ZAP Scanning Report

Risk Level	Number of Alerts
High	2
Medium	7
Low	6
Informational	7

Name	Risk Level	Number of Instances
Cloud Metadata Potentially Exposed	High	11
SQL Injection - SQLite	High	4
CSP: Wildcard Directive	Medium	2
Content Security Policy (CSP) Header Not Set	Medium	157
Cross-Domain Misconfiguration	Medium	108
Hidden File Found	Medium	12
Missing Anti-clickjacking Header	Medium	95
Session ID in URL Rewrite	Medium	285
Vulnerable JS Library	Medium	1
Application Error Disclosure	Low	1
Cross-Domain JavaScript Source File Inclusion	Low	106
Private IP Disclosure	Low	1
Strict-Transport-Security Header Not Set	Low	20
Timestamp Disclosure - Unix	Low	13
X-Content-Type-Options Header Missing	Low	292
Authentication Request Identified	Informational	1
Information Disclosure - Suspicious Comments	Informational	4
Modern Web Application	Informational	54
Re-examine Cache-control Directives	Informational	17
Retrieved from Cache	Informational	102
Session Management Response Identified	Informational	9
User Agent Fuzzer	Informational	336

Name	Rule Type	Threshold	Strength
Directory Browsing	Active	MEDIUM	MEDIUM
CRLF Injection	Active	MEDIUM	MEDIUM
Path Traversal	Active	MEDIUM	MEDIUM
Remote File Inclusion	Active	MEDIUM	MEDIUM
Parameter Tampering	Active	MEDIUM	MEDIUM
Server Side Include	Active	MEDIUM	MEDIUM
GET for POST	Active	MEDIUM	MEDIUM
Cross Site Scripting (Reflected)	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent)	Active	MEDIUM	MEDIUM
Script Active Scan Rules	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Prime	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Spider	Active	MEDIUM	MEDIUM
SQL Injection - MySQL	Active	MEDIUM	MEDIUM
SQL Injection - Hypersonic SQL	Active	MEDIUM	MEDIUM
SQL Injection - Oracle	Active	MEDIUM	MEDIUM
SQL Injection - PostgreSQL	Active	MEDIUM	MEDIUM
SQL Injection - SQLite	Active	MEDIUM	MEDIUM
Cross Site Scripting (DOM Based)	Active	MEDIUM	MEDIUM
SQL Injection - MsSQL	Active	MEDIUM	MEDIUM
ELMAH Information Leak	Active	MEDIUM	MEDIUM
Trace.axd Information Leak	Active	MEDIUM	MEDIUM
XSLT Injection	Active	MEDIUM	MEDIUM
.htaccess Information Leak	Active	MEDIUM	MEDIUM
.env Information Leak	Active	MEDIUM	MEDIUM
Server Side Code Injection	Active	MEDIUM	MEDIUM
XPath Injection	Active	MEDIUM	MEDIUM
Remote OS Command Injection	Active	MEDIUM	MEDIUM
XML External Entity Attack	Active	MEDIUM	MEDIUM
Generic Padding Oracle	Active	MEDIUM	MEDIUM
Spring Actuator Information Leak	Active	MEDIUM	MEDIUM
SOAP Action Spoofing	Active	MEDIUM	MEDIUM
Log4Shell	Active	MEDIUM	MEDIUM
SOAP XML Injection	Active	MEDIUM	MEDIUM
Spring4Shell	Active	MEDIUM	MEDIUM
Heartbleed OpenSSL Vulnerability	Active	MEDIUM	MEDIUM
Buffer Overflow	Active	MEDIUM	MEDIUM
Source Code Disclosure - CVE-2012-1823	Active	MEDIUM	MEDIUM
Format String Error	Active	MEDIUM	MEDIUM
Server Side Template Injection	Active	MEDIUM	MEDIUM
Remote Code Execution - CVE-2012-1823	Active	MEDIUM	MEDIUM
External Redirect	Active	MEDIUM	MEDIUM
Server Side Template Injection (Blind)	Active	MEDIUM	MEDIUM
Source Code Disclosure - /WEB-INF Folder	Active	MEDIUM	MEDIUM
Verification Request Identified	Passive	MEDIUM	-
Insecure JSF ViewState	Passive	MEDIUM	-
Charset Mismatch	Passive	MEDIUM	-
Cookie No HttpOnly Flag	Passive	MEDIUM	-
Cookie Without Secure Flag	Passive	MEDIUM	-
Content-Type Header Missing	Passive	MEDIUM	-
Information Disclosure - Debug Error Messages	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in URL	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in HTTP Referrer Header	Passive	MEDIUM	-
Open Redirect	Passive	MEDIUM	-
Cookie Poisoning	Passive	MEDIUM	-
User Controllable Charset	Passive	MEDIUM	-
WSDL File Detection	Passive	MEDIUM	-
User Controllable HTML Element Attribute (Potential XSS)	Passive	MEDIUM	-
Loosely Scoped Cookie	Passive	MEDIUM	-
Viewstate	Passive	MEDIUM	-
Directory Browsing	Passive	MEDIUM	-
Heartbleed OpenSSL Vulnerability (Indicative)	Passive	MEDIUM	-
HTTP Server Response Header	Passive	MEDIUM	-
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)	Passive	MEDIUM	-
X-Backend-Server Header Information Leak	Passive	MEDIUM	-
Secure Pages Include Mixed Content	Passive	MEDIUM	-
HTTP to HTTPS Insecure Transition in Form Post	Passive	MEDIUM	-
HTTPS to HTTP Insecure Transition in Form Post	Passive	MEDIUM	-
User Controllable JavaScript Event (XSS)	Passive	MEDIUM	-
Big Redirect Detected (Potential Sensitive Information Leak)	Passive	MEDIUM	-
X-ChromeLogger-Data (XCOLD) Header Information Leak	Passive	MEDIUM	-
Cookie without SameSite Attribute	Passive	MEDIUM	-
X-Debug-Token Information Leak	Passive	MEDIUM	-
Username Hash Found	Passive	MEDIUM	-
X-AspNet-Version Response Header	Passive	MEDIUM	-
PII Disclosure	Passive	MEDIUM	-
Script Passive Scan Rules	Passive	MEDIUM	-
Stats Passive Scan Rule	Passive	MEDIUM	-
Absence of Anti-CSRF Tokens	Passive	MEDIUM	-
Hash Disclosure	Passive	MEDIUM	-
Weak Authentication Method	Passive	MEDIUM	-
Reverse Tabnabbing	Passive	MEDIUM	-

Sites

https://clients1.google.com

HTTP Response Code	Number of Responses
200 OK	1

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

https://update.googleapis.com

HTTP Response Code	Number of Responses
200 OK	2

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

https://optimizationguide-pa.googleapis.com

HTTP Response Code	Number of Responses
200 OK	10

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

https://content-autofill.googleapis.com

HTTP Response Code	Number of Responses
200 OK	12

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

https://accounts.google.com

HTTP Response Code	Number of Responses
200 OK	1

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

https://cdnjs.cloudflare.com

HTTP Response Code	Number of Responses
200 OK	205

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

http://localhost:3000

HTTP Response Code	Number of Responses
304 Not Modified	961
403 Forbidden	1237
404 Not Found	256
405 Method Not Allowed	272
101 Switching Protocols	313
200 OK	54059
301 Moved Permanently	788
400 Bad Request	14198
500 Internal Server Error	2482
401 Unauthorized	1422

Authentication Statistics	Number of Responses
!reports.report.stats.auth.sessiontoken.authentication.token!	1
!reports.report.stats.auth.sessiontoken.token!	15

Parameter Name	Type	Times Used	# Values
cookieconsent_status	Cookie	689	1
language	Cookie	1443	1
token	Cookie	30	1
welcomebanner_status	Cookie	341	1
EIO	URL	374	1
name	URL	87	1
q	URL	68	1
sid	URL	285	70
t	URL	304	300
transport	URL	374	2
Accept-Ranges	Header	854	1
Access-Control-Allow-Origin	Header	1946	2
Cache-Control	Header	854	1
Connection	Header	2016	2
Content-Length	Header	952	51
Content-Security-Policy	Header	2	1
Content-Type	Header	985	15
Date	Header	1946	77
ETag	Header	1639	43
Feature-Policy	Header	1661	1
Keep-Alive	Header	1946	1
Last-Modified	Header	854	3
Location	Header	2	2
Sec-WebSocket-Accept	Header	70	70
Upgrade	Header	70	1
Vary	Header	816	2
X-Content-Type-Options	Header	1661	1
X-Frame-Options	Header	1661	1
X-Recruiting	Header	1661	1
content-length	Header	33	4

Alert Detail

High	Cloud Metadata Potentially Exposed
Description	The Cloud Metadata Attack attempts to abuse a misconfigured NGINX server in order to access the instance metadata maintained by cloud service providers such as AWS, GCP and Azure. All of these providers provide metadata via an internal unroutable IP address '169.254.169.254' - this can be exposed by incorrectly configured NGINX servers and accessed by using this IP address in the Host header field.

URL	http://localhost:3000/latest/meta-data/
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 556 bytes.	GET http://localhost:3000/latest/meta-data/ HTTP/1.1 host: 169.254.169.254 Proxy-Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost:3000/ Accept-Language: en-US,en;q=0.9
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:14:40 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIrV
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 568 bytes.	GET http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIrV HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:28:02 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIsi&sid=5cC22cXjPnGwQSu3AAKZ
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 593 bytes.	GET http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIsi&sid=5cC22cXjPnGwQSu3AAKZ HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:26:39 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukjC
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 1,354 bytes.	GET http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukjC HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiJmb28iLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMjcuMC4wLjEiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MTI6MjkuNDY2ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MzM6MzcuMDg2ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTcxNDc0NTY1NX0.c-3xiM6JnYmk6XbuPvdtQHGKFiP10i1DRFAzfCw1L4hDlDoup6fp7xYusKUjNwGfWtmBPJ3-KcaKOB4iKYsCVUhgwmUlTYMupE6-0OONtEiHuHSYYgDVAo7x-P7GCBwU4OSzR5Ak7IdqtKZs2qz3KmDSJT6MAj6gtx93YI0_uRM
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 14:36:48 GMT ETag: W/"ea4-18f3ee2e56a" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:41:48 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukmB&sid=GOS7U2yR94gA7yNmAAAC
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 1,379 bytes.	GET http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukmB&sid=GOS7U2yR94gA7yNmAAAC HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiJmb28iLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMjcuMC4wLjEiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MTI6MjkuNDY2ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MzM6MzcuMDg2ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTcxNDc0NTY1NX0.c-3xiM6JnYmk6XbuPvdtQHGKFiP10i1DRFAzfCw1L4hDlDoup6fp7xYusKUjNwGfWtmBPJ3-KcaKOB4iKYsCVUhgwmUlTYMupE6-0OONtEiHuHSYYgDVAo7x-P7GCBwU4OSzR5Ak7IdqtKZs2qz3KmDSJT6MAj6gtx93YI0_uRM
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 14:36:48 GMT ETag: W/"ea4-18f3ee2e56a" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:41:24 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?name=Score%20Board
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 562 bytes.	GET http://localhost:3000/latest/meta-data/?name=Score%20Board HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:24:16 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?q=
Method	GET
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 2,125 bytes.	GET http://localhost:3000/latest/meta-data/?q= HTTP/1.1 host: 169.254.169.254 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiJmb28iLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMjcuMC4wLjEiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MTI6MjkuNDY2ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MzM6MzcuMDg2ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTcxNDc0NTY1NX0.c-3xiM6JnYmk6XbuPvdtQHGKFiP10i1DRFAzfCw1L4hDlDoup6fp7xYusKUjNwGfWtmBPJ3-KcaKOB4iKYsCVUhgwmUlTYMupE6-0OONtEiHuHSYYgDVAo7x-P7GCBwU4OSzR5Ak7IdqtKZs2qz3KmDSJT6MAj6gtx93YI0_uRM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiJmb28iLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMjcuMC4wLjEiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MTI6MjkuNDY2ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MzM6MzcuMDg2ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTcxNDc0NTY1NX0.c-3xiM6JnYmk6XbuPvdtQHGKFiP10i1DRFAzfCw1L4hDlDoup6fp7xYusKUjNwGfWtmBPJ3-KcaKOB4iKYsCVUhgwmUlTYMupE6-0OONtEiHuHSYYgDVAo7x-P7GCBwU4OSzR5Ak7IdqtKZs2qz3KmDSJT6MAj6gtx93YI0_uRM
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:27:53 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/
Method	POST
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 679 bytes.	POST http://localhost:3000/latest/meta-data/ HTTP/1.1 host: 169.254.169.254 Connection: keep-alive Content-Length: 51 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss
Request Body - size: 51 bytes.	{"email":"admin@juice-sh.op","password":"admin123"}
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:24:36 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-n2dt&sid=yn9UCvlQawB5ReBLAAB-
Method	POST
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 727 bytes.	POST http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-n2dt&sid=yn9UCvlQawB5ReBLAAB- HTTP/1.1 host: 169.254.169.254 Proxy-Connection: keep-alive Content-Length: 1 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / Content-type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; cookieconsent_status=dismiss
Request Body - size: 1 bytes.	1
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:04:52 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIsh&sid=5cC22cXjPnGwQSu3AAKZ
Method	POST
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 685 bytes.	POST http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-qIsh&sid=5cC22cXjPnGwQSu3AAKZ HTTP/1.1 host: 169.254.169.254 Connection: keep-alive Content-Length: 2 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / Content-type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en
Request Body - size: 2 bytes.	40
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:26:43 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukkd&sid=GOS7U2yR94gA7yNmAAAC
Method	POST
Parameter
Attack	169.254.169.254
Evidence
Show / hide Request and Response
Request Header - size: 1,471 bytes.	POST http://localhost:3000/latest/meta-data/?EIO=4&transport=polling&t=Oy-ukkd&sid=GOS7U2yR94gA7yNmAAAC HTTP/1.1 host: 169.254.169.254 Connection: keep-alive Content-Length: 2 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: / Content-type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiJmb28iLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMjcuMC4wLjEiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHRBZG1pbi5wbmciLCJ0b3RwU2VjcmV0IjoiIiwiaXNBY3RpdmUiOnRydWUsImNyZWF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MTI6MjkuNDY2ICswMDowMCIsInVwZGF0ZWRBdCI6IjIwMjQtMDUtMDMgMDk6MzM6MzcuMDg2ICswMDowMCIsImRlbGV0ZWRBdCI6bnVsbH0sImlhdCI6MTcxNDc0NTY1NX0.c-3xiM6JnYmk6XbuPvdtQHGKFiP10i1DRFAzfCw1L4hDlDoup6fp7xYusKUjNwGfWtmBPJ3-KcaKOB4iKYsCVUhgwmUlTYMupE6-0OONtEiHuHSYYgDVAo7x-P7GCBwU4OSzR5Ak7IdqtKZs2qz3KmDSJT6MAj6gtx93YI0_uRM
Request Body - size: 2 bytes.	40
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 14:36:48 GMT ETag: W/"ea4-18f3ee2e56a" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:41:36 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
Instances	11
Solution	Do not trust any user data in NGINX configs. In this case it is probably the use of the $host variable which is set from the 'Host' header and can be controlled by an attacker.
Reference	https://www.nginx.com/blog/trust-no-one-perils-of-trusting-user-input/
Tags	OWASP_2021_A05 OWASP_2017_A06
CWE Id
WASC Id
Plugin Id	90034

High	SQL Injection - SQLite
Description	SQL injection may be possible.

