Pwning OWASP’s Juice Shop Pt. 8: Missing Encoding

Challenge: 

Name: Missing Encoding

Description: Retrieve the photo of Bjoern’s cat in “melee combat-mode”.

Difficulty: 1 star

Category: Improper Input Validation

Expanded Description: https://pwning.owasp-juice.shop/part2/improper-input-validation.html

Tools used:

None.

Resources used:

URL Encoding table: https://www.eso.org/~ndelmott/url_encode.html

Emoji use in filename: https://www.howtogeek.com/682868/%E2%9C%A8-you-can-use-emoji-in-file-names-on-windows-10/#:~:text=This%20is%20easy%20thanks%20to,file%20to%20open%20the%20picker.

Methodology: 

First thing’s first, I went to the site’s Photo Wall to see what was there.

Photo Wall 
#zatschi #whoneedsfourlegs

It looks like all but one photo are loading properly, obviously leaving the photo of kitty combat. Since the challenge is named “Missing Encoding”, it’s now time to inspect the page’s code to see what makes this photo different than the others.

<img src="https://curiositykillscolby.files.wordpress.com/2020/11/image.jpeg?w=525&quot; alt="• <div • <div ng-star-inserted" • espan nat-eIevation-z6 ng-star-inserted" ngcontent -opt -c 219=1' ngcontent-opf-c219=" " src=" assets/ oublic / -*zatschi -#wh oneeds four legz= 1572688969477 jag" alt="" #zatschi • :before •

After comparing the filenames of the missing photo with the four which loaded as intended, there were two things which stood out to me: 1. Who uses emojis in filenames? Is that even a thing? 2. Those hashes should probably be URL encoded.

While I knew there would be a way to figure out the emoji encoding, I also knew that the hashes were low hanging fruit. After finding a URL encoding table and finding the code for ‘#’, I swapped out the two hashes in the code to see if that was enough. I really didn’t want to have to dig into encoding an emoji, since that was definitely going to take more legwork.

<img src="https://curiositykillscolby.files.wordpress.com/2020/11/image-1.jpeg?w=528&quot; alt="• <div • <liv ng-star-inserted" • espan mat-elevation-z6 ng-star-inserted" ngcontent -opt -c219=" n content-o f-c219="" – *23zatschi – *23whoneedsfourIegs -1572688969477. jpg' #zatschi ngcontent-opf-c219="

Now to check the page…

Photo Wall
That’s one fearsome beast. I hope Bjoern keeps it locked up tight, lest it be unleashed on society.
You successfully solved a challenge: Missing Encoding (Retrieve the photo of Bjoern's cat in "melee combat-mode".) 
x
Success!

Prevention and mitigation strategies:

Validate inputs. They only work if they are properly URL encoded.

Lessons Learned: 

  1. Emojis are encodable for filenames and URLs.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s