Challenge 1: 

Name: Upload Size

Description: Upload a file larger than 100 kB.

Difficulty: 3 star

Category: Improper Input Validation

Challenge 2: 

Name: Upload Type

Description: Upload a file that has no .pdf or .zip extension.

Difficulty: 3 star

Category: Improper Input Validation

Expanded Description: https://pwning.owasp-juice.shop/part2/improper-input-validation.html

Tools used:

Burp, FoxyProxy, Mousepad

Resources used:

None.

Methodology: 

While the number of images in this walkthrough might suggest that this was a difficult challenge, in reality it was mostly just tedious. The first thing I did was log in (I used the admin account, but any account would work) and test out the Complaint form’s parameters. It would only allow two file types: PDF and ZIP. That’s easy enough to circumvent. Simply renaming a text file “filename.txt.zip” is enough to fool this form, but there’s also a 100kb limit involved.

This file is clearly above that limit, so after copying the original to a safe location where it wouldn’t be at risk of destruction if I were to make a mistake, I opened the text file, created a second text file in another tab, and copied over the majority of “db_contents.txt” to that temporary file.

After saving db_contents.txt as a ZIP archive and ensuring that the contents of that file were below the 100KB threshold, I set up Burp to intercept the packet and submitted it via the Complaint form.

Now it was just a case of adding back the original contents of db_contents.txt to the packet and eliminating the .zip file suffix.

Then hitting “Forward”.

Prevention and Mitigation Strategies:

OWASP Mitigation Cheat Sheet

Lessons Learned and Things Worth Mentioning: 

The first time I ever attended a CTF event, the very first flag I ever captured was simply because I knew enough to disregard filetype designators. Opening that .png as a text file gave me the flag, and I’ve never trusted filetypes since. The server here should have learned that lesson.