>Sidebar >Compliant> Message: Testing
>Invoice: Choose file > baddy.txt> Nope > ONLY pdf or zip
>Upload baddy.zip > That seems to have worked. With no errors.
Check Burp > Proxy > HTTP history > ENTRY http://localhost:3000/file-upload
>Send to Repeater > made changes
-Content-Disposition: form-data; name=”file”; filename=”baddy.txt”
-Content-Type: application/txt
>Successful Challenge > Successfully uploaded a txt file.
See another customer’s basket
>Check Burp > ENTRY http://localhost:3000/rest/basket/1
-IDOR?
>Edit to ../basket/2 > Successful Challenge
JWT Token for admin@juice-sh.op
{“status”:”success”,”data”:{“id”:1,”username”:””,”email”:”admin@juice-sh.op”,”password”:”0192023a7bbd73250516f069df18b500″,”role”:”admin”,”deluxeToken”:””,”lastLoginIp”:””,”profileImage”:”assets/public/images/uploads/defaultAdmin.png”,”totpSecret”:””,”isActive”:true,”createdAt”:”
>Password looks like a hash
>Visit Crackstation.net and paste in the hash. MATCH: admin123
>Login as admin with password admin123 > Successful Challenge > Password Strength