OWASP Juice Shop v6.4.1 part of the answer to the question (ii)

OWASP Juice Shop v6.4.1 part of the answer to the question (ii)

Previous link: http://blog.51cto.com/10506646/2067233

1. Confidential Document
   By grasping the packet can analyze the site has a directory called FTP, enter
   
   Complete All Access once
2. Redirects Tier 1
   Through the analysis of the source code of the payment interface can find a string of hidden code, copy the link, open to complete
   
3. Christmas Special
   Find a "Special Christmas Product", first go to search to see the wrong code, enter '; to return
   
   Crawling Packets with Burpsuite
   
   Repair the statement, you can see the "not exist" Christmas products
   ‘))--
   
   After adding the shopping basket, you can checkout
4. Easter Egg Tier 1
   Find the hidden easter eggs, according to confidential document This problem can be concluded that there is an FTP directory, enter, see a named Eastere.gg, but the server only allow. MD and. pdf files open, no card. GG, this time use 00 truncation can
   

   Why this is not direct% 00, but%2500, because URL URL will be escaped to a special string,% =%25 Reference article: http://blog.csdn.net/pcyph/article/details/45010609

5.Forged Feedback
Use other people's user name to feedback, through the basket access this problem can be concluded that the server is ultra vires. Click "Contact Us", submit a feedback, then grab the package

Userid:1 on behalf of admin, Change 1 for other digital submissions can be
6.Upload Type
Upload a file that is not a PDF file in the "complaints"

Change the filename in the packet to the file suffix
7.Upload Size
Uploaded file is larger than 100KB

Website has been limited, can not directly upload, directly change the package

Change the content, enter something, more than 100KB can
8.XSS Tier 2
This XSS is not directly inserted into the box popup is done, but a persistent XSS, to the registered user interface, normally submit a form, grab the package, and then replace the mailbox with an XSS statement

And then you'll find an error.
View error messages

A backslash is added to each double quote before it is found, and the statement is reconstructed

Submit, then login Admin This user, enter/administration page, success

Because/administration is the admin interface, you can see all registered users, and the XSS submitted here will be executed.

Summary:
Or because of their own technology is not enough, so only the completion of less than 40% points of the topic, a lot of topics are testing code audit and the use of grab Bag tool, very interesting infiltration environment, here paste a friend's blog link, may also be able to browse (laughter)
http://blog.51cto.com/12804405

OWASP Juice Shop v6.4.1 part of the answer to the question (ii)