Challenge III

A shopping cart application allows users to purchase laptops at low rates. The application makes use of JWT tokens for authorization purposes. With every product purchased, the user gets an invoice.

The application is still in the BETA phase so registrations are not accepted. Instead, a few selected individuals are provided access! Conclusively, the backend is SQLite-based due to the small size of the BETA members.

The application had suffered a breach the previous month and had tightened the security since then. Data retrieval is done with proper security practices to avoid any injection issues. But some artifacts of the breach might be present and could be of great value during this pentest exercise.

Objective: Leverage the misconfigurations on the backend server and retrieve the following:

1. Flag retrieved from the exposed HTTP server

2. Password for support@e-shopping-cart.com

3. Flag retrieved after successful purchase by performing parameter tampering attack

4. Password for user corey after retrieving all the invoices from the backend leveraging the lack of rate-limiting

5. Flag present in the home directory of the compromised user, that is, corey

Instructions:

• This lab is dedicated to you! No other users are on this network :)

• Once you start the lab, you will have access to a Kali GUI instance.

• Your Kali instance has an interface with IP address 192.X.Y.2. Run "ifconfig" to know the values of X and Y.

• The shopping cart application should be running on port 5000 on the machine located at the IP address 192.X.Y.3.

• Do not attack the gateway located at IP address 192.X.Y.1

NOTE: This badge challenge is for evaluation, so we don't provide hints or explanations for this. Hence, contact us on support email only if you are facing a technical issue.