This course puts into practice a lot of the concepts we've covered so far. We'll be using a vulnerable website called Juice Shop to solve a variety of challenges. This will give us opportunity to practice what we have learned so far, and also learn about new techniques and new vulnerabilities as well, such as XX vulnerabilities.
Hi, within this lecture, we're going to find the administrator dashboard and try to solve the challenges related with that. So, within the previous lecture, I had said that we have to find this administrator dashboard in order to solve some challenges and I didn't even see it as you can see the first challenge over here is the access the administration section of the store. So, there is definitely an administrator panel and we need to find it and then we can maybe solve the other challenges with using that administrator dashboard, like getting rid of all these 5-star customer feedback as well. So, how can we find it? Of course, we're going to use the same old trick that we have seen in the previous lectures. We're going to go into the JavaScript code and search for the administrator panel, okay? Of course, you can just try it like this like admin or any other thing over there, but maybe it wouldn't work. So, rather than that, rather than guessing it, I'm just going to go into the debugger over here and find the main JavaScript file that we have been working on, okay? And make it pretty. If you haven't done it so, so just hit the 'Ctrl F' to open the find bar and search for admin. So, I'm searching for admin but I don't know if the actual word is admin in this case, I'm just trying to find a path as we have done before, like we have found the scoreboard, right? So there is a lot of the results over here regarding with the admin and administration, as you can see. So, we're going to figure out the path searching for this. There's nothing else we can do over here, and here we go. Now we see the path and as you can see, it says the administration. Of course, we can run a debugger against this as well but it will be a waste of time. So, I'm going to say copy source text and come over here and just delete the search and paste the administration and hit 'Enter' and here we go. Now we are inside of the administration panel and we just solved the challenge. It says that administration section, access the administration panel. So, here we go. Now let's see what we can do in this dashboard. So, we can just close this down and as you can see, we see the customer feedbacks then we see the registered users as well. Maybe we can even delete some users or add some users. We can see there is a juice shop, so this is all very important in a CTF maybe we can just take notes of all of these users, okay? And we can see all the users over here. So, maybe they're kind of deleted, so they are shown in green but maybe it means offline as well, I don't know about that, and let me go to the second page of the users. Yeah, here we go. This is the users that we have created, so this is working fine. Yes, we're in the administration dashboard and here we see the customer feedback and as you can see this is the feedback I believe we have left before with zero stars and one of the challenges, if you might remember it says that get rid of all the 5-star customer feedbacks and here we go. That's very easy, if you come to this point, we can just delete this from here, okay? And here we go. Now we solved a challenge, 5-star feedback, get rid of all 5-star customer feedbacks. We can delete all of the other challenges here as well or we can just click onto them to read about them, but we have solved this over here easily. Great, now we started to solve the second stars as well. I believe it's good for us to just proceed into the 3-stars right now because again, I want to focus on the things that can teach us something, something new and get the opportunity to practice that we have learned before. So, I'm going to just go directly into the 3-stars and maybe along the way we can solve some of the 2-stars or 1-stars that we have left before. Let's do that in the next lecture.
Atil is an instructor at Bogazici University, where he graduated back in 2010. He is also co-founder of Academy Club, which provides training, and Pera Games, which operates in the mobile gaming industry.