diff --git a/config/fbctf.yml b/config/fbctf.yml
index f885edd7497..92f79dedea5 100644
--- a/config/fbctf.yml
+++ b/config/fbctf.yml
@@ -260,6 +260,6 @@ ctf:
privacyPolicyProofChallenge:
name: Namibia
code: NA
- dryRegistrationChallenge:
+ passwordRepeatChallenge:
name: Guyana
code: GY
diff --git a/data/static/challenges.yml b/data/static/challenges.yml
index 58baf47004e..6f0da77dea5 100644
--- a/data/static/challenges.yml
+++ b/data/static/challenges.yml
@@ -680,10 +680,10 @@
hintUrl: 'https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-through-obscurity.html#prove-that-you-actually-read-our-privacy-policy'
key: privacyPolicyProofChallenge
-
- name: 'User Registration'
+ name: 'Repetitive Registration'
category: 'Improper Input Validation'
- description: 'Register but "Don''t Repeat Yourself".'
+ description: 'Follow the DRY principle while registering a user.'
difficulty: 1
- hint: 'Avoid any repetitive tasks during user registration.'
- # hintUrl: ''
- key: dryRegistrationChallenge
+ hint: 'You can solve this by cleverly interacting with the UI or bypassing it altogether.'
+ # hintUrl: 'https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/improper-input-validation.html#follow-the-dry-principle-while-registering-a-user'
+ key: passwordRepeatChallenge
diff --git a/routes/verify.js b/routes/verify.js
index 7c99054c92f..9f0a79a43ad 100644
--- a/routes/verify.js
+++ b/routes/verify.js
@@ -43,10 +43,10 @@ exports.registerAdminChallenge = () => (req, res, next) => {
next()
}
-exports.dryRegistrationChallenge = () => (req, res, next) => {
- if (utils.notSolved(challenges.dryRegistrationChallenge)) {
+exports.passwordRepeatChallenge = () => (req, res, next) => {
+ if (utils.notSolved(challenges.passwordRepeatChallenge)) {
if (req.body && req.body.passwordRepeat !== req.body.password) {
- utils.solve(challenges.dryRegistrationChallenge)
+ utils.solve(challenges.passwordRepeatChallenge)
}
}
next()
diff --git a/server.js b/server.js
index 161b46512ff..38ff10f7584 100644
--- a/server.js
+++ b/server.js
@@ -222,7 +222,7 @@ app.post('/api/Feedbacks', captcha.verifyCaptcha())
app.post('/api/Feedbacks', verify.captchaBypassChallenge())
/* User registration challenge verifications before finale takes over */
app.post('/api/Users', verify.registerAdminChallenge())
-app.post('/api/Users', verify.dryRegistrationChallenge())
+app.post('/api/Users', verify.passwordRepeatChallenge())
/* Unauthorized users are not allowed to access B2B API */
app.use('/b2b/v2', insecurity.isAuthorized())
/* Add item to basket */
diff --git a/test/e2e/registerSpec.js b/test/e2e/registerSpec.js
index 6bddaa318eb..114cd45e5b6 100644
--- a/test/e2e/registerSpec.js
+++ b/test/e2e/registerSpec.js
@@ -49,7 +49,7 @@ describe('/#/register', () => {
protractor.expect.challengeSolved({ challenge: 'Admin Registration' })
})
- describe('challenge "dryRegistration"', () => {
+ describe('challenge "passwordRepeat"', () => {
it('should be possible to register user without repeating the password', () => {
browser.executeScript(() => {
var xhttp = new XMLHttpRequest()