URL	http://localhost:3000/rest/products/search?q=%27%28
Method	GET
Parameter	q
Attack	'(
Evidence	SQLITE_ERROR
Show / hide Request and Response
Request Header - size: 567 bytes.	GET http://localhost:3000/rest/products/search?q=%27%28 HTTP/1.1 host: localhost:3000 Proxy-Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost:3000/ Accept-Language: en-US,en;q=0.9
Request Body - size: 0 bytes.
Response Header - size: 362 bytes.	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: application/json; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:04:17 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 309
Response Body - size: 309 bytes.	{ "error": { "message": "SQLITE_ERROR: near \"(\": syntax error", "stack": "Error: SQLITE_ERROR: near \"(\": syntax error", "errno": 1, "code": "SQLITE_ERROR", "sql": "SELECT * FROM Products WHERE ((name LIKE '%'(%' OR description LIKE '%'(%') AND deletedAt IS NULL) ORDER BY name" } }
URL	http://localhost:3000/rest/user/login
Method	POST
Parameter	email
Attack	'
Evidence	SQLITE_ERROR
Show / hide Request and Response
Request Header - size: 676 bytes.	POST http://localhost:3000/rest/user/login HTTP/1.1 host: localhost:3000 Connection: keep-alive content-length: 35 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss
Request Body - size: 35 bytes.	{"email":"'","password":"admin123"}
Response Header - size: 363 bytes.	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: application/json; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:23:36 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 1250
Response Body - size: 1,250 bytes.	{ "error": { "message": "SQLITE_ERROR: unrecognized token: \"0192023a7bbd73250516f069df18b500\"", "stack": "Error\n at Database.<anonymous> (C:\\code\\juice-shop_16.0.0\\node_modules\\sequelize\\lib\\dialects\\sqlite\\query.js:185:27)\n at C:\\code\\juice-shop_16.0.0\\node_modules\\sequelize\\lib\\dialects\\sqlite\\query.js:183:50\n at new Promise (<anonymous>)\n at Query.run (C:\\code\\juice-shop_16.0.0\\node_modules\\sequelize\\lib\\dialects\\sqlite\\query.js:183:12)\n at C:\\code\\juice-shop_16.0.0\\node_modules\\sequelize\\lib\\sequelize.js:315:28\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)", "name": "SequelizeDatabaseError", "parent": { "errno": 1, "code": "SQLITE_ERROR", "sql": "SELECT * FROM Users WHERE email = ''' AND password = '0192023a7bbd73250516f069df18b500' AND deletedAt IS NULL" }, "original": { "errno": 1, "code": "SQLITE_ERROR", "sql": "SELECT * FROM Users WHERE email = ''' AND password = '0192023a7bbd73250516f069df18b500' AND deletedAt IS NULL" }, "sql": "SELECT * FROM Users WHERE email = ''' AND password = '0192023a7bbd73250516f069df18b500' AND deletedAt IS NULL", "parameters": {} } }
URL	http://localhost:3000/api/Challenges/?name=Score%20Board
Method	GET
Parameter	name
Attack	case randomblob(1000000) when not null then 1 else 1 end
Evidence	The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [265] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [696] milliseconds, when the original unmodified query with value [Score Board] took [91] milliseconds.
Show / hide Request and Response
Request Header - size: 607 bytes.	GET http://localhost:3000/api/Challenges/?name=case+randomblob%281000000%29+when+not+null+then+1+else+1+end+ HTTP/1.1 host: localhost:3000 Connection: keep-alive sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9
Request Body - size: 0 bytes.
Response Header - size: 384 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: application/json; charset=utf-8 Content-Length: 30 ETag: W/"1e-JkPcI+pGj7BBTxOuZTVVIm91zaY" Vary: Accept-Encoding Date: Fri, 03 May 2024 14:23:45 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 30 bytes.	{"status":"success","data":[]}
URL	http://localhost:3000/rest/user/login
Method	POST
Parameter	email
Attack	case randomblob(100000000) when not null then 1 else 1 end
Evidence	The query time is controllable using parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [122] milliseconds, parameter value [case randomblob(1000000000) when not null then 1 else 1 end ], which caused the request to take [1,534] milliseconds, when the original unmodified query with value [admin@juice-sh.op] took [99] milliseconds.
Show / hide Request and Response
Request Header - size: 676 bytes.	POST http://localhost:3000/rest/user/login HTTP/1.1 host: localhost:3000 Connection: keep-alive content-length: 93 sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99" Accept: application/json, text/plain, / Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://localhost:3000 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://localhost:3000/ Accept-Language: en-US,en;q=0.9 Cookie: language=en; welcomebanner_status=dismiss
Request Body - size: 93 bytes.	{"email":"case randomblob(100000000) when not null then 1 else 1 end ","password":"admin123"}
Response Header - size: 387 bytes.	HTTP/1.1 401 Unauthorized Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Content-Length: 26 ETag: W/"1a-ARJvVK+smzAF3QQve2mDSG+3Eus" Vary: Accept-Encoding Date: Fri, 03 May 2024 14:40:43 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 26 bytes.	Invalid email or password.
Instances	4
Solution	Do not trust client side input, even if there is client side validation in place. In general, type check all data on the server side. If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?' If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries. If database Stored Procedures can be used, use them. Do not concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality! Do not create dynamic SQL queries using simple string concatenation. Escape all data received from the client. Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input. Apply the principle of least privilege by using the least privileged database user possible. In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact. Grant the minimum database access that is necessary for the application.
Reference	https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
Tags	OWASP_2021_A03 WSTG-v42-INPV-05 OWASP_2017_A01
CWE Id	89
WASC Id	19
Plugin Id	40018

Medium	CSP: Wildcard Directive
Description	Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

URL	http://localhost:3000/assets
Method	GET
Parameter	Content-Security-Policy
Attack
Evidence	default-src 'none'
Show / hide Request and Response
Request Header - size: 235 bytes.	GET http://localhost:3000/assets HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 416 bytes.	HTTP/1.1 301 Moved Permanently Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=UTF-8 Content-Length: 179 Content-Security-Policy: default-src 'none' Location: /assets/ Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 179 bytes.	<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Redirecting</title> </head> <body> <pre>Redirecting to <a href="/assets/">/assets/</a></pre> </body> </html>
URL	http://localhost:3000/assets/public
Method	GET
Parameter	Content-Security-Policy
Attack
Evidence	default-src 'none'
Show / hide Request and Response
Request Header - size: 242 bytes.	GET http://localhost:3000/assets/public HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 423 bytes.	HTTP/1.1 301 Moved Permanently Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=UTF-8 Content-Length: 193 Content-Security-Policy: default-src 'none' Location: /assets/public/ Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 193 bytes.	<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Redirecting</title> </head> <body> <pre>Redirecting to <a href="/assets/public/">/assets/public/</a></pre> </body> </html>
Instances	2
Solution	Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Reference	https://www.w3.org/TR/CSP/ https://caniuse.com/#search=content+security+policy https://content-security-policy.com/ https://github.com/HtmlUnit/htmlunit-csp https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Tags	OWASP_2021_A05 OWASP_2017_A06
CWE Id	693
WASC Id	15
Plugin Id	10055

Medium	Content Security Policy (CSP) Header Not Set
Description	Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

