The OWASP Juice Shop and OWASP Cornucopia cheat sheet
Welcome new-bee OWASP Cornucopia game masters!
This is how you can connect OWASP Cornucopia with the OWAP Juice Shop challenges. Here is a list of all the Website App Edition cards and how they are connected to the OWASP Juice Shop vulnerabilities. You will also find the threat model that showes you which component is vulnerable which will help you to lead a fun game of OWASP Cornucopia even if you don't have a threat model to use!
The threat model
First of, here is the hi-res threat model you should show to your peers. You can also use the empty threat model template. The template can be opened up in OWASP Threat Dragon. you should allow your peers to explore the threat model and understand the different components and how they are connected. During the OWASP Cornucopia session the players can add threats and cards to the model as they are playing. There is also a cheat sheet model that you can use to quickly find the vulnerable components and the related cards and guide the participants if they get stuck.
Instructions to the game master
Keep the cheat sheet to yourself, but use it to guide the players if they get stuck. You can also use the cheat sheet to prepare for the game and understand which cards are related to which vulnerabilities and components. If you do not have a computer, use the written solution below instead.
You should have the model printed out infront of you. Notice the components names on the drawing, you will find the main vulnerable components in the table below. For each of the vulnerable component there is a table with the related cards and the related Juice Shop challenges. You can use the table to guide the players if they get stuck and to prepare for the game. The card represent the threat that can be exploited in the related Juice Shop challenge. Each challenge represent a vulnerability in the related component. The description of the challenge is a dead give away, but if you are in doubt, click on the challenge to read the solution and understand the vulnerability and the related card.
Happy gaming!
The solution
Components
Angular Frontend
Goto: Overview
| Card | Description | Juice Box |
|---|---|---|
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Let us redirect you to one of our crypto currency addresses |
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Find an accidentally deployed code sandbox |
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | A developer was careless with hardcoding unused but still valid credentials |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Use the bonus payload in the DOM XSS challenge (Past an iframe into the search field) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a reflected XSS attack (through the tracking url parameter) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Change the href of the link within the O-Saft product description (through stored Xss) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a persisted XSS attack bypassing a client-side security mechanism |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a persisted XSS attack without using the frontend application at all (viewable through search) |
| Cryptography J | Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code | A developer was careless with hardcoding unused but still valid credentials |
| Cryptography J | Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code | Take over the wallet containing our official Soul Bound Token |
| Cryptography J | Axel can modify transient or permanent data (stored or in transit), or source code, or updates/patches, or configuration data, because it is not subject to integrity checking | A developer was careless with hardcoding unused but still valid credentials |
| Cornucopia 3 | Andrew can access source code, or decompile, or debug, or otherwise access business logic to understand how the application works and any secrets contained | Find an accidentally deployed code sandbox |
Application Server
Goto: Overview
| Card | Description | Juice Box |
|---|---|---|
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Access a confidential document (Because directory listing not is disabled) |
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Retrieve the content of C:\Windows\system.ini or /etc/passwd from the server (and sensitive trading info) |
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Find the carefully hidden 'Score Board' page |
| Data Validation 3 | Robert can input malicious data because the allowed protocol format is not being checked, or duplicates are accepted, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats | Upload a file larger than 100 kB |
| Data Validation 3 | Robert can input malicious data because the allowed protocol format is not being checked, or duplicates are accepted, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats | Perform a DOM XSS attack (against the search field) |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Perform a DOM XSS attack (against the search field) |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Give a devastating zero-star feedback to the store (enable the submit button in the frontend) |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Follow the DRY principle while registering a user (missing password validation) |
| Data Validation 8 | Oana can bypass the centralized sanitization routines since they are not being used comprehensively | Perform a DOM XSS attack (against the search field) |
| Data Validation 9 | Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized | Follow the DRY principle while registering a user (missing password validation) |
| Data Validation 10 | Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) | Post a product review as another user or edit any user’s existing review |
| Data Validation 10 | Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) | Post some feedback in another user’s name |
| Data Validation 10 | Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) | View another user’s shopping basket |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a DOM XSS attack (against the search field) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a reflected XSS attack (through the tracking url parameter) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Change the href of the link within the O-Saft product description (through stored Xss) |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a persisted XSS attack bypassing a client-side security mechanism |
| Data Validation Q | Xavier can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes | Perform a persisted XSS attack without using the frontend application at all (viewable through search) |
| Authentication 3 | Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or from memory, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password | Determine the answer to John’s security question |
| Authentication 3 | Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or from memory, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password | Determine the answer to Emma’s security question (and reset his password) |
| Authentication 3 | Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or from memory, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password | Reset the password of Bjoern’s OWASP account via the Forgot Password mechanism (by find his pet's name) |
| Authentication 6 | Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry, or it does not use an out-of-band delivery method (e.g. post, mobile app, SMS) | Users registering via Google account will receive a very silly default password that involves Base64 encoding. |
| Authentication 7 | Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords | Follow the DRY principle while registering a user (missing password validation) |
| Authentication 7 | Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords | Log in with Amy’s original user credentials (K1f.....................) |
| Authentication 7 | Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords | Log in with Jim’s user account (using a rainbow table, e.g: ncc-1701) |
| Authentication 7 | Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords | Log in with the administrator’s user credentials without previously changing them or applying SQL Injection (pass: admin123) |
| Authentication Q | Johan can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) or across all versions/channels (e.g. mobile website, mobile app, full website, API, call centre) | Determine the answer to John’s security question (and reset his password) |
