From 3f821d2ccc0cbcd5ea79e8dafc14da72f01d8e51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Kimminich?= Date: Wed, 15 Feb 2023 12:50:09 +0000 Subject: [PATCH 001/161] =?UTF-8?q?New=20translations=20en.json=20(Bengali?= =?UTF-8?q?)=20[ci=20skip]=20Signed-off-by:=20Bj=C3=B6rn=20Kimminich=20?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- frontend/src/assets/i18n/bn_BD.json | 418 ++++++++++++++++++++++++++++ 1 file changed, 418 insertions(+) create mode 100644 frontend/src/assets/i18n/bn_BD.json diff --git a/frontend/src/assets/i18n/bn_BD.json b/frontend/src/assets/i18n/bn_BD.json new file mode 100644 index 00000000000..2e30934f10a --- /dev/null +++ b/frontend/src/assets/i18n/bn_BD.json @@ -0,0 +1,418 @@ +{ + "LANGUAGE": "English", + "NAV_SEARCH": "Search", + "SEARCH_PLACEHOLDER": "Search...", + "NAV_COMPLAIN": "Complaint", + "TITLE_LOGIN": "Login", + "MANDATORY_EMAIL": "Please provide an email address.", + "MANDATORY_PASSWORD": "Please provide a password.", + "LABEL_EMAIL": "Email", + "LABEL_PASSWORD": "Password", + "SHOW_PASSWORD_ADVICE": "Show password advice", + "LOWER_CASE_CRITERIA_MSG": "contains at least one lower character", + "UPPER_CASE_CRITERIA_MSG": "contains at least one upper character", + "DIGITS_CRITERIA_MSG": "contains at least one digit", + "SPECIAL_CHARS_CRITERIA_MSG": "contains at least one special character", + "MIN_CHARS_CRITERIA_MSG": "contains at least {{value}} characters", + "BTN_LOGIN": "Log in", + "BTN_GOOGLE_LOGIN": "Log in with Google", + "REMEMBER_ME": "Remember me", + "NO_CUSTOMER": "Not yet a customer?", + "ALREADY_A_CUSTOMER": "Already a customer?", + "TITLE_REGISTRATION": "User Registration", + "INVALID_EMAIL": "Email address is not valid.", + "SECURITY_ANSWER": "Answer", + "MANDATORY_PASSWORD_REPEAT": "Please repeat your password.", + "INVALID_PASSWORD_LENGTH": "Password must be {{length}} characters long.", + "LABEL_PASSWORD_REPEAT": "Repeat Password", + "PASSWORDS_NOT_MATCHING": "Passwords do not match", + "BTN_REGISTER": "Register", + "CONFIRM_REGISTER": "Registration completed successfully. You can now log in.", + "TITLE_LOGOUT": "Logout", + "CONFIRM_LOGGED_OUT": "You have been logged out.", + "TITLE_CONTACT": "Contact", + "MANDATORY_COMMENT": "Please provide a comment.", + "INVALID_COMMENT_LENGTH": "Comment length must be {{length}} characters.", + "MAX_TEXTAREA_LENGTH": "Max. {{length}} characters", + "MANDATORY_RATING": "Please provide a rating.", + "MANDATORY_CAPTCHA": "Please enter the result of the CAPTCHA.", + "INVALID_CAPTCHA": "Invalid CAPTCHA code", + "LABEL_AUTHOR": "Author", + "LABEL_COMMENT": "Comment", + "LABEL_RATING": "Rating", + "LABEL_WHAT_IS": "What is", + "BTN_SUBMIT": "Submit", + "TITLE_ABOUT": "About Us", + "SECTION_CORPORATE_HISTORY": "Corporate History & Policy", + "SECTION_CUSTOMER_FEEDBACK": "Customer Feedback", + "SECTION_SUPPORT_CHAT": "Support Chat", + "LABEL_POWERED_BY_CHATBOT": "powered by {{chatbot}}", + "ASK_ME_ANYTHING_PLACEHOLDER": "Ask me anything in English", + "SECTION_SOCIAL_MEDIA": "Follow us on Social Media", + "LINK_TERMS_OF_USE": "Check out our boring terms of use if you are interested in such lame stuff.", + "TITLE_ADMINISTRATION": "Administration", + "SECTION_USER": "Registered Users", + "LABEL_USER": "User", + "LABEL_CREATED_AT": "Created at", + "LABEL_UPDATED_AT": "Updated at", + "BTN_CLOSE": "Close", + "TITLE_SEARCH_RESULTS": "Search Results", + "TITLE_ALL_PRODUCTS": "All Products", + "BASKET_ADD_SAME_PRODUCT": "Added another {{product}} to basket.", + "BASKET_ADD_PRODUCT": "Placed {{product}} into basket.", + "LABEL_PRODUCT": "Product", + "LABEL_PRODUCT_ORDERED": "Ordered products", + "LABEL_EXPECTED_DELIVERY": "Expected Delivery", + "LABEL_DAYS": "Days", + "LABEL_NAME": "Name", + "LABEL_DESCRIPTION": "Description", + "LABEL_PRICE": "Price", + "LABEL_BONUS": "Bonus", + "LABEL_IMAGE": "Image", + "TITLE_BASKET": "Your Basket", + "LABEL_QUANTITY": "Quantity", + "LABEL_TOTAL_PRICE": "Total Price", + "CHECKOUT_FOR_BONUS_POINTS": "You will gain {{bonus}} Bonus Points from this order!", + "BTN_CHECKOUT": "Checkout", + "BTN_CREDIT_CARD": "Credit Card", + "INVALID_COUPON_LENGTH": "Coupon code must be {{length}} characters long.", + "INVALID_COUPON": "Invalid coupon.", + "LABEL_COUPON": "Coupon", + "FOLLOW_FOR_MONTHLY_COUPONS": "Need a coupon code? Follow us on Twitter or Facebook for monthly coupons and other spam!", + "BTN_REDEEM": "Redeem", + "THANKS_FOR_SUPPORT": "Thank you for supporting {{juiceshop}}!", + "THANKS_FOR_SUPPORT_CUSTOMIZED": "Thank you for supporting the open source project behind {{appname}}!", + "LABEL_PAYMENT": "Payment", + "LABEL_DONATIONS": "Donations", + "LABEL_MERCHANDISE": "Merchandise", + "OFFICIAL_MERCHANDISE_STORES": "Official stores for {{juiceshop}} apparel, mugs and stickers!", + "OFFICIAL_MERCHANDISE_STORES_CUSTOMIZED": "Official stores for apparel, mugs and stickers of the open source project behind {{appname}}!", + "DISCOUNT_APPLIED": "Your discount of {{discount}}% will be applied during checkout.", + "TITLE_CHANGE_PASSWORD": "Change Password", + "MANDATORY_CURRENT_PASSWORD": "Please provide your current password.", + "MANDATORY_NEW_PASSWORD": "Please provide your new password.", + "LABEL_CURRENT_PASSWORD": "Current Password", + "LABEL_NEW_PASSWORD": "New Password", + "LABEL_REPEAT_NEW_PASSWORD": "Repeat New Password", + "BTN_CHANGE": "Change", + "LABEL_CAPTCHA": "CAPTCHA", + "ENTER_CAPTCHA": "Enter CAPTCHA", + "TITLE_COMPLAIN": "File Complaint", + "MANDATORY_MESSAGE": "Please provide a text.", + "INVALID_MESSAGE_LENGTH": "Text length must be {{length}} characters.", + "INVALID_FILE_SIZE": "File too large. Maximum {{size}} allowed.", + "INVALID_FILE_TYPE": "Forbidden file type. Only {{type}} allowed.", + "LABEL_CUSTOMER": "Customer", + "LABEL_MESSAGE": "Message", + "LABEL_INVOICE": "Invoice", + "TITLE_SCORE_BOARD": "Score Board", + "LABEL_DIFFICULTY": "Difficulty", + "LABEL_CATEGORY": "Category", + "LABEL_TAGS": "Tags", + "LABEL_CHALLENGES": "Challenges", + "LABEL_STATUS": "Status", + "STATUS_UNSOLVED": "unsolved", + "STATUS_SOLVED": "solved", + "STATUS_UNAVAILABLE": "unavailable", + "CALL_FOR_CONTRIBUTIONS": "Got an idea for a new challenge? Found a vulnerability that is not tracked here? Let us know via Gitter.im community chat or by opening a GitHub issue!", + "CALL_FOR_FEEDBACK": "Please help us to make {{appname}} even better for you by answering our user questionaire!", + "CHALLENGE_SOLVED": "You successfully solved a challenge: {{challenge}}", + "INVALID_CONTINUE_CODE": "Invalid continue code.", + "CONFIRM_LOGGED_IN_VIA_OAUTH2": "You have been logged in via OAuth 2.0 provider.", + "HOME_LINK_MESSAGE": "If you are not automatically redirected, please click here: {{home}}", + "TITLE_BITCOIN_ADDRESS": "Bitcoin Address", + "TITLE_DASH_ADDRESS": "Dash Address", + "TITLE_ETHER_ADDRESS": "Ether Address", + "NOTIFICATION_RESEND_INSTRUCTIONS": "Click to repeat the notification containing the solution-code for this challenge.", + "COPY_TO_CLIPBOARD": "Copy to clipboard", + "COPY_SUCCESS": "Copied!", + "NAV_RECYCLE": "Recycle", + "TITLE_RECYCLE": "Request Recycling Box", + "LABEL_REQUESTOR": "Requestor", + "LABEL_RECYCLE_QUANTITY": "Quantity", + "LABEL_DELIVERY_ADDRESS": "Delivery Address", + "LABEL_PICKUP_ADDRESS": "Pickup Address", + "INVALID_ADDRESS_LENGTH": "Address length must be {{length}} characters.", + "INVALID_QUANTITY": "Quantity must be {{range}} liters.", + "MANDATORY_ADDRESS": "Please provide an address.", + "MANDATORY_QUANTITY": "Please provide a quantity.", + "IN_LITERS_PLACEHOLDER": "...in liters", + "REQUEST_PICKUP": "Please pickup at above address instead of sending a recycle box.", + "LABEL_PICKUP_DATE": "Pickup Date", + "SECTION_RECYCLING": "Recycling Requests", + "LABEL_ADDRESS": "Address", + "SECTION_PRESS_JUICE_RESPONSIBLY": "You hug trees. We save money. Win-win!", + "LABEL_SECURITY_QUESTION": "Security Question", + "CANNOT_BE_CHANGED_LATER": "This cannot be changed later!", + "MANDATORY_SECURITY_QUESTION": "Please select a security question.", + "MANDATORY_SECURITY_ANSWER": "Please provide an answer to your security question.", + "FORGOT_PASSWORD": "Forgot your password?", + "TITLE_FORGOT_PASSWORD": "Forgot Password", + "NOTIFICATION_SERVER_STARTED": "The server has been restarted", + "AUTO_RESTORED_PROGRESS": "Your previous hacking progress has been restored automatically.", + "AUTO_RESTORE_PROGRESS_FAILED": "Restoring your previous hacking progress failed: {{error}}", + "RESET_HACKING_PROGRESS": "Delete cookie to clear hacking progress", + "RESTART_REQUIRED": "You now have to manually restart the application to start over!", + "LABEL_EDIT_REVIEW": "Edit Review", + "LABEL_REVIEW": "Review", + "LABEL_REVIEWS": "Reviews", + "LABEL_ADD_REVIEW_FOR_PRODUCT": "Add a review for this product", + "LABEL_NO_REVIEWS": "No Reviews", + "TITLE_TOKENSALE": "Token Sale", + "SECTION_ICO": "Initial Coin Offering for {{juicycoin}}", + "ICO_FAQ": "FAQ about our ICO", + "SECTION_WHITEPAPER": "Whitepaper", + "WHITEPAPER_REFERENCES": "Instead of reinventing the square coin, we just refer to existing brilliant whitepapers!", + "SECTION_SALES_PITCH": "Convincing ICO Sales Pitch", + "GIVE_US_ALL_YOUR_MONEY": "Give us all your money.", + "ICO_FAQ_QUESTION": "Can I really get rich with {{juicycoin}}?", + "ICO_FAQ_ANSWER": "Of course you can! We would never lie to you!", + "TITLE_TRACK_ORDERS": "Track Orders", + "LABEL_ORDER_ID": "Order ID", + "BTN_TRACK": "Track", + "LAST_LOGIN_IP": "Last Login IP", + "BTN_EDIT": "Edit", + "INVALID_DATE": "Please provide a valid date.", + "SECURITY_ANSWER_PLACEHOLDER": "Answer to your security question", + "MANDATORY_ORDER_ID": "Please provide an Order ID.", + "BTN_SHOW_SOLVED": "Show solved", + "TITLE_TWO_FACTOR_AUTH_ENTER": "Enter the 6 digit token from your 2FA app", + "LABEL_TWO_FACTOR_AUTH_TOKEN": "2FA Token", + "CONFIRM_2FA_SETUP": "Setup of Two-Factor Authentication successfully completed.", + "CONFIRM_2FA_DISABLE": "Two-Factor Authentication has been removed.", + "INVALID_TWO_FACTOR_AUTH_TOKEN": "The token appears to be invalid.", + "UNAUTHORIZED_PAGE_ACCESS_ERROR": "You are not allowed to access this page!", + "TITLE_PRIVACY_POLICY": "Privacy Policy", + "TITLE_TWO_FACTOR_AUTHENTICATION": "Two Factor Authentication", + "TITLE_REQUEST_DATA_EXPORT": "Request Data Export", + "PRIVACY_AND_SECURITY": "Privacy & Security", + "MENU": "Menu", + "LABEL_OR": "or", + "COMPANY": "Company", + "ADD_BASKET": "Add to Basket", + "BTN_SHOW_ALL": "Show all", + "BTN_SHOW_UNAVAILABLE": "Show unavailable", + "INFO_DISABLED_CHALLENGES": "{{num}} challenges are unavailable on {{env}} due to security concerns or technical incompatibility!", + "BTN_HIDE_ALL": "Hide all", + "TYPE_THESE_LETTERS": "Type these {{length}} letters", + "BTN_REQUEST": "Request", + "EXPORT_LABEL": "Export Format", + "ACCOUNT": "Account", + "TITLE_TWO_FACTOR_AUTH_CONFIG": "2FA Configuration", + "LABEL_CONFIRM_CURRENT_PASSWORD": "Confirm your current password", + "LABEL_INITIAL_2FA_TOKEN": "Initial token from your authenticator", + "INITIAL_CODE": "Initial Token", + "INITIAL_TOKEN_TOOLTIP": "The token to be entered from the authenticator must have 6 digits.", + "2FA_ENTER_CODE_PLACEHOLDER": "Please enter your 2FA token", + "INITIAL_CODE_PLACEHOLDER": "Please enter your initial token", + "2FA_AUTH_SETUP_INSTRUCTIONS": "Secure your account with an additional factor. Scan the QR code into an authenticator app supporting TOTP (e.g. Google Authenticator) to get started.", + "2FA_SETUP_ERROR": "Failed to change 2FA setup. Check if you entered your password (and token) correctly.", + "2FA_SUCCESSFUL_SETUP": "You have enabled 2FA for your account. Thank you for taking the time to keep your juices safe!", + "REMOVE_TWO_FACTOR_AUTH": "Remove 2FA from your account", + "BTN_REMOVE": "Remove", + "MANDATORY_REVIEW": "Please provide a review text.", + "WRITE_REVIEW": "Write a review", + "WRITE_REVIEW_PLACEHOLDER": "What did you like or dislike?", + "EMPTY_REVIEW_LIST": "There is no review for this product yet.", + "EMPTY_SEARCH_RESULT": "Try adjusting your search to find what you're looking for.", + "NO_SEARCH_RESULT": "No results found", + "DATA_SUBJECT_TITLE": "Request Data Erasure", + "GDPR_HEADING": "Data Erasure Request (Art. 17 GDPR)", + "GDPR_MESSAGE": "We take data