URL	http://localhost:3000
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 228 bytes.	GET http://localhost:3000 HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 229 bytes.	GET http://localhost:3000/ HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:27 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 275 bytes.	GET http://localhost:3000/assets/ HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 402 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 374 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 381 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 386 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 384 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 384 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 383 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 346 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 353 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 358 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 356 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 356 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 355 bytes.	GET http://localhost:3000/assets/assets/public/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 304 bytes.	GET http://localhost:3000/assets/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 325 bytes.	GET http://localhost:3000/assets/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 330 bytes.	GET http://localhost:3000/assets/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 328 bytes.	GET http://localhost:3000/assets/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 328 bytes.	GET http://localhost:3000/assets/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 327 bytes.	GET http://localhost:3000/assets/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 283 bytes.	GET http://localhost:3000/assets/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 288 bytes.	GET http://localhost:3000/assets/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 289 bytes.	GET http://localhost:3000/assets/public/ HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 416 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 388 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 395 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 400 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 398 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 398 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 397 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 360 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 367 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 372 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 370 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 370 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 369 bytes.	GET http://localhost:3000/assets/public/assets/public/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:33 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/favicon_js.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 318 bytes.	GET http://localhost:3000/assets/public/assets/public/favicon_js.ico HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 339 bytes.	GET http://localhost:3000/assets/public/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 344 bytes.	GET http://localhost:3000/assets/public/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 342 bytes.	GET http://localhost:3000/assets/public/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 342 bytes.	GET http://localhost:3000/assets/public/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 341 bytes.	GET http://localhost:3000/assets/public/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/assets/public/favicon_js.ico
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/main.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 297 bytes.	GET http://localhost:3000/assets/public/main.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/polyfills.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 302 bytes.	GET http://localhost:3000/assets/public/polyfills.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 300 bytes.	GET http://localhost:3000/assets/public/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 300 bytes.	GET http://localhost:3000/assets/public/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/public/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 299 bytes.	GET http://localhost:3000/assets/public/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/public/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/runtime.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 286 bytes.	GET http://localhost:3000/assets/runtime.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/styles.css
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 286 bytes.	GET http://localhost:3000/assets/styles.css HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/assets/vendor.js
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 285 bytes.	GET http://localhost:3000/assets/vendor.js HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/assets/
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 14:02:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	http://localhost:3000/ftp
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 275 bytes.	GET http://localhost:3000/ftp HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/robots.txt
Request Body - size: 0 bytes.
Response Header - size: 338 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Content-Length: 11063 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:27 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 11,052 bytes.	<!DOCTYPE html> <html> <head> <meta charset='utf-8'> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>listing directory /ftp</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2, h3 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } h3 { margin: 5px 0 10px 0; padding-bottom: 5px; border-bottom: 1px solid #eee; font-size: 18px; } ul li { list-style: none; } ul li:hover { cursor: pointer; color: #2e2e2e; } ul li .path { padding-left: 5px; font-weight: bold; } ul li .line { padding-right: 5px; font-style: italic; } ul li:first-child .path { padding-left: 0; } p { line-height: 1.5; } a { color: #555; text-decoration: none; } a:hover { color: #303030; } #stacktrace { margin-top: 15px; } .directory h1 { margin-bottom: 15px; font-size: 18px; } ul#files { width: 100%; height: 100%; overflow: hidden; } ul#files li { float: left; width: 30%; line-height: 25px; margin: 1px; } ul#files li a { display: block; height: 25px; border: 1px solid transparent; -webkit-border-radius: 5px; -moz-border-radius: 5px; border-radius: 5px; overflow: hidden; white-space: nowrap; } ul#files li a:focus, ul#files li a:hover { background: rgba(255,255,255,0.65); border: 1px solid #ececec; } ul#files li a.highlight { -webkit-transition: background .4s ease-in-out; background: #ffff4f; border-color: #E9DC51; } #search { display: block; position: fixed; top: 20px; right: 20px; width: 90px; -webkit-transition: width ease 0.2s, opacity ease 0.4s; -moz-transition: width ease 0.2s, opacity ease 0.4s; -webkit-border-radius: 32px; -moz-border-radius: 32px; -webkit-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -moz-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -webkit-font-smoothing: antialiased; text-align: left; font: 13px "Helvetica Neue", Arial, sans-serif; padding: 4px 10px; border: none; background: transparent; margin-bottom: 0; outline: none; opacity: 0.7; color: #888; } #search:focus { width: 120px; opacity: 1.0; } /views/ #files span { display: inline-block; overflow: hidden; text-overflow: ellipsis; text-indent: 10px; } #files .name { background-repeat: no-repeat; } #files .icon .name { text-indent: 28px; } /tiles/ .view-tiles .name { width: 100%; background-position: 8px 5px; } .view-tiles .size, .view-tiles .date { display: none; } /details/ ul#files.view-details li { float: none; display: block; width: 90%; } ul#files.view-details li.header { height: 25px; background: #000; color: #fff; font-weight: bold; } .view-details .header { border-radius: 5px; } .view-details .name { width: 60%; background-position: 8px 5px; } .view-details .size { width: 10%; } .view-details .date { width: 30%; } .view-details .size, .view-details .date { text-align: right; direction: rtl; } /mobile/ @media (max-width: 768px) { body { font-size: 13px; line-height: 16px; padding: 0; } #search { position: static; width: 100%; font-size: 2em; line-height: 1.8em; text-indent: 10px; border: 0; border-radius: 0; padding: 10px 0; margin: 0; } #search:focus { width: 100%; border: 0; opacity: 1; } .directory h1 { font-size: 2em; line-height: 1.5em; color: #fff; background: #000; padding: 15px 10px; margin: 0; } ul#files { border-top: 1px solid #cacaca; } ul#files li { float: none; width: auto !important; display: block; border-bottom: 1px solid #cacaca; font-size: 2em; line-height: 1.2em; text-indent: 0; margin: 0; } ul#files li:nth-child(odd) { background: #e0e0e0; } ul#files li a { height: auto; border: 0; border-radius: 0; padding: 15px 10px; } ul#files li a:focus, ul#files li a:hover { border: 0; } #files .header, #files .size, #files .date { display: none !important; } #files .name { float: none; display: inline-block; width: 100%; text-indent: 0; background-position: 0 50%; } #files .icon .name { text-indent: 41px; } } #files .icon-directory .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC/xhBQAAAWtQTFRFAAAA/PPQ9Nhc2q402qQ12qs2/PTX2pg12p81+/LM89NE9dto2q82+/fp2rM22qY39d6U+/bo2qo2/frx/vz32q812qs12qE279SU8c4w9NZP+/LK//367s9y7s925cp0/vzw9t92//342po2/vz25s1579B6+OSO2bQ0/v799NyT8tE79dld8Msm+OrC/vzx79KA2IYs7s6I9d6R4cJe9+OF/PLI/fry79OF/v30//328tWB89RJ8c9p8c0u9eCf//7+9txs6sts5Mdr+++5+u2z/vrv+/fq6cFz8dBs8tA57cpq+OaU9uGs27Y8//799NdX/PbY9uB89unJ//z14sNf+emh+emk+vDc+uys9+OL8dJy89NH+eic8tN5+OaV+OWR9N2n9dtl9t529+KF9+GB9Nue9NdU8tR/9t5y89qW9dpj89iO89eG/vvu2pQ12Y4z/vzy2Ict/vvv48dr/vzz4sNg///+2Igty3PqwQAAAAF0Uk5TAEDm2GYAAACtSURBVBjTY2AgA2iYlJWVhfohBPg0yx38y92dS0pKVOVBAqIi6sb2vsWWpfrFeTI8QAEhYQEta28nCwM1OVleZqCAmKCEkUdwYWmhQnFeOStQgL9cySqkNNDHVJGbiY0FKCCuYuYSGRsV5KgjxcXIARRQNncNj09JTgqw0ZbkZAcK5LuFJaRmZqfHeNnpSucDBQoiEtOycnIz4qI9bfUKQA6pKKqAgqIKQyK8BgAZ5yfODmnHrQAAAABJRU5ErkJggg==); } #files .icon-text .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAADoSURBVBgZBcExblNBGAbA2ceegTRBuIKOgiihSZNTcC5LUHAihNJR0kGKCDcYJY6D3/77MdOinTvzAgCw8ysThIvn/VojIyMjIyPP+bS1sUQIV2s95pBDDvmbP/mdkft83tpYguZq5Jh/OeaYh+yzy8hTHvNlaxNNczm+la9OTlar1UdA/+C2A4trRCnD3jS8BB1obq2Gk6GU6QbQAS4BUaYSQAf4bhhKKTFdAzrAOwAxEUAH+KEM01SY3gM6wBsEAQB0gJ+maZoC3gI6iPYaAIBJsiRmHU0AALOeFC3aK2cWAACUXe7+AwO0lc9eTHYTAAAAAElFTkSuQmCC); } #files .icon-default .