OWASP Juice Shop 实战报告与解析
安装教程
按照github项目的流程
结果18.04ubuntu 在第四部编译一直报错
npm ERR! fetch failed https://registry.npmjs.org/jsesc/-/jsesc-1.3.0.tgz
npm WARN retry will retry, error on last attempt: Error: read ECONNRESET
npm ERR! fetch failed https://registry.npmjs.org/jsesc/-/jsesc-1.3.0.tgz
npm WARN retry will retry, error on last attempt: Error: read ECONNRESET
npm ERR! fetch failed https://registry.npmjs.org/jsesc/-/jsesc-1.3.0.tgz
npm ERR! Linux 4.15.0-38-generic
npm ERR! argv "/usr/bin/node" "/usr/bin/npm" "install"
npm ERR! node v8.10.0
npm ERR! npm v3.5.2
npm ERR! code ECONNRESET
npm ERR! errno ECONNRESET
npm ERR! syscall read
npm ERR! network read ECONNRESET
npm ERR! network This is most likely not a problem with npm itself
npm ERR! network and is related to network connectivity.
npm ERR! network In most cases you are behind a proxy or have bad network settings.
npm ERR! network
npm ERR! network If you are behind a proxy, please make sure that the
npm ERR! network 'proxy' config is set properly. See: 'npm help config'
npm ERR! Please include the following file with any support request:
npm ERR! /home/zhouzhong/juice-shop_7.5.1/npm-debug.log
即使添加了淘宝镜像
npm config set registry https://registry.npm.taobao.org
还是凉凉
还好之前玩vulhub 有使用docker
直接用docker的步骤，一步到位
到这一步就是搭建?了
不过，，，真当是饮品店了，，，
解题第一步
扒源码
一开始看感觉没毛病，，，因为没有什么特殊的注释但是看其他老哥搭环境的教程看到他们的这块是注释掉的就很气，，，
应该是最新版有更改
进入记分板（source-board），老版本是原谅色的记分板好气！
真香
1.1 Admin Section
在浏览器的开发者工具中打开juice-shop.min.js并搜索“admin”。
访问 http://localhost:3000/#/administration 即可
1.2 confidential document
查看关于我们
很皮~发现其是个链接
点开看到链接是个ftp
不下载，访问ftp链接即可
http://localhost:3000/ftp/acquisitions.md
1.3 Error Handing（错误的登录框）
点击登陆，电子邮箱前加一个 ’ (单引号) 就行了
1.7 XSS Tier 1
2.5
根据在Error Handling里看到的SQL语句，直接进行构造:
SELECT * FROM Users WHERE email=” or 1=1 — AND password = ‘xxxxxx’;
所以在Email处直接输入’ or 1=1 – (万能)，密码处任意填写，即可成功登录。
到购物车里看看，可以看到登录的是admin用户:
持续更新 ~
项目地址 https://github.com/bkimminich/juice-shop