security, customer privacy, and legal compliance very serious. In accordance with GDPR we allow you to request complete erasure of your account and any associated data.", + "DELETE_DATA_LABEL": "Delete User Data", + "ADD_NEW_ADDRESS": "Add New Address", + "LABEL_COUNTRY": "Country", + "LABEL_MOBILE_NUMBER": "Mobile Number", + "LABEL_ZIP_CODE": "ZIP Code", + "LABEL_CITY": "City", + "LABEL_STATE": "State", + "STATE_PLACEHOLDER": "Please provide a state.", + "LABEL_GO_BACK": "Go Back", + "LABEL_BACK": "Back", + "TITLE_SELECT_ADDRESS": "Select an address", + "USE_THIS_ADDRESS": "Use this address", + "BTN_DELETE": "Delete", + "MANDATORY_COUNTRY": "Please provide a country.", + "MANDATORY_NAME": "Please provide a name.", + "MANDATORY_NUMBER": "Please provide a mobile number.", + "MANDATORY_ZIP": "Please provide a ZIP code.", + "MANDATORY_CITY": "Please provide a city.", + "INVALID_MOBILE_NUMBER": "Mobile number must match {{range}} format.", + "UNAUTHORIZED_ACCESS_ERROR": "Please login to view this page.", + "SEARCH_PROCESSING": "Searching for products", + "STOCK": "Stock", + "UNITS": "units", + "ACCOUNTING": "Accounting", + "CONFIRM_ERASURE_REQUEST": "Sorry to see you leave! Your erasure request will be processed shortly.", + "INFO_HACKING_INSTRUCTOR": "Start an interactive hacking tutorial for this challenge.", + "SCORE_BOARD_HACKING_INSTRUCTOR": "Launch a tutorial to get you started hacking the Juice Shop.", + "BTN_GETTING_STARTED": "Help getting started", + "BTN_DISMISS": "Dismiss", + "SIDENAV_HINT": "Open side menu", + "LANGUAGE_SEL_HINT": "Choose language", + "PLACE_ORDER_AND_PAY": "Place your order and pay", + "ORDER_SUMMARY": "Order Summary", + "ITEMS": "Items", + "DELIVERY": "Delivery", + "PROMOTION": "Promotion", + "MY_SAVED_ADRESSES": "My saved addresses", + "BTN_HIDE": "Hide", + "YOUR_SAVED_CARDS": "Your saved cards", + "LABEL_CARD_NUMBER": "Card Number", + "LABEL_EXPIRES_ON": "Expires On", + "ADD_NEW_CARD": "Add new card", + "ADD_NEW_CARD_DESCRIPTION": "Add a credit or debit card", + "ADD_A_COUPON": "Add a coupon", + "OTHER_PAYMENT_OPTIONS": "Other payment options", + "VOUCHERS_AND_PROMOTIONAL_CODE": "Add a coupon code to receive discounts", + "LABEL_EXPIRY_MONTH": "Expiry Month", + "LABEL_EXPIRY_YEAR": "Expiry Year", + "MANDATORY_CARD_NUMBER": "Please enter your card number.", + "MANDATORY_EXPIRY_MONTH": "Please enter an expiry month.", + "MANDATORY_EXPIRY_YEAR": "Please enter an expiry year.", + "VALID_CARD_NUMBER": "Please enter a valid sixteen digit card number.", + "LABEL_CONTINUE": "Continue", + "REVIEW_ALERT": "You can review this order before it is finalized.", + "MY_PAYMENT_OPTIONS": "My Payment Options", + "BTN_SAVE": "Save", + "LABEL_RESULT": "Result", + "IP_ADDRESS": "IP Address", + "WRITE_MESSAGE_PLACEHOLDER": "What would you like to tell us?", + "SHOW_PWD_TOOLTIP": "Show password", + "HIDE_PWD_TOOLTIP": "Hide password", + "DATA_EXPORT_HINT": "(Your data export will open in a new Browser window.)", + "LABEL_SOLD_OUT": "Sold Out", + "LABEL_ONLY_QUANTITY_LEFT": "Only {{quantity}} left", + "THANKS_FOR_PURCHASE": "Thank you for your purchase!", + "PURCHASE_COMMENT_PREFIX": "Your order has been placed and is being processed. You can check for status updates on our", + "PURCHASE_COMMENT_SUFFIX": "page.", + "BONUS_POINTS_COUNT": "You have gained {{bonus}} Bonus Points from this order!", + "ESTIMATED_TIME_OF_DELIVERY": "Your order will be delivered in {{numberdays}} days.", + "PRINT_ORDER_CONFIRMATION": "Print Order Confirmation", + "DIGITAL_WALLET": "Digital Wallet", + "LABEL_ADD_MONEY": "Add Money", + "LABEL_WALLET_BALANCE": "Wallet Balance", + "MANDATORY_AMOUNT": "Please enter an amount", + "LABEL_AMOUNT": "Amount", + "AMOUNT_LIMIT": "You can add a minimum of 10¤ and only up to 1000¤.", + "LABEL_CHOOSE_A_DELIVERY_SPEED": "Choose a delivery speed", + "CARD_ENDING_IN": "Card ending in", + "CARD_HOLDER": "Card Holder", + "PAYMENT_METHOD": "Payment Method", + "PHONE_NUMBER": "Phone Number", + "LABEL_ORDER_HISTORY": "Order History", + "LABEL_IN_TRANSIT": "In Transit", + "LABEL_DELIVERED": "Delivered", + "LABEL_TRACK_ORDER": "Track Order", + "NO_ORDERS_PLACED": "You have not placed any orders yet.", + "LABEL_MARK_AS_DELIVERED": "Mark as delivered", + "LABEL_MARK_AS_TRANSIT": "Mark as in transit", + "LABEL_PHOTO_WALL": "Photo Wall", + "LABEL_SHARE_A_MEMORY": "Share a memory", + "MANDATORY_CAPTION": "Please enter a caption", + "LABEL_CAPTION": "Caption", + "LABEL_PICK_IMAGE": "Pick image", + "IMAGE_UPLOAD_SUCCESS": "Your image was successfully uploaded.", + "EMPTY_MEMORY_LIST": "No memories have been shared yet.", + "LABEL_DELUXE_MEMBERSHIP": "Deluxe Membership", + "DESCRIPTION_DELUXE_MEMBERSHIP": "Enjoy amazing benefits as a a deluxe customer of {{appname}}. Check out what is included with your membership.", + "LABEL_BECOME_MEMBER": "Become a member", + "LABEL_DEALS_OFFERS": "Deals and Offers", + "DESCRIPTION_DEALS_OFFERS": "As a deluxe member, you get access to exclusive deals and irresistible offers.", + "LABEL_FREE_FAST_DELIVERY": "Free Fast Delivery", + "DESCRIPTION_FREE_FAST_DELIVERY": "Get unlimited free Fast Delivery for all products in the shop.", + "LABEL_UNLIMITED_PURCHASE": "Unlimited Purchase", + "DESCRIPTION_UNLIMITED_PURCHASE": "Enjoy unrestricted purchase of your favourite products.", + "LABEL_PAY_USING_WALLET": "Pay using wallet", + "LABEL_PAY": "Pay", + "LABEL_ADD": "Add", + "REVIEW_WALLET": "You will be redirected back to your wallet.", + "ORDERS_AND_PAYMENT": "Orders & Payment", + "ADDRESS_REMOVED": "Your address has been removed.", + "ADDRESS_UPDATED": "The address at {{city}} has been successfully updated.", + "ADDRESS_ADDED": "The address at {{city}} has been successfully added to your addresses.", + "PASSWORD_SUCCESSFULLY_CHANGED": "Your password was successfully changed.", + "CUSTOMER_SUPPORT_COMPLAINT_REPLY": "Customer support will get in touch with you soon! Your complaint reference is #{{ref}}", + "FEEDBACK_FIVE_STAR_THANK_YOU": "Thank you so much for your amazing 5-star feedback!", + "FEEDBACK_THANK_YOU": "Thank you for your feedback.", + "CREDIT_CARD_SAVED": "Your card ending with {{cardnumber}} has been saved for your convenience.", + "CONFIRM_REVIEW_SAVED": "You review has been saved.", + "CONFIRM_CHANGES_SAVED": "Your changes have been saved.", + "CONFIRM_RECYCLING_BOX": "Thank you for using our eco-friendly recycling self-service. We will send you a pomace recycling box asap.", + "CONFIRM_RECYCLING_PICKUP": "Thank you for using our convenient recycling service. We will pick up your pomace on {{pickupdate}}.", + "CHALLENGE_UNAVAILABLE": "This challenge is unavailable in a {{env}} environment!", + "CLICK_FOR_MORE_HINTS": "Click for more hints.", + "CLICK_TO_OPEN_HINTS": "Click to open hints.", + "BONUS_POINTS_EARNED": "Bonus Points Earned: {{bonus}}", + "BONUS_FOR_FUTURE_PURCHASES": "The bonus points from this order will be added 1:1 to your wallet ¤-fund for future purchases!", + "ENTER_COUPON_CODE": "Please enter your coupon code", + "COUPON_CODE_HINT": "Coupon code must be 10 characters long.", + "CHARGED_WALLET": "Wallet successfully charged.", + "BTN_SHOW_ONLY_TUTORIALS": "Show tutorials only", + "INFO_FULL_CHALLENGE_MODE": "Complete the remaining tutorial challenges to unveil all {{num}} challenges and unlock the advanced Score Board filters!", + "INFO_NEXT_TUTORIAL_TIER": "Complete the {{tier}} tutorial challenges to unveil the next difficulty tier!", + "SHOW_COMMENT": "Show Comment", + "INFO_VULNERABILITY_MITIGATION_LINK": "Click to learn how to avoid or mitigate similar vulnerabilities!", + "SAVE_BACKUP_TOOLTIP": "Save challenge progress and application settings to file.", + "RESTORE_BACKUP_TOOLTIP": "Restore challenge progress and application settings from file.", + "TAG_DANGER_ZONE": "Danger Zone", + "TAG_DANGER_ZONE_DESCRIPTION": "Marks potentially dangerous challenges which are disabled on Docker/Heroku/Gitpod by default due to RCE or other risks.", + "TAG_GOOD_FOR_DEMOS": "Good for Demos", + "TAG_GOOD_FOR_DEMOS_DESCRIPTION": "Highlights challenges which are suitable for live demos or awareness trainings.", + "TAG_PREREQUISITE": "Prerequisite", + "TAG_PREREQUISITE_DESCRIPTION": "Marks challenges which need to be solved before one or more other challenges can be (realistically) solved.", + "TAG_OSINT": "OSINT", + "TAG_OSINT_DESCRIPTION": "Marks challenges which require some Internet research or \"social stalking\" actvitiy outside the application.", + "TAG_CONTRAPTION": "Contraption", + "TAG_CONTRAPTION_DESCRIPTION": "Indicates that a challenge is not exactly part of a realistic scenario but might be a bit forced or crafted.", + "TAG_SHENANIGANS": "Shenanigans", + "TAG_SHENANIGANS_DESCRIPTION": "Marks challenges which are not considered serious and/or realistic but exist more for entertainment.", + "TAG_TUTORIAL": "Tutorial", + "TAG_TUTORIAL_DESCRIPTION": "Marks challenges for which a Hacking Instructor script exists to assist newcomers.", + "TAG_BRUTE_FORCE": "Brute Force", + "TAG_BRUTE_FORCE_DESCRIPTION": "Marks challenges where automation of some security tool or custom script is an option or even prerequisite.", + "TAG_GOOD_PRACTICE": "Good Practice", + "TAG_GOOD_PRACTICE_DESCRIPTION": "Highlights challenges which are less about vulnerabilities but promoting good (security) practices.", + "TAG_CODE_ANALYSIS": "Code Analysis", + "TAG_CODE_ANALYSIS_DESCRIPTION": "Marks challenges where it can be helpful to rummage through some source code of the application or a third party.", + "CATEGORY_BROKEN_ACCESS_CONTROL": "Broken Access Control", + "CATEGORY_BROKEN_ANTI_AUTOMATION": "Broken Anti Automation", + "CATEGORY_BROKEN_AUTHENTICATION": "Broken Authentication", + "CATEGORY_CRYPTOGRAPHIC_ISSUES": "Cryptographic Issues", + "CATEGORY_IMPROPER_INPUT_VALIDATION": "Improper Input Validation", + "CATEGORY_INJECTION": "Injection", + "CATEGORY_INSECURE_DESERIALIZATION": "Insecure Deserialization", + "CATEGORY_MISCELLANEOUS": "Miscellaneous", + "CATEGORY_SECURITY_MISCONFIGURATION": "Security Misconfiguration", + "CATEGORY_SECURITY_THROUGH_OBSCURITY": "Security through Obscurity", + "CATEGORY_SENSITIVE_DATA_EXPOSURE": "Sensitive Data Exposure", + "CATEGORY_UNVALIDATED_REDIRECTS": "Unvalidated Redirects", + "CATEGORY_VULNERABLE_COMPONENTS": "Vulnerable Components", + "CATEGORY_XSS": "XSS", + "CATEGORY_XXE": "XXE", + "CATEGORY_BROKEN_ACCESS_CONTROL_DESCRIPTION": "Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.", + "CATEGORY_BROKEN_ANTI_AUTOMATION_DESCRIPTION": "Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force.", + "CATEGORY_BROKEN_AUTHENTICATION_DESCRIPTION": "Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.", + "CATEGORY_CRYPTOGRAPHIC_ISSUES_DESCRIPTION": "A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources. The use of a non-standard algorithm is dangerous because a determined attacker may be able to break the algorithm and compromise whatever data has been protected. Well-known techniques may exist to break the algorithm.", + "CATEGORY_IMPROPER_INPUT_VALIDATION_DESCRIPTION": "When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the application. This will lead to parts of the system receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution.", + "CATEGORY_INJECTION_DESCRIPTION": "Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.", + "CATEGORY_INSECURE_DESERIALIZATION_DESCRIPTION": "Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.", + "CATEGORY_MISCELLANEOUS_DESCRIPTION": "Everything that does not match any of the other vulnerability categories or would not even be considered a security issue in a real world scenario.", + "CATEGORY_SECURITY_MISCONFIGURATION_DESCRIPTION": "Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.", + "CATEGORY_SECURITY_THROUGH_OBSCURITY_DESCRIPTION": "The software uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.", + "CATEGORY_SENSITIVE_DATA_EXPOSURE_DESCRIPTION": "Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser.", + "CATEGORY_UNVALIDATED_REDIRECTS_DESCRIPTION": "Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.", + "CATEGORY_VULNERABLE_COMPONENTS_DESCRIPTION": "Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.", + "CATEGORY_XSS_DESCRIPTION": "Cross-Site Scripting (XSS) flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.", + "CATEGORY_XXE_DESCRIPTION": "Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.", + "INSUFFICIENT_WALLET_BALANCE": "Insufficient wallet balance.", + "LAUNCH_CODING_CHALLENGE": "Launch associated coding challenge.", + "LOADING_CODE_SNIPPET": "Loading code snippet...", + "SOLVE_HACKING_CHALLENGE": "Solve the hacking challenge to unlock the associated coding challenge.", + "LABEL_CORRECT_FIX": "Correct Fix", + "TITLE_CODING_CHALLENGE": "Coding Challenge", + "TAB_FIND_IT": "Find It", + "TAB_FIX_IT": "Fix It", + "TITLE_CODING_SCORE": "Coding Score", + "LABEL_FEEDBACK": "Feedback" +} From 1045fa8f101eef3f98b6a7d899f16ae07bb3f3d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Kimminich?