Petshop Pro

Easy | Web

ctf url: https://ctf.hacker101.com/ ↗

Flag 1#

• Inspect /cart.
• We see hidden input field containing item details
• POST /checkout content

URL encoded:

cart=%5B%5B0%2C+%7B%22name%22%3A+%22Kitten%22%2C+%22desc%22%3A+%228%5C%22x10%5C%22+color+glossy+photograph+of+a+kitten.%22%2C+%22logo%22%3A+%22kitten.jpg%22%2C+%22price%22%3A+8.95%7D%5D%5D

Decoded JSON array:

;[
  [
    0,
    {
      name: 'Kitten',
      desc: '8"x10" color glossy photograph of a kitten.',
      logo: 'kitten.jpg',
      price: 8.95
    }
  ]
]

• Change item price to 0 in burp or the hidden input field
  we get 1st flag in the checkout page
  

Flag 2#

• Fuzz url to find other pages
• found admin page login at /login
• Bruteforce credentials using hydra or fuzz or burp turbo intruder
• used names.txt ↗ from seclist

Flag 3#

Try XSS in item name

Go to cart