Skip to content

Øvelse 17 - Active Reconnaissance Juice Shop

Forfatter: Mathias Greisen

Dato: 2026-09-21

Fag/modul: It-sikkerhed i Webapplikationer

Status: Færdig

1. Beskrivelse af øvelsen

Foretag aktiv rekognoscering af JuiceShop applikationen.

2. Reproduktion trin for trin

Forudsætninger

  • Adgang til JuiceShop
  • Nmap
  • GoBuster

Nmap Service Scan

  1. Brug Nmap til at foretage scanning af alle porte for at specificere porte til service scanning:

    nmap -p- -oX allportscan.xml 127.0.0.1

    xml title:"[Resultat](./assets/allportscan.xml)" [...] <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ppp" method="table" conf="3"/></port> <port protocol="tcp" portid="4280"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="vrml-multi-use" method="table" conf="3"/></port> <port protocol="tcp" portid="8025"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ca-audit-da" method="table" conf="3"/></port> <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="https-alt" method="table" conf="3"/></port> <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="sun-answerbook" method="table" conf="3"/></port> [...]

  2. Brug Nmap til at udføre default scripts og version detection, detection:

    nmap -p 3000,4280,8025,8443,8888 -sC -sV -oX servicedetection.xml 127.0.0.1
    [Resultat](./assets/servicedetection.xml)
    [...]
<port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ppp" servicefp="SF-Port3000-TCP:V=7.99%I=7%D=9/11%Time=6AA3DD48%P=x86_64-pc-linux-gnu%r(GetRequest,101B9,&quot;HTTP/1\.1\x20200\x20OK\r\nAccess-Control-Allow-Origin:\x20\*\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20SAMEORIGIN\r\nFeature-Policy:\x20payment\x20&apos;self&apos;\r\nX-Recruiting:\x20/#/jobs\r\nAccept-Ranges:\x20bytes\r\nCache-Control:\x20public,\x20max-age=0\r\nLast-Modified:\x20Fri,\x2011\x20Sep\x202026\x2009:24:23\x20GMT\r\nETag:\x20W/\&quot;124fa-1a08fc84ca3\&quot;\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\nContent-Length:\x2075002\r\nVary:\x20Accept-Encoding\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n&lt;!-&#45;\n\x20\x20~\x20Copyright\x20\(c\)\x202014-2025\x20Bjoern\x20Kimminich\x20&amp;\x20the\x20OWASP\x20Juice\x20Shop\x20contributors\.\n\x20\x20~\x20SPDX-License-Identifier:\x20MIT\n\x20\x20-&#45;&gt;\n\n&lt;!doctype\x20html&gt;\n&lt;html\x20lang=\&quot;en\&quot;\x20data-beasties-container&gt;\n&lt;head&gt;\n\x20\x20&lt;meta\x20charset=\&quot;utf-8\&quot;&gt;\n\x20\x20&lt;title&gt;OWASP\x20Juice\x20Shop&lt;/title&gt;\n\x20\x20&lt;meta\x20name=\&quot;description\&quot;\x20content=\&quot;Probably\x20the\x20most\x20modern\x20and\x20sophisticated\x20insecure\x20web\x20application\&quot;&gt;\n\x20\x20&lt;meta\x20name=\&quot;viewport\&quot;\x20content=\&quot;width=device-width,\x20initial-scale=1\&quot;&gt;\n\x20\x20&lt;link\x20id=\&quot;favicon\&quot;\x20rel=\&quot;icon\&quot;\x20&quot;)%r(Help,2F,&quot;HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n&quot;)%r(NCP,2F,&quot;HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n&quot;)%r(HTTPOptions,EA,&quot;HTTP/1\.1\x20204\x20No\x20Content\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n&quot;)%r(RTSPRequest,EA,&quot;HTTP/1\.1\x20204\x20No\x20Content\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n&quot;);" method="table" conf="3"/>
[...]

    Som vi kan udelade af resultatet, så kører JuiceShop applikationen på port 3000.

Gobuster directory enummeration

  1. Enumerating Juice Shop med Gobuster og common.txt

    gobuster dir -w "/usr/share/seclists/Discovery/Web-Content/common.txt" -u "http://127.0.0.1:3000" -o "Juiceshop_wordlist.txt" --xl "75002" -b "404,500"
    Resultat
    .well-known/security.txt (Status: 200) [Size: 475]
Video                (Status: 200) [Size: 10075518]
assets               (Status: 301) [Size: 156] [--> /assets/]
ftp                  (Status: 200) [Size: 11307]
promotion            (Status: 200) [Size: 6586]
robots.txt           (Status: 200) [Size: 28]
security.txt         (Status: 200) [Size: 475]
video                (Status: 200) [Size: 10075518]

    FTP findes ved "/ftp".

  2. Enumerating Juice Shop with swagger.txt

    gobuster dir -w "/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt" -u "http://127.0.0.1:3000/[path]" -o "Juiceshop_wordlist.txt" -b "404,500"
    Resultat
    api-docs             (Status: 301) [Size: 158] [--> /api-docs/]
api-docs/v1/openapi.json (Status: 200) [Size: 3106]
api/users/current    (Status: 401) [Size: 972]
api/users/login      (Status: 401) [Size: 972]

    Ved besøg til "/api-docs" vises der swagger UI til tests af /orders endpoint. Den viser hvordan dette endpoint skal bruges, f.eks. hvilke parametre der bruges. Dette kan være en usikkerhed, da man med en token kan oprette uendelig mange ordrer.

  3. Enumerating Juice Shop med quickhits.txt

    gobuster dir -w "/usr/share/seclists/Discovery/Web-Content/quickhits.txt" -u "http://127.0.0.1:3000/[path]" -o "Juiceshop_wordlist.txt" -b "404,500"
    Resultat
    metrics              (Status: 200) [Size: 24368]
/api-docs/README.md            (Status: 200) [Size: 1726]
/api/users/               (Status: 401) [Size: 972]

    /metrics giver en masse metrikker over applikationen.

3. Problemer og løsninger

Problem Årsag Løsning
Problemer med at oprette wordlist fil Gobuster overskriver output fil Lavede en liste manuelt fra output

4. Besvarelse af reflekterende spørgsmål

  1. How did the results differ from the crAPI enumeration tasks?

    Disse endpoints gav mere lækket data som nok ikke var intentionen.

  2. Why is it important to repeat these methods across different applications?

    For at kortlægge angrebsfladen og se om man har overset nogle ting som ikke skulle være tilgængelige. Dette skal gøres for hver applikation for at kortlægge alt.

  3. What do these findings suggest about common developer oversights?

    Man glemmer at få fjernet ting fra development stadiet eller at få låst de dele som ikke skal tilgås af alle.

  4. What defenses could help protect against the vulnerabilities you observed?

    Deny by default, for at man skal huske at låse op for ting fremfor at huske at låse.

    Autorization på alle sider undtagen webshoppen.

    Tests af applikationen inden udrulning for at fange det.