= Date: Wed, 15 Feb 2023 12:50:10 +0000 Subject: [PATCH 002/161] =?UTF-8?q?New=20translations=20en.json=20(Bengali?= =?UTF-8?q?)=20[ci=20skip]=20Signed-off-by:=20Bj=C3=B6rn=20Kimminich=20?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- data/static/i18n/bn_BD.json | 456 ++++++++++++++++++++++++++++++++++++ 1 file changed, 456 insertions(+) create mode 100644 data/static/i18n/bn_BD.json diff --git a/data/static/i18n/bn_BD.json b/data/static/i18n/bn_BD.json new file mode 100644 index 00000000000..22dc6bf17a6 --- /dev/null +++ b/data/static/i18n/bn_BD.json @@ -0,0 +1,456 @@ +{ + "Find the carefully hidden 'Score Board' page.": "Find the carefully hidden 'Score Board' page.", + "Try to find a reference or clue behind the scenes. Or simply guess what URL the Score Board might have.": "Try to find a reference or clue behind the scenes. Or simply guess what URL the Score Board might have.", + "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> without using the frontend application at all.": "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> without using the frontend application at all.", + "You need to work with the server-side API directly. Try different HTTP verbs on different entities exposed through the API.": "You need to work with the server-side API directly. Try different HTTP verbs on different entities exposed through the API.", + "Gain access to any access log file of the server.": "Gain access to any access log file of the server.", + "Who would want a server access log to be accessible through a web application?": "Who would want a server access log to be accessible through a web application?", + "Register as a user with administrator privileges.": "Register as a user with administrator privileges.", + "You have to assign the unassignable.": "You have to assign the unassignable.", + "Access the administration section of the store.": "Access the administration section of the store.", + "It is just slightly harder to find than the score board link.": "It is just slightly harder to find than the score board link.", + "Overwrite the Legal Information file.": "Overwrite the Legal Information file.", + "Look out for a tweet praising new functionality of the web shop. Then find a third party vulnerability associated with it.": "Look out for a tweet praising new functionality of the web shop. Then find a third party vulnerability associated with it.", + "Reset the password of Bjoern's OWASP account via the Forgot Password mechanism with the original answer to his security question.": "Reset the password of Bjoern's OWASP account via the Forgot Password mechanism with the original answer to his security question.", + "He might have spoilered it on at least one occasion where a camera was running. Maybe elsewhere as well.": "He might have spoilered it on at least one occasion where a camera was running. Maybe elsewhere as well.", + "Learn about the Token Sale before its official announcement.": "Learn about the Token Sale before its official announcement.", + "The developers truly believe in \"Security through Obscurity\" over actual access restrictions.": "The developers truly believe in \"Security through Obscurity\" over actual access restrictions.", + "Perform a Remote Code Execution that would keep a less hardened application busy forever.": "Perform a Remote Code Execution that would keep a less hardened application busy forever.", + "The feature you need to exploit for this challenge is not directly advertised anywhere.": "The feature you need to exploit for this challenge is not directly advertised anywhere.", + "Submit 10 or more customer feedbacks within 20 seconds.": "Submit 10 or more customer feedbacks within 20 seconds.", + "After finding a CAPTCHA bypass, write a script that automates feedback submission. Or open many browser tabs and be really quick.": "After finding a CAPTCHA bypass, write a script that automates feedback submission. Or open many browser tabs and be really quick.", + "Change Bender's password into slurmCl4ssic without using SQL Injection or Forgot Password.": "Change Bender's password into slurmCl4ssic without using SQL Injection or Forgot Password.", + "In previous releases this challenge was wrongly accused of being based on CSRF.": "In previous releases this challenge was wrongly accused of being based on CSRF.", + "Order the Christmas special offer of 2014.": "Order the Christmas special offer of 2014.", + "Find out how the application handles unavailable products and try to find a loophole.": "Find out how the application handles unavailable products and try to find a loophole.", + "Bypass the Content Security Policy and perform an XSS attack with <script>alert(`xss`)</script> on a legacy page within the application.": "Bypass the Content Security Policy and perform an XSS attack with <script>alert(`xss`)</script> on a legacy page within the application.", + "What is even \"better\" than a legacy page with a homegrown RegEx sanitizer? Having CSP injection issues on the exact same page as well!": "What is even \"better\" than a legacy page with a homegrown RegEx sanitizer? Having CSP injection issues on the exact same page as well!", + "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> bypassing a client-side security mechanism.": "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> bypassing a client-side security mechanism.", + "Only some input fields validate their input. Even less of these are persisted in a way where their content is shown on another screen.": "Only some input fields validate their input. Even less of these are persisted in a way where their content is shown on another screen.", + "Access a confidential document.": "Access a confidential document.", + "Analyze and tamper with links in the application that deliver a file directly.": "Analyze and tamper with links in the application that deliver a file directly.", + "Perform a DOM XSS attack with <iframe src=\"javascript:alert(`xss`)\">.": "Perform a DOM XSS attack with <iframe src=\"javascript:alert(`xss`)\">.", + "Look for an input field where its content appears in the HTML when its form is submitted.": "Look for an input field where its content appears in the HTML when its form is submitted.", + "Exfiltrate the entire DB schema definition via SQL Injection.": "Exfiltrate the entire DB schema definition via SQL Injection.", + "Find out where this information could come from. Then craft a UNION SELECT attack string against an endpoint that offers an unnecessary way to filter data.": "Find out where this information could come from. Then craft a UNION SELECT attack string against an endpoint that offers an unnecessary way to filter data.", + "Use a deprecated B2B interface that was not properly shut down.": "Use a deprecated B2B interface that was not properly shut down.", + "The developers who disabled the interface think they could go invisible by just closing their eyes.": "The developers who disabled the interface think they could go invisible by just closing their eyes.", + "Find the hidden easter egg.": "Find the hidden easter egg.", + "If you solved one of the three file access challenges, you already know where to find the easter egg.": "If you solved one of the three file access challenges, you already know where to find the easter egg.", + "Perform an unwanted information disclosure by accessing data cross-domain.": "Perform an unwanted information disclosure by accessing data cross-domain.", + "Try to find and attack an endpoint that responds with user information. SQL Injection is not the solution here.": "Try to find and attack an endpoint that responds with user information. SQL Injection is not the solution here.", + "Log in with the (non-existing) accountant acc0unt4nt@juice-sh.op without ever registering that user.": "Log in with the (non-existing) accountant acc0unt4nt@juice-sh.op without ever registering that user.", + "Try to create the needed user \"out of thin air\".": "Try to create the needed user \"out of thin air\".", + "Provoke an error that is neither very gracefully nor consistently handled.": "Provoke an error that is neither very gracefully nor consistently handled.", + "Try to submit bad input to forms. Alternatively tamper with URL paths or parameters.": "Try to submit bad input to forms. Alternatively tamper with URL paths or parameters.", + "Successfully redeem an expired campaign coupon code.": "Successfully redeem an expired campaign coupon code.", + "Try to identify past special event or holiday campaigns of the shop first.": "Try to identify past special event or holiday campaigns of the shop first.", + "Retrieve the language file that never made it into production.": "Retrieve the language file that never made it into production.", + "Brute force is not the only option for this challenge, but a perfectly viable one.": "Brute force is not the only option for this challenge, but a perfectly viable one.", + "Get rid of all 5-star customer feedback.": "Get rid of all 5-star customer feedback.", + "Once you found admin section of the application, this challenge is almost trivial.": "Once you found admin section of the application, this challenge is almost trivial.", + "Forge a coupon code that gives you a discount of at least 80%.": "Forge a coupon code that gives you a discount of at least 80%.", + "Try either a) a knowledgable brute force attack or b) reverse engineering or c) some research in the cloud.": "Try either a) a knowledgable brute force attack or b) reverse engineering or c) some research in the cloud.", + "Post some feedback in another user's name.": "Post some feedback in another user's name.", + "You can solve this by tampering with the user interface or by intercepting the communication with the RESTful backend.": "You can solve this by tampering with the user interface or by intercepting the communication with the RESTful backend.", + "Post a product review as another user or edit any user's existing review.": "Post a product review as another user or edit any user's existing review.", + "Observe the flow of product review posting and editing and see if you can exploit it.": "Observe the flow of product review posting and editing and see if you can exploit it.", + "Forge an almost properly RSA-signed JWT token that impersonates the (non-existing) user rsa_lord@juice-sh.op.": "Forge an almost properly RSA-signed JWT token that impersonates the (non-existing) user rsa_lord@juice-sh.op.", + "This challenge is explicitly not about acquiring the RSA private key used for JWT signing.": "This challenge is explicitly not about acquiring the RSA private key used for JWT signing.", + "Access a developer's forgotten backup file.": "Access a developer's forgotten backup file.", + "You need to trick a security mechanism into thinking that the file you want has a valid file type.": "You need to trick a security mechanism into thinking that the file you want has a valid file type.", + "Access a salesman's forgotten backup file.": "Access a salesman's forgotten backup file.", + "Inform the shop about a typosquatting imposter that dug itself deep into the frontend. (Mention the exact name of the culprit)": "Inform the shop about a typosquatting imposter that dug itself deep into the frontend. (Mention the exact name of the culprit)", + "This challenge has nothing to do with mistyping web domains. There is no conveniently misplaced file helping you with this one either. Or is there?": "This challenge has nothing to do with mistyping web domains. There is no conveniently misplaced file helping you with this one