OWASP Juice Shop - Revision history

LJahn at 21:01, 17 December 2024

2024-12-17T21:01:01Z

@@ Line 28: / Line 28: @@
 [[File:JS loggedin.PNG|500px|center]]
-'''NoSQL Manipulation challenge'''
+===NoSQL Manipulation challenge===
 As another example, we can look at the NoSQL Manipulation (also known as NoSQL Injection) challenge, where all of the product reviews, in the OWASP Juice Shop, have to be updated at the same time.
@@ Line 55: / Line 55: @@
 Such an exploit can be prevented, by sanitizing the user-input/ the endpoints. In this case, this can be achieved by using the module "express-mongo-sanitize" [https://www.npmjs.com/package/express-mongo-sanitize].
 [[Category:Documentation]]

GHuebner at 12:10, 4 January 2023

2023-01-04T12:10:37Z

← Older revision		Revision as of 12:10, 4 January 2023
Line 54:		Line 54:
	[[File:OWASP JuiceShop NoSQL Mani ChallengeSolved.png\|1000px\|center]]		[[File:OWASP JuiceShop NoSQL Mani ChallengeSolved.png\|1000px\|center]]

			Such an exploit can be prevented, by sanitizing the user-input/ the endpoints. In this case, this can be achieved by using the module "express-mongo-sanitize" [https://www.npmjs.com/package/express-mongo-sanitize].

	[[Category:Documentation]]		[[Category:Documentation]]

GHuebner at 12:07, 4 January 2023

2023-01-04T12:07:38Z

@@ Line 27: / Line 27: @@
 *'''or 1 = 1 and email like ('% bender% '); --'' </br>
 [[File:JS loggedin.PNG|500px|center]]
 [[Category:Documentation]]

CPodpera: updated installation process

2021-12-21T20:32:15Z

updated installation process

← Older revision		Revision as of 20:32, 21 December 2021
Line 12:		Line 12:
	*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.</br>		*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.</br>
	*The downloaded file will be extracted to any path.</br>		*The downloaded file will be extracted to any path.</br>
			*To install all necessary dependencies you first need to run the command ''"npm install"''</br>
	*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''</br>		*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''</br>
	[[File:JS Terminal.PNG\|500px\|center]]</br>		[[File:JS Terminal.PNG\|500px\|center]]</br>

CEberhart at 18:55, 21 December 2020

2020-12-21T18:55:26Z

← Older revision		Revision as of 18:55, 21 December 2020
Line 1:		Line 1:
	At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]		At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]] from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

	== Architecture: ==		== Architecture: ==

CEberhart: /* Example */

2020-12-21T18:50:25Z

Example

← Older revision		Revision as of 18:50, 21 December 2020
Line 20:		Line 20:

	In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.</br>		In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.</br>
	'''or 1 = 1; --'' </br>		*'''or 1 = 1; --'' </br>
	[[File:JS sqllogin.PNG\|500px\|center]]</br>		[[File:JS sqllogin.PNG\|500px\|center]]</br>
	It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.</br>		It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.</br>
	'''or 1 = 1 and email not like ('% admin% '); --'' </br>		*'''or 1 = 1 and email not like ('% admin% '); --'' </br>
	'''or 1 = 1 and email like ('% bender% '); --'' </br>		*'''or 1 = 1 and email like ('% bender% '); --'' </br>
	[[File:JS loggedin.PNG\|500px\|center]]		[[File:JS loggedin.PNG\|500px\|center]]

			[[Category:Documentation]]

CEberhart: /* Installation */

2020-12-21T18:48:37Z

Installation

← Older revision		Revision as of 18:48, 21 December 2020
Line 14:		Line 14:
	*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''</br>		*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''</br>
	[[File:JS Terminal.PNG\|500px\|center]]</br>		[[File:JS Terminal.PNG\|500px\|center]]</br>
	*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''<(br>		*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''</br>
	[[File:JS Homepage.PNG\|500px\|center]]		[[File:JS Homepage.PNG\|500px\|center]]

CEberhart: /* Installation */

2020-12-21T18:48:19Z

Installation

← Older revision		Revision as of 18:48, 21 December 2020
Line 10:		Line 10:

	For a successful installation, the following steps must be observed:</br>		For a successful installation, the following steps must be observed:</br>
	Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.</br>		*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.</br>
	The downloaded file will be extracted to any path.</br>		*The downloaded file will be extracted to any path.</br>
	To start the Juice Shop, ~~Open~~ the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"</br>		*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''</br>
	[[File:JS Terminal.PNG\|500px\|center]]</br>		[[File:JS Terminal.PNG\|500px\|center]]</br>
	Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>		*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''<(br>
	[[File:JS Homepage.PNG\|500px\|center]]		[[File:JS Homepage.PNG\|500px\|center]]

CEberhart at 18:46, 21 December 2020

2020-12-21T18:46:35Z

← Older revision		Revision as of 18:46, 21 December 2020
Line 1:		Line 1:
	~~The name is a bit misleading~~, ~~and its is not a real online~~ Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.		At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

	== Architecture: ==		== Architecture: ==

CEberhart: /* Architecture: */

2020-12-21T18:42:01Z

Architecture:

← Older revision		Revision as of 18:42, 21 December 2020
Line 5:		Line 5:
	OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.</br>		OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.</br>

	[[~~JS_Architectur~~.PNG\|~~500px\|center~~]]		[[File:ArchitekturOWASP.PNG\|700px]]

	== Installation ==		== Installation ==