The application does not adequately validate user input. Exploit a logic flaw in its account registration process to gain access to administrative functionality.

Poisoning a cache with multiple malicious responses simultaneously. The website is vulnerable to DOM-XSS due to the way the initTranslations() function handles data from the JSON file for all languages except English, and the home page sometimes uses backslashes as a folder separator. The server normalises these to forward slashes using a redirect. As a result, setting a language request with backward slash that redirects to the proper language path in a 302 response is cacheable and can be used to force other users to the another language version of the home page.

This application uses a serialisation-based session mechanism and loads the Apache Commons Collections library.

This application uses a serialisation-based session mechanism and is vulnerable to arbitrary object injection as a result.

The application uses a serialisation-based session mechanism and is vulnerable to authentication bypass as a result.

This application uses a serialisation-based session mechanism and a certain feature invokes a dangerous method on data provided in a serialised object.

The application uses a serialisation-based session mechanism and is vulnerable to privilege escalation as a result.

Another application vulnerable to web cache poisoning. An attacker can poison the internal cache so that the home page executes alert(document.cookie) in a victim's browser.

If an application directly reflects the value of an unkeyed header in the response, it opens the door to cache poisoning. Its value is not part of the cache key. If the attacker sends a request where only this header is maliciously modified, the response to this request will be cached, with the malicious payload targeting, for example, an XSS vulnerability. Users subsequently requesting content that matches the same cache key will receive the malicious version from the cache.

This lab contains multiple independent vulnerabilities, including cache key injection. The vulnerabilities are combined to execute an alert(1) in a victim's browser.