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAC4SURBVCjPdZFbDsIgEEWnrsMm7oGGfZrohxvU+Iq1TyjU60Bf1pac4Yc5YS4ZAtGWBMk/drQBOVwJlZrWYkLhsB8UV9K0BUrPGy9cWbng2CtEEUmLGppPjRwpbixUKHBiZRS0p+ZGhvs4irNEvWD8heHpbsyDXznPhYFOyTjJc13olIqzZCHBouE0FRMUjA+s1gTjaRgVFpqRwC8mfoXPPEVPS7LbRaJL2y7bOifRCTEli3U7BMWgLzKlW/CuebZPAAAAAElFTkSuQmCC); } </style> <script> function $(id){ var el = 'string' == typeof id ? document.getElementById(id) : id; el.on = function(event, fn){ if ('content loaded' == event) { event = window.attachEvent ? "load" : "DOMContentLoaded"; } el.addEventListener ? el.addEventListener(event, fn, false) : el.attachEvent("on" + event, fn); }; el.all = function(selector){ return $(el.querySelectorAll(selector)); }; el.each = function(fn){ for (var i = 0, len = el.length; i < len; ++i) { fn($(el[i]), i); } }; el.getClasses = function(){ return this.getAttribute('class').split(/\s+/); }; el.addClass = function(name){ var classes = this.getAttribute('class'); el.setAttribute('class', classes ? classes + ' ' + name : name); }; el.removeClass = function(name){ var classes = this.getClasses().filter(function(curr){ return curr != name; }); this.setAttribute('class', classes.join(' ')); }; return el; } function search() { var str = $('search').value.toLowerCase(); var links = $('files').all('a'); links.each(function(link){ var text = link.textContent.toLowerCase(); if ('..' == text) return; if (str.length && ~text.indexOf(str)) { link.addClass('highlight'); } else { link.removeClass('highlight'); } }); } $(window).on('content loaded', function(){ $('search').on('keyup', search); }); </script> </head> <body class="directory"> <input id="search" type="text" placeholder="Search" autocomplete="off" /> <div id="wrapper"> <h1><a href=".">~</a> / <a href="ftp">ftp</a></h1> <ul id="files" class="view-tiles"><li><a href="ftp/quarantine" class="icon icon-directory" title="quarantine"><span class="name">quarantine</span><span class="size"></span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/acquisitions.md" class="icon icon icon-md icon-text" title="acquisitions.md"><span class="name">acquisitions.md</span><span class="size">928</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/announcement_encrypted.md" class="icon icon icon-md icon-text" title="announcement_encrypted.md"><span class="name">announcement_encrypted.md</span><span class="size">370431</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/coupons_2013.md.bak" class="icon icon icon-bak icon-default" title="coupons_2013.md.bak"><span class="name">coupons_2013.md.bak</span><span class="size">142</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/eastere.gg" class="icon icon icon-gg icon-default" title="eastere.gg"><span class="name">eastere.gg</span><span class="size">337</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/encrypt.pyc" class="icon icon icon-pyc icon-default" title="encrypt.pyc"><span class="name">encrypt.pyc</span><span class="size">573</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/incident-support.kdbx" class="icon icon icon-kdbx icon-default" title="incident-support.kdbx"><span class="name">incident-support.kdbx</span><span class="size">3246</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/legal.md" class="icon icon icon-md icon-text" title="legal.md"><span class="name">legal.md</span><span class="size">3100</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/package.json.bak" class="icon icon icon-bak icon-default" title="package.json.bak"><span class="name">package.json.bak</span><span class="size">4468</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="ftp/suspicious_errors.yml" class="icon icon icon-yml icon-text" title="suspicious_errors.yml"><span class="name">suspicious_errors.yml</span><span class="size">741</span><span class="date">19/12/2023 13:12:16</span></a></li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 280 bytes.	GET http://localhost:3000/ftp/ HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp/quarantine
Request Body - size: 0 bytes.
Response Header - size: 338 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Content-Length: 11067 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:37 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 11,013 bytes.	<!DOCTYPE html> <html> <head> <meta charset='utf-8'> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>listing directory /ftp/</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2, h3 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } h3 { margin: 5px 0 10px 0; padding-bottom: 5px; border-bottom: 1px solid #eee; font-size: 18px; } ul li { list-style: none; } ul li:hover { cursor: pointer; color: #2e2e2e; } ul li .path { padding-left: 5px; font-weight: bold; } ul li .line { padding-right: 5px; font-style: italic; } ul li:first-child .path { padding-left: 0; } p { line-height: 1.5; } a { color: #555; text-decoration: none; } a:hover { color: #303030; } #stacktrace { margin-top: 15px; } .directory h1 { margin-bottom: 15px; font-size: 18px; } ul#files { width: 100%; height: 100%; overflow: hidden; } ul#files li { float: left; width: 30%; line-height: 25px; margin: 1px; } ul#files li a { display: block; height: 25px; border: 1px solid transparent; -webkit-border-radius: 5px; -moz-border-radius: 5px; border-radius: 5px; overflow: hidden; white-space: nowrap; } ul#files li a:focus, ul#files li a:hover { background: rgba(255,255,255,0.65); border: 1px solid #ececec; } ul#files li a.highlight { -webkit-transition: background .4s ease-in-out; background: #ffff4f; border-color: #E9DC51; } #search { display: block; position: fixed; top: 20px; right: 20px; width: 90px; -webkit-transition: width ease 0.2s, opacity ease 0.4s; -moz-transition: width ease 0.2s, opacity ease 0.4s; -webkit-border-radius: 32px; -moz-border-radius: 32px; -webkit-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -moz-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -webkit-font-smoothing: antialiased; text-align: left; font: 13px "Helvetica Neue", Arial, sans-serif; padding: 4px 10px; border: none; background: transparent; margin-bottom: 0; outline: none; opacity: 0.7; color: #888; } #search:focus { width: 120px; opacity: 1.0; } /views/ #files span { display: inline-block; overflow: hidden; text-overflow: ellipsis; text-indent: 10px; } #files .name { background-repeat: no-repeat; } #files .icon .name { text-indent: 28px; } /tiles/ .view-tiles .name { width: 100%; background-position: 8px 5px; } .view-tiles .size, .view-tiles .date { display: none; } /details/ ul#files.view-details li { float: none; display: block; width: 90%; } ul#files.view-details li.header { height: 25px; background: #000; color: #fff; font-weight: bold; } .view-details .header { border-radius: 5px; } .view-details .name { width: 60%; background-position: 8px 5px; } .view-details .size { width: 10%; } .view-details .date { width: 30%; } .view-details .size, .view-details .date { text-align: right; direction: rtl; } /mobile/ @media (max-width: 768px) { body { font-size: 13px; line-height: 16px; padding: 0; } #search { position: static; width: 100%; font-size: 2em; line-height: 1.8em; text-indent: 10px; border: 0; border-radius: 0; padding: 10px 0; margin: 0; } #search:focus { width: 100%; border: 0; opacity: 1; } .directory h1 { font-size: 2em; line-height: 1.5em; color: #fff; background: #000; padding: 15px 10px; margin: 0; } ul#files { border-top: 1px solid #cacaca; } ul#files li { float: none; width: auto !important; display: block; border-bottom: 1px solid #cacaca; font-size: 2em; line-height: 1.2em; text-indent: 0; margin: 0; } ul#files li:nth-child(odd) { background: #e0e0e0; } ul#files li a { height: auto; border: 0; border-radius: 0; padding: 15px 10px; } ul#files li a:focus, ul#files li a:hover { border: 0; } #files .header, #files .size, #files .date { display: none !important; } #files .name { float: none; display: inline-block; width: 100%; text-indent: 0; background-position: 0 50%; } #files .icon .name { text-indent: 41px; } } #files .icon-directory .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC/xhBQAAAWtQTFRFAAAA/PPQ9Nhc2q402qQ12qs2/PTX2pg12p81+/LM89NE9dto2q82+/fp2rM22qY39d6U+/bo2qo2/frx/vz32q812qs12qE279SU8c4w9NZP+/LK//367s9y7s925cp0/vzw9t92//342po2/vz25s1579B6+OSO2bQ0/v799NyT8tE79dld8Msm+OrC/vzx79KA2IYs7s6I9d6R4cJe9+OF/PLI/fry79OF/v30//328tWB89RJ8c9p8c0u9eCf//7+9txs6sts5Mdr+++5+u2z/vrv+/fq6cFz8dBs8tA57cpq+OaU9uGs27Y8//799NdX/PbY9uB89unJ//z14sNf+emh+emk+vDc+uys9+OL8dJy89NH+eic8tN5+OaV+OWR9N2n9dtl9t529+KF9+GB9Nue9NdU8tR/9t5y89qW9dpj89iO89eG/vvu2pQ12Y4z/vzy2Ict/vvv48dr/vzz4sNg///+2Igty3PqwQAAAAF0Uk5TAEDm2GYAAACtSURBVBjTY2AgA2iYlJWVhfohBPg0yx38y92dS0pKVOVBAqIi6sb2vsWWpfrFeTI8QAEhYQEta28nCwM1OVleZqCAmKCEkUdwYWmhQnFeOStQgL9cySqkNNDHVJGbiY0FKCCuYuYSGRsV5KgjxcXIARRQNncNj09JTgqw0ZbkZAcK5LuFJaRmZqfHeNnpSucDBQoiEtOycnIz4qI9bfUKQA6pKKqAgqIKQyK8BgAZ5yfODmnHrQAAAABJRU5ErkJggg==); } #files .icon-text .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAADoSURBVBgZBcExblNBGAbA2ceegTRBuIKOgiihSZNTcC5LUHAihNJR0kGKCDcYJY6D3/77MdOinTvzAgCw8ysThIvn/VojIyMjIyPP+bS1sUQIV2s95pBDDvmbP/mdkft83tpYguZq5Jh/OeaYh+yzy8hTHvNlaxNNczm+la9OTlar1UdA/+C2A4trRCnD3jS8BB1obq2Gk6GU6QbQAS4BUaYSQAf4bhhKKTFdAzrAOwAxEUAH+KEM01SY3gM6wBsEAQB0gJ+maZoC3gI6iPYaAIBJsiRmHU0AALOeFC3aK2cWAACUXe7+AwO0lc9eTHYTAAAAAElFTkSuQmCC); } #files .icon-default .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAC4SURBVCjPdZFbDsIgEEWnrsMm7oGGfZrohxvU+Iq1TyjU60Bf1pac4Yc5YS4ZAtGWBMk/drQBOVwJlZrWYkLhsB8UV9K0BUrPGy9cWbng2CtEEUmLGppPjRwpbixUKHBiZRS0p+ZGhvs4irNEvWD8heHpbsyDXznPhYFOyTjJc13olIqzZCHBouE0FRMUjA+s1gTjaRgVFpqRwC8mfoXPPEVPS7LbRaJL2y7bOifRCTEli3U7BMWgLzKlW/CuebZPAAAAAElFTkSuQmCC); } </style> <script> function $(id){ var el = 'string' == typeof id ? document.getElementById(id) : id; el.on = function(event, fn){ if ('content loaded' == event) { event = window.attachEvent ? "load" : "DOMContentLoaded"; } el.addEventListener ? el.addEventListener(event, fn, false) : el.attachEvent("on" + event, fn); }; el.all = function(selector){ return $(el.querySelectorAll(selector)); }; el.each = function(fn){ for (var i = 0, len = el.length; i < len; ++i) { fn($(el[i]), i); } }; el.getClasses = function(){ return this.getAttribute('class').split(/\s+/); }; el.addClass = function(name){ var classes = this.getAttribute('class'); el.setAttribute('class', classes ? classes + ' ' + name : name); }; el.removeClass = function(name){ var classes = this.getClasses().filter(function(curr){ return curr != name; }); this.setAttribute('class', classes.join(' ')); }; return el; } function search() { var str = $('search').value.toLowerCase(); var links = $('files').all('a'); links.each(function(link){ var text = link.textContent.toLowerCase(); if ('..' == text) return; if (str.length && ~text.indexOf(str)) { link.addClass('highlight'); } else { link.removeClass('highlight'); } }); } $(window).on('content loaded', function(){ $('search').on('keyup', search); }); </script> </head> <body class="directory"> <input id="search" type="text" placeholder="Search" autocomplete="off" /> <div id="wrapper"> <h1><a href=".">~</a> / <a href="">ftp</a> / </h1> <ul id="files" class="view-tiles"><li><a href="quarantine" class="icon icon-directory" title="quarantine"><span class="name">quarantine</span><span class="size"></span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="acquisitions.md" class="icon icon icon-md icon-text" title="acquisitions.md"><span class="name">acquisitions.md</span><span class="size">928</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="announcement_encrypted.md" class="icon icon icon-md icon-text" title="announcement_encrypted.md"><span class="name">announcement_encrypted.md</span><span class="size">370431</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="coupons_2013.md.bak" class="icon icon icon-bak icon-default" title="coupons_2013.md.bak"><span class="name">coupons_2013.md.bak</span><span class="size">142</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="eastere.gg" class="icon icon icon-gg icon-default" title="eastere.gg"><span class="name">eastere.gg</span><span class="size">337</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="encrypt.pyc" class="icon icon icon-pyc icon-default" title="encrypt.pyc"><span class="name">encrypt.pyc</span><span class="size">573</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="incident-support.kdbx" class="icon icon icon-kdbx icon-default" title="incident-support.kdbx"><span class="name">incident-support.kdbx</span><span class="size">3246</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="legal.md" class="icon icon icon-md icon-text" title="legal.md"><span class="name">legal.md</span><span class="size">3100</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="package.json.bak" class="icon icon icon-bak icon-default" title="package.json.bak"><span class="name">package.json.bak</span><span class="size">4468</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="suspicious_errors.yml" class="icon icon icon-yml icon-text" title="suspicious_errors.yml"><span class="name">suspicious_errors.yml</span><span class="size">741</span><span class="date">19/12/2023 13:12:16</span></a></li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/.%5C..
