OWASP Juice Shop
This guide contains the answer and steps necessary to get to them for the OWASP Juice Shop room.
Table of contents
- Let's go on an adventure!
- Inject the juice
- Who broke my lock?!
- AH! Don't look!
- Who's flying this thing?
- Where did that come from?
- Exploration!
Let's go on an adventure!
- Question #1: What's the Administrator's email address?
Clicking one of the products gives us the admin's email address in the review.
Click for answer
admin@juice-sh.op
- Question #2: What parameter is used for searching?
After searching, we can see the parameter in the address bar.
Click for answer
q
- Question #3: What show does Jim reference in his review?
This answer can even be found in the text.
Click for answer
Star Trek
Inject the juice
- Question #1: Log into the administrator account!
We can use Burpsuite to intercept and modify the request or we can input in directly into the username field.
Click for answer
32a5e0f21372bcc1000a6088b93b458e41f0e02a
- Question #2: Log into the Bender account!
Now we do the same, but we add the user's email and add '-- to the end.
Click for answer
fb364762a3c102b2db932069c0e6b78e738d4066
Who broke my lock?!
- Question #1: Bruteforce the Administrator account's password!
First lets intercept a login request using the admin's password. And send it to Intruder in Burpsuite.
Now we add a position for the password field. We don't have to do this for the username as we will be using the same for each try.
Next we add items to try from a wordlist from Seclists (best1050).
Now we start the attack and wait for a response status of 200, this should be our password.
Finally, we can log in with the password we found.
Click for answer
c2110d06dc6f81c67cd8099ff0ba601241f1ac0e
- Question #2: Reset Jim's password!
For this we can simply answer the security question with the answer from the text.
Click for answer
094fbc9b48e525150ba97d05b942bbf114987257
AH! Don't look!
- Question #1: Access the Confidential Document!
Looking at the url for the legal document, we can access the ftp server directly.
From here we get a flag for accessing secret documents.
Click for answer
edf9281222395a1c5fee9b89e32175f1ccf50c5b
- Question #2: Log into MC SafeSearch's account!
After watching the clip (or using the text) we can log into Mc Safe Search's account.
Click for answer
66bdcffad9e698fd534003fbb3cc7e2b7b55d7f0
- Question #3: Download the Backup file!
Using the Poison Null Byte as suggested, we can bypass the file extension restriction and download the backup file.
Click for answer
bfc1e6b4a16579e85e06fee4c36ff8c02fb13795
Who's flying this thing?
- Question #1: Access the administration page!
Looking at the javascript in the debugger we see this mention of an administration panel.
Logging into the admin account with our previously found credentials and navigating to #/administration gives us access to the admin panel.
Click for answer
946a799363226a24822008503f5d1324536629a0
- Question #2: View another user's shopping basket!
First we capture the request and change the basket number to something else.
This lets us view another user's basket.
Click for answer
41b997a36cc33fbe4f0ba018474e19ae5ce52121
- Question #3: Remove all 5-star reviews!
Under the feedback column, we can delete a five-start review.
Click for answer
50c97bcce0b895e446d61c83a21df371ac2266ef
Where did that come from?
- Question #1: Perform a DOM XSS!
For our first XSS attack we use the following code in the search bar.
Click for answer
9aaf4bbea5c30d00a1f5bbcfce4db6d4b0efe0bf
- Question #2: Perform a persistent XSS!
For this XSS attack we enable intercept in Burpsuite and log out of our account. In this request we head the following header.
Now we can log back in again and go to the last login ip page.
Click for answer
149aa8ce13d7a4a8a931472308e269c94dc5f156
- Question #3: Perform a reflected XSS!
For this final XSS attack we navigate to the order history page and click on the track button.
Now we can cange the id parameter in the URL with:
Click for answer
23cefee1527bde039295b2616eeb29e1edc660a0
Exploration!
- Access the /#/score-board/ page
This can si,ply be found by navigating to the /#/score-board/ page.
Click for answer
7efd3174f9dd5baa03a7882027f2824d2f72d86e