either. Or is there?", + "Log in with Chris' erased user account.": "Log in with Chris' erased user account.", + "Turns out that something is technically and legally wrong with the implementation of the \"right to be forgotten\" for users.": "Turns out that something is technically and legally wrong with the implementation of the \"right to be forgotten\" for users.", + "Steal someone else's personal data without using Injection.": "Steal someone else's personal data without using Injection.", + "Trick the regular Data Export to give you more than actually belongs to you.": "Trick the regular Data Export to give you more than actually belongs to you.", + "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> through an HTTP header.": "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> through an HTTP header.", + "Finding a piece of displayed information that could originate from an HTTP header is part of this challenge.": "Finding a piece of displayed information that could originate from an HTTP header is part of this challenge.", + "Solve challenge #999. Unfortunately, this challenge does not exist.": "Solve challenge #999. Unfortunately, this challenge does not exist.", + "You need to trick the hacking progress persistence feature into thinking you solved challenge #999.": "You need to trick the hacking progress persistence feature into thinking you solved challenge #999.", + "Dumpster dive the Internet for a leaked password and log in to the original user account it belongs to. (Creating a new account with the same password does not qualify as a solution.)": "Dumpster dive the Internet for a leaked password and log in to the original user account it belongs to. (Creating a new account with the same password does not qualify as a solution.)", + "Once you have it, a technique called \"Password Spraying\" might prove useful.": "Once you have it, a technique called \"Password Spraying\" might prove useful.", + "Identify an unsafe product that was removed from the shop and inform the shop which ingredients are dangerous.": "Identify an unsafe product that was removed from the shop and inform the shop which ingredients are dangerous.", + "Your own SQLi and someone else's Ctrl-V will be your accomplices in this challenge!": "Your own SQLi and someone else's Ctrl-V will be your accomplices in this challenge!", + "Inform the shop about a typosquatting trick it has been a victim of at least in v6.2.0-SNAPSHOT. (Mention the exact name of the culprit)": "Inform the shop about a typosquatting trick it has been a victim of at least in v6.2.0-SNAPSHOT. (Mention the exact name of the culprit)", + "This challenge has nothing to do with mistyping web domains. Investigate the forgotten developer's backup file instead.": "This challenge has nothing to do with mistyping web domains. Investigate the forgotten developer's backup file instead.", + "Log in with the administrator's user account.": "Log in with the administrator's user account.", + "Try different SQL Injection attack patterns depending whether you know the admin's email address or not.": "Try different SQL Injection attack patterns depending whether you know the admin's email address or not.", + "Log in with Amy's original user credentials. (This could take 93.83 billion trillion trillion centuries to brute force, but luckily she did not read the \"One Important Final Note\")": "Log in with Amy's original user credentials. (This could take 93.83 billion trillion trillion centuries to brute force, but luckily she did not read the \"One Important Final Note\")", + "This challenge will make you go after a needle in a haystack.": "This challenge will make you go after a needle in a haystack.", + "Log in with Bender's user account.": "Log in with Bender's user account.", + "If you know Bender's email address, try SQL Injection. Bender's password hash might not help you very much.": "If you know Bender's email address, try SQL Injection. Bender's password hash might not help you very much.", + "Log in with Bjoern's Gmail account without previously changing his password, applying SQL Injection, or hacking his Google account.": "Log in with Bjoern's Gmail account without previously changing his password, applying SQL Injection, or hacking his Google account.", + "The security flaw behind this challenge is 100% OWASP Juice Shop's fault and 0% Google's.": "The security flaw behind this challenge is 100% OWASP Juice Shop's fault and 0% Google's.", + "Exploit OAuth 2.0 to log in with the Chief Information Security Officer's user account.": "Exploit OAuth 2.0 to log in with the Chief Information Security Officer's user account.", + "Don't try to beat Google's OAuth 2.0 service. Rather investigate implementation flaws on OWASP Juice Shop's end.": "Don't try to beat Google's OAuth 2.0 service. Rather investigate implementation flaws on OWASP Juice Shop's end.", + "Log in with Jim's user account.": "Log in with Jim's user account.", + "Try cracking Jim's password hash if you harvested it already. Alternatively, if you know Jim's email address, try SQL Injection.": "Try cracking Jim's password hash if you harvested it already. Alternatively, if you know Jim's email address, try SQL Injection.", + "Log in with MC SafeSearch's original user credentials without applying SQL Injection or any other bypass.": "Log in with MC SafeSearch's original user credentials without applying SQL Injection or any other bypass.", + "You should listen to MC's hit song \"Protect Ya Passwordz\".": "You should listen to MC's hit song \"Protect Ya Passwordz\".", + "Log in with the support team's original user credentials without applying SQL Injection or any other bypass.": "Log in with the support team's original user credentials without applying SQL Injection or any other bypass.", + "The underlying flaw of this challenge is a lot more human error than technical weakness.": "The underlying flaw of this challenge is a lot more human error than technical weakness.", + "Put an additional product into another user's shopping basket.": "Put an additional product into another user's shopping basket.", + "Have an eye on the HTTP traffic while placing products in the shopping basket. Changing the quantity of products already in the basket doesn't count.": "Have an eye on the HTTP traffic while placing products in the shopping basket. Changing the quantity of products already in the basket doesn't count.", + "Access a misplaced SIEM signature file.": "Access a misplaced SIEM signature file.", + "Like any review at least three times as the same user.": "Like any review at least three times as the same user.", + "Punctuality is the politeness of kings.": "Punctuality is the politeness of kings.", + "Apply some advanced cryptanalysis to find the real easter egg.": "Apply some advanced cryptanalysis to find the real easter egg.", + "You might have to peel through several layers of tough-as-nails encryption for this challenge.": "You might have to peel through several layers of tough-as-nails encryption for this challenge.", + "Let the server sleep for some time. (It has done more than enough hard work for you)": "Let the server sleep for some time. (It has done more than enough hard work for you)", + "This challenge is essentially a stripped-down Denial of Service (DoS) attack.": "This challenge is essentially a stripped-down Denial of Service (DoS) attack.", + "All your orders are belong to us! Even the ones which don't.": "All your orders are belong to us! Even the ones which don't.", + "Take a close look on how the $where query operator works in MongoDB.": "Take a close look on how the $where query operator works in MongoDB.", + "Update multiple product reviews at the same time.": "Update multiple product reviews at the same time.", + "Take a close look on how the equivalent of UPDATE-statements in MongoDB work.": "Take a close look on how the equivalent of UPDATE-statements in MongoDB work.", + "Let us redirect you to one of our crypto currency addresses which are not promoted any longer.": "Let us redirect you to one of our crypto currency addresses which are not promoted any longer.", + "We might have failed to take this out of our code properly.": "We might have failed to take this out of our code properly.", + "Log in with the administrator's user credentials without previously changing them or applying SQL Injection.": "Log in with the administrator's user credentials without previously changing them or applying SQL Injection.", + "This one should be equally easy to a) brute force, b) crack the password hash or c) simply guess.": "This one should be equally easy to a) brute force, b) crack the password hash or c) simply guess.", + "Place an order that makes you rich.": "Place an order that makes you rich.", + "You literally need to make the shop owe you any amount of money.": "You literally need to make the shop owe you any amount of money.", + " Unlock Premium Challenge to access exclusive content.": " Unlock Premium Challenge to access exclusive content.", + "You do not have to pay anything to unlock this challenge! Nonetheless, donations are very much appreciated.": "You do not have to pay anything to unlock this challenge! Nonetheless, donations are very much appreciated.", + "Read our privacy policy.": "Read our privacy policy.", + "We won't even ask you to confirm that you did. Just read it. Please. Pretty please.": "We won't even ask you to confirm that you did. Just read it. Please. Pretty please.", + "Prove that you actually read our privacy policy.": "Prove that you actually read our privacy policy.", + "Only by visiting a special URL you can confirm that you read it carefully.": "Only by visiting a special URL you can confirm that you read it carefully.", + "Change the href of the link within the OWASP SSL Advanced Forensic Tool (O-Saft) product description into https://owasp.slack.com.": "Change the href of the link within the OWASP SSL Advanced Forensic Tool (O-Saft) product description into https://owasp.slack.com.", + "Look for one of the following: a) broken admin functionality, b) holes in RESTful API or c) possibility for SQL Injection.": "Look for one of the following: a) broken admin functionality, b) holes in RESTful API or c) possibility for SQL Injection.", + "Perform a reflected XSS attack with <iframe src=\"javascript:alert(`xss`)\">.": "Perform a reflected XSS attack with <iframe src=\"javascript:alert(`xss`)\">.", + "Look for an input field where its content appears in the response HTML when its form is submitted.": "Look for an input field where its content appears in the response HTML when its form is submitted.", + "Follow the DRY principle while registering a user.": "Follow the DRY principle while registering a user.", + "You can solve this by cleverly interacting with the UI or bypassing it altogether.": "You can solve this by cleverly interacting with the UI or bypassing it altogether.", + "Reset Bender's password via the Forgot Password mechanism with the original answer to his security question.": "Reset Bender's password via the Forgot Password mechanism with the original answer to his security question.", + "Not as trivial as Jim's but still not too difficult with some \"Futurama\" background knowledge.": "Not as trivial as Jim's but still not too difficult with some \"Futurama\" background knowledge.", + "Reset the password of Bjoern's internal account via the Forgot Password mechanism with the original answer to his security question.": "Reset the password of Bjoern's internal account via the Forgot Password mechanism with the original answer to his security question.", + "Nothing a little bit of Facebook stalking couldn't reveal. Might involve a historical twist.": "Nothing a little bit of Facebook stalking couldn't reveal. Might involve a historical twist.", + "Reset Jim's password via the Forgot Password mechanism with the original answer to his security question.": "Reset Jim's password via the Forgot Password mechanism with the original answer to his security question.", + "It's hard for celebrities to pick a security question from a hard-coded list where the answer is not publicly exposed.": "It's hard for celebrities to pick a security question from a hard-coded list where the answer is not publicly exposed.", + "Reset