Hey, guys, welcome back to another episode on How to Hack.
So over here, we're back to the ASPE Open Web Application Security Project, Juice Shop.
So this is a vulnerable Web application server in which we can test all our different ways of injection
to gain access into the site, looking at different ways of manipulating and controlling the site.
So we have gone through a lot of demonstration tutorials on this e-commerce web application penetration
testing series.
So quickly join as a member so that you gain access to full flash videos on practicals, as well as
lectures about how you can do web application penetration testing.
So back to the demonstration and Gitari for you today.
We can go ahead and click under a.
OK, so I'm going to introduce to you a couple of things that is going to be very important as part
of learning Web application penetration testing.
So the first thing you want to do is you want to examine the site and how do you do that?
How you could do that is go to the top right corner.
So better on Firefox or better Chrome or any browser.
So what we want to do is to be able to inspect what is going on as we navigate across the entire Web
application server.
So go to top right corner, click on the web developer, OK?
And then you click on, say, for example, under network.
So I'm going to click on Network and I'm going to zoom in a little more so it's easier for you to see.
OK, so we click on Not Yet a customer and over here will be presented with a user registration page.
And of course we can immediately see that we get API application programming interfaces running as part
of the Web application server.
All right.
So we can go ahead and do a registration.
All right.
So please provide an email address.
Let me enter, say, for example, a user email address.
So I'm just going to Keun some email address so you can just go ahead and test it out and we will enter
the password as a particular password.
I'm going to tell the password so that you can make a guess about what we are entering and then you
begin to appreciate how we are monitoring the network.
Data is being sent in and out of the Web application server.
And as we scroll down further.
All right.
So do you have security questions?
I'm going to click on say Modarres made his name.
All right.
So I'll just enter, for example, Lioy.
OK, so once we're done, go ahead and click on register.
All right.
So once we click on register, is is registration completed successfully?
You can now log in.
OK, so we got all of that done.
And of course, you can see over here that we have different kind of methods.
So we got get as well as post.
So we've posted information or data into the server and get meaning that we pull information out directly
from the system.
OK, so click on, say, API users and we can click under the requests.
So requests is the information that we are actually sending over.
And of course we can see the response.
All right, so he says ID number 18.
So this is an interesting role.
So behind every Web application server, behind every mobile application, they have a huge database.
So it's like an Excel sheet.
All right.
So it is a D column and row structure for them to store data.
So data like text format are very, very easy to be stored on MySQL, Pastorale Squirrelled, Microsoft
and so on.
So those already relational databases that help us store all this data, all this information in a very
structured format, especially for tax base information.
So that's why we are moving a lot of big enterprises, big Web application servers and moving all those
into not only SQL databases like Mongo DB that we have done a demonstration on earlier.
So overstressing information about ID.
So again, this could be one of those information that could help us understand about the structure
of the database.
So we have ID 18 and most of the time IDs are primary key to their unique identifier in a table, in
site, a table.
So in this case there is a very high chance that we have one seven more uses before this account.
OK, so we may have one several more uses before this account, even create another account on the registration
page.
We may look at ID 19 and that would validate our assumption.
OK, so moving back, we can go under account and we can try to log in to the website with a newly created
account.
OK, so let's go ahead.
Entered today, Loy Yang, Young at heart, Milkha and of course I entered a password and I can go ahead
and click on Remember Me and I can click on login.
OK, so once we're in.
Of course, we can see a lot more information coming from the network tap on the web developer, so
we have like who am I?
We got Log-in.
We could all these different information.
OK, so we see again beat.
All right.
So you see a bit number six and we have to you mail and of course I can click on Who am I.
Again, we are looking at 18.
So this is the primary key of the table, helping us uniquely identify the user who is logged in now
and also as a way for the table to uniquely identify users who are logging in and out of the system.
OK, so we also got as separate application programming, interface quantities.
And of course we can see the idea of the quantities or we can look at all this different information
and this could be information directly available being pulled out from a table that actually stores
all these different products.
OK, so we are seeing all those different information coming out directly from the Web application.
So, for example, if I click on, say, one of the items, right.
So let's say I click on a couple of the items I click on, say, APJ click ET to basket.
All right.
And of course, we can see information being sent again.
I could click a separate item, add to basket again.
We're seeing all those details being sent over.
So here we can see these requests and a response.
So in response case, we can see success.
So we successfully added the item onto the system and we could see coupon, we could see use ID and
all those different information.
And again, we are able to see all these different details.
And we got API game application programming interface for basket items.
All right.
So we got ID number 10.
All right.
We got product ID, we got a quantity, OK?
And we got two separate basket items.
So again, it's 11.
All right.
And we have product ID, we have basket ID, we have quantity and all those different data and information.
So moving to the top right corner, we go back to your basket.
OK, let's go ahead and click on that.
And we see a retrieval, we see retrieval of the ID, all right, and we can see the structure or we
can see the structure of a shopping cart.
So we see all this different information, the description, the data, the pricing, the quantity and
all this different data.
So we can, in a way, map out how the tables operate for shopping cart, how the tables look like in
holidae or interlinked.
OK, so the next thing I want to demonstrate to you to share with you is to click under storage inspector.
So go ahead and click on that.
And we have storage inspector over here.
So, of course, we have cookies, information, and we can actually go under SACHEEN Storage and we
have the specific IP address.
And in this case, I'm hosting the IP address internally on one or two one six eight zero one zero on
point three thousand.
So click on that and we can see the bit number.
OK, so the bit number could be the shopping cart ID that is being stored in the server.
So if I change this, for example, to a lower number.
All right.
Because it seems like they're using additional of one every time there is a new user, every time there
is a new shopping cart.
That could be the case.
That could be the logic behind the scene.
So if I go ahead and click on, say, five and I hit enter on that, I go back to the Web page.
OK, so in this case, we have to produce one quantity.
We have Apple, Pomi said one quantity.
So if I do a refresh and I would see over here we have two quantity.
OK, so what if we change the value of this to one?
So one could be the first shopping cart.
OK, so if I do a refresh again.
And we can see somebody else's shopping cart, so this shopping cart is the first on the list of someone
else's account.
OK, so this could be one of those ways in which we can access other people's personal information out
of people to profile their shopping cart and many others.
So by understanding the basic structure of how we could manipulate the sash and storage information,
how we could look at the data is coming in and out, we'll be able to change those data change tools,
value giving us access to personal information, sensitive data.
And those information could be critical details.
There could be date of birth of the person, your home address and all this different data could be
accessed on and truly Web applications of it.
So with that, I hope you learned something valuable in today's tutorial.
And if I have any questions, feel free to leave a comment below and I'll try my best to answer any
of your questions.
So stay tuned for many more Web application penetration testing series.
And we'll try our best to share as much as we can because thank you so much once again for watching.