OWASP Juice Shop

• We can now see the search parameter after the /#/search? the letter q 

q

• Question #2: Log into the Bender account!

32a5e0f21372bcc1000a6088b93b458e41f0e02a

• Similar to what we did in Question #1, we will now log into Bender's account! Capture the login request again, but this time we will put: bender@juice-sh.op'-- as the email.  

fb364762a3c102b2db932069c0e6b78e738d4066

• Bruteforce the Administrator account's password!

c2110d06dc6f81c67cd8099ff0ba601241f1ac0e

• Reset Jim's password!

094fbc9b48e525150ba97d05b942bbf114987257

• Access the Confidential Document!

edf9281222395a1c5fee9b89e32175f1ccf50c5b

• Log into MC SafeSearch's account! 

66bdcffad9e698fd534003fbb3cc7e2b7b55d7f0

• Download the Backup file! 

bfc1e6b4a16579e85e06fee4c36ff8c02fb13795

• Access the administration page! 

946a799363226a24822008503f5d1324536629a0

• View another user's shopping basket! 

41b997a36cc33fbe4f0ba018474e19ae5ce52121

• Remove all 5-star reviews! 

50c97bcce0b895e446d61c83a21df371ac2266ef

• Perform a DOM XSS! 

9aaf4bbea5c30d00a1f5bbcfce4db6d4b0efe0bf

• Perform a persistent XSS! 

149aa8ce13d7a4a8a931472308e269c94dc5f156

• Perform a reflected XSS! 

23cefee1527bde039295b2616eeb29e1edc660a0

• Access the /#/score-board/ page

7efd3174f9dd5baa03a7882027f2824d2f72d86e