diff --git a/config/fbctf.yml b/config/fbctf.yml index f885edd7497..92f79dedea5 100644 --- a/config/fbctf.yml +++ b/config/fbctf.yml @@ -260,6 +260,6 @@ ctf: privacyPolicyProofChallenge: name: Namibia code: NA - dryRegistrationChallenge: + passwordRepeatChallenge: name: Guyana code: GY diff --git a/data/static/challenges.yml b/data/static/challenges.yml index 58baf47004e..6f0da77dea5 100644 --- a/data/static/challenges.yml +++ b/data/static/challenges.yml @@ -680,10 +680,10 @@ hintUrl: 'https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-through-obscurity.html#prove-that-you-actually-read-our-privacy-policy' key: privacyPolicyProofChallenge - - name: 'User Registration' + name: 'Repetitive Registration' category: 'Improper Input Validation' - description: 'Register but "Don''t Repeat Yourself".' + description: 'Follow the DRY principle while registering a user.' difficulty: 1 - hint: 'Avoid any repetitive tasks during user registration.' - # hintUrl: '' - key: dryRegistrationChallenge + hint: 'You can solve this by cleverly interacting with the UI or bypassing it altogether.' + # hintUrl: 'https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/improper-input-validation.html#follow-the-dry-principle-while-registering-a-user' + key: passwordRepeatChallenge diff --git a/routes/verify.js b/routes/verify.js index 7c99054c92f..9f0a79a43ad 100644 --- a/routes/verify.js +++ b/routes/verify.js @@ -43,10 +43,10 @@ exports.registerAdminChallenge = () => (req, res, next) => { next() } -exports.dryRegistrationChallenge = () => (req, res, next) => { - if (utils.notSolved(challenges.dryRegistrationChallenge)) { +exports.passwordRepeatChallenge = () => (req, res, next) => { + if (utils.notSolved(challenges.passwordRepeatChallenge)) { if (req.body && req.body.passwordRepeat !== req.body.password) { - utils.solve(challenges.dryRegistrationChallenge) + utils.solve(challenges.passwordRepeatChallenge) } } next() diff --git a/server.js b/server.js index 161b46512ff..38ff10f7584 100644 --- a/server.js +++ b/server.js @@ -222,7 +222,7 @@ app.post('/api/Feedbacks', captcha.verifyCaptcha()) app.post('/api/Feedbacks', verify.captchaBypassChallenge()) /* User registration challenge verifications before finale takes over */ app.post('/api/Users', verify.registerAdminChallenge()) -app.post('/api/Users', verify.dryRegistrationChallenge()) +app.post('/api/Users', verify.passwordRepeatChallenge()) /* Unauthorized users are not allowed to access B2B API */ app.use('/b2b/v2', insecurity.isAuthorized()) /* Add item to basket */ diff --git a/test/e2e/registerSpec.js b/test/e2e/registerSpec.js index 6bddaa318eb..114cd45e5b6 100644 --- a/test/e2e/registerSpec.js +++ b/test/e2e/registerSpec.js @@ -49,7 +49,7 @@ describe('/#/register', () => { protractor.expect.challengeSolved({ challenge: 'Admin Registration' }) }) - describe('challenge "dryRegistration"', () => { + describe('challenge "passwordRepeat"', () => { it('should be possible to register user without repeating the password', () => { browser.executeScript(() => { var xhttp = new XMLHttpRequest()