| Authentication Q | Johan can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) or across all versions/channels (e.g. mobile website, mobile app, full website, API, call centre) | Reset the password of Bjoern’s OWASP account via the Forgot Password mechanism (by find his pet's name) |
| Authentication Q | Johan can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) or across all versions/channels (e.g. mobile website, mobile app, full website, API, call centre) | Reset Jim’s password via the Forgot Password mechanism (by using his sibling's famous middle name) |
| Authentication Q | Johan can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) or across all versions/channels (e.g. mobile website, mobile app, full website, API, call centre) | Determine the answer to Emma’s security question (and reset his password) |
| Authentication K | Olga can influence or alter authentication code/routines so they can be bypassed | Log in with Chris' erased user account (using SQL injection) |
| Session Management K | Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module | View another user’s shopping basket |
| Session Management 10 | Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens (i.e. anti-CSRF tokens) or similar are not being used for actions that change state | Change the name of a user by performing Cross-Site Request Forgery from another origin |
| Authorization 6 | Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point | Put an additional product into another user’s shopping basket |
| Authorization 6 | Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point | View another user’s shopping basket |
| Authorization 7 | Yuanjing can access application functions, objects, or properties he is not authorized to access | Put an additional product into another user’s shopping basket |
| Authorization 7 | Yuanjing can access application functions, objects, or properties he is not authorized to access | View another user’s shopping basket |
| Authorization 8 | Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data | View another user’s shopping basket |
| Authorization 8 | Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data | Put an additional product into another user’s shopping basket |
| Authorization 8 | Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data | Obtain a Deluxe Membership without paying for it |
| Authorization 9 | Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or over-utilizes a feature | Put an additional product into another user’s shopping basket |
| Authorization 9 | Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or over-utilizes a feature | Receive a coupon code from the support chatbot (by asking repeatedly) |
| Authorization 9 | Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or over-utilizes a feature | Give a devastating zero-star feedback to the store (enable the submit button in thte frontend) |
| Authorization 10 | Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions | Put an additional product into another user’s shopping basket |
| Authorization 10 | Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions | View another user’s shopping basket |
| Authorization 10 | Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions | Post a product review as another user or edit any user’s existing review |
| Authorization K | Ryan can influence or alter authorization controls and permissions, and can therefore bypass them | Register as a user with administrator privileges ("email":"admin","password":"admin","role":"admin") |
| Cryptography 10 | Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make | Users registering via Google account will receive a very silly default password that involves Base64 encoding. |
| Cornucopia 9 | Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately | Find the carefully hidden 'Score Board' page (arguably a page not meant to be found) |
| Cornucopia 9 | Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately | Log in with the administrator’s user credentials without previously changing them or applying SQL Injection (pass: admin123) |
| Cornucopia 9 | Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately | Register as a user with administrator privileges ("email":"admin","password":"admin","role":"admin") |
B2B API
Goto: Overview
| Card | Description | Juice Box |
|---|---|---|
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Provoke an error that is neither very gracefully nor consistently handled (and reveal sensitive information) |
| Data Validation 2 | Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code | Use a deprecated B2B interface that was not properly shut down |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Place an order that makes you rich (by using negative numbers) |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Perform a persisted XSS attack bypassing a client-side security mechanism |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Perform a persisted XSS attack without using the frontend application at all (viewable through search) |
| Data Validation 6 | Jason can bypass the centralized validation routines since they are not being used on all inputs | Change the href of the link within the O-Saft product description (through stored Xss) |
| Data Validation 8 | Oana can bypass the centralized sanitization routines since they are not being used comprehensively | Perform a persisted XSS attack bypassing a client-side security mechanism |
| Data Validation 8 | Oana can bypass the centralized sanitization routines since they are not being used comprehensively | Change the href of the link within the O-Saft product description (through stored Xss) |
| Data Validation 8 | Oana can bypass the centralized sanitization routines since they are not being used comprehensively | Perform a persisted XSS attack without using the frontend application at all (viewable through search) |
| Data Validation 10 | Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) | Post some feedback in another user’s name |
| Authorization 3 | Christian can access information, which he should not have permission to, through another mechanism that does have permission (e.g. search indexer, logger, reporting), or because it is cached, or kept for longer than necessary, or through other information leakage | Find the endpoint that serves usage data to be scraped by a popular monitoring system |
| Authorization 8 | Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data | Place an order that makes you rich (by using negative numbers) |
| Authorization 9 | Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or over-utilizes a feature | Submit 10 or more customer feedbacks within 10 seconds |
| Cryptography 10 | Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make | Forge a coupon code that gives you a discount of at least 80% exploits z85 (Zero-MQ Base85 implementation) as the library for coupon codes |
| Cryptography 10 | Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make | Solve challenge #999 requires you to create a valid hash with the hashid library |
| Cornucopia 9 | Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately | Find the endpoint that serves usage data to be scraped by a popular monitoring system |
| Cornucopia 10 | Spyros can circumvent the application's controls because code frameworks, libraries and components contain malicious code or vulnerabilities (e.g. in-house, commercial off the shelf, outsourced, open source, externally-located) | Use a deprecated B2B interface that was not properly shut down |
MarsDB NoSQL DB
Goto: Overview
| Card | Description | Juice Box |
|---|---|---|
| Data Validation 5 | Jee can bypass the centralized encoding routines since they are not being used everywhere, or the wrong encodings are being used | Log in with the administrator’s user account (using SQL injection because of lack of encoding and parameterization) |
| Data Validation K | Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly | Log in with the administrator’s user account (using SQL injection because of lack of encoding and parameterization) |
| Data Validation K | Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly | Exfiltrate the entire DB schema definition via SQL Injection |
| Data Validation K | Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly | Log in with Chris' erased user account (using SQL injection) |
| Data Validation K | Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly | Log in with Jim’s user account (using SQL injection) |
| Cryptography 8 | Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed | Passwords in the Users table are hashed with unsalted MD5 |
| Cryptography 10 | Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make | Passwords in the Users table are hashed with unsalted MD5 |