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 286 bytes.	GET http://localhost:3000/ftp/.%5C.. HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp/quarantine
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:37 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 3335
Response Body - size: 3,335 bytes.	<html> <head> <meta charset='utf-8'> <title>ForbiddenError: Forbidden</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> ForbiddenError: Forbidden</h2> <ul id="stacktrace"><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:125:19</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:346:12)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at serveIndexMiddleware (C:\code\juice-shop_16.0.0\build\server.js:250:9)</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:346:12)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\build\lib\antiCheat.js:71:5</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:346:12)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:646:15</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:265:14)</li><li>    at Function.handle (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:175:3)</li><li>    at router (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:47:12)</li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/coupons_2013.md.bak
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 288 bytes.	GET http://localhost:3000/ftp/coupons_2013.md.bak HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 2076
Response Body - size: 2,076 bytes.	<html> <head> <meta charset='utf-8'> <title>Error: Only .md and .pdf files are allowed!</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> Error: Only .md and .pdf files are allowed!</h2> <ul id="stacktrace"><li>    at verify (C:\code\juice-shop_16.0.0\build\routes\fileServer.js:55:18)</li><li>    at C:\code\juice-shop_16.0.0\build\routes\fileServer.js:39:13</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:365:14)</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:376:14)</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:421:3)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:145:39</li><li>    at FSReqCallback.oncomplete (node:fs:205:5)</li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/eastere.gg
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 279 bytes.	GET http://localhost:3000/ftp/eastere.gg HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 2076
Response Body - size: 2,076 bytes.	<html> <head> <meta charset='utf-8'> <title>Error: Only .md and .pdf files are allowed!</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> Error: Only .md and .pdf files are allowed!</h2> <ul id="stacktrace"><li>    at verify (C:\code\juice-shop_16.0.0\build\routes\fileServer.js:55:18)</li><li>    at C:\code\juice-shop_16.0.0\build\routes\fileServer.js:39:13</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:365:14)</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:376:14)</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:421:3)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:145:39</li><li>    at FSReqCallback.oncomplete (node:fs:205:5)</li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/encrypt.pyc
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 280 bytes.	GET http://localhost:3000/ftp/encrypt.pyc HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 2076
Response Body - size: 2,076 bytes.	<html> <head> <meta charset='utf-8'> <title>Error: Only .md and .pdf files are allowed!</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> Error: Only .md and .pdf files are allowed!</h2> <ul id="stacktrace"><li>    at verify (C:\code\juice-shop_16.0.0\build\routes\fileServer.js:55:18)</li><li>    at C:\code\juice-shop_16.0.0\build\routes\fileServer.js:39:13</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:365:14)</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:376:14)</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:421:3)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:145:39</li><li>    at FSReqCallback.oncomplete (node:fs:205:5)</li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/package.json.bak
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 285 bytes.	GET http://localhost:3000/ftp/package.json.bak HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 2076
Response Body - size: 2,076 bytes.	<html> <head> <meta charset='utf-8'> <title>Error: Only .md and .pdf files are allowed!</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> Error: Only .md and .pdf files are allowed!</h2> <ul id="stacktrace"><li>    at verify (C:\code\juice-shop_16.0.0\build\routes\fileServer.js:55:18)</li><li>    at C:\code\juice-shop_16.0.0\build\routes\fileServer.js:39:13</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:365:14)</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:376:14)</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:421:3)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:145:39</li><li>    at FSReqCallback.oncomplete (node:fs:205:5)</li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/quarantine
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 279 bytes.	GET http://localhost:3000/ftp/quarantine HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 337 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Content-Length: 9612 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 9,584 bytes.	<!DOCTYPE html> <html> <head> <meta charset='utf-8'> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <title>listing directory /ftp/quarantine</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2, h3 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } h3 { margin: 5px 0 10px 0; padding-bottom: 5px; border-bottom: 1px solid #eee; font-size: 18px; } ul li { list-style: none; } ul li:hover { cursor: pointer; color: #2e2e2e; } ul li .path { padding-left: 5px; font-weight: bold; } ul li .line { padding-right: 5px; font-style: italic; } ul li:first-child .path { padding-left: 0; } p { line-height: 1.5; } a { color: #555; text-decoration: none; } a:hover { color: #303030; } #stacktrace { margin-top: 15px; } .directory h1 { margin-bottom: 15px; font-size: 18px; } ul#files { width: 100%; height: 100%; overflow: hidden; } ul#files li { float: left; width: 30%; line-height: 25px; margin: 1px; } ul#files li a { display: block; height: 25px; border: 1px solid transparent; -webkit-border-radius: 5px; -moz-border-radius: 5px; border-radius: 5px; overflow: hidden; white-space: nowrap; } ul#files li a:focus, ul#files li a:hover { background: rgba(255,255,255,0.65); border: 1px solid #ececec; } ul#files li a.highlight { -webkit-transition: background .4s ease-in-out; background: #ffff4f; border-color: #E9DC51; } #search { display: block; position: fixed; top: 20px; right: 20px; width: 90px; -webkit-transition: width ease 0.2s, opacity ease 0.4s; -moz-transition: width ease 0.2s, opacity ease 0.4s; -webkit-border-radius: 32px; -moz-border-radius: 32px; -webkit-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -moz-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03); -webkit-font-smoothing: antialiased; text-align: left; font: 13px "Helvetica Neue", Arial, sans-serif; padding: 4px 10px; border: none; background: transparent; margin-bottom: 0; outline: none; opacity: 0.7; color: #888; } #search:focus { width: 120px; opacity: 1.0; } /views/ #files span { display: inline-block; overflow: hidden; text-overflow: ellipsis; text-indent: 10px; } #files .name { background-repeat: no-repeat; } #files .icon .name { text-indent: 28px; } /tiles/ .view-tiles .name { width: 100%; background-position: 8px 5px; } .view-tiles .size, .view-tiles .date { display: none; } /details/ ul#files.view-details li { float: none; display: block; width: 90%; } ul#files.view-details li.header { height: 25px; background: #000; color: #fff; font-weight: bold; } .view-details .header { border-radius: 5px; } .view-details .name { width: 60%; background-position: 8px 5px; } .view-details .size { width: 10%; } .view-details .date { width: 30%; } .view-details .size, .view-details .date { text-align: right; direction: rtl; } /mobile/ @media (max-width: 768px) { body { font-size: 13px; line-height: 16px; padding: 0; } #search { position: static; width: 100%; font-size: 2em; line-height: 1.8em; text-indent: 10px; border: 0; border-radius: 0; padding: 10px 0; margin: 0; } #search:focus { width: 100%; border: 0; opacity: 1; } .directory h1 { font-size: 2em; line-height: 1.5em; color: #fff; background: #000; padding: 15px 10px; margin: 0; } ul#files { border-top: 1px solid #cacaca; } ul#files li { float: none; width: auto !important; display: block; border-bottom: 1px solid #cacaca; font-size: 2em; line-height: 1.2em; text-indent: 0; margin: 0; } ul#files li:nth-child(odd) { background: #e0e0e0; } ul#files li a { height: auto; border: 0; border-radius: 0; padding: 15px 10px; } ul#files li a:focus, ul#files li a:hover { border: 0; } #files .header, #files .size, #files .date { display: none !important; } #files .name { float: none; display: inline-block; width: 100%; text-indent: 0; background-position: 0 50%; } #files .icon .name { text-indent: 41px; } } #files .icon-directory .