14 real issues are hiding in this shop — the kind that turn up on ordinary engagements. Nothing to submit: exploit one and it confirms itself.
Information disclosure 0/4
Files a deploy left behind. Always the first thing to look for.
Environment file served to anyoneHigh
Find the file holding the live database password and API keys.
Stuck? Show a hint
Sloppy deploys leave the app config in the web root. It is one file, its name starts with a dot, and every framework uses the same one.
Deployment notes with working credentialsHigh
Find the leftover install notes and get a set of staff credentials out of them.
Stuck? Show a hint
Think about what a developer drops in the web root while setting a site up and forgets to delete. A plain text file with a name like install, setup or notes.
Admin login page reachable from the internetMedium
Find the staff login. Nothing on the shop links to it.
Stuck? Show a hint
The file that tells search engines what to skip is a list of the paths the owner did not want found.
Site backup downloadableCritical
Download the backup archive and read what is inside it.
Stuck? Show a hint
Same idea as the notes file. Backups get written into the web root and left there — try the obvious archive names.
Broken access control 0/4
Four different ways into an account that should not be yours.
Default credentials on the admin panelCritical
Sign in to the staff panel without stealing anyone's password.
Stuck? Show a hint
Before guessing anything clever, try what the software shipped with. The most tired username and the most tired password.
Staff access granted by email domainCritical
Register a brand new account that comes out with staff rights instead of customer rights.
Stuck? Show a hint
The site decides who works here by looking at the address you sign up with. Nothing checks that you can actually receive mail there. The company domain is in the leaked config.
Account role accepted from the requestCritical
Make an ordinary account into an admin by changing what the browser sends.
Stuck? Show a hint
The signup form sends three fields. The account record holds more than three. Add one the form never sends and see whether the server keeps it.
Second factor can be skippedCritical
Get into the staff account from the notes file, without ever entering its one-time code.
Stuck? Show a hint
Enter the password and stop at the code screen. Do not solve it — go somewhere else on the site by typing the address in yourself, and see whether you are treated as signed in.
Insecure direct object references 0/2
The server hands over whatever record number you ask for.
Another company's invoiceHigh
Read an invoice belonging to a different customer.
Stuck? Show a hint
Open one of your own invoices and look at the number in the address bar. Then change it.
Another customer's profileHigh
Read the personal details of a customer who is not you.
Stuck? Show a hint
Your own profile page has your account number in the address. The accounts either side of it belong to somebody.
Business logic flaws 0/2
Nothing is technically broken. The rules are just wrong.
Price decided by the buyerCritical
Buy the 1,000.00 laser printer for a fraction of its price.
Stuck? Show a hint
Look at every field the checkout form sends, including the ones you cannot see on the page. Ask which of them the server should have looked up for itself.
One-use coupon used many timesHigh
Get more than one discount out of a coupon that is limited to a single use.
Stuck? Show a hint
The server checks whether you have used it, then takes a moment, then applies it. Send several requests at the same instant so they all pass the check before any of them finishes.
Cross-site scripting 0/2
Text you supply is put into the page as part of the page.
Stored script in a product reviewHigh
Leave a review that runs your JavaScript for everyone who opens that product.
Stuck? Show a hint
Reviews come back onto the product page exactly as they were typed. Ask whether they come back as text, or as part of the page.
Script reflected from the search boxMedium
Get your JavaScript to run from a search results page — a link you could send to someone.
Stuck? Show a hint
The shop repeats your search term back to you above the results. Watch how it is written into the page.