Capture the Flag

Your turn. Eight fake companies, eight real bugs. Break in, find the flag (it looks like RCC{...}), and move to the next one. Go in any order.

Before you start Every app here runs right in your browser, so DevTools is the only tool you need. The flags are technically sitting in the source code, but digging them out that way teaches you nothing. Hack the app.
lab_01 TrailMart recon An outdoor gear shop that left a few things lying around. The flag comes in 3 pieces. lab_02 SecureBank sql injection Get into the admin account. You don't know the password, and you won't need it. lab_03 GearShop sql injection The search box only shows products. Make it show you something else. lab_04 InvoiceHub access control You're Jordan, and you can see your own invoices. Whose else can you see? lab_05 SearchBuddy xss Craft a search link that runs JavaScript for whoever clicks it. lab_06 Rowdy Guestbook xss Sign the guestbook with a message that fires for every visitor. lab_07 NetPing command injection A ping tool with a shell behind it. There's a flag.txt on the server. lab_08 MemberZone access control The admin panel says no. Convince it you're someone else.

Need a nudge?

Try for a few minutes before opening these. Getting stuck is part of it.

lab_01 TrailMartEverything from 03-recon: look at the raw page source, the JavaScript it loads, and robots.txt (the app lives at /labs/lab1/).
lab_02 SecureBankWatch the debug query while you type. What does a ' in the username do? How do you make SQL ignore the rest of a line?
lab_03 GearShopWork out how many columns the query returns with ORDER BY, then bolt on a UNION SELECT. SQLite keeps its table list in sqlite_master.
lab_04 InvoiceHubNetwork tab, then reload. Which request loads your invoice? Try other numbers in that URL.
lab_05 SearchBuddyYour search ends up in the URL and gets written to the page with innerHTML. <script> tags won't run there, but event handlers will.
lab_06 Rowdy GuestbookThe name field is handled safely. The message field isn't.
lab_07 NetPingYour input is pasted onto the end of ping -c 2 and run in a shell. How do you tack on a second command?
lab_08 MemberZoneDevTools → Application → Cookies. If a value starts with eyJ, it's base64 JSON.
../07-game-plan ←