Your basket
Your basket is empty. Browse the catalogue.
Your basket is empty. Browse the catalogue.
0 of 14 confirmed
14 real issues are hiding in this shop — the kind that turn up on ordinary engagements. Nothing to submit: exploit one and it confirms itself.
Files a deploy left behind. Always the first thing to look for.
Find the file holding the live database password and API keys.
Sloppy deploys leave the app config in the web root. It is one file, its name starts with a dot, and every framework uses the same one.
Find the leftover install notes and get a set of staff credentials out of them.
Think about what a developer drops in the web root while setting a site up and forgets to delete. A plain text file with a name like install, setup or notes.
Find the staff login. Nothing on the shop links to it.
The file that tells search engines what to skip is a list of the paths the owner did not want found.
Download the backup archive and read what is inside it.
Same idea as the notes file. Backups get written into the web root and left there — try the obvious archive names.
Four different ways into an account that should not be yours.
Sign in to the staff panel without stealing anyone's password.
Before guessing anything clever, try what the software shipped with. The most tired username and the most tired password.
Register a brand new account that comes out with staff rights instead of customer rights.
The site decides who works here by looking at the address you sign up with. Nothing checks that you can actually receive mail there. The company domain is in the leaked config.
Make an ordinary account into an admin by changing what the browser sends.
The signup form sends three fields. The account record holds more than three. Add one the form never sends and see whether the server keeps it.
Get into the staff account from the notes file, without ever entering its one-time code.
Enter the password and stop at the code screen. Do not solve it — go somewhere else on the site by typing the address in yourself, and see whether you are treated as signed in.
The server hands over whatever record number you ask for.
Read an invoice belonging to a different customer.
Open one of your own invoices and look at the number in the address bar. Then change it.
Read the personal details of a customer who is not you.
Your own profile page has your account number in the address. The accounts either side of it belong to somebody.
Nothing is technically broken. The rules are just wrong.
Buy the 1,000.00 laser printer for a fraction of its price.
Look at every field the checkout form sends, including the ones you cannot see on the page. Ask which of them the server should have looked up for itself.
Get more than one discount out of a coupon that is limited to a single use.
The server checks whether you have used it, then takes a moment, then applies it. Send several requests at the same instant so they all pass the check before any of them finishes.
Text you supply is put into the page as part of the page.
Leave a review that runs your JavaScript for everyone who opens that product.
Reviews come back onto the product page exactly as they were typed. Ask whether they come back as text, or as part of the page.
Get your JavaScript to run from a search results page — a link you could send to someone.
The shop repeats your search term back to you above the results. Watch how it is written into the page.