OWASP Juice Box Challenges part 1
Published: 2020-04-12 22:19:15

Note that the browser of choice here is Google Chrome. Here are my solutions to some of the 1-star challenges in OWASP Juice Box:

##Finding the score board

*Challenge: Find the carefully hidden 'Score Board' page.*

Open up the developer tools on you browser and find the Source tab. If we look at the file main-es2015.js, we can see that it contains code for the routing paths in the app. Use Ctrl-F to search for keywords , in our case "Score". We can see in the code that there exist a path called "score-board".

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pw13lm934mydexr40tbx.PNG)
Enter "score-board" after the `/#/` and you get the scoreboard!

##How to leave a zero-star rating

*Challenge: Give a devastating zero-star feedback to the store*

Open up the developer tools on your browser and find the Network tab equivalent on your browser. Lets first investigate the request that is being made when submitting a review.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pfkehl8r9z0idkadyvro.PNG)
Notice how the rating is sent to the app. What this means is that we can send a zero star rating if we set the value of rating to zero. We will go about this by intercepting the request with [burpsuite](https://portswigger.net/support/getting-started-with-burp-suite) and modifying it before it gets sent to the app. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/3vekws1gyphw3etv5ofn.PNG)
Clicked "Forward" and the modified request will be sent to the app. 

##That's not how you register a user

*Challenge: Follow the DRY principle while registering a user.*

This is very similar to the above one in which you intercept and modified the request, thus bypassing any validation done on the client side. Again, lets first investigate the request:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vt7th2xf2e5eos1suc2e.PNG)
We can modified the payload like the following:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/7p0auuunyntfyzvm2wjj.PNG)
Clicked "Forward" and the modified request will be sent to the app. 

##Where's the cat photo?

*Challenge: Retrieve the photo of Bjoern's cat in "melee combat-mode".*

If we go the "Photo Wall" Page, we can see that one of the photos hasn't load properly. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/7b72n4irlgdbe7gg6pbd.PNG)
Lets find the url of where the photo is being pulled from:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ixzxb5tsiz6b56ekldee.PNG)
If we go to to that url and investigate the request on the Network tab:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/f70glbndrht5cmtpx9jh.PNG)
We can see that the browser didn't execute the full url. The same thing happens when we try to execute the associated twitter link:

 ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/6xjzza6kqoxymahepl28.PNG)
It seems like there's an issue with encoding.

To fix it, first find the encoding characters for the 😼 symbol (`%F0%9F%98%BC`), then take the rest of the url and url encode it. You can do this by going [here](https://www.urlencoder.org/). Now put the two parts together and you should have an url that has been properly encoded, and we should be able to see the cat photo now.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8ahghde0tjlk497zmrne.PNG)

That's it for the 1 star challenges. I hope this has help you in any way. Thank you for reading. Till next time!