Challenge:
Name: Retrieve Blueprint
Description: Deprive the shop of earnings by downloading the blueprint for one of its products.
Difficulty: 5 star
Category: Sensitive Data Exposure
Expanded Description: https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html
Read MoreChallenge:
Name: Supply Chain Attack
Description: Inform the development team about a danger to some of their credentials. (Send them the URL of the original report or an assigned CVE or another identifier of this vulnerability)
Difficulty: 5 star
Category: Vulnerable Components
Expanded Description: https://pwning.owasp-juice.shop/part2/vulnerable-components.html
Read MoreChallenge:
Name: Leaked Access Logs
Description: Dumpster dive the Internet for a leaked password and log in to the original user account it belongs to. (Creating a new account with the same password does not qualify as a solution.)
Difficulty: 5 star
Category: Sensitive Data Exposure
Expanded Description: https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html
Read MoreChallenge:
Name: Extra Language
Description: Retrieve the language file that never made it into production.
Difficulty: 5 star
Category: Broken Anti-Automation
Expanded Description: https://pwning.owasp-juice.shop/part2/broken-anti-automation.html
Read MoreChallenge:
Name: Change Bender’s Password
Description: Change Bender’s password into slurmCl4ssic without using SQL Injection or Forgot Password.
Difficulty: 5 star
Category: Broken Authentication
Expanded Description: https://pwning.owasp-juice.shop/part2/broken-authentication.html
Read MoreChallenge:
Name: Two Factor Authentication
Description: Solve the 2FA challenge for user “wurstbrot”. (Disabling, bypassing or overwriting his 2FA settings does not count as a solution)
Difficulty: 5 star
Category: Broken Authentication
Expanded Description: https://pwning.owasp-juice.shop/part2/broken-authentication.html
Read MoreChallenge:
Name: Blockchain Hype
Description: Learn about the Token Sale before its official announcement.
Difficulty: 5 star
Category: Security Through Obscurity
Expanded Description: https://pwning.owasp-juice.shop/part2/security-through-obscurity.html
Read MoreChallenge:
Name: Allowlist Bypass (formerly Whitelist Bypass)
Description: Enforce a redirect to a page you are not supposed to redirect to.
Difficulty: 4 star
Category: Unvalidated Redirects
Expanded Description: https://pwning.owasp-juice.shop/part2/unvalidated-redirects.html
Read MoreChallenge:
Name: GDPR Data Theft
Description: Steal someone else’s personal data without using Injection.
Difficulty: 4 star
Category: Sensitive Data Exposure
Expanded Description: https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html
Read MoreChallenge:
Name: Login Bjoern
Description: Log in with Bjoern’s Gmail account without previously changing his password, applying SQL Injection, or hacking his Google account.
Difficulty: 4 star
Category: Broken Authentication
Expanded Description: https://pwning.owasp-juice.shop/part2/broken-authentication.html
Read More
Curiosity Kills Colby 