Morty's password via the Forgot Password mechanism with his obfuscated answer to his security question.": "Reset Morty's password via the Forgot Password mechanism with his obfuscated answer to his security question.", + "Find a way to bypass the rate limiting and brute force the obfuscated answer to Morty's security question.": "Find a way to bypass the rate limiting and brute force the obfuscated answer to Morty's security question.", + "Deprive the shop of earnings by downloading the blueprint for one of its products.": "Deprive the shop of earnings by downloading the blueprint for one of its products.", + "The product you might want to give a closer look is the OWASP Juice Shop Logo (3D-printed).": "The product you might want to give a closer look is the OWASP Juice Shop Logo (3D-printed).", + "Request a hidden resource on server through server.": "Request a hidden resource on server through server.", + "Reverse engineering something bad can make good things happen.": "Reverse engineering something bad can make good things happen.", + "Infect the server with juicy malware by abusing arbitrary command execution.": "Infect the server with juicy malware by abusing arbitrary command execution.", + "\"SSTi\" is a clear indicator that this has nothing to do with anything Angular. Also, make sure to use only our non-malicious malware.": "\"SSTi\" is a clear indicator that this has nothing to do with anything Angular. Also, make sure to use only our non-malicious malware.", + "Behave like any \"white-hat\" should before getting into the action.": "Behave like any \"white-hat\" should before getting into the action.", + "Undoubtably you want to read our security policy before conducting any research on our application.": "Undoubtably you want to read our security policy before conducting any research on our application.", + "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> bypassing a server-side security mechanism.": "Perform a persisted XSS attack with <iframe src=\"javascript:alert(`xss`)\"> bypassing a server-side security mechanism.", + "The \"Comment\" field in the \"Customer Feedback\" screen is where you want to put your focus on.": "The \"Comment\" field in the \"Customer Feedback\" screen is where you want to put your focus on.", + "Rat out a notorious character hiding in plain sight in the shop. (Mention the exact name of the character)": "Rat out a notorious character hiding in plain sight in the shop. (Mention the exact name of the character)", + "No matter how good your eyes are, you will need tool assistance for this challenge.": "No matter how good your eyes are, you will need tool assistance for this challenge.", + "Perform a Remote Code Execution that occupies the server for a while without using infinite loops.": "Perform a Remote Code Execution that occupies the server for a while without using infinite loops.", + "Your attack payload must not trigger the protection against too many iterations.": "Your attack payload must not trigger the protection against too many iterations.", + "This vulnerability will not affect any customer of the shop. It is aimed exclusively at its developers.": "This vulnerability will not affect any customer of the shop. It is aimed exclusively at its developers.", + "Solve the 2FA challenge for user \"wurstbrot\". (Disabling, bypassing or overwriting his 2FA settings does not count as a solution)": "Solve the 2FA challenge for user \"wurstbrot\". (Disabling, bypassing or overwriting his 2FA settings does not count as a solution)", + "The 2FA implementation requires to store a secret for every user. You will need to find a way to access this secret in order to solve this challenge.": "The 2FA implementation requires to store a secret for every user. You will need to find a way to access this secret in order to solve this challenge.", + "Forge an essentially unsigned JWT token that impersonates the (non-existing) user jwtn3d@juice-sh.op.": "Forge an essentially unsigned JWT token that impersonates the (non-existing) user jwtn3d@juice-sh.op.", + "This challenge exploits a weird option that is supported when signing tokens with JWT.": "This challenge exploits a weird option that is supported when signing tokens with JWT.", + "Upload a file larger than 100 kB.": "Upload a file larger than 100 kB.", + "You can attach a small file to the \"Complaint\" form. Investigate how this upload actually works.": "You can attach a small file to the \"Complaint\" form. Investigate how this upload actually works.", + "Upload a file that has no .pdf or .zip extension.": "Upload a file that has no .pdf or .zip extension.", + "You can attach a PDF or ZIP file to the \"Complaint\" form. Investigate how this upload actually works.": "You can attach a PDF or ZIP file to the \"Complaint\" form. Investigate how this upload actually works.", + "Retrieve a list of all user credentials via SQL Injection.": "Retrieve a list of all user credentials via SQL Injection.", + "Gather information on where user data is stored and how it is addressed. Then craft a corresponding UNION SELECT attack.": "Gather information on where user data is stored and how it is addressed. Then craft a corresponding UNION SELECT attack.", + "Embed an XSS payload </script><script>alert(`xss`)</script> into our promo video.": "Embed an XSS payload </script><script>alert(`xss`)</script> into our promo video.", + "You have to reuse the vulnerability behind one other 6-star challenge to be able to solve this one.": "You have to reuse the vulnerability behind one other 6-star challenge to be able to solve this one.", + "View another user's shopping basket.": "View another user's shopping basket.", + "Have an eye on the HTTP traffic while shopping. Alternatively try to find a client-side association of users to their basket.": "Have an eye on the HTTP traffic while shopping. Alternatively try to find a client-side association of users to their basket.", + "Inform the shop about a vulnerable library it is using. (Mention the exact library name and version in your comment)": "Inform the shop about a vulnerable library it is using. (Mention the exact library name and version in your comment)", + "Report one of two possible answers via the \"Customer Feedback\" form. Do not forget to submit the library's version as well.": "Report one of two possible answers via the \"Customer Feedback\" form. Do not forget to submit the library's version as well.", + "Inform the shop about an algorithm or library it should definitely not use the way it does.": "Inform the shop about an algorithm or library it should definitely not use the way it does.", + "Report one of four possible answers via the \"Customer Feedback\" form.": "Report one of four possible answers via the \"Customer Feedback\" form.", + "Enforce a redirect to a page you are not supposed to redirect to.": "Enforce a redirect to a page you are not supposed to redirect to.", + "You have to find a way to beat the allowlist of allowed redirect URLs.": "You have to find a way to beat the allowlist of allowed redirect URLs.", + "Retrieve the content of C:\\Windows\\system.ini or /etc/passwd from the server.": "Retrieve the content of C:\\Windows\\system.ini or /etc/passwd from the server.", + "The leverage point for this challenge is the deprecated B2B interface.": "The leverage point for this challenge is the deprecated B2B interface.", + "Give the server something to chew on for quite a while.": "Give the server something to chew on for quite a while.", + "It is not as easy as sending a large amount of data directly to the deprecated B2B interface.": "It is not as easy as sending a large amount of data directly to the deprecated B2B interface.", + "Give a devastating zero-star feedback to the store.": "Give a devastating zero-star feedback to the store.", + "Before you invest time bypassing the API, you might want to play around with the UI a bit.": "Before you invest time bypassing the API, you might want to play around with the UI a bit.", + "Your eldest siblings middle name?": "Your eldest siblings middle name?", + "Mother's maiden name?": "Mother's maiden name?", + "Mother's birth date? (MM/DD/YY)": "Mother's birth date? (MM/DD/YY)", + "Father's birth date? (MM/DD/YY)": "Father's birth date? (MM/DD/YY)", + "Maternal grandmother's first name?": "Maternal grandmother's first name?", + "Paternal grandmother's first name?": "Paternal grandmother's first name?", + "Name of your favorite pet?": "Name of your favorite pet?", + "Last name of dentist when you were a teenager? (Do not include 'Dr.')": "Last name of dentist when you were a teenager? (Do not include 'Dr.')", + "Your ZIP/postal code when you were a teenager?": "Your ZIP/postal code when you were a teenager?", + "Company you first work for as an adult?": "Company you first work for as an adult?", + "Your favorite book?": "Your favorite book?", + "Your favorite movie?": "Your favorite movie?", + "Number of one of your customer or ID cards?": "Number of one of your customer or ID cards?", + "Apple Juice (1000ml)": "Apple Juice (1000ml)", + "The all-time classic.": "The all-time classic.", + "Orange Juice (1000ml)": "Orange Juice (1000ml)", + "Made from oranges hand-picked by Uncle Dittmeyer.": "Made from oranges hand-picked by Uncle Dittmeyer.", + "Eggfruit Juice (500ml)": "Eggfruit Juice (500ml)", + "Now with even more exotic flavour.": "Now with even more exotic flavour.", + "Raspberry Juice (1000ml)": "Raspberry Juice (1000ml)", + "Made from blended Raspberry Pi, water and sugar.": "Made from blended Raspberry Pi, water and sugar.", + "Lemon Juice (500ml)": "Lemon Juice (500ml)", + "Sour but full of vitamins.": "Sour but full of vitamins.", + "Banana Juice (1000ml)": "Banana Juice (1000ml)", + "Monkeys love it the most.": "Monkeys love it the most.", + "OWASP Juice Shop T-Shirt": "OWASP Juice Shop T-Shirt", + "Real fans wear it 24/7!": "Real fans wear it 24/7!", + "OWASP Juice Shop CTF Girlie-Shirt": "OWASP Juice Shop CTF Girlie-Shirt", + "For serious Capture-the-Flag heroines only!": "For serious Capture-the-Flag heroines only!", + "OWASP SSL Advanced Forensic Tool (O-Saft)": "OWASP SSL Advanced Forensic Tool (O-Saft)", + "O-Saft is an easy to use tool to show information about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations. More...": "O-Saft is an easy to use tool to show information about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations. More...", + "Christmas Super-Surprise-Box (2014 Edition)": "Christmas Super-Surprise-Box (2014 Edition)", + "Contains a random selection of 10 bottles (each 500ml) of our tastiest juices and an extra fan shirt for an unbeatable price! (Seasonal special offer! Limited availability!)": "Contains a random selection of 10 bottles (each 500ml) of our tastiest juices and an extra fan shirt for an unbeatable price! (Seasonal special offer! Limited availability!)", + "Rippertuer Special Juice": "Rippertuer Special Juice", + "Contains a magical collection of the rarest fruits gathered from all around the world, like Cherymoya Annona cherimola, Jabuticaba Myrciaria cauliflora, Bael Aegle marmelos... and others, at an unbelievable price!
This item has been made unavailable because of lack of safety standards. (This product is unsafe! We plan to remove it from the stock!)": "Contains a magical collection of the rarest fruits gathered from all around the world, like Cherymoya Annona cherimola, Jabuticaba Myrciaria cauliflora, Bael Aegle marmelos... and others, at an unbelievable price!
