{"id":150,"date":"2020-06-06T00:16:29","date_gmt":"2020-06-05T16:16:29","guid":{"rendered":"https:\/\/byy3.com\/?p=150"},"modified":"2020-06-06T00:16:29","modified_gmt":"2020-06-05T16:16:29","slug":"owasp-juice-shop%e7%bd%91%e7%ab%99%e5%85%a5%e4%be%b5%e5%ae%9e%e5%88%97%ef%bc%88%e7%bd%91%e7%ab%99%e7%bb%8f%e5%85%b8%e5%85%a5%e4%be%b5%ef%bc%89","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=150","title":{"rendered":"OWASP Juice Shop\u7f51\u7ad9\u5165\u4fb5\u5b9e\u5217\uff08\u7f51\u7ad9\u7ecf\u5178\u5165\u4fb5\uff09"},"content":{"rendered":"\n

[Task 1] Connect To Our Network<\/strong><\/p>\n\n\n\n

[Task 2] Configure Burp (If you haven\u2019t already)<\/strong><\/p>\n\n\n\n

[Task 3] Walk through the application
<\/strong>1. create an account
2. click on the links you can see what the application does(and to identify an attack surface i.e. what parts of the application have functionality that you can attack)
3. use the different functionality(e.g. making transactions)<\/p>\n\n\n\n

Steps:
<\/strong>1. Discover web application\u2019s functionality to find the attack surface.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

2. View page\u2019s source<\/p>\n\n\n\n

\"OWASP
There\u2019s a youtube link.<\/figcaption><\/figure>\n\n\n\n

3. Follow youtube link \u2192 nothing just for fun. lol<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

4. Create account<\/p>\n\n\n\n

5. Click \u201cNot yet a customer?\u201d<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

6. User Registration
\u2192 Email: testtest@testtest.com
\u2192 Password: 12345
\u2192 Answer to question: 12345<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

7. Try to login with created account \u2192 SQL injection<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

8. Try changing password<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

9. Enter required data \u2192 It\u2019s very easy to change a password.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

10. Try to buy something and checkout<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

11. There\u2019s ftp path.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

12. Follow the ftp path \u2192 File inclusion<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

5. About us
Click on the green text.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

6. There\u2019a \u201clegal.md\u201d file which is located in the ftp path.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

6. Contact us
Click on \u201cComplain?\u201d<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

7. Try upload some text files. It seems like only PDF file is allowed.<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

8. Upload test.pdf<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

9. Successfully upload \u2192 file inclusion<\/p>\n\n\n\n

\"OWASP<\/figure>\n\n\n\n

Conclusion:<\/strong><\/p>\n\n\n\n

The things I discovered so far:
1. The site was developed using Javascript.
2. SQL Injection
3. Password is easily changed
4. Exposure of data
5. File inclusion<\/p>\n\n\n\n

\n\n\n\n

[Task 4] Injection
<\/strong>Log in with the administrator's user account using SQL Injection<\/p>\n\n\n\n

  1. Try to inject login page<\/li><\/ol>\n\n\n\n
    \"OWASP<\/figure>\n\n\n\n

    2. Try SQL injection<\/p>\n\n\n\n

    username '
    password test<\/pre>\n\n\n\n
    \"OWASP<\/figure>\n\n\n\n
    username ' or 1=1
    password test<\/pre>\n\n\n\n
    \"OWASP<\/figure>\n\n\n\n
    username ' or 1=1--
    password test<\/pre>\n\n\n\n
    Success!!!<\/p>\n\n\n\n
    \"OWASP<\/figure>\n\n\n\n
    It seems like we logged in with admin account<\/p>\n\n\n\n
    \"OWASP<\/figure>\n\n\n\n
    Admin email is admin@juice-sh.op<\/strong><\/p>\n\n\n\n
    \n\n\n\n
    [Task 5] Broken Authentication<\/strong><\/p>\n\n\n\n