Once the machine has loaded, access it by copying and pasting its IP into your browser; if you're using the browser-based machine, paste the machines IP into a browser on that machine.

Question #1: What's the Administrator's email address?

The reviews show each user's email address. Which, by clicking on the Apple Juice product, shows us the Admin email!

Question #2: What parameter is used for searching? 

Click on the magnifying glass in the top right of the application will pop out a search bar.

We can then input some text and by pressing Enter will search for the text which was just inputted.

Now pay attention to the URL which will now update with the text we just entered.

We can now see the search parameter after the /#/search? the letter q

Question #3: What show does Jim reference in his review? 

Jim did a review on the Green Smoothie product. We can see that he mentions a replicator. 

If we google "replicator" we will get the results indicating that it is from a TV show called Star Trek

Question #1: Log into the administrator account!

After we navigate to the login page, enter some data into the email and password fields.

 Before clicking submit, make sure Intercept mode is on.

This will allow us to see the data been sent to the server!

We will now change the "a" next to the email to: ' or 1=1-- and forward it to the server.

Why does this work?

1. The character ' will close the brackets in the SQL query
2. 'OR' in a SQL statement will return true if either side of it is true. As 1=1 is always true, the whole statement is true. Thus it will tell the server that the email is valid, and log us into user id 0, which happens to be the administrator account.
3. The -- character is used in SQL to comment out data, any restrictions on the login will no longer work as they are interpreted as a comment. This is like the # and // comment in python and javascript respectively.

Question #2: Log into the Bender account!

Similar to what we did in Question #1, we will now log into Bender's account! Capture the login request again, but this time we will put: bender@juice-sh.op'-- as the email. 

Now, forward that to the server!

But why don't we put the 1=1?

Well, as the email address is valid (which will return true), we do not need to force it to be true. Thus we are able to use '-- to bypass the login system. Note the 1=1 can be used when the email or username is not known or invalid.

Question #1: Bruteforce the Administrator account's password!

We have used SQL Injection to log into the Administrator account but we still don't know the password. Let's try a brute-force attack! We will once again capture a login request, but instead of sending it through the proxy, we will send it to Intruder.

Go to Positions and then select the Clear § button. In the password field place two § inside the quotes. To clarify, the § § is not two sperate inputs but rather Burp's implementation of quotations e.g. "". The request should look like the image below. 

For the payload, we will be using the best1050.txt from Seclists. (Which can be installed via: apt-get install seclists)

You can load the list from: /usr/share/wordlists/SecLists/Passwords/Common-Credentials/best1050.txt

Once the file is loaded into Burp, start the attack. You will want to filter for the request by status.

A failed request will receive a 401 Unauthorized   

Whereas a successful request will return a 200 OK. 

Once completed, login to the account with the password.

Question #2: Reset Jim's password!

       

We will download the acquisitions.md and save it. It looks like there are other files of interest here as well.

After downloading it, navigate to the home page to receive the flag!

Question #2: Log into MC SafeSearch's account!

After watching the video there are certain parts of the song that stand out.

He notes that his password is "Mr. Noodles" but he has replaced some "vowels into zeros", meaning that he just replaced the o's into 0's.

We now know the password to the mc.safesearch@juice-sh.op account is "Mr. N00dles"

Question #3: Download the Backup file!

We will now go back to the http://MACHINE_IP /ftp/ folder and try to download package.json.bak. But it seems we are met with a 403, which says that only .md and .pdf files can be downloaded.

To get around this, we will use a character bypass called "Poison Null Byte". A Poison Null Byte looks like this: %00.

Note: as we can download it using the url, we will need to encode this into a url encoded format.

The Poison Null Byte will now look like this: %2500. Adding this and then a .md to the end will bypass the 403 error!

Why does this work?

A Poison Null Byte is actually a NULL terminator. By placing a NULL character in the string at a certain byte, the string will tell the server to terminate at that point, nulling the rest of the string.

Question #1: Access the administration page!

First, we are going to open the Debugger on Firefox. 

(Or Sources on Chrome.)

This can be done by navigating to it in the Web Developers menu. 

We are then going to refresh the page and look for a javascript file for main-es2015.js

We will then go to that page at: http://MACHINE_IP/main-es2015.js

To get this into a format we can read, click the { } button at the bottom  

Now search for the term "admin" 

You will come across a couple of different words containing "admin" but the one we are looking for is "path: administration"

This hints towards a page called "/#/administration" as can be seen by the about path a couple lines below, but going there while not logged in doesn't work. 

As this is an Administrator page, it makes sense that we need to be in the Admin account in order to view it.

A good way to stop users from accessing this is to only load parts of the application that need to be used by them. This stops sensitive information such as an admin page from been leaked or viewed.

Question #2: View another user's shopping basket!

Login to the Admin account and click on 'Your Basket'. Make sure Burp is running so you can capture the request!

Forward each request until you see: GET /rest/basket/1 HTTP/1.1

Now, we are going to change the number 1 after /basket/ to 2

It will now show you the basket of UserID 2. You can do this for other UserIDs as well, provided that they have one!

Question #1: Perform a DOM XSS!

We will be using the iframe element with a javascript alert tag: 

<iframe src="javascript:alert(`xss`)"> 

Inputting this into the search bar will trigger the alert.

Note that we are using iframe which is a common HTML element found in many web applications, there are others which also produce the same result. 

This type of XSS is also called XFS (Cross-Frame Scripting), is one of the most common forms of detecting XSS within web applications.

Websites that allow the user to modify the iframe or other DOM elements will most likely be vulnerable to XSS.   

Why does this work?

It is common practice that the search bar will send a request to the server in which it will then send back the related information, but this is where the flaw lies. Without correct input sanitation, we are able to perform an XSS attack against the search bar. 

Question #2: Perform a persistent XSS!

First, login to the admin account.

We are going to navigate to the "Last Login IP" page for this attack.

It should say the last IP Address is 0.0.0.0 or 10.x.x.x 

As it logs the 'last' login IP we will now logout so that it logs the 'new' IP.

Make sure that Burp intercept is on, so it will catch the logout request.

We will then head over to the Headers tab where we will add a new header:

Then forward the request to the server!
When signing back into the admin account and navigating to the Last Login IP page again, we will see the XSS alert!

Why do we have to send this Header?

The True-Client-IP  header is similar to the X-Forwarded-For header, both tell the server or proxy what the IP of the client is. Due to there being no sanitation in the header we are able to perform an XSS attack. 

Question #3: Perform a reflected XSS!

First, we are going to need to be on the right page to perform the reflected XSS!

Login into the admin account and navigate to the 'Order History' page. 

From there you will see a "Truck" icon, clicking on that will bring you to the track result page. You will also see that there is an id paired with the order.   

We will use the iframe XSS, <iframe src="javascript:alert(`xss`)">, in the place of the 5267-f73dcd000abcc353

After submitting the URL, refresh the page and you will then get an alert saying XSS!

Why does this work?

The server will have a lookup table or database (depending on the type of server) for each tracking ID. As the 'id' parameter is not sanitised before it is sent to the server, we are able to perform an XSS attack.