This item has been made unavailable because of lack of safety standards. (This product is unsafe! We plan to remove it from the stock!)", + "OWASP Juice Shop Sticker (2015/2016 design)": "OWASP Juice Shop Sticker (2015/2016 design)", + "Die-cut sticker with the official 2015/2016 logo. By now this is a rare collectors item. Out of stock!": "Die-cut sticker with the official 2015/2016 logo. By now this is a rare collectors item. Out of stock!", + "OWASP Juice Shop Iron-Ons (16pcs)": "OWASP Juice Shop Iron-Ons (16pcs)", + "Upgrade your clothes with washer safe iron-ons of the OWASP Juice Shop or CTF Extension logo!": "Upgrade your clothes with washer safe iron-ons of the OWASP Juice Shop or CTF Extension logo!", + "OWASP Juice Shop Magnets (16pcs)": "OWASP Juice Shop Magnets (16pcs)", + "Your fridge will be even cooler with these OWASP Juice Shop or CTF Extension logo magnets!": "Your fridge will be even cooler with these OWASP Juice Shop or CTF Extension logo magnets!", + "OWASP Juice Shop Sticker Page": "OWASP Juice Shop Sticker Page", + "Massive decoration opportunities with these OWASP Juice Shop or CTF Extension sticker pages! Each page has 16 stickers on it.": "Massive decoration opportunities with these OWASP Juice Shop or CTF Extension sticker pages! Each page has 16 stickers on it.", + "OWASP Juice Shop Sticker Single": "OWASP Juice Shop Sticker Single", + "Super high-quality vinyl sticker single with the OWASP Juice Shop or CTF Extension logo! The ultimate laptop decal!": "Super high-quality vinyl sticker single with the OWASP Juice Shop or CTF Extension logo! The ultimate laptop decal!", + "OWASP Juice Shop Temporary Tattoos (16pcs)": "OWASP Juice Shop Temporary Tattoos (16pcs)", + "Get one of these temporary tattoos to proudly wear the OWASP Juice Shop or CTF Extension logo on your skin! If you tweet a photo of yourself with the tattoo, you get a couple of our stickers for free! Please mention @owasp_juiceshop in your tweet!": "Get one of these temporary tattoos to proudly wear the OWASP Juice Shop or CTF Extension logo on your skin! If you tweet a photo of yourself with the tattoo, you get a couple of our stickers for free! Please mention @owasp_juiceshop in your tweet!", + "OWASP Juice Shop Mug": "OWASP Juice Shop Mug", + "Black mug with regular logo on one side and CTF logo on the other! Your colleagues will envy you!": "Black mug with regular logo on one side and CTF logo on the other! Your colleagues will envy you!", + "OWASP Juice Shop Hoodie": "OWASP Juice Shop Hoodie", + "Mr. Robot-style apparel. But in black. And with logo.": "Mr. Robot-style apparel. But in black. And with logo.", + "OWASP Juice Shop-CTF Velcro Patch": "OWASP Juice Shop-CTF Velcro Patch", + "4x3.5\" embroidered patch with velcro backside. The ultimate decal for every tactical bag or backpack!": "4x3.5\" embroidered patch with velcro backside. The ultimate decal for every tactical bag or backpack!", + "Woodruff Syrup \"Forest Master X-Treme\"": "Woodruff Syrup \"Forest Master X-Treme\"", + "Harvested and manufactured in the Black Forest, Germany. Can cause hyperactive behavior in children. Can cause permanent green tongue when consumed undiluted.": "Harvested and manufactured in the Black Forest, Germany. Can cause hyperactive behavior in children. Can cause permanent green tongue when consumed undiluted.", + "Green Smoothie": "Green Smoothie", + "Looks poisonous but is actually very good for your health! Made from green cabbage, spinach, kiwi and grass.": "Looks poisonous but is actually very good for your health! Made from green cabbage, spinach, kiwi and grass.", + "Quince Juice (1000ml)": "Quince Juice (1000ml)", + "Juice of the Cydonia oblonga fruit. Not exactly sweet but rich in Vitamin C.": "Juice of the Cydonia oblonga fruit. Not exactly sweet but rich in Vitamin C.", + "Apple Pomace": "Apple Pomace", + "Finest pressings of apples. Allergy disclaimer: Might contain traces of worms. Can be sent back to us for recycling.": "Finest pressings of apples. Allergy disclaimer: Might contain traces of worms. Can be sent back to us for recycling.", + "Fruit Press": "Fruit Press", + "Fruits go in. Juice comes out. Pomace you can send back to us for recycling purposes.": "Fruits go in. Juice comes out. Pomace you can send back to us for recycling purposes.", + "OWASP Juice Shop Logo (3D-printed)": "OWASP Juice Shop Logo (3D-printed)", + "This rare item was designed and handcrafted in Sweden. This is why it is so incredibly expensive despite its complete lack of purpose.": "This rare item was designed and handcrafted in Sweden. This is why it is so incredibly expensive despite its complete lack of purpose.", + "Juice Shop Artwork": "Juice Shop Artwork", + "Unique masterpiece painted with different kinds of juice on 90g/m² lined paper.": "Unique masterpiece painted with different kinds of juice on 90g/m² lined paper.", + "Global OWASP WASPY Award 2017 Nomination": "Global OWASP WASPY Award 2017 Nomination", + "Your chance to nominate up to three quiet pillars of the OWASP community ends 2017-06-30! Nominate now!": "Your chance to nominate up to three quiet pillars of the OWASP community ends 2017-06-30! Nominate now!", + "Strawberry Juice (500ml)": "Strawberry Juice (500ml)", + "Sweet & tasty!": "Sweet & tasty!", + "Carrot Juice (1000ml)": "Carrot Juice (1000ml)", + "As the old German saying goes: \"Carrots are good for the eyes. Or has anyone ever seen a rabbit with glasses?\"": "As the old German saying goes: \"Carrots are good for the eyes. Or has anyone ever seen a rabbit with glasses?\"", + "OWASP Juice Shop Sweden Tour 2017 Sticker Sheet (Special Edition)": "OWASP Juice Shop Sweden Tour 2017 Sticker Sheet (Special Edition)", + "10 sheets of Sweden-themed stickers with 15 stickers on each.": "10 sheets of Sweden-themed stickers with 15 stickers on each.", + "Pwning OWASP Juice Shop": "Pwning OWASP Juice Shop", + "Melon Bike (Comeback-Product 2018 Edition)": "Melon Bike (Comeback-Product 2018 Edition)", + "The wheels of this bicycle are made from real water melons. You might not want to ride it up/down the curb too hard.": "The wheels of this bicycle are made from real water melons. You might not want to ride it up/down the curb too hard.", + "OWASP Juice Shop Coaster (10pcs)": "OWASP Juice Shop Coaster (10pcs)", + "Our 95mm circle coasters are printed in full color and made from thick, premium coaster board.": "Our 95mm circle coasters are printed in full color and made from thick, premium coaster board.", + "Retrieve the photo of Bjoern's cat in \"melee combat-mode\".": "Retrieve the photo of Bjoern's cat in \"melee combat-mode\".", + "Check the Photo Wall for an image that could not be loaded correctly.": "Check the Photo Wall for an image that could not be loaded correctly.", + "Stick cute cross-domain kittens all over our delivery boxes.": "Stick cute cross-domain kittens all over our delivery boxes.", + "This challenge would formally have to be in several categories as the developers made multiple gaffes for this to be possible.": "This challenge would formally have to be in several categories as the developers made multiple gaffes for this to be possible.", + "ea.": "ea.", + "Delivery Price": "Delivery Price", + "Total Price": "Total Price", + "Bonus Points Earned": "Bonus Points Earned", + "The bonus points from this order will be added 1:1 to your wallet ¤-fund for future purchases!": "The bonus points from this order will be added 1:1 to your wallet ¤-fund for future purchases!", + "Thank you for your order!": "Thank you for your order!", + "Order Confirmation": "Order Confirmation", + "Customer": "Customer", + "Order": "Order", + "Date": "Date", + "OWASP Juice Shop Holographic Sticker": "OWASP Juice Shop Holographic Sticker", + "Die-cut holographic sticker. Stand out from those 08/15-sticker-covered laptops with this shiny beacon of 80's coolness!": "Die-cut holographic sticker. Stand out from those 08/15-sticker-covered laptops with this shiny beacon of 80's coolness!", + "OWASP Snakes and Ladders - Mobile Apps": "OWASP Snakes and Ladders - Mobile Apps", + "This amazing mobile app security awareness board game is available for Tabletop Simulator on Steam Workshop now!": "This amazing mobile app security awareness board game is available for Tabletop Simulator on Steam Workshop now!", + "OWASP Snakes and Ladders - Web Applications": "OWASP Snakes and Ladders - Web Applications", + "This amazing web application security awareness board game is available for Tabletop Simulator on Steam Workshop now!": "This amazing web application security awareness board game is available for Tabletop Simulator on Steam Workshop now!", + "The official Companion Guide by Björn Kimminich available for free on LeanPub and also readable online!": "The official Companion Guide by Björn Kimminich available for free on LeanPub and also readable online!", + "We are out of stock! Sorry for the inconvenience.": "We are out of stock! Sorry for the inconvenience.", + "Wrong answer to CAPTCHA. Please try again.": "Wrong answer to CAPTCHA. Please try again.", + "Invalid email or password.": "Invalid email or password.", + "Current password is not correct.": "Current password is not correct.", + "Password cannot be empty.": "Password cannot be empty.", + "New and repeated password do not match.": "New and repeated password do not match.", + "Wrong answer to security question.": "Wrong answer to security question.", + "Inform the development team about a danger to some of their credentials. (Send them the URL of the original report or an assigned CVE or another identifier of this vulnerability)": "Inform the development team about a danger to some of their credentials. (Send them the URL of the original report or an assigned CVE or another identifier of this vulnerability)", + "You can order only up to {{quantity}} items of this product.": "You can order only up to {{quantity}} items of this product.", + " (This challenge is not available on Docker!)": " (This challenge is not available on Docker!)", + " (This challenge is not available on Heroku!)": " (This challenge is not available on Heroku!)", + " (This challenge is not available on Gitpod!)": " (This challenge is not available on Gitpod!)", + " (This challenge is potentially harmful on Docker!)": " (This challenge is potentially harmful on Docker!)", + " (This challenge is potentially harmful on Gitpod!)": " (This challenge is potentially harmful on Gitpod!)", + " (This challenge is potentially harmful on Heroku!)": " (This challenge is potentially harmful on Heroku!)", + "Find the endpoint that serves usage data to be scraped by a popular monitoring system.": "Find the endpoint that serves usage data to be scraped by a popular monitoring system.", + "Try to guess what URL the endpoint might have.": "Try to guess what URL the endpoint might have.", + "Look for a url parameter where its value appears in the page it is leading to.": "Look for a url parameter where its value appears in the page it is leading to.", + "Change the name of a user by performing Cross-Site Request Forgery from another origin.": "Change the name of a user by performing Cross-Site Request Forgery from another origin.", + "Use the bonus payload <iframe width="100%" height="166" scrolling="no" frameborder="no" allow="autoplay" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/771984076&color=%23ff5500&auto_play=true&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true"></iframe> in the DOM XSS challenge.": "Use the bonus payload <iframe width="100%" height="166" scrolling="no" frameborder="no" allow="autoplay" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/771984076&color=%23ff5500&auto_play=true&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true"></iframe> in the DOM XSS challenge.", + "Copy + Paste = Solved!": "Copy + Paste = Solved!", + "Obtain a Deluxe Membership without paying for it.": "Obtain a Deluxe Membership without paying for it.", + "Look closely at what happens when you attempt to upgrade your account.": "Look closely at what happens when you attempt to upgrade your account.", + " (This challenge is not available on Windows!)": " (This challenge is not available on Windows!)", + "Reset Uvogin's password via the Forgot Password mechanism with the original answer to his security question.": "Reset Uvogin's password via the Forgot Password mechanism with the original answer to his security question.", + "You might have to do some OSINT on his social media personas to find out his honest answer to the security question.": "You might have to do some OSINT on his social media personas to find out his honest answer to the security question.", + "Juice Shop Adversary Trading Card (Common)": "Juice Shop Adversary Trading Card (Common)", + "Common rarity \"Juice Shop\" card for the Adversary Trading Cards CCG.": "Common rarity \"Juice Shop\" card for the Adversary Trading Cards CCG.", + "Juice Shop Adversary Trading Card (Super Rare)": "Juice Shop Adversary Trading Card (Super Rare)", + "Super