Skip to main content

Whats juiceshop

  • deliberately vulnerable web app

  • named after german "Saftladen" which is a shitty shop

  • browser recommendation: chrome oder firefox

  • whats considered cheating: reading the book from front to end reading juiceshops source code getting hints before trying setting the entries in the Challnges table in the DB to solved hacking instructor script contains tutorials: disable! (hacking-instructor-hash.js)

Installation

Install juiceshop locally with docker​

  1. install node.js
  2. Install Docker
  3. Run these in terminal
docker pull bkimminich/juice-shop
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
# 891716ad95c2d...
# docker kill 891716a

Install on Kali linux​

  1. Install kali linux in vm on Mac with UTM
  2. Install requirements
sudo apt update
sudo apt install -y docker.io
sudo systemctl start docker
sudo systemctl enable docker
sudo usermod -aG docker $USER
  1. Install juiceshop
sudo docker pull bkimminich/juice-shop
sudo docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
# Keep state but --rm removes containers 
  docker run --rm -p 3000:3000 \
  -v juice-data:/juice-shop/data \
  bkimminich/juice-shop

docker run -d --name juice-shop -p 3000:3000 -v juice-data:/juice-shop/data bkimminich/juice-shop
docker ps
docker logs -f juice-shop  # wait for "Server listening on port 3000"
  1. Limit network outbound access to specific pages and updates only Solution: Shared network + scoped PF + VM-side host-block

UTM: Use Shared Network (not host-only) Mac PF: Whitelist on bridge100 interface only Inside VM: Block host IP ranges with iptables VM gets internet for installs/APIs, can't reach Mac, can't reach arbitrary sites, Mac unaffected.

On Mac PF example:

/etc/pf.conf - add before your existing rules

block drop out on bridge100 all pass out on bridge100 proto udp to any port 53 pass out on bridge100 proto tcp to {http.kali.org, security.kali.org} port 443 pass out on bridge100 proto tcp to {api.openai.com, api.anthropic.com} port 443

sudo pfctl -f /etc/pf.conf Inside VM:

sudo iptables -A OUTPUT -d 192.168.64.0/24 -j DROP # block host subnet Done. VM can install, access APIs, can't touch Mac, can't reach random sites, Mac unaffected.

Use Juiceshop

Juiceshop is configured so that the docker container cleans itself when its terminated. Your progress is only stored in the browser in the cookies.

Juiceshop delete cookies

See Juiceshop Intro presentation

Access Juiceshop via http://localhost:3000

Challenge order​

  1. Find scoreboard
  2. Map out the web app and find principal workflows. Do some "happy testing" = normal user behaviour and if nothing goes wrong you have a "sunny day" (do that 10 min then we compare)

•⁠ ⁠browse products •⁠ ⁠⁠search bar •⁠ ⁠⁠user login / registration •⁠ ⁠⁠choosing products •⁠ ⁠⁠checkout •⁠ ⁠⁠DO NOT ENTER REAL CREDIT CARD DETAILS OR ADDRESS •⁠ ⁠⁠user menu, profile •⁠ ⁠⁠customer feedback •⁠ ⁠⁠request recycle box •⁠ ⁠⁠complaint •⁠ ⁠⁠ai chat (must have llm in backend) •⁠ ⁠⁠about us •⁠ ⁠⁠photo wall •⁠ ⁠⁠deluxe membership •⁠ ⁠⁠language selection

took approx 1h:

  • Logging Tables from Network Tab: Users/ SecurityAnswers/ Quantitys/ Capthcha answer is in console/network tab: captcha/ {"captchaId":1,"captcha":"7+4+9","answer":"20"} Hints/

recommended order: Challenge Category Difficulty Score Board Miscellaneous ⭐ DOM XSS XSS ⭐ Bonus Payload XSS ⭐ Privacy Policy Miscellaneous ⭐ Reflected XSS XSS ⭐⭐ Exposed Credentials Sensitive Data Exposure ⭐⭐ Login Admin Injection ⭐⭐ Admin Section Broken Access Control ⭐⭐ Password Strength Broken Authentication ⭐⭐ View Basket Broken Access Control ⭐⭐ Forged Feedback Broken Access Control ⭐⭐⭐ Login Jim Injection ⭐⭐⭐ Login Bender Injection ⭐⭐⭐ Coding Challenges n/a n/a

  1. XSS in searchbar:
  • Output encoding: variables are not interpreted as code