Client Side | Client Side Filtering (3) | Cycubix Docs

No need to pay if you know the code …​


  • Let's intercept the request with ZAP and see what we can find about the checkout code.

  • If we open the developer tools we will see that there are some checkout code's but they do not work.

package org.owasp.webgoat.lessons.clientsidefiltering;
import org.owasp.webgoat.container.assignments.AssignmentEndpoint; import org.owasp.webgoat.container.assignments.AssignmentHints; import org.owasp.webgoat.container.assignments.AttackResult; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.RestController;
@author nbaars
@since 4/6/17. */ @RestController @AssignmentHints({ "", "", "" }) public class ClientSideFilteringFreeAssignment extends AssignmentEndpoint {
public static final String SUPER_COUPON_CODE = "get_it_for_free";
@PostMapping("/clientSideFiltering/getItForFree") @ResponseBody public AttackResult completed(@RequestParam String checkoutCode) { if (SUPER_COUPON_CODE.equals(checkoutCode)) { return success(this).build(); } return failed(this).build(); } }
  • We can see there is a SUPER_COUPON_CODE="get_it_for_free".

Last updated