rare \"Juice Shop\" card with holographic foil-coating for the Adversary Trading Cards CCG.": "Super rare \"Juice Shop\" card with holographic foil-coating for the Adversary Trading Cards CCG.", + "OWASP Juice Shop \"King of the Hill\" Facemask": "OWASP Juice Shop \"King of the Hill\" Facemask", + "Facemask with compartment for filter from 50% cotton and 50% polyester.": "Facemask with compartment for filter from 50% cotton and 50% polyester.", + "Determine the answer to John's security question by looking at an upload of him to the Photo Wall and use it to reset his password via the Forgot Password mechanism.": "Determine the answer to John's security question by looking at an upload of him to the Photo Wall and use it to reset his password via the Forgot Password mechanism.", + "Take a look at the meta data of the corresponding photo.": "Take a look at the meta data of the corresponding photo.", + "Determine the answer to Emma's security question by looking at an upload of her to the Photo Wall and use it to reset her password via the Forgot Password mechanism.": "Determine the answer to Emma's security question by looking at an upload of her to the Photo Wall and use it to reset her password via the Forgot Password mechanism.", + "Take a look at the details in the photo to determine the location of where it was taken.": "Take a look at the details in the photo to determine the location of where it was taken.", + "Juice Shop \"Permafrost\" 2020 Edition": "Juice Shop \"Permafrost\" 2020 Edition", + "Bypass a security control with a Poison Null Byte to access a file not meant for your eyes.": "Bypass a security control with a Poison Null Byte to access a file not meant for your eyes.", + "Best Juice Shop Salesman Artwork": "Best Juice Shop Salesman Artwork", + "Unique digital painting depicting Stan, our most qualified and almost profitable salesman. He made a succesful carreer in selling used ships, coffins, krypts, crosses, real estate, life insurance, restaurant supplies, voodoo enhanced asbestos and courtroom souvenirs before finally adding his expertise to the Juice Shop marketing team.": "Unique digital painting depicting Stan, our most qualified and almost profitable salesman. He made a succesful carreer in selling used ships, coffins, krypts, crosses, real estate, life insurance, restaurant supplies, voodoo enhanced asbestos and courtroom souvenirs before finally adding his expertise to the Juice Shop marketing team.", + "20th Anniversary Celebration Ticket": "20th Anniversary Celebration Ticket", + "Get your free 🎫 for OWASP 20th Anniversary Celebration online conference! Hear from world renowned keynotes and special speakers, network with your peers and interact with our event sponsors. With an anticipated 10k+ attendees from around the world, you will not want to miss this live on-line event!": "Get your free 🎫 for OWASP 20th Anniversary Celebration online conference! Hear from world renowned keynotes and special speakers, network with your peers and interact with our event sponsors. With an anticipated 10k+ attendees from around the world, you will not want to miss this live on-line event!", + "OWASP Juice Shop Card (non-foil)": "OWASP Juice Shop Card (non-foil)", + "Mythic rare (obviously...) card \"OWASP Juice Shop\" with three distinctly useful abilities. Alpha printing, mint condition. A true collectors piece to own!": "Mythic rare (obviously...) card \"OWASP Juice Shop\" with three distinctly useful abilities. Alpha printing, mint condition. A true collectors piece to own!", + "Line {{vulnLine}} is responsible for this vulnerability or security flaw. Select it and submit to proceed.": "Line {{vulnLine}} is responsible for this vulnerability or security flaw. Select it and submit to proceed.", + "Lines {{vulnLines}} are responsible for this vulnerability or security flaw. Select them and submit to proceed.": "Lines {{vulnLines}} are responsible for this vulnerability or security flaw. Select them and submit to proceed.", + "Receive a coupon code from the support chatbot.": "Receive a coupon code from the support chatbot.", + "Just keep asking.": "Just keep asking.", + "Permanently disable the support chatbot so that it can no longer answer customer queries.": "Permanently disable the support chatbot so that it can no longer answer customer queries.", + "Think of a way to get a hold of the internal workings on the chatbot API.": "Think of a way to get a hold of the internal workings on the chatbot API.", + "Gain read access to an arbitrary local file on the web server.": "Gain read access to an arbitrary local file on the web server.", + "You should read up on vulnerabilities in popular NodeJs template engines.": "You should read up on vulnerabilities in popular NodeJs template engines.", + "Try to identify where (potentially malicious) user input is coming into the code.": "Try to identify where (potentially malicious) user input is coming into the code.", + "What is the code doing with the user input other than using it to filter the data source?": "What is the code doing with the user input other than using it to filter the data source?", + "Look for a line where the developers fiddled with Angular's built-in security model.": "Look for a line where the developers fiddled with Angular's built-in security model.", + "Using bypassSecurityTrustStyle() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. If at all, this switch might only accidentally keep XSS prevention intact. The context where the parameter is used is not CSS, making this switch totally pointless.": "Using bypassSecurityTrustStyle() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. If at all, this switch might only accidentally keep XSS prevention intact. The context where the parameter is used is not CSS, making this switch totally pointless.", + "Using bypassSecurityTrustResourceUrl() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. This switch might only accidentally keep XSS prevention intact, but the new URL context does not make any sense here.": "Using bypassSecurityTrustResourceUrl() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. This switch might only accidentally keep XSS prevention intact, but the new URL context does not make any sense here.", + "Using bypassSecurityTrustScript() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. If at all, this switch might only accidentally keep XSS prevention intact. The context where the parameter is used is not a script either, so this switch would be nonsensical.": "Using bypassSecurityTrustScript() instead of bypassSecurityTrustHtml() changes the context for which input sanitization is bypassed. If at all, this switch might only accidentally keep XSS prevention intact. The context where the parameter is used is not a script either, so this switch would be nonsensical.", + "Removing the bypass of sanitization entirely is the best way to fix this vulnerability. Fiddling with Angular's built-in sanitization was entirely unnecessary as the user input for a text search should not be expected to contain HTML that needs to be rendered but merely plain text.": "Removing the bypass of sanitization entirely is the best way to fix this vulnerability. Fiddling with Angular's built-in sanitization was entirely unnecessary as the user input for a text search should not be expected to contain HTML that needs to be rendered but merely plain text.", + "Can you identify one or more routes which have something to do with log files?": "Can you identify one or more routes which have something to do with log files?", + "Did you spot the directory listing clearly linked to log files?": "Did you spot the directory listing clearly linked to log files?", + "Did you notice that there is a seperate route for retrieving individual log files?": "Did you notice that there is a seperate route for retrieving individual log files?", + "Make sure to select both lines responsible for the log file data leakage.": "Make sure to select both lines responsible for the log file data leakage.", + "Switching off the detailed view option is a cosmetic change on the directory listing but still allows the logs to be browsed and accessed.": "Switching off the detailed view option is a cosmetic change on the directory listing but still allows the logs to be browsed and accessed.", + "Removing the route that serves individual log files is likely to plumb the data leak but still provides information to the attacker unnecessarily.": "Removing the route that serves individual log files is likely to plumb the data leak but still provides information to the attacker unnecessarily.", + "Removing only the directory listing will still allow attackers to download individual log files if they can come up with a valid file name.": "Removing only the directory listing will still allow attackers to download individual log files if they can come up with a valid file name.", + "There should generally be no good reason to expose server logs through a web URL of the server itself, epecially not when that server is Internet-facing.": "There should generally be no good reason to expose server logs through a web URL of the server itself, epecially not when that server is Internet-facing.", + "Among the long list of route mappings, can you spot any that seem responsible for admin-related functionality?": "Among the long list of route mappings, can you spot any that seem responsible for admin-related functionality?", + "Luckily the route mappings were originally in alphabetical order before the developers forgot about that rule at some point.": "Luckily the route mappings were originally in alphabetical order before the developers forgot about that rule at some point.", + "Assuming that the original \"AdminGuard\" provided access control only to admin users, switching to \"LoginGuard\" seems like a downgrade that would give access to any authenticated user.": "Assuming that the original \"AdminGuard\" provided access control only to admin users, switching to \"LoginGuard\" seems like a downgrade that would give access to any authenticated user.", + "Obfuscating the path to the administration section does not add any security, even if it wasn't just a trivial Base64 encoding.": "Obfuscating the path to the administration section does not add any security, even if it wasn't just a trivial Base64 encoding.", + "This obfuscation attempt is hard to undo by hand but trivial when executed in a JavaScript console. Regardless, obfuscating the route does not add any level of security.": "This obfuscation attempt is hard to undo by hand but trivial when executed in a JavaScript console. Regardless, obfuscating the route does not add any level of security.", + "While attempts could be made to limit access to administrative functions of a web shop through access control, it is definitely safer to apply the \"separation of concerns\" pattern more strictly by internally hosting a distinct admin backend application with no Internet exposure.": "While attempts could be made to limit access to administrative functions of a web shop through access control, it is definitely safer to apply the \"separation of concerns\" pattern more strictly by internally hosting a distinct admin backend application with no Internet exposure.", + "Can you identify one or more routes which have something to do with file serving?": "Can you identify one or more routes which have something to do with file serving?", + "Did you notice that there are seperate routes the directory listing and retrieving individual files?": "Did you notice that there are seperate routes the directory listing and retrieving individual files?", + "Make sure to select both lines responsible for the data leakage.": "Make sure to select both lines responsible for the data leakage.", + "Removing only the directory listing will still allow attackers to download individual files if they can come up with a valid file name.": "Removing only the directory listing will still allow attackers to download individual files if they can come up with a valid file name.", + "Removing the routes that serve individual files is likely to plumb the data leak but still provides information to the attacker unnecessarily.": "Removing the routes that serve individual