What you will do
In Juice Shop Basics you found things a shop should not have shown. Here you find one more, and then try the best-known weakness on the web: cross-site scripting, or XSS. It happens when a website puts what you type into its page without making it safe, so what you typed runs as part of the page.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The shop opens from the OWASP Juice Shop link on the bar. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Find a page meant for the owner
Many programs publish numbers about themselves so their owners can watch them. Juice Shop does it at /metrics, and does not ask who is looking. 200 means the page answered anybody. On the Score Board, Exposed Metrics turns green.
curl -s -o /dev/null -w "%{http_code}\n" http://juice-shop:3000/metricsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Try cross-site scripting
Open the shop from the lab bar. Click the magnifying glass at the top and type this exactly into the search box, then press Enter. The marks around xss are backticks, the key left of 1 on a UK or US keyboard (on other layouts it is often a key pressed with Shift or AltGr), and not quotes:
<iframe src="javascript:alert(`xss`)">The shop did not make your text safe before drawing the results, so the browser read it as part of the page and ran it: a box says xss. Press OK.
3. Check the Score Board
Open the Score Board again (/#/score-board). DOM XSS is now green, with Exposed Metrics beside it.
The fix is to treat everything a visitor types as text and never as part of the page, which is what DVWA Basics 2 shows from the other side.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. XSS is the example every web security unit uses, and a student sees it run in a lab with no way out, so nobody else can be affected. Ask for a screenshot of the Score Board and a sentence on what the shop should have done instead. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.