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC/xhBQAAAWtQTFRFAAAA/PPQ9Nhc2q402qQ12qs2/PTX2pg12p81+/LM89NE9dto2q82+/fp2rM22qY39d6U+/bo2qo2/frx/vz32q812qs12qE279SU8c4w9NZP+/LK//367s9y7s925cp0/vzw9t92//342po2/vz25s1579B6+OSO2bQ0/v799NyT8tE79dld8Msm+OrC/vzx79KA2IYs7s6I9d6R4cJe9+OF/PLI/fry79OF/v30//328tWB89RJ8c9p8c0u9eCf//7+9txs6sts5Mdr+++5+u2z/vrv+/fq6cFz8dBs8tA57cpq+OaU9uGs27Y8//799NdX/PbY9uB89unJ//z14sNf+emh+emk+vDc+uys9+OL8dJy89NH+eic8tN5+OaV+OWR9N2n9dtl9t529+KF9+GB9Nue9NdU8tR/9t5y89qW9dpj89iO89eG/vvu2pQ12Y4z/vzy2Ict/vvv48dr/vzz4sNg///+2Igty3PqwQAAAAF0Uk5TAEDm2GYAAACtSURBVBjTY2AgA2iYlJWVhfohBPg0yx38y92dS0pKVOVBAqIi6sb2vsWWpfrFeTI8QAEhYQEta28nCwM1OVleZqCAmKCEkUdwYWmhQnFeOStQgL9cySqkNNDHVJGbiY0FKCCuYuYSGRsV5KgjxcXIARRQNncNj09JTgqw0ZbkZAcK5LuFJaRmZqfHeNnpSucDBQoiEtOycnIz4qI9bfUKQA6pKKqAgqIKQyK8BgAZ5yfODmnHrQAAAABJRU5ErkJggg==); } #files .icon-default .name { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAC4SURBVCjPdZFbDsIgEEWnrsMm7oGGfZrohxvU+Iq1TyjU60Bf1pac4Yc5YS4ZAtGWBMk/drQBOVwJlZrWYkLhsB8UV9K0BUrPGy9cWbng2CtEEUmLGppPjRwpbixUKHBiZRS0p+ZGhvs4irNEvWD8heHpbsyDXznPhYFOyTjJc13olIqzZCHBouE0FRMUjA+s1gTjaRgVFpqRwC8mfoXPPEVPS7LbRaJL2y7bOifRCTEli3U7BMWgLzKlW/CuebZPAAAAAElFTkSuQmCC); } </style> <script> function $(id){ var el = 'string' == typeof id ? document.getElementById(id) : id; el.on = function(event, fn){ if ('content loaded' == event) { event = window.attachEvent ? "load" : "DOMContentLoaded"; } el.addEventListener ? el.addEventListener(event, fn, false) : el.attachEvent("on" + event, fn); }; el.all = function(selector){ return $(el.querySelectorAll(selector)); }; el.each = function(fn){ for (var i = 0, len = el.length; i < len; ++i) { fn($(el[i]), i); } }; el.getClasses = function(){ return this.getAttribute('class').split(/\s+/); }; el.addClass = function(name){ var classes = this.getAttribute('class'); el.setAttribute('class', classes ? classes + ' ' + name : name); }; el.removeClass = function(name){ var classes = this.getClasses().filter(function(curr){ return curr != name; }); this.setAttribute('class', classes.join(' ')); }; return el; } function search() { var str = $('search').value.toLowerCase(); var links = $('files').all('a'); links.each(function(link){ var text = link.textContent.toLowerCase(); if ('..' == text) return; if (str.length && ~text.indexOf(str)) { link.addClass('highlight'); } else { link.removeClass('highlight'); } }); } $(window).on('content loaded', function(){ $('search').on('keyup', search); }); </script> </head> <body class="directory"> <input id="search" type="text" placeholder="Search" autocomplete="off" /> <div id="wrapper"> <h1><a href=".\..">~</a> / <a href=".">ftp</a> / <a href="quarantine">quarantine</a></h1> <ul id="files" class="view-tiles"><li><a href="." class="icon icon-directory" title=".."><span class="name">..</span><span class="size"></span><span class="date"></span></a></li> <li><a href="quarantine/juicy_malware_linux_amd_64.url" class="icon icon icon-url icon-default" title="juicy_malware_linux_amd_64.url"><span class="name">juicy_malware_linux_amd_64.url</span><span class="size">171</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="quarantine/juicy_malware_linux_arm_64.url" class="icon icon icon-url icon-default" title="juicy_malware_linux_arm_64.url"><span class="name">juicy_malware_linux_arm_64.url</span><span class="size">171</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="quarantine/juicy_malware_macos_64.url" class="icon icon icon-url icon-default" title="juicy_malware_macos_64.url"><span class="name">juicy_malware_macos_64.url</span><span class="size">167</span><span class="date">19/12/2023 13:12:16</span></a></li> <li><a href="quarantine/juicy_malware_windows_64.exe.url" class="icon icon icon-url icon-default" title="juicy_malware_windows_64.exe.url"><span class="name">juicy_malware_windows_64.exe.url</span><span class="size">173</span><span class="date">19/12/2023 13:12:16</span></a></li></ul> </div> </body> </html>
URL	http://localhost:3000/ftp/suspicious_errors.yml
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 290 bytes.	GET http://localhost:3000/ftp/suspicious_errors.yml HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://localhost:3000/ftp
Request Body - size: 0 bytes.
Response Header - size: 344 bytes.	HTTP/1.1 403 Forbidden Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:32 GMT Connection: keep-alive Keep-Alive: timeout=5 content-length: 2076
Response Body - size: 2,076 bytes.	<html> <head> <meta charset='utf-8'> <title>Error: Only .md and .pdf files are allowed!</title> <style>* { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px "Helvetica Neue", "Lucida Grande", "Arial"; background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9)); background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9); background-repeat: no-repeat; color: #555; -webkit-font-smoothing: antialiased; } h1, h2 { font-size: 22px; color: #343434; } h1 em, h2 em { padding: 0 5px; font-weight: normal; } h1 { font-size: 60px; } h2 { margin-top: 10px; } ul li { list-style: none; } #stacktrace { margin-left: 60px; } </style> </head> <body> <div id="wrapper"> <h1>OWASP Juice Shop (Express ^4.17.1)</h1> <h2><em>403</em> Error: Only .md and .pdf files are allowed!</h2> <ul id="stacktrace"><li>    at verify (C:\code\juice-shop_16.0.0\build\routes\fileServer.js:55:18)</li><li>    at C:\code\juice-shop_16.0.0\build\routes\fileServer.js:39:13</li><li>    at Layer.handle [as handle_request] (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\layer.js:95:5)</li><li>    at trim_prefix (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:328:13)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:286:9</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:365:14)</li><li>    at param (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:376:14)</li><li>    at Function.process_params (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:421:3)</li><li>    at next (C:\code\juice-shop_16.0.0\node_modules\express\lib\router\index.js:280:10)</li><li>    at C:\code\juice-shop_16.0.0\node_modules\serve-index\index.js:145:39</li><li>    at FSReqCallback.oncomplete (node:fs:205:5)</li></ul> </div> </body> </html>
URL	http://localhost:3000/sitemap.xml
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 240 bytes.	GET http://localhost:3000/sitemap.xml HTTP/1.1 host: localhost:3000 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 466 bytes.	HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Feature-Policy: payment 'self' X-Recruiting: /#/jobs Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Fri, 03 May 2024 09:12:31 GMT ETag: W/"ea4-18f3dba02fa" Content-Type: text/html; charset=UTF-8 Content-Length: 3748 Vary: Accept-Encoding Date: Fri, 03 May 2024 13:57:27 GMT Connection: keep-alive Keep-Alive: timeout=5
Response Body - size: 3,748 bytes.	<!-- ~ Copyright (c) 2014-2023 Bjoern Kimminich & the OWASP Juice Shop contributors. ~ SPDX-License-Identifier: MIT --><!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>OWASP Juice Shop</title> <meta name="description" content="Probably the most modern and sophisticated insecure web application"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico"> <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css"> <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script> window.addEventListener("load", function(){ window.cookieconsent.initialise({ "palette": { "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" }, "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" } }, "theme": "classic", "position": "bottom-right", "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" } })}); </script> <style>.bluegrey-lightgreen-theme{--theme-primary:#546e7a;--theme-primary-lighter:#607e8c;--theme-primary-light:#698998;--theme-primary-darker:#485e68;--theme-primary-dark:#3f535c;--theme-primary-fade-10:rgba(84, 110, 122, .9);--theme-primary-fade-20:rgba(84, 110, 122, .8);--theme-primary-fade-30:rgba(84, 110, 122, .7);--theme-primary-fade-40:rgba(84, 110, 122, .6);--theme-primary-fade-50:rgba(84, 110, 122, .5);--theme-accent:#689f38;--theme-accent-lighter:#77b640;--theme-accent-light:#81bf4b;--theme-accent-darker:#598830;--theme-accent-dark:#4f792b;--theme-accent-fade-10:rgba(104, 159, 56, .9);--theme-accent-fade-20:rgba(104, 159, 56, .8);--theme-accent-fade-30:rgba(104, 159, 56, .7);--theme-accent-fade-40:rgba(104, 159, 56, .6);--theme-accent-fade-50:rgba(104, 159, 56, .5);--theme-warn:#ff5722;--theme-warn-lighter:#ff6e41;--theme-warn-light:#ff7e55;--theme-warn-darker:#ff4003;--theme-warn-dark:#ee3900;--theme-warn-fade-10:rgba(255, 87, 34, .9);--theme-warn-fade-20:rgba(255, 87, 34, .8);--theme-warn-fade-30:rgba(255, 87, 34, .7);--theme-warn-fade-40:rgba(255, 87, 34, .6);--theme-warn-fade-50:rgba(255, 87, 34, .5);--theme-text:white;--theme-text-lighter:white;--theme-text-light:white;--theme-text-darker:#e6e6e6;--theme-text-dark:#bfbfbf;--theme-text-fade-10:rgba(255, 255, 255, .9);--theme-text-fade-20:rgba(255, 255, 255, .8);--theme-text-fade-30:rgba(255, 255, 255, .7);--theme-text-fade-40:rgba(255, 255, 255, .6);--theme-text-fade-50:rgba(255, 255, 255, .5);--theme-text-invert-15:#d9d9d9;--theme-text-invert-30:#b3b3b3;--theme-background:#424242;--theme-background-lighter:#515151;--theme-background-light:#5c5c5c;--theme-background-darker:#333333;--theme-background-dark:#292929;--theme-background-darkest:#1e1e1e}.bluegrey-lightgreen-theme.mat-app-background{background-color:#303030;color:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head> <body class="mat-app-background bluegrey-lightgreen-theme"> <app-root></app-root> <script src="runtime.js" type="module"></script><script src="polyfills.js" type="module"></script><script src="vendor.js" type="module"></script><script src="main.js" type="module"></script> </body></html>
URL	https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAGE_VISIBILITY
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 482 bytes.	GET https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAGE_VISIBILITY HTTP/1.1 host: optimizationguide-pa.googleapis.com Connection: keep-alive X-Goog-Api-Key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept-Language: en-US,en;q=0.9
Request Body - size: 0 bytes.
Response Header - size: 457 bytes.	HTTP/1.1 200 OK Vary: X-Goog-Api-Key Cache-Control: public, max-age=86400 Date: Fri, 03 May 2024 14:14:01 GMT Expires: Sat, 04 May 2024 14:14:01 GMT Accept-Ranges: bytes X-GUploader-UploadID: ABPtcPqMZVW_uf_dP1AYOmcY5jTJQQ-Q51apVFL3Qx5QRzSv8N7mSc8H3vAOnuLBzYgWEUlbTyOFOiqmVw X-Goog-Hash: crc32c=phKVxw== Content-Length: 883094 Server: UploadServer Content-Type: text/html; charset=UTF-8 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Response Body - size: 883,094 bytes.	Cr24E� �0�"0 �H�� 0� ��:2�W�))��I��5_U(I7nzԂ��2[�;�H�ǦS��٨/��nb%Yx�6�]i��u��PDF�iLJK�?��l��R��\|��j�C �j!%'�s��[�"� �Gy� �=l).�=�l\��4蠕�Q!$e�=��C�1�%d��B�ݖK�[�l,��7�� y�$7J�G&TT��W�-=jgs[��&�@/гj$��+��yk\|l^��Km)\Yx��}OCXf�� A5s7�8�o��L�(p[��^e�Ȃ��㟪?&X� :~,�)��C�nʯ��Hh��<�N�0.��woa6��'&y��tHƔ�7@�a�t��F�YQU��<��m!.^�#f�'F"��lt�97U3f��WM˦�]Lw��)�x��)��Hy Z��l�a�)J~'�y�o�NS�#�,6D�9UMW�l> pa�WG䍇^�L,��B��"p�Y� ĸ��<��y�x�2LP�n9O�y�$M��f�J�� �E��/�b�Ü=1n�9ʛ&Z��A�h&1� �'\|��{f�h��/@��6}L��^�kk9�i��T�0��0�-:�N�\�O�J񗑰�պ�y��րt&�Z�]��-�%J%��! o��jG �7�p��!=K��A"�ː�Μ�/��j=Sv��$��t��.��6��.�I٘�$1�q��5��H��w�wDs�;����Գ@�9�j��44&�<��5�7��:<y�:��9V;���O��c�q]fC�3�_�f��`,%oO��ч�� [&L͢��$��xD�Ru��a�>IB��l�d��J��r��`��I�Rn\-_%-�#0��b]d�~4��x;���[�g�Ɗ�a#�?9݀��d@1�@G�+ɤ�=��t�r��YdaO0#@��(��W־ ˘u��?F�Rn�� 0xE:?�Җ��PK�~1V model-info.pb��r�<6%F&PK�� PK�~1Vmodel.tflitel�Y�e�yve�e&��B�C N�FB+��8B� j��v��vW�8��jV�5�[��3��<��w�ꪮ��nR-K�;�l�0�0��D�>��@�Y��H�XU�=��o��]��ں��j��G��և��~��6?��g�<��G��>��\|��'¿��w��KO��\��c��{��]\|��G.>��`� �{��?�į�{��ܸ�}io�=�r�K��lo��h�/~��o�!�m��3�y��x��O=�u��_zx��[��8��o]�Ň�� \|x��_<��K��[��x�O��o��{o=��<��w�;��?��[p��ۿ��֣��3[��·�>��[[�?�w�>��m}왿��Oo}J��?�u�}��_ۺ��֟��[[�� <\��> \|��Q�#��ͭ�?~\|��]��{��[�]��p F�u�y�ܺ�>\|�8�1��G�?�i\�!��@x�)0��O>\|��a�!��~��>�=��w��1��@ ��3�E�<�(�)��ǁ�>\|x�1��G��\|�6��.�p��o��8�#�:�<�p8< \| �$�q�c�G��Ĝ7�'��~��&�� n�\|zx��d��ad�Oo��?爇�'��9�us��~�i��~�<?��?<��¹'.<~��_=��p��^~��K7�^x��s#��_��r��}C�ue��x�{}�ڟ��;[��Sl��6�9$p�o�30p��}��<��ǀ��e�p@��K��\|�ӏ?z.=��G.\>��/~��{�i\|�t�ܧ�~��_E^\|��X��.\|��?�_��{��g/]\|�Ϝ{�K�>��g.