Copy of Copy of Copy of Copy of Vertical infinite scroll OG

Identify and exploit weak authentication mechanisms

Business Scenario

Welcome!
Today is your first day as a Cyber Security Analyst at SecureXit.

Today, we received a request from a client to assess the security of their web application's authentication system.

The client wants us to identify weak authentication mechanisms, determine how they could be exploited by an attacker, and recommend security improvements to protect user accounts and sensitive data.

Pre-Lab Preparation

Topic : Common Web Vulnerabilities

1) SQL Injection concepts and examples

2) Cross Site Scripting (XSS)

3) Broken authentication vulnerabilities

4) File upload vulnerabilities

5) Session management issues

Task 1: Test Authentication Security Using Password Guessing

First you have to open browser and search owps juice shop.

Now click on the following link

After that you will get the following interface

Now to get access of the admin account you need to find the admin email address.

You will get the admin email from the review panel.

Now use this email and log in.

Now to get the passward you have use the Password Guessing method

Eg admin123

Now you will get the access of the admin account.

Now to see the administrator panel add this parameter in url https://juice-shop.herokuapp.com/#/administration

After that you will get this panel

Task 2: unprotected admin functionality

Now to get access of the admin account you need to find the admin email address.

Then click on the 1st vulnerability “unprotected admin functionality ”

This lab has an unprotected admin panel.

Solve the lab by deleting the user carlos.

Then click on “access the lab”

After that you will get redirected to this interface.

To solve this lab you have to follow the following steps.

Go to the lab and view robots.txt by appending /robots.txt to the lab URL. Notice that the Disallow line discloses the path to the admin panel

As you can see the administrator-panel is disallowed

So after that we will change the parameter from url.

In the URL bar, replace /robots.txt with /administrator-panel to load the admin panel.

After that you will get the admin panel from this you have to delete the user carlos.

Then the lab will be solved.

Task 3: Unprotected admin functionality with unpredictable URL

Now to solve the next lab “Unprotected admin functionality with unpredictable URL” we have to find the url parameter from the javascript.

To do that we have to follow the following steps

Click on the access the lab

Then you will get the following interface

After that you have to right click on the page and select the “view page source”

Observe that it contains some JavaScript that discloses the URL of the admin panel.

After that you have to insert the following “/admin-mhhecd” parameter in the url .

After that you can access the admin panel

From here delete the user carlos

Then the lab will be solved.

Task 4: User role controlled by request parameter

This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie.
Solve the lab by accessing the admin panel and using it to delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter

Click on the access the lab

Browse to /admin and observe that you can't access the admin panel.

Col 1	Col 2	Col 3
Row 1
Row 2
Row 3

Formula

Profit = Revenue - Cost

Task 2: Create WireFrame

Now that you understand the requirements, don’t jump into coding yet. Before development, we always visualize the layout.

Now lets create a simple wireframe for the homepage.

A wireframe is like a layout plan of a house. Before building, you decide where rooms, doors, and windows will be placed.Similarly, a wireframe helps you plan where elements like headers, images, and buttons will appear on a webpage—before adding design or colours.

Task 3: Code Editor Installation

Good work on completing the planning phase.

Now we will start development. Before that, make sure your system is ready with the required tools.

In this step we will install the VS code editor that will help to Write code efficiently,Organize files , Run and test your application

Go to the visual studio code official website

Click to download Homepage Wireframe : Homepage Wireframe

Link - https://code.visualstudio.com/download

Choose your operating system(windows / Mac) and download the installation file.

Double click on the download app and Accept the agreement and click next

It is a long established fact that a reader will be distracted

Sub Steps

Double click on the download app and Accept the agreement and click next

public class MathSample {
    public static void main(String[] args) {
        int x = 10;
        int y = 20;
        int sum = x + y;
        
        System.out.println("The sum is: " + sum);
    }
}

public class MathSample {
    public static void main(String[] args) {
        int x = 10;
        int y = 20;
        int sum = x + y;
        
        System.out.println("The sum is: " + sum);
    }
}

public class MathSample {
    public static void main(String[] args) {
        int x = 10;
        int y = 20;
        int sum = x + y;
        
        System.out.println("The sum is: " + sum);
    }
}

Great job!
You have successfully completed your first lab on BiteBox Project Onboarding.

In this lab, you have: Understood the BRD, Created a wireframe, Set up your development environment, Organised your project structure, Run your first program

You are now ready to move to the next stage of development

Checkpoint

Next-Lab Preparation

Git Push

git push origin branchName

Topic : Working with a Text and Listin HTML

1) Power of HTML text tags
2) Customizing your style with CSS
3) Listing it right using HTML
4) HTML Link up , attributes of tag, block vs inline elements

Text box Width : 887
Business Scenario, Pre-lab Preparation, Next-lab Preparation, Task, Activity, Checkpoint : 90%.
Steps : 1,2,3 [Sub Steps - a,b,c]
Normal Text, Topic Name : 80%
Subtopic : 70%
Code Box font Size : 16px