What you will do
Many websites trust more than they should: a page nobody linked to, an error that says too much, a folder anyone can read. OWASP Juice Shop is a shop built with weaknesses like these, so you can find them safely. You will solve three of its easiest challenges and watch each one turn green on its Score Board.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The shop opens from the OWASP Juice Shop link on the bar. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Look at the shop
Press the link on the lab bar to open the shop in a new tab. Look around as a customer would: search for apple, open a product. Each thing you do sends a request to a program. A program can be asked things it was not meant to answer.
2. Ask the shop a question without the page
The search box asks the shop for products. curl can ask the same question without a browser, and the answer is plain JSON. Look at what comes back: it is much more than the page shows.
curl -s -w "\n" "http://juice-shop:3000/rest/products/search?q=apple"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Challenge: find the Score Board
The Score Board is a real page, but nothing links to it: finding it is the first challenge. In the shop tab, change the end of the address to /#/score-board and press Enter. It lists every challenge by difficulty, and Score Board is the first one, now green.
4. Challenge: read a file you should not
Web servers sometimes list a folder that was never meant to be public. This asks for a document in the shop's /ftp folder. It is marked confidential, yet anybody who asks can read it. On the Score Board, Confidential Document turns green.
curl -s http://juice-shop:3000/ftp/acquisitions.mdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
5. Challenge: make the shop show an error
This search is '(, a quote and a bracket, written %27( in the address. The quote ends the shop's own text early, and the bracket breaks its database question. A careful program says "no results". This one prints its database's error, SQLITE_ERROR, which tells an attacker what it is built with. Error Handling turns green.
curl -s "http://juice-shop:3000/rest/products/search?q=%27("Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
6. Check the Score Board
Go back to the Score Board tab and reload it: the three challenges are green. There are over a hundred more, with hints, if you want to carry on. The shop forgets its state when the lab stops, so if you will carry on tomorrow, copy the continue code the Score Board offers.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. The lab is a whole web application every student attacks in a copy of their own, with no way out to the internet, and nothing is marked for you: ask for a screenshot of the Score Board and a sentence on why each weakness exists. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.