<8%�t��g�x��O<�ăc>��S�^��O>��S�y�s.}��#O~��=��}��s�y��p�a��?��h�/<u��x�W��c.<�ع�_�p��cÉ?w��s.�Ĺs��y��O=~�s?��?��?�+��=z �x��W��sO\|�ܥG~��~��y�/<��%��8�/��{7��'?k��}��'?y�/�o��W��_��l��O��~p��C�\|��1�r��S?��q��П�s�}ț_��_�ş��_��?��~�>�W�~�v�1�C�O��<\|�0�0��瀏��> ��)��G��'��g�g�灗��M`̀ 4�� p��w�w��~�6��>�G��?~�)�#�π[7��C��?\|��ǀ�\|��I��O�< \|8< \�<<<�\n#`�8��@l�c�p��6��{��?~�1�C�O��E��.��i��֖5��Nk)��L�J�Д�R��ΚR1�[�#Q��Ԓ1��qLzY�> L��:)�.�l��YY�V��{�Jm��M�L֪L��\�,J[.E"%Hb��=�<q��T��wKa�� GKVɒY�+�M0�rg�R�X��<h^�%��KR K(�W�c��Bp�9j��DZ;U8�2�$�VRiOj�Md\ WZE�a��2�.�Jj%��Η�r��N�"�&�ژ3�q�#�H-�X�EK\|��z�tA�%��7�q�9�^gl��R&��j��J8B��5Q�3K�+M�Z�,�!��V�V��F1��:\��ea�U�Ȫ�X#p�&��+��sXJK�FΜ��"#�Ή�2�t,�CS��ѥ�Bd�`8�d�B��O�ߪ��:��\_��J}�Ȝ�.��Уu=�x�j��8��M�t޿H��#��X��i��?��m}X��2��#��ݙL��y��$wN�q��za��k-;��Yin��%y�^\|+��W��+�:{[��pr��^��R�9=��d�z��dc��\|GZ��\Q߈͝�ڝ�/%�ߝsY�p�l8��?��a��շte��gn\|-��w=s�S�д�e��ۓߙ�[u��d��ڻ��͔��_��xV�ӟ��ݻ7Fwqk�8[�5\|6]��ݛ��k�W�n��}q��[�F�>��Y�Ygrt�W��M�I_�Q��ݿ��\c��/��u��y�ǃ��ꅷŎxWE/��n$�w�G��r�Ӯo�A�?-/��ڳ_��{��Q��z{o�ŷ�'ey��:�w~�V�跫�>�s�b�I�Fn,X_��[��m�jg��J��^�ŕ��҆��ļ~+�Ku��3^�q�f��6�>ӫ"waou�f�V��qKl?��[��6$��{�h��uw��w��ܐ�Ϗf)�~mwӑ��˦؞�nP��KzXޘJ��/Uo̵��p}K��ke~i��uFU~��v#Su��uL�x^m�x�J�i��Ñt'��t/Uݬ(��99.i ��_(6��ݫ��o��ny��lɓQ��2��H��}٘lS��թmJPE3];�-�aMo�!��g��2ٔ�z�+��y�ȶ�U��L� �Lw�\|>6�Þ��%��&e�VeV-�e��C�O3�l��D��M��S;��,�n�J��r! ;�[q�nuB1�mG�5�^x'Yn�͐CW�f�9�y��-�ܰ�긿\�ZȾ��w5��j1��n�W��"6{1KX�e��_�՚��z��.�U��޸]��d6�+{��u�$#}(T3�\e�$�M�8o�N�K3#��b�:�Ig�Յ6��Q�w@�P)-W�gB�缯9��MmUZ��K;��3k�$8�e�4�Z�4�(��M^D��P��NSA�!��k�K��"�:��v�+�x�f��e�d&r�S�b��+�ш8�5�\�[�q�{��y:w��l;��QS7m�J֡��" 6$(sEM3��TIm9��ʩ� `x7��4']��Sԉ�g��]�o��8��U�Y��w:��Y��qԍ$Gy �#�JC�t��TrQ��I�h��B[�\|�$ �4-��EkZ�Ι�Պe��-35O8q�E��@��U��jƢ�@�ḨH��H��t�q_0�.�`�PMVUgC�9J2/;��U�Jn)�ǺQ�2��M�Ѹ�Ǭ�`��۠�W�-�)Lj��r��IH3�gE蚫��u��̊y��tb�n�n�Ǽ�y��t�>��b�[��9��ʑ>1e%�.�B�2��+��0��M�O�WɎ��B^��[d+��Bh��xvmIO��؞o��:_p��j��§�m�[�nccw�?k��'$��y��s��Hֱ �,6m\]]B�I��EwGa�.�n�%~R�D��&�m��iK&��T��%c�T�ߓ�6��<��j�L��Y��rߞ�S�N�+�;�WH��.\|K��ږ��T�}۸��R�D̼o�r��^�3u� [S��M;R��Ȝ4v�]�{�+_�EM��B� �K��q�<6��H��f9��uaNCnf��,�YvZ��7s��lU�F��l��UݙW�6��aZ�\|��vL��̏L��7D��vmj�(�BA"�Q��e'��%ؠS�[�2hA�r+�˨5䬠rRd�`J�B�uRh`�#MK�E �"m+B 3��<�̤iDq2��64�7,w.D�d)b�i�0�eJU�;+��y)�f��NJXN%a��8��P#(�F.+$�AE��P�ĺZ_7�� !��f/B� �:�\��GN)�0J��0T��o9��Be��Cij$+��YK:Qr?�� y��Y4s�lբ��ԗh싈d\&!�aza`�X��2(��1�2��5Tq�I'�W�8��>��k�"�5uƄ�Q�2P=s��@��{�9��$Z��DW6X�(�wb�D��(�Ze��".�ƍ�}F� �h8L�#�%�\|��b�h�F)�B�Q{kO! �0��x)g=��py��8��y��&�>�/�&:8T?�5�D1[��"&�4jn��4!Dx��9��S(RH��Pb ̼�Q!F] ��/��=�Ы��^ Y%qm&9��7��K��0��h��1"��~��a��׶N)��0Y_� EF`n��),��UEG�Z gg��D��a�5+b��P;U�2��bd�EÈs%g�C�yR��ЈLx�)��#F$0s�,��x�W�g��S��N_0!�q��~�=/��a�ʑ��ep��ʆ�E�4��u�/t��X([��ِ��k�'�L(]�i��'{G;�A�G��m��ب7�j1tI�I�䛬�'>�h�$�j�Gd��ؕ�jD�V��W�M�~�1Hjn\le��r=�]E�nf��a̹�e��o�&�T9o "tC+h�c?�-�Y��:d�^Ρ��M��{��w$��r�Nz��$�� �X2��V_�m8�g,�A�y��nXJ�ѡ��&��,�c�~�n,q7nyo8��,��w��f�.��Z)�x�\R7�FM�,��J x��o�&w��+��4T��B#��Y�S(0��<��}�hܔ��+��D,��t�_�[��@�f��yʬ1�m��lX�ȃ��یNh�7��e��Q\�R� �s��Ҏ��"�]�Օn\|U5�5eW�$�i�Z:GJ�ډ��~��@"�<{�#�ɘ�� B' 9L5�{�ը� eitTŶ�cv��!��E K U�2�+E�]6�ֶPj�B�?��D�\bꍐ��lX��.�Ɯ�U�Z��=n��#qe&��X�$�Ʉ�y%MGUr��K⟉,v��9E6�j^� +j_��籭��̨;��0�0�H$��X�6�(�)/� �΄Nm�T��L�e� �q��l�y�6�1��]�� XyK�]f�Rj�JG��"�erG��/E}�f�,@4PD�%��!P3{��P3�.��r9D��f(Zδ��yW�D��Bu�P��5SE�C,�N檕�G��F5P�� ��\@��6o�f�{�#��S@��X!� )��eVy.!"�1�\|!\�� ȼ��f�@RY�L�j�HE��[�E��,j4C�a�-��Z& '�R݋��I��u(�P��8�b�e��:zػ~�,QvSwL��z1��7�4g��6KP��/o-,U�4-b��d�f��p/Mjל��( d�P&˶��/�j�Ę,ĴR��QӼ ��uY\��}c�^n�{�K��g��E�Tn/��{uک�o�9�7��ػ��F��S�� 7cf�!)K ��GW0��+��f�Z��03_M��NR)�. dP�yX��F6w=�+�x(琂�Ӷ�r�ټ�H'�e �l��5`��O(�.-�\��&�#��FuKVF�-f��v��l2�c�- �aڻEbrb��ײFC[��Q�&ڃ� �}!k�9+ ��0K?-QDk�/RFef��U�(�2G��Pr�J��L�Wu�<�Z�+�[=�9� B��X��܀r��_�,-J�\@��v��2�T+w�;��\|��Zm�1+��b�Z�䀳�� n�!�iJ�Zʹ�v!`D���:'�B�� M��Bt�Λ��>-7�lZ� ��`��A��:�BY[�KV7�s��p��Lׄ�� ��C�EȘ �DM��Bź�Z�櫊{8�JL`aD痄�P`Ƈ��[hZU$��+w _3�m��]�S�\|VQB�.�S9+�H��FN�o��P-� :1ׅ��nB��b�h�B��b�G}A��R��)yk�.:��-��V'��̱�u=�F�B�n�UɫF�K��J��`��]P��l Vs��r��q�䡊�uM2�"-j ��#���5�3�!hc�av!ԗ��Dw�5�"(��F[`H��,fja��"�J-<��_�ܸ�H6�=��i0{ֻ� �� (�^�Pg�%�A�@�~c�T��5kPZ=x�9��F�`��I��Ema$��LkCt��1���¶̱��VUZe��S+��0 ��r:��Z� zZH�A�"� �s�\�j��4�yD'C��yC�,�mjU�(�'9m��2��[��+�ݠ��Q��Y�CB�5�� !-2��hjr��è7�Ih�@-�OmlWP��n2�r��4��<K w��2��i�;)�H�C�.z�V��36�Y�%��E�BX�8�)P�UI�\H�@��,��>��3�f�.��"�܇]�u��e/F�R��ȭ#�}5A9��$0ׯ�T�U<�~�8j�Hes��c�羠 '�Dj�Ҝ�vn�I�Y۠L�9_�fnܜ��>B:��?��Z�s3f3�\4K� �v��q3eI��̥;{˃�\�m{U�Z�v[�Or�:Jr��5��t1�Z��N��j�-��Sp%t2o��^,&D>��1�5��pw��Ӣ�UZRY�FhXL��dZf~ݤ�VDt�!;}� eH�˶PZ��m��&H��⥄�O�V��3��Z�,@��3�%)��p�٬�q�t�^{m�a��C��tB0��K��2�p��yӜ��QY�El�Is�d �v�M[�r��U��V�~ᐒ��`��J�%�/D ��'X��z�hO3�\,jh>.{E3�Fs>܀ȇ�F�h�R{�=$(zK]D�n��/m�C�A�1h� b`$�bFWf��Z�W�ĭj�EF /SD�\|H)�.r#;5(��t��m5#��XXvf��K��L�i�e��[�sa��%�4 &��6��(�F\LQ��R3V��V��B�z��E��H�D+(`��RD�ZX�P6�<�܁ �e)��`=��V�6'�_9��@8�`P��+�\|�n��R)�Wm��΀�E�U�D��D#`K�\|��`UC��]��B��~U�'E5<?J.8�T#�JU8�\��Zjc�"� ��Lb�lZr�On��OjBɇ{7A��Bw>�;�\|��Qr�Q�I� ��R[L&TW�eN1d�̃�\��cl�Mo�Ñ3L�Z�1��@�MD�ɉ�M9�[hQ�b%z�A��[0�it:F��V��ފ̪J��rRy$@嬱Mk�-T��gӼ�+ٔǘe'\|S`��l�Zc�#UP>��k��L�S�YR�fr��׬/�Nt�S�̭+�UA6u U)tY��$�EX�r��KzP��eR��C[�Nt��Ggd�)j8�(P�jC\�]�nr%Џ6G�\P��U�B�in�U��;Ѷ-2�B�D/��Х��\��T�)�pĺ��6(��p�2��:�Uu�!��kG}f7�0 .fum$��`��25+N:�L�2>��S��Q4\�!G�+�_a�3�U3�C��`d�ز�G-��B�#%P8��HVCz#�B�"�ᡑ$R��D�9]�M�eX��BW�K#�þ�\|�R��6�a�>��!�m8��q�� ��p��0`N�j��p�w8��ǤE��1G3�o?>��k�}��8�+ D�P��.�V�0�4\|yp��K��?A~<��A{�\|h�0�r�#�04AH��f�08��a��^�\|�Bl��>8��;,�C7�%F��7�a/�bh4�'��Y5�`pq�퇁~��H��U+J5(n��VԊLΌ�.D��aE��8Z��ð�a�pr10�Y�� aS�� &V��P�`��<�t6E��A�]�+�� ��h]u�[A5�7�H\MX��d˼�$�Fy�8kA�Y��R\vP0E��Ě�X�q�^�L�!�\|��)�^/�,��dQ50�� W��m�\߮H�ڜk>6�Tp�(�)?q��L �t�aɃKt�@ua� ��R�st�'�9��7To�d06εkkU(R1RY��l�$�4��<��V�E��3-2f+yZgjs�'Y�X��f��b%PF�W��S,fxe'<�O,u9�c�e��f';0զ~��3�jH�Ŋ9G3�R��3#�m�1�5��f�"�a��4Cf>�a�[?[h��R ��;��c'S��L�ea!!�h��t_�0�m=��>R��o5ec��K�0�M�D�Ԣ�(�n`f�X6�M�ek��,��t��"�Tí��?�\g��jFUΤ��g�e[9�e�~E� �d0�UaO �� Z�̞Ih�pCh�EhY �5ɝ��+��Adr3��i�OU\ar�m ��b�r�'K]�U�a?��y�d@JU�Sd�6^�\�#E�no��ԍ#` +�)\+A��yP�-bVӒar��H%W����> K=܀D�h"<� �=��jP�QW3b��(��V1�Ԝ��DVPg`A^XE��"��ڼRtC�\�8�L_SD�30UR4=��9>�֜�.E]�� p�<�ȥn!�`�Xl<�!��rM2^x�H7((PS�$l��T6�u�E�5��J�a� C��I��:��F��1\�+DL��0#��Y04�lY�N��'i��IR�H��${6��v�5Y(9��+ܸ��ϲʜCV�j�ˣት�\��Vg�6� ��\|�Ɓ7S�^'풗��B��U�sgXO/�g/[I1�3Qz��K��xMݦ�I; ��͜�զ��?��-&�H�dEY�%:��r�/� F�s3h��0XȸH�t8�4��8t��ʸ�չe�]+X)b�$�WiWg:��+%#�:M�됞��'T��$�֧��#)�b�(��%��9�"�6Fc��<��+H�<d�L@�e��U�7>)�ӑ܁�Yͳ��yU۱J��ʕ-\|n'��b$G0i�ҟ��F��j�7b_��4�ʦ"�K]ڷ�&�GrJ�==��:��M_&��B�T�/��0G��kL��W�v��_�ʊ��>�H�=�@ �ݭ�X8'=hOE\|�d�a�@U�� Ȉ�� T��g�q��UJzi��T6/z��j"��ý~@��񸐾g$�1X{��qj5��H)/�/9jlUU��# 'P�� 2s[��9�;m��49 ��!��p�0�հ��p8\�i3Q4Q(��7�p`����-d��A�u�Q�B:�@��o��J�"'��O��a��a�IcŢ�%��0��+�!��:#L��Ͱ~A�z�� .%��0۪d(DrЪ��e�)�j ��C0�Jj�6NU�!��IQR`)]Y��^��Δ�R�2��b�\\|�7~Mg�7��_M�_Vo�z��l�߿\|��7wm>g��ft%��7�hR��~`6��/�7��&8��],G��ܮ�P�k�B�d�ڴ�V�Inf��x]O��z�9��ho��k'y��2�$��9��Ku��9�od/e��W��?+�ůί��;�յ�� ׊�1��w�K��+׏��1�{9�A<�߇�зZ�؛��tY}g~ro�˪�� ��z��ϔ��K�C~Q�g�k��U~��-2#��ZT\nC�$��w��7�W�^Syz�OLq�$��F�'��˛��>7��7��K�'ˊ�yK^I]$��륱y�}��7O��:l�q��;�^>\^[H��m�_��M�Cv��WgϯT��y�dW,� �{�ؾ�]+�;��Y��T��'w��I��4�G��_l�m��t^�V�d�n\��7��N��w��}�ղ9:u/�W�\|=[�5�~�\|s��6�}3˪�`^�Wo<��k\|M��ӯu��7��W��l�Z��rqF'1��S�@2�,�&�Z�)g�X��[��k/��ý}�ڍfwJ~��P��5��O�o�w&��ϼ>��؃n}K��O��7��8J�e��{o\|��>y�e}�ݦ��j~�v��V�_t�R��Y8�c��%}�M/�.�ӽ�ݝE��aMrt!��"��͕��D��1I�mL��Is�n��<�w�\|��ܩ��j?��g��+��g�׬1�ɭmo.�D�\|G^��?��"��,+��ɻ��6{��{�]��H�[o�}��m��g�&�=�=�Ezp��7��ѣ�_L��nU�^��^��v��n$�1��y^��d��R꙯��hg��g�sVnt}Ē��ל��-̔�֪�+�1}-�� i��+��\|��X�,}��\|}dH)��˯��L��)ѯ�;�.k��7��<U��7�zn忖��\|c�h��w��\|��@E��B(ߒYo��\|Ur[��"-��u��N��y}l�O�On�&�^;jI+��ݾP7ɚ��S'��]�j�hy��k�n�;h��u^,��0��~z\|��H��r��/��P�fV��f4��@�A��qQ�:��.DY8��Ի ��!ݐ�� HB ϖ��I@��봲�qu3�g�D�򨟙f6��P��J��/k��֪��9�G��fT�iʸ��1'W��a-M��v�L�b2�?��V#�X��yv:J��R]Ֆϭ��[��k0R��%�]g��_�E͍��t��q��s%��R{��f[Uiz��9QQ��;"�f��=~V-T�Z�z�n��<��[e�,�9V�\<G��f~-�[�]��#��i��ɘ�4{��4j��)�ۥ�Ց�c��WDt��z~�N�2"��:γ��䨵��7Ь�-�q �IԽ\}<)�S/�}u��&��Ǌ��Y�o�1>+��\|N]\|��U��9,��\|g�U��T]=-y��L�s�O�\|u,�U)1�;�Y�Z��I�?�wJhk�Q��G��򵧳�'�n��N�r��^�~��^��\�v5��;��Yaü�P�Y]�[��+zfo��_g9y&�ȓ��eu�ܿ�`�D]��hz�޷��ޚ�+�_��xw�U8��E��M��.�/M��j��QS��[.^?��{ٴ�4y1uϞ��o�pX�7�ã�~2��v�ݩ��\|oԑ06��{㟤��כF�.�[��M��t�/�3W��lvy^,&oϦ�?��6��+�kyPx�Cn�I�ͥK7�� ѽ�cS�ة��N�R��x3��t��V�e�T��Q'��rm��3x�>M��r��d1��=ߎ�7��'��_�݅��W�'��w)'��F�I��x��U}}�Y�sgwOV�{5�<w/i�x��f��^dAA�A�ik��!f��[Hfs�N��7�,��bxXG�Ih��@+�� G��-�� 0. �"m ��Ԓ�áL�Ɛ:�cV��\C��R�Ơ%��s[fĩ��BB�R�L�9�N�A�r!cɆۡބ@��E��\�l�jPO�5<��VW=�(Ѥ(!��6-��;�.p��5�,ȑ��ӣP��H�M��T��>�c\|Cȥ� �zP�j�_-�zx��S��5�J�-�E��b(m��ڔ"�tX��U�2�0b�p�2x�L��A�R�'_v��U��7f��،�J-��"c];�N.l�5$�F,p� ��v�S��L kP��_��⌈��0��zFaa��C��aZ��:�$�m3��w��7��f2]���%A��5fx>�\v�U!�ʒR&��ⰝRէ搢�S��Jf��4��_Y%^oF�ë0�m��&u2ʒU��8�/��ؖ�-B�D��xⓩu�X�%��Ym��X=��3��19��]\�u@�� o��/�Rd�BfQ]�d�^�1�6��!DDbI;�CZ�j�Y��1~��U%�4髕,C��rH_��2:r��z�k1��4ᵦ�� [��P}��ūG��!��pS�]t�4_��+S��S��¼#ݒJ��FE8��/%�l��Ó�9e�ۄ��X�eF7��Ĉ4�er��_2��T6��S�D�q_,1>e�K6��l6�u�tN%�,S��Y�t��!V�� ��J�Jjʬ)P��T��$6B��O\O ��X�/dc�c"��j]p�%[�� �5��v�w�W�ɓ�,�!;,��ֹ��8K��b;�m [ؕ��#)�գj1�kַ�"��t^�j��ԁ(U�gg3��i��fif�^ؕ�M6k9�^��-�h�d��=��rMW�jf>�N=[�R�+�rB�ŀ�5��3��%w��&��Қ2S�٢RU�j�=JV�J\|�2P.�AZ�A\|�]��ԫ��$q:�M��F��"�ד#5'^�72��ӜMY�"�"&��g��a��zu�k�ҳ��Fꈝ�z�ys�HE'y�,�Kׄ�9�.��h3��[��}�YY+2�lBlɁw�7��,��GfA��@�BVW�e�p��yzd��6̩<T\|��,��%��>��fJ��~OY߸I0��V�E\N3_�}ޕӧ"��ZR��[o��>ӼjK��bΧ��/��M��٢��e<{nXL�v��k=u�+��~b�֜2��ɺ K�P:TĶ��s��jw��D��i��d�d4�\|xi�.M�`�fj�4��$% �� fL��&%�qPe�zX�&��T']��O�4mK��w�No��6�ٕkZ8C�~a�66ר�Ey��Wܛǆ�%-8��\�Ia�;ڷ�ZD��;!��zW�E�,Nuf�:�R�I��s��4̛��v�tx�On�uc��d�q��L�r�0X�NT�9��k��Uz�LU�.�) P��8x��X�«vx 0�tF�QY��򵑡��-_��5��xqŨ�{�O��v�P��t7m��q=i7�he�m�2�A�#��kf�Ҫ��"Ϥ�ͨ�ټ�ǨDN<u!�W0��e�&�,UU� �NL�V�9`��tM�F3��a�r�x/��K��Q�lP��$��NH�aݶo�Y&IL�� rq`M-iR��Y0UVx�+г"/\�2��4�iV�ƤV��-��N!�d��~=��QGNPQ#O�qI�Qr8-��U��,Sm�%'�h&!l�j�!�z(1}�3�a�wVb��L�\��D� l\|�\K�&WTJ�Pƒ�5�I-]�k#��L̒#��9 �(ͤ#�(��VgLɢ��L"[�Gm�3��hylJ��>fx3��U��-��l�E��DE@ �V6�:��X��p&gq=<@0M�UzxL/<g&Ti�X��g�D��e M#H�$�A��$^�1�DY�5�u�ό`�H\9)�?aP��aY�Du9�v��"z�+7�HJhvy�wh�.��<M:V8k:2��9��rCվ� .W��𹩠$téX��l�4�dL�6��I1��4�VE�#gk��\6��IVV:P� �;ܷg��nX�t�9\|sm��j��P�t�X.e9\|4�S��W��(�ҫTdx�k�K\�T�ٖ��&��v�S�dx;�U ��G��,M�܁�4�QG�C�ʍn\m�R��fX2@�}��3<Y'�J�Xag�9�!H#�'Ë�1�ڻL��"��hYR��h�UƆw-&r,k�J�@>�HP�/-��I�TL�i��\�Z�zX�V{h(Y��c� C�Wa�cН�1��ҷ�0��v@�+�ii��<R�E\�N䘑l�{��U,9+<c��(e��a)�X�n��ee�V�70c6ݜ��2��]aC��)��D�Mn;YAV��U �S3�I-��8P�r��0vI��q��G]s�J3�9j��p$��uL1��RY�֝�B�W��rA�BCB=c��5K'��N��+��K��mIܰb<Z�̕5�LES�B;��G�e�}��C�� Z��l��)1��t͂�律�po+�;5�'�jDXb9� �/ҥ6u�7j\��fxa��Y>�(ܼ,�E�e�U�w#��L�:�lX��6ɰ��;VA�Q%'v��BG��-Y�E��<!5,u�X ��[�.x)Z��d�eX��P��wyv@1n��w��of��o=��ߛ�߻��\��ٻ�_>�iz�]ۮ#K��h�0l��.�3S�DR�%o{�ݮv��\su�?�m)R��T��̪�J��e#�~��A$�=��f1ƌ��?t?�ή�\<��r<��z��]F�~S<��?��w�۟��=�>Ɵ��'��}��^-�ֿ{Cz��X��W�a��b��Ƌ"��g�W��?ߞ@��N��ɓw�\|��W��~ʳ��g��_�w᰸��0\|��_��ٯ�s��#0��v}��E2��/��gwo�x^��y��o�~�Om?��r��3}�S��l��__�7O��\|�2��N�I��;��?~q-:]J.��lu;��/أ{��R��?~��n/o뗛��-N��V�?;7 ��ͫ�`��.��y��&��۟��_��y�ߞ��;{�8��[��ṭϫ��8�_}��ir�8��8a�'��ћ�$r�ߓ��_?��N�ܜ��3��S��:-��F=��D��d.ʽz��Y�_~u=o?�g�u�u��;I��^�y��[��^��v\|9K��lE��Զ��a��1��>Q&]�j��p��35��h��"�G&�gRn�Y�d�&;��B�_F5sL��Ӌ�JW�妌K�ݐ�\��;+v�s?��N]}q�`+�Y��A<WpX w�[�iL�j��8�p��ڕUO6��\�[s^/w��7��Tl��^p�!�{��ݕ��ni�K{^�z�eZͲ��Q�ĶX.S�Xs��]��-��@}O�s~�x�Ѿ�E��0'8sr ��E5��j0��l��OW�t��/>�7�Zk�rx�2l��L>#��]�s.�h�E�p��^ц3�deL�/�u��n��!4��߬��n��o��k�S5�v��w�;�l��2T�p��C��?�?�2)XZ��k��^ ŌX��&c��U� �Quȇ��2>��\��`5x�@�k�'�g�e�e�$gX3.