection', (ws, req) => {
+ // Ensure the connection is authenticated
+ sessionParser(req, {}, () => {
+ const username = req.session.username;
+ if (!username) {
+ ws.close();
+ return;
+ }
+
+ activeConnections.set(username, ws);
+ broadcastActivePlayers();
+
+ // Handle incoming WebSocket messages
+ ws.on('message', (message) => {
+ const data = JSON.parse(message);
+
+ if (data.type === 'giftCards') {
+ handleGiftCards(username, data, ws);
+ }
+ });
+
+ ws.on('close', () => {
+ activeConnections.delete(username);
+ broadcastActivePlayers();
+ });
+ });
+});
+
+function handleGiftCards(username, data, ws) {
+ const { toUser, cardIds } = data;
+
+ // Process the gift (intentionally vulnerable)
+ const fromUser = users.get(username);
+ const toUserData = users.get(toUser);
+
+ // Get the full card details
+ const giftedCards = cardIds
+ .map(cardId => fromUser.cards.find(card => card.id === cardId))
+ .filter(card => card);
+
+ // Remove cards from sender
+ giftedCards.forEach(card => {
+ fromUser.cards = fromUser.cards.filter(c => c.id !== card.id);
+ });
+
+ // Add cards to receiver
+ toUserData.cards.push(...giftedCards);
+
+ // Check for duplication
+ const fromFlag = checkForDuplication(username);
+ const toFlag = checkForDuplication(toUser);
+
+ // Notify both parties
+ const fromWs = activeConnections.get(username);
+ const toWs = activeConnections.get(toUser);
+
+ if (fromWs && fromWs.readyState === WebSocket.OPEN) {
+ fromWs.send(JSON.stringify({
+ type: 'giftComplete',
+ inventory: fromUser.cards,
+ flag: fromFlag
+ }));
+ }
+
+ if (toWs && toWs.readyState === WebSocket.OPEN) {
+ toWs.send(JSON.stringify({
+ type: 'giftReceived',
+ from: username,
+ cards: giftedCards,
+ inventory: toUserData.cards,
+ flag: toFlag
+ }));
+ }
+}
+
+const PORT = 3001;
+server.listen(PORT, () => {
+ console.log(`Card Game Server running on port ${PORT}`);
+});

package.json

@@ -12,6 +12,7 @@
  "dependencies": {
  "dotenv": "^16.4.7",
  "express": "^4.21.2",
- "express-session": "^1.18.1"
+ "express-session": "^1.18.1",
+ "ws": "^8.18.1"
  }
 }