Challenge: 

Name: Leaked Unsafe Product

Description: Identify an unsafe product that was removed from the shop and inform the shop which ingredients are dangerous.

Difficulty: 4 star

Category: Sensitive Data Exposure

Expanded Description: https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html

Tools used:

None.

Resources used:

Database Schema

Methodology: 

Obviously the first step in this challenge is to determine what the unsafe product is/was. The extracted contents of the site database’s Product table (specifically the deletedAt column) ensured that this step required only a trivial amount of time to complete.

The product description for the Rippertuer Special Juice reads “Contains a magical collection of the rarest fruits gathered from all around the world, like Cherymoya Annona cherimola, Jabuticaba Myrciaria cauliflora, Bael Aegle marmelos… and others, at an unbelievable price! <br />This item has been made unavailable because of lack of safety standards. (This product is unsafe! We plan to remove it from the stock!) “. By googling the listed fruit names, I was sent to a Pastebin page which contained descriptions of each ingredient, including the hazards posed by two of the fruits.

OSINT research completed, then it was simply a matter of informing the store of the hazard posed by their admittedly unsafe and recalled product.

Lessons Learned and Things Worth Mentioning: 

Extracting the contents of the database using sqlmap was, by a wide margin, the most useful thing I could have done during the Database Schema challenge. It has been useful in a huge number of challenges, and tackling this challenge without completing and expanding on that one would have been a nightmare.