files is likely to plumb the data leak but still provides information to the attacker unnecessarily.", + "Switching off the icons is a cosmetic change on the directory listing but still allows the files to be browsed and accessed.": "Switching off the icons is a cosmetic change on the directory listing but still allows the files to be browsed and accessed.", + "Getting rid of the /ftp folder entirely is the only way to plumb this data leakage for good. Valid static content in it needs to be moved to a more suitable location and order confirmation PDFs had no business to be placed there publicly accessible in the first place. Everything else in that folder was just accidentally put & forgotten there anyway.": "Getting rid of the /ftp folder entirely is the only way to plumb this data leakage for good. Valid static content in it needs to be moved to a more suitable location and order confirmation PDFs had no business to be placed there publicly accessible in the first place. Everything else in that folder was just accidentally put & forgotten there anyway.", + "In the long list of API-handling middleware, try to find the ones dealing with products offered in the shop first.": "In the long list of API-handling middleware, try to find the ones dealing with products offered in the shop first.", + "API routes need to specifically define a handler for a HTTP verb if they wish to override the \"allow everything to everyone\" default behavior.": "API routes need to specifically define a handler for a HTTP verb if they wish to override the \"allow everything to everyone\" default behavior.", + "There is one line that is commented out for no good reason among the product-related middleware.": "There is one line that is commented out for no good reason among the product-related middleware.", + "While removing the commented-out line made the code cleaner, it did not change the functionality in any way and thus cannot have improved security either.": "While removing the commented-out line made the code cleaner, it did not change the functionality in any way and thus cannot have improved security either.", + "Removing all dedicated handling of the products API made things worse, as now the default permissions of the underlying API generator will be used: Allowing GET, POST, PUT and DELETE - without any restrictions.": "Removing all dedicated handling of the products API made things worse, as now the default permissions of the underlying API generator will be used: Allowing GET, POST, PUT and DELETE - without any restrictions.", + "You improved security slightly by no longer accepting PUT requests from anonymous API callers. But does the shop even want to allow its authenticated customers to change products themselves?": "You improved security slightly by no longer accepting PUT requests from anonymous API callers. But does the shop even want to allow its authenticated customers to change products themselves?", + "Disabling all HTTP verbs other than GET for the products API is indeed the only safe way to implement secure access control. Shop administrators should not use the customer facing web UI to manage the store's inventory anyway.": "Disabling all HTTP verbs other than GET for the products API is indeed the only safe way to implement secure access control. Shop administrators should not use the customer facing web UI to manage the store's inventory anyway.", + "Try to identify any variables in the code that might contain arbitrary user input.": "Try to identify any variables in the code that might contain arbitrary user input.", + "Follow the user input through the function call and try to spot places where it might be abused for malicious purposes.": "Follow the user input through the function call and try to spot places where it might be abused for malicious purposes.", + "Can you spot a place where a SQL query is being cobbled together in an unsafe way?": "Can you spot a place where a SQL query is being cobbled together in an unsafe way?", + "Trying to prevent any injection attacks with a custom-built blocklist mechanism is doomed to fail. It might work for some simpler attack payloads but an attacker with time and skills can likely bypass it at some point.": "Trying to prevent any injection attacks with a custom-built blocklist mechanism is doomed to fail. It might work for some simpler attack payloads but an attacker with time and skills can likely bypass it at some point.", + "Replacing the template string (`...`) notation with plain string concatenation (\"...\"+\"...\") does not change the behavior of the code in any way. It only makes the code less readable.": "Replacing the template string (`...`) notation with plain string concatenation (\"...\"+\"...\") does not change the behavior of the code in any way. It only makes the code less readable.", + "Using the built-in replacement (or binding) mechanism of Sequelize is equivalent to creating a Prepared Statement. This prevents tampering with the query syntax through malicious user input as it is \"set in stone\" before the criteria parameter is inserted.": "Using the built-in replacement (or binding) mechanism of Sequelize is equivalent to creating a Prepared Statement. This prevents tampering with the query syntax through malicious user input as it is \"set in stone\" before the criteria parameter is inserted.", + "Can you find a HTTP route mapping that deals with metrics?": "Can you find a HTTP route mapping that deals with metrics?", + "Remember: The default behavior of route mappings is to allow access to everyone.": "Remember: The default behavior of route mappings is to allow access to everyone.", + "The metrics route remains publicly accessible. This change only messes with functional settings of the measurement framework unnecessarily.": "The metrics route remains publicly accessible. This change only messes with functional settings of the measurement framework unnecessarily.", + "This fix prevents unauthorized access to the metrics route but overshoots the goal by locking out everyone - including administrators.": "This fix prevents unauthorized access to the metrics route but overshoots the goal by locking out everyone - including administrators.", + "Access will now be restricted only to users with administrator permissions, which seems reasonable protection, assuming that it is not possible for a regular user to escalate admin priviliges. If that were a risk, the metrics should better be stored behind the scenes not be made accessible via the shop application at all.": "Access will now be restricted only to users with administrator permissions, which seems reasonable protection, assuming that it is not possible for a regular user to escalate admin priviliges. If that were a risk, the metrics should better be stored behind the scenes not be made accessible via the shop application at all.", + "Do you remember the security question that Bender used for his account?": "Do you remember the security question that Bender used for his account?", + "This question is the source of the security risk in this challenge.": "This question is the source of the security risk in this challenge.", + "While not necessarily as trivial to research via a user's LinkedIn profile, the question is still easy to research or brute force when answered truthfully.": "While not necessarily as trivial to research via a user's LinkedIn profile, the question is still easy to research or brute force when answered truthfully.", + "Exchanging \"company\" with \"organization\" is only a vocabulary change and has no effect on security.": "Exchanging \"company\" with \"organization\" is only a vocabulary change and has no effect on security.", + "When answered truthfully, all security questions are susceptible to online research (on Facebook, LinkedIn etc.) and often even brute force. If at all, they should not be used as the only factor for a security-relevant function.": "When answered truthfully, all security questions are susceptible to online research (on Facebook, LinkedIn etc.) and often even brute force. If at all, they should not be used as the only factor for a security-relevant function.", + "Can you identify the lines which have something to do with crypto currency addresses?": "Can you identify the lines which have something to do with crypto currency addresses?", + "Did you notice there is a constant containing allowed redirect web addresses?": "Did you notice there is a constant containing allowed redirect web addresses?", + "Make sure to select all three lines responsible for crypto currency addresses which are not promoted any longer.": "Make sure to select all three lines responsible for crypto currency addresses which are not promoted any longer.", + "This fix removes one deprecated crypto currency address from the allow list but forgets to deal with two other ones.": "This fix removes one deprecated crypto currency address from the allow list but forgets to deal with two other ones.", + "When cleaning up any allow list of deprecated entries, it is crucial to be thorough and re-check the list regularly. Otherwise allow lists tend to become weaker over time.": "When cleaning up any allow list of deprecated entries, it is crucial to be thorough and re-check the list regularly. Otherwise allow lists tend to become weaker over time.", + "This fix uses the binding mechanism of Sequelize to create the equivalent of a Prepared Statement, which is great. Unfortunately this fix also introduces a critical functional bug into the authentication process.": "This fix uses the binding mechanism of Sequelize to create the equivalent of a Prepared Statement, which is great. Unfortunately this fix also introduces a critical functional bug into the authentication process.", + "This fix unfortunately goes only half the way to using the binding mechanism of Sequelize. Such a Prepared Statement still concatenated from user input, is still wide open for SQL Injection attacks.": "This fix unfortunately goes only half the way to using the binding mechanism of Sequelize. Such a Prepared Statement still concatenated from user input, is still wide open for SQL Injection attacks.", + "This fix unfortunately goes only half the way to using the replacement mechanism of Sequelize. Such a Prepared Statement still concatenated from user input, is still wide open for SQL Injection attacks.": "This fix unfortunately goes only half the way to using the replacement mechanism of Sequelize. Such a Prepared Statement still concatenated from user input, is still wide open for SQL Injection attacks.", + "Turning off the \"plain\" flag will let Sequelize return all matching rows instead of just the first one. This neither makes sense from a functional point of view in a login function, not could it prevent SQL Injection attacks.": "Turning off the \"plain\" flag will let Sequelize return all matching rows instead of just the first one. This neither makes sense from a functional point of view in a login function, not could it prevent SQL Injection attacks.", + "Using the built-in binding (or replacement) mechanism of Sequelize is equivalent to creating a Prepared Statement. This prevents tampering with the query syntax through malicious user input as it is \"set in stone\" before the criteria parameter is inserted.": "Using the built-in binding (or replacement) mechanism of Sequelize is equivalent to creating a Prepared Statement. This prevents tampering with the query syntax through malicious user input as it is \"set in stone\" before the criteria parameter is inserted.", + "Using bypassSecurityTrustSoundCloud() instead of bypassSecurityTrustHtml() supposedly bypasses sanitization to allow only content from that service provider. Not surprisingly, there is no such vendor-specific function bypassSecurityTrustSoundCloud() offered by the Angular DomSanitizer.": "Using bypassSecurityTrustSoundCloud() instead of bypassSecurityTrustHtml() supposedly bypasses sanitization to allow only content from that service provider. Not surprisingly, there is no such vendor-specific function bypassSecurityTrustSoundCloud() offered by the Angular DomSanitizer.", + "Using bypassSecurityTrustIframe() instead of bypassSecurityTrustHtml() supposedly bypasses sanitization to allow only