This lab cannot reach the internet, so a server of your own is not reachable from it. Anything the shop addresses to a host that is not its own is captured here instead, written the way it would have arrived in that server's access log. Nothing is ever actually sent.
Nothing yet.
0 of 21 confirmed
21 real issues are hiding in this shop — the kind that turn up on ordinary engagements. Nothing to submit: exploit one and it confirms itself.
Files a deploy left behind. Always the first thing to look for.
Find the file holding the live database password and API keys.
Sloppy deploys leave the app config in the web root. It is one file, its name starts with a dot, and every framework uses the same one.
Find the leftover install notes and get a set of staff credentials out of them.
Think about what a developer drops in the web root while setting a site up and forgets to delete. A plain text file with a name like install, setup or notes.
Find the staff login. Nothing on the shop links to it.
The file that tells search engines what to skip is a list of the paths the owner did not want found.
Download the backup archive and read what is inside it.
Same idea as the notes file. Backups get written into the web root and left there — try the obvious archive names.
Four different ways into an account that should not be yours.
Sign in to the staff panel without stealing anyone's password.
Before guessing anything clever, try what the software shipped with. The most tired username and the most tired password.
Register a brand new account that comes out with staff rights instead of customer rights.
The site decides who works here by looking at the address you sign up with. Nothing checks that you can actually receive mail there. The company domain is in the leaked config.
Make an ordinary account into an admin by changing what the browser sends.
The signup form sends three fields. The account record holds more than three. Add one the form never sends and see whether the server keeps it.
Get into the staff account from the notes file, without ever entering its one-time code.
Enter the password and stop at the code screen. Do not solve it — go somewhere else on the site by typing the address in yourself, and see whether you are treated as signed in.
The site works out who you are from things you are allowed to change.
Sign in as an ordinary customer, then get the shop to treat you as staff by editing what your browser is holding. No password, and no key.
One of your cookies is three blocks of text with dots between them. The first two are only encoded, not protected — decode them and you will see who the site thinks you are, and what it claims is guarding the token. Change both blocks and hand it back.
Make a properly signed token that the shop accepts as one of its own, for an account that is not yours.
A signature is only worth something while the key behind it is secret. This deploy wrote its key down, in one of the files it left sitting in the web root.
Make the password reset link for an account that is not yours arrive at a server you control, and take the account over with it.
You can read your own mail in the mailbox, but not anybody else's — so the code has to be made to arrive somewhere you can see. The forgotten-password form sends more than the box you can type in: one of its fields decides which site the link in that email points at, and nothing checks that site is this shop. You cannot run a server from in here, so the lab captures anything the shop addresses elsewhere — the collector is linked at the bottom of this panel.
Change somebody else's password using a reset code that was emailed to you.
Ask for a code on your own address first and read it in your mailbox, so the code is honestly yours. Then look at the form you type it into: the code is not the only thing it asks for, and nothing checks that the two belong together.
Get into an account by working through reset codes until one is taken. No mailbox to read, and no link to poison.
Count the digits in a code you have been sent, and work out how many codes that is altogether. Then ask what stops you from sending all of them: a lockout, a delay, a puzzle, a cap on tries? Point a tool at the form, give it every code in that range, and watch for the answer that is not the same size as the rest. Pace it at about 50 a second — the web server in front of the lab drops anything faster, and a dropped request could be the one that worked. That limit is out in the proxy, not in the shop.
The server hands over whatever record number you ask for.
Read an invoice belonging to a different customer.
Open one of your own invoices and look at the number in the address bar. Then change it.
Read the personal details of a customer who is not you.
Your own profile page has your account number in the address. The accounts either side of it belong to somebody.
Nothing is technically broken. The rules are just wrong.
Buy the 1,000.00 laser printer for a fraction of its price.
Look at every field the checkout form sends, including the ones you cannot see on the page. Ask which of them the server should have looked up for itself.
Get more than one discount out of a coupon that is limited to a single use.
The server checks whether you have used it, then takes a moment, then applies it. Send several requests at the same instant so they all pass the check before any of them finishes.
What you type is read as part of a database query.
Get the search box to hand back rows that are not products — customer details the shop never shows to a visitor.
Type a single quote into the search and read the error it gives back. It tells you the shape of the query. Once you can end the quote yourself, you can add a second query to the first — the trick is that both halves must return the same number of columns, and the error keeps telling you when they do not.
Get into the staff panel without knowing any password at all.
The panel builds its login the same careless way the search does. If the password can never be checked, what is left of the check? Ending the username early and commenting out the rest of the line is the classic shape.
Text you supply is put into the page as part of the page.
Leave a review that runs your JavaScript for everyone who opens that product.
Reviews come back onto the product page exactly as they were typed. Ask whether they come back as text, or as part of the page.
Get your JavaScript to run from a search results page — a link you could send to someone.
The shop repeats your search term back to you above the results. Watch how it is written into the page.
Confirm a finding and it appears on your Taghra progress page by itself — nothing to copy, nothing to submit. This shop forgets everything a few hours after you leave; your record over there does not.
Learn these bugs on Taghra — every finding in here is taught in plain language on the Web Attacks path.
Mailbox — this lab cannot send mail, so anything the shop emails a customer is delivered there. You can open your own messages.
Collector — this lab cannot reach the internet, so anything the shop addresses to a server that is not its own is captured there instead.