��Ftf�s+0�X��F��J��a�8W��I��p��<�[�-V~�k�F��;L�X��N%��z�� )0�5��^�A��_��0�F��1]]�h� ��gA��,m� �J1�i+)�V%�)�+�s��{�u�22�4;�`� �mJ��Y��&L!j1��N��b�@b�� i��'�@S]��&0�9DH�487��rކ^T��0��h&)��rA�g�L��sp�L(º�Ĭsp^�`�,�8t��@��z�c�N��L.d��T%$�eݔ�0��E-�)��ߏ��O)�S,,��,S�-��2�^V�k�cLƏN)��)��g�-i0i��)ScQP�M��X��0�?�_�3��Rc��0�V~LM��Zrӧ�ͧ��)�E�e��+~�O��0S�0�۟Rs1E_�'�sf:@�d̕��]�98�k��^΀�s��@��MS�_.��Ϫ�4l��ܺ) �1�r�V2Li��1ј[1�M�ra��ƉP�0��y��aF7�3&�X��0l�m��tb�E:o o��aay~�3��$���liLҒP&_�X,��ɡK=wz��6%��V��\��xC��Tٜ��>%>��\|9� ��k�7��M��@㱳��5��d��i��2�U;�4�se��0��5��p� O1�T���5%�s`��@�LT�3��Ǆ#��rm��lSP�䆳J�Qs�� �q\��a��C��Q�5��=��X�,ڢ�e�a�V�7 fP�p\��tqk��ua`aՁ�F� ��'��cG}FeT��Ä�@/o �[�(��B�&��B!Zx��򀕡��8E�0F;�yj$E�)�NV�U^S�F�f��׃S6�k�E�r[��.�=��V�j��i�K�1@��>�� UeH��[��0-Ql�u�w��`�;Ԣ>��5ٛݲ0uVz�)U��<�y0�.#�뚚"�r��.��<X�5W�V��ʍ�M�Ub��!+as��XWM��v`y��Z��{��\%��ur��/�j!ss`��(w��#� ��8�W�})�Qc��4z7ۘX�mBfy��WKbR��9rpʇ�h5�h�r�!m�Z��)N�8!�]�caCuЂ�\|lܴ�u��M��l�k!��b��1V{�5�(�ZY��>�l�� 6C�7��H��7Ǝ5z�Q�{�ȃ0�c�v3uo 7�a8�5퍨��J$��Ɛ�,j�fmwC��C�ँiImu喃�%��"9W��8Pe��:S��7��`�:�a/LgVW�06�[��P"��\|��=~Ӊ:k��h�e�ND��vE VO��b��X{Z��a��nG?�ټ�碣��c��T��^��J44��Bt�]/��J�#�W�-bvx�K�v7Y�o ��]W-��c�Kڧ�2�:ʸ-c�I��<��0�j!��˶�Z`DU��YIt"Z�Z��dn��ro1��Y�vԪl��Ņ��i��y#즫��𕱣�;Y��v�L�i�J0�pJ[h/qxwiU��G@^E)u#�B��j\|;�x0�Q�Ȋ�$�8[�]�Nt��J�\|�2s0��bU&� @`'�F�U��yY�D�V`)&�na�Q��[��4�RVDގ��(U#Ŏ�-��Ӳ͙d%ϋ P��㢼ֻ=�#�D [K�(W��(SB�t��R�b6�s�Q_�ޯS��t�h�^�}�V��dn\�ڎD�>m��uu��zOO}~��\t�Y��b��{��D��.�b�rz��}��c,��C��r^��?.ܳ�p��(W{�"·�Flًx�vb��;,]Gٷ�?�}��û��#��^��ݪ��C�]�ݹ�_0��ͷ��N�X^�w��U��X��`��{��@U_�R��+�.��"x�r�ξ��$�{��\|f��L�uh.{�}��o�m��菀6ݳmjb?2�c&��o��T��w��x��f�e{�\|^��g��tٝ�M��~��i�5��wͮ_֛˝I�m�ِ��k��n�yySP[��Ð��Y�%��E5��?��V�(Y_��X�?��?�1l�Y��1��u�\�<��Lf Ԙ��}��S�pxO�syWa]��/گ�D��(�c �:�e��tCe]u��n�m��>��7\?�줺��g��؁��t��~��Ҿ��RTsca�ks��h�B�r�:^�e�V�#�S{E q%7`�l�I��\|�^�;��B��v^#�^Q2��)��κ6�eEe8\��I-��B[V�1#��{Ө��7�n��`��>q׌`��^�w!�%��jnͺ0k��9��z��T��\�ie��h�߼�s��Z-��zΤ(3z��>�L`.�:gQz��@��J:9��-�`��WpMe��)\| ��N�֞t�1��նN��-��AKց��7`�܍Re3W9a=+��~�R>VP��+�h�jm�%bQ��g��4�Veff�� &(@L��K�Ͷ�5^��"��q��9�l��l��l�a� ��5� ~8mK��߉�Y��L�Z��WK��Q�L��0Z�1��i��ْV�o��_d�\Z��{!�Usqm�m ��e��ON�� i���K�l7{3��UzZ<��q�/\��Ӹ{�X3;�&z��AشLf�N��ñ_W:3�7��XjV�D�'T��%�eѤ��[�� �֜g��"dXt�Α��b��z��o�W��v t��og7��6��n=not,�?�9V>��]�v�1'��B�7C��~��pI��}��Nt��d��%V�6Ղ&�z.'kn9��9��}�^+�n�� ><q�J��.Kv�Vz9��t^��E��s�7�֭�C��Ň��NT餲�)wt�� >o�ѥkcn܊0C��:�S�P��J��o�7Of��<��s��"7��a��l�)�j�ū�dOzuі�'@�]~�.�rU��~v��2��EΟh�X��W��붑��G��WŹ�UKǫ�~5�I�F�.�O��Bv�� N��b�U�Ί��t�\|'��m�;pM= `�n�:8_��S��m40=de�\|.ƅalL�E��+?د^��`.��MS�$S�/Q@�_�H�ԭ^�r�u��~�[�'@0��wm��A��C�\�PTv\7�� E��W�7`�EM��W+�{��6��U_t2r��aw��zBH��a3ԡ�Ge�j�0��l�s g�rnv��C�m�2}Q�K�(J�c��vu8��@]��bIϪYS��86J�ۤ-y�oN}��uP�+2Z�bM��M��ۧ�(+M�^v�B{��%�:��jw�myw��Ⱦ��F��} _ӿ�7��+��l%��Bs�`ݥ/��X)o�0D�F{k��d�"x��Qi@m<0j�g�[Nݠ8��x�'�M��pz��5�U�JKn��$4��9�y�x'�U��xm�eQ�S0}Qx�%��\K��H��a�jP�ál��7��vƁ��:�f8~�h �R��hV�2%k�\|-u�i�0\:� ��BG��"wsF��$�)�e��G�Pa��\�l�`gB]˼��jZ ��p\|c�TA��9�y!�d�t�<L!6���/U� +�TQ \MZ(�o��Pa0��k6�X%.0Ө�j<,��˻` Xj�uXe?��di��5L&��q�d]��?��c��xY0��s�p�U�8G�"8��e��-��F��e��k #��m0�֜��h��2��`jr��b��CH�akR:�9�!��r�yWxU��40M�nM�jZF��#�!!Pv��r�\�l?wX��a�_UKJS��+�5!��PL��KKybDe��"QT�a>�� 4�gYA��XFP:�pk(I5j��N��j';�2[�� X��ڷ1��( lk�'0��lh�L`��p�KX1"��L�u�bM�߸��=x��6]��%��e�:lmR׷6xT ��L��cB�~��f�JB9e��He޲�"H�bC��V�h��z��`fq`�8v��A6�S�j�s��tq�1��pdG�yo�xf��K�9�ծ�o�T?ԏ��c��O�&�0n;��m!Ƌ~�^�lo��@�`n�� f��y�X)��nw��`4��5��&D��W�r�)�L�b1�y�e�+)`X��6��إu�T��kL�ȷI[���t��&B�4��(o��~�G�~��i)�% a��G_��Xi�#�˗�f��R�ŶZ;��w�E�/��-�s 2s�jhj��\|u1hX�&�nU�yl�X7~��vx{]�E��[��B�P�f�3��Y�_p��R�lV��wf�V��\|ˍ��J̷�o�vgJ�媩�e7.��j��iɆ��]E�,m�[��w�'{��^��/�S�� ���W��lӖ�w͗��̮34!��SV��\�v��@g쯣��eS�$��F0�c՟tX�c\�In�c�5��3�拚��I��j5cH�:�,8��̤!3�t�o�{d�g�y��I�DM��0�⛡� �(�g[b��M�I�g$~�`PL�O�,�S��;U��[��8$�?L�G͕i��1��$(-�>��p�$�G=�/a'&�X�f%��1�O�0`^P��M�/v �TD@qr#�q��:��bg��bR��XӼ��(O�qfĴ$��S��;�H��8��C�$G3-��/�q�p��U��E4��(�çМFU�IsSӟ񹰸t8�g��kW��A\�χ��k��p�4/��(��k��B!tʢ�:t�\|9�WK�Xܟ\|/F26��/��`�G�Jܬ��}.��Y�A�֖��KS��[;̬��ڞ9>�F4i�ĺ��u��2�wk]��Պ�mfb��_6a �3;��i�P-W� ��(e�%�q`��lT�2�_��4��@��k�ͪ�77 ��3c�йP��[V��EV甉��d��{_��7�2�}��o��n[�KX�6�o1��P��&d�79E%80�K x~��$4!��M�[�M��w@�D�vm �;F��bT"Ǟ��7qe��i��m�.�"�]��0�({�Z7 ��A��%�m��@��T�УQ��24�j��ƛ��{�,��THp�b�n�h2�)��B5��ҔA%,� e;��3��8i��1�X[�b� �6��A5(�Q{�9��M-�K��XU��5��%:q��f��$�'��rTR%�`�bS�P8�b:��؊:�D�G��B)��h`@U�_݀m��)AQe-<+\\� �Uk'��p�H,1A��Kn�4z�T9"��̞��H8�4`��i�9�]fSX��IH�q T�+5l`�J<�Pc�Ds�5�� /�ᥱ��F]R�U�5;�}p��Q؁c�AΘ�y�xIɩL�kLt��y�48�`uP��4�0��P�¾��T�h_��5"�vP0��<7f�Ć��ֈ�a�`��滚��\|x l��P��p��V�Ζ��}�Q��1��9��vk��W5>�5̏u�w��)��&r��e�� ftS��R��`�C�^'�[�u�<�Պ�D�Cݢ�6j��j3ʌQ�s�U��v��3��@9J��6�At��/4]�1<��f��u#7`$Iesan�\mڪ��Y� ��iܰƣ�f[��u�ږ�6{�Ka��#Ѯ;��/K�؆ �kp�@6kL�J�w. SkO`N��as��,�U�; �U��0ɪ��Q��K��/�v�S��D��sb�Kۺ�J�R⶿�f�T�o�Q��(�Ԥq��\|`�U�a�M�Z�v��ij�x{��ֳ~e�8&��f��.7�m�)��b��0�ǁQ��JI�h�$�9i��N�2tw�S~ˤQ� ��t)XrGx��p�0�c��(��Y%�\|D�=)�St��L�l�\|�� 1��#n1�L��R8=�?UZ2;��c�^<��f��r@}��k 9�;��(@Ҙ��TD�`��`U��a��;�YQπ�I\| �/H�2C�2�n��+DaG;��Q��`�xE�� NtR�A�d-f�a��pc�"l&��5b\�UnJ}X�Y��M갰M�ڡ��>��9��,f(�s�<O�S��vj�;��S�͔��hq� �r=14yfr�$�)1��bmm��(.��Z�kS��f��8m��0H:[.�?e�u�M�iZS��Mƻ��F�@��" �Y��b�X��@M}�V�(�u�I� L#8Tf��0�\|�>Ĉ��)�` B `6��T��ۥ��58fm�ͽ�s)�6�7��q"�6P�T�W#L��t%Uh��a�:��$��#�x�Zw2�mѴYI��XU6Kc֕"b��}��u�Ѝ` b�`�D��n{lUP]4��r!�'N�E��%-}c��R��p�2��u��ǂ[~gKg�-�ccYB{2�'��8�ĺ��i(��Yф�� @( &��.uOE['@Էݠ��FW��-rL��vƸ-\h4��=��Lp�"�>F�-`S�"��Z�,� �L`l��$J��Q��F�ih�l�ǣ��sm�C��=^(O4�<0��gP�C=�-��ôUU�f��4��br�#�Q�% ��6�"(��4�,��8� (�xE��N1x4�p��R)��8�J�g��f\|E�)S�bZ(,6S`�>�0�4�^ˍ2��,;T��= ��$�.Xa@�ho�$��@�H8� ��`25��)�Q#܀��q�#�qU:�x��sT��u�X��=��{��NE��A4��W��X�ʯXe��ŧ��r�(�{NfS�� أw��܃S�-V!�i00�(/S�z)ZoP2�81^�lJm��dvD� ��KNl��v�酋2OP�5� :�q��9��2��<z�I�.�5.F�0�`$f�yt��C''�h��!��Tp0��Sm��$�,i�^ 5 ��@J ��5�l<7�Q��M�Rw�� xP ��,P�Z��$��[��<}gj�=T��j(�_0i�l�Z�4�#2\|I ��\|`�@bD#�)�?r�Π�&ЊIT��n��f��^X ֣�ix8W�d��- F�8JC��v(#w�FN��`�l��\�:v�hCK��Z��2x^��i�'��)��l�0hYU�O��WM O-O5�z�^>��\r�f��%�֣��~Z<σ��O�Ӄ��6��r�)�R�3ު��۩\\|>��x��^�MN~:dI��3[��;s^?�?Q@�B�];��r��z]nȓ:4�M�7�v�}�W�.��]:�r��nم��U\U�(lU��/��^nRs��}�͞ȟ�W��_,��X��W��^��WX�\:�j�U_��t~�cU,�U��v�a-_lh�rd��} G��6#�v��(1��+bi��5��l��o`�/]Sw��ܹ�;�[��xy��~W�2��L��Z��^���<�̗K 缫��T�c�� [��(}��ᘊ%x;��L�\|��\|�k�P�e�^��M�`L=v��{��r�f�ߪN%v�9�ۇu�${ų��Y��:��i��.��Mf�>�{�hٮO�ϛ]ớw�%2��u��c�]�0��}��p-벢�\#�ց�oT��5b��S�5")0y�&l�� k�)�֍]7��Lq�f[��G�(�."V�Mlg��Ya��ܨ׻�aC��L�MA^�6.+��WZ��ԥ+%�v vkXsй�`/��3��Z��H�_��W��Y�m��m�L��`� ^�3p�Ein` �(e[�D�s)�B�=B�%u��j��%R<(�o�� ��k'�Ŭkm��lj��N��(3����Z�!e%P2�5,@E��͎ -g��Rf2��5�C�z0\�~ �� ,R�p 嚞�� zE��S?�X�Lg��i��\�be�R)m�۵u�񜆄m }Ⱥm�>��n��c�W~ke5�.��<}��_��E4��Q��2��Qv��t�R��`r�3��&V��=[��>�r�N\�C�lKߵv7�Mv� 8q�#�i6��`�M݂_�>�ʕe�>��6�+�OV3I��p<f��nۺ��~�.M��4�;�r��f_{��}:��̋9�{�"I��E�ֱ��Q��ʭ\��iMZ��7��%��6}�כ#�K�#�2�W��ש"'�U�,��̉��ME�H6��U�s�6�m��m&��\4?�m�%�5�M4�뮠�~^0ۻ��r޸�;�%��dWS�lڬ��<�>�:]m��ej}X��Ww�n�܎��o."/��_=�폢�Ґ.JF��~a��,�FY!%��e�c-�-�m��&��0�l��S@�FΩC�!��@]n��3�q��_�eǜ\|0�� �}ׁ�!�� a+; ��W�:��3�r��G��=�oG�6 ȝY�JJ��XO�8�� 2$�-\r�b�# K�'(�v�%lԹJ˭0�d�Dx8][, S��a��aN��&�~osS�XJTӄ��M&�A�b��ղ��Z_�( (��PQ�3�̌2@3a�5Vl� 5)]y ��8��f�r�< ��5`��F@��P��ne�N�F��}�g�I�1�u�1�,N@��>SO�:[�"I��P\|QPC¹� ,�=�TК��h8��$��K��}�� J�1��7�a<L��<��0��``��#\�C֞��?��ᕇ�qKXi��~2e)�h�h�Nv@͑�/\|I��˓��N��a��5�x˖#U3Ŝ2��6�N��%L.��B)@�04l�^��m%+�K7�:��:H�� SO0�G9��@ &��ڱ��9x��$Y��"P��9<�V��l��lj\��!bq)��+��-E�j� �(�r=�TD��ck��(./�gM([y-^�/#Lm��sú PSlg�hZ�bG�k��] LN��%p%8�Ra��[�`VB�\|7�J9[P��'�o��y� �E\`,�{�ڄ.�T��`~�~�mx��`�6�6v��+se�C'��xվli�޺ݗT��T�R,y�,��,Oy+��H��[b��J�R��/d��Ȯ�-Q��˷)7o-;�J��^5��В��+��yv�v�_\\| ��B�~��U��lS��G8��ω\|9�p{�)dW�m7��Ow�h^�bsW��K�`_��ߤ�"�GQ��q��hV��i�7V�r?Ͻ&��d�uw�˷��:�G��nC�~3g�%D�~�+�y��]k x��v��6�7%N/�\��L �[ �k��(�t8��5e{P[��A��JY�/�� Ǘ��r��N��'�%��ݪ��!쪪��W�ސ ��onx�7�8�`�-��-��J}N�x�Fǽ�PG��>�j��&�d�&ۛ��c��H�E(��dQ��bQ$�w��mpS 'C�L�9��%�`�Y ��@�+cd��DM��xc��[�w�aϣ}4�h&6boTA�eG-?��Nc8��z��KДS5�L;�c��I�c�u+i#��l��MU�j��/xd�Z'�}��; �W��`��&>U��80�� f��6B0��F�J9��S��z5I��QG�0! P\�D��)äZ؃��p&��M�A��&G�ݘ��E7 ��؄,��^=��a\m1��/� �e��Ԡ�:F3��X��3��)�qH�snzp�\|��6��o�d��>p��(>FU1SΕ)lj��(��h,�~��4��:�j9��`��8�}Lc��Y�y XJ{/��,\|S,�m�Ųz7ey`j��HT��@��60��`�r9�K\�0�ƀ��ZŚN=��0�2`��%��/��[�v��`��y�� og5�B�}8.XI,�i��u�s� \�=T�Ǯ��1gƇ0�0(L�`��I��Tl�"hS�`�."x�6�v%��QXF��ԥ�9 �Ma ;Tc��b�O8�i{!PV��!Ӂ]c]��Til��c��v�7G�y��[��BM#�}�9��'�3@�� !$lT �֜a�da�%M�R�^i86��<S��߅��ʣ�u�w�p��L�K�]�0�c��R�c��x��oǅ��#�Ǫz�1z8��0��2�>��S��\�O�Pnj�X^O�?�Li̡�ZW��?V�c< ��v��?e8��#��ftM��$6��A酏��xL�&^��(��j�1��$��q+��`�wQ�``Cl�7%�1A c��C�ؗ�c%v��8�T��T\|>���;5��W��tD��4�O��0c�cӴ)�O fCa?61�σՃ-��ԱkR0��S�=�%,��&�{��Ĕҋ[y�Κ,�Թ_�!@q1�p��,V��)��M��L�/J��9�gzv�oҾ܍�~-�e�//��X̷2fo��z�O�nTooʭ�6�ny�6�`�b��@ߐ�GS,�?��"�_��˔�s��Z�^!�}X�x�QR�x�\ں[��=�\|5��n��ĦۂV�3ӎ��)9��jd��+<�w%$�1�=8��D��Zm�[��(o�U�i�-NZ�v��v�Y;��Pyk��[��Igq�,<��b��M�9FoF+��^b S{[�+�z��dK��&ybJ`k�K�ieȪ,Q0Ȍ0̻U!ŉc�:��0��&�;��[�J%W�t(8%ov�)�q̽Z��P��4��1/�y�=�1T��E<�׬�&��Դ~ v}= '�v`�4��#�:��]y�%��Wr��R��J��d�"�Z8�ۢG�bK�>�Ug��~��V�5#A�Z�_!qal�&�Bs[T`7�N�y dTaT�˘PY��Sx��G�{�)��X�Z7��m��uM�,�/H;��S�'3�B)�C�-��?0��4�U�5��F��\��1�b� ��9�/)��c`� �־f@X#v0)�S��.=E�΄nY�2u�L- +�h�29_��8$ނ�E<B-�;@S��e�Q�%�)<$f�S=� 6Ih D ,5`�I��Z[��j`�t6��@��6e-��ڈ \|4�YxiƢf)�$��MP L�͉m��m\|b ��~��@C��t@D��Ei64`��(�j)�`ezx�ʠ&o��#�3�8r��`^�b�Դ��S�a��{�aB0� �dD-D@TL��(�W�Ř(,h���`��S��tk��bb��j~��D��zF�C��P"�a>C(ms�� >@��>��9�Ӕ�b �Pm� c��tc!��;�TKt�?��PvxDV��b�aƁ�L=Ҩ��x1e�4��):_�J6u`�ݤ��VO%e\�,��L�m��x3�V��%ο�Q��+cox�<��o��Ї�܊�$yLs�͇��8 F�0A��z��'��֫�F�� jR 0�e�VĄ ��zUVD�� M¢~��uy4�]�c�CND[�ځ8_��F'̼M�[�h ��f�ފ-�ܮN�G9 -0j�j)�:��q�z��{��e��v�if�jS-ô��Z��]��+��{��^��?��~��7_[��5� (�z�b��-/_�M�Ԙ�� G2�U]�ru��B��;��&��_5�,W߫}�H�k⾽k��W򕶻fԥ�� Lץ�ף��ҮR��l�B�xi�Zz��[�%��l��aN=��%��ƴӯ��.��y��^�_�l/��{��+��t� _��L�Hi�b��&��j}+��}��d��W�_�o_��^�Aܹ��D:��q,��U,7��˶y�-�Ųrg��զ��+�c�LQV�z�^sP��s;=�ܧ�]ڳ�e�w�۸�خ-�E]Սz��e��/k�]֏�:�(�\��A3?�` ��XU�Z��c� �\_��T��N r�3�ʮ[SwM�iL:z^�n3�d�2�jb�` j�1�R�Zr8Z��"h��~yJ��uVe��o�_��ł�Cla��:��W� ��U��R��q`5S�(L[`�keJ�˴��G�.�g�9 ++ϱ]��;�k�LK0<)�r��.�}൏0��Oj�mY��%��:��ʙ-�<�LQ��_��߃1U��JX�ѳk��O��\�?;��X`�4)Xj5��4E�Ot)}�FQQ0��P�>�4�3Qzh�fI2�z�Q�.�M�,�%۫� �CN�/� x�V��?�̦��'�lU��)i;�y��Y\|uT� �z��a��`_U�95_sOV�dՆL��T��m�=��~��_}�W?}}�U��˧?ރ�>��W>l�ˋn#Y�o��W��㇕��<�͚_��]��;,�/䏎o[��/߼��?��//��gA?�e��˿)��j��ڿ�y��/��G��\|��&��o��=}�_��䯿��Vg��S��͋��O�o�ժ��,��H��ۻ,�f��~��.�8n��S�l&�O��C�;[��w?�/�p~��"wW��n�I��{��ŏ��>\|��M^}n~�˥6W��x�O�}��U��8_7�)��O��x�/��gc/n�.�3��n�w=@�W�5�w��O�ݻ��a��_<�<��1�(^=��0\|h��\|��2��R<[�o��t:ܞV��f��y~�?a�F��V}��dF��ݏߨ��S�y��Wwߜ��Ӿٟ~ی?-�e{x��Ϥ��y2\|��yO�_ʗ�0�.�B]o�'b��糹�gs�L��\��7��7F?��J7v�gI��C�.�(�y�ו�Q�/ ��բ��қ�9�_��d�e��X'��Eq`�<t��e�ی�t��p��e��{��_�Ԟ�U2�%��^�_�-�j5��Ѿ��U��d7��f\�Ǫ��#�~�6!-[�cEc 7�,u��-��x�/��j��YV�{��?6�6? ��Fc��W�]�>�T.���3Wf��E��ݤc�Ƹ;o��\|��@��W��o��hG�.�rx�꓾߶�Tg�v�f_�t'��j�椻i ��ƺ F�Hҷ2~8��c̊�zma\|ҒWn�_�v�t�� _�[�$��}y��ϫ�hAc�l��Y~AO�=�m�bǭ�Te:Yo�!�2�6��p��O9��M��Զ[�>��\��5 �\�uB/]6�~e+R��ǫ��]��j68��n�3�\|��R�9�� X98��o_��zҜ�~&�bM�+#W�%"��?��; �,�Ŭ\��W��=�ߺaˮw�iK��і�ۿ��B��hl,��}�ٳ��ƛKN.��xy��s��<��E�/�H�gz��wlv\��`1º�ʫ�}�+��y��Rc��o�c ��5�5��j�-n��Z�Ό��R��ա��~�4��GIv��H?-�ɾ�c�t�ܿ=�&��a�S��H�.��۵��^�z��6�T^�]�^֭�y��wC��/j]�W�M�=��n�?;l)!��zK��W��_��k.4 �8\|�[�y8lG5�#�gŭm��u�=V}�X��on��x�/�Ug暲L��K�v��6FΨ��_ok��P�nh�6�"'��b�u�(��j.oI��&���m��T��μ�b��il9��=�V}~Py!��ַ�Cp�Ḹz��Y7f�:�¨6J�#��Y�n7M��͏��?y�\��G݉��b��J��4 ��Q�4�I�eY�$�� `��0a2IH�E��JUfVEdt��{��۝v��ާ��#<�#��$��0a��!��r��{��{��}��}k9��=��xK��"!��TM�~��U�Ʌ�wWE��>��t+[?�Y�ٍ��z�=�E��p]L��O��Y�Z��p�\|��0�a��^SU߮�A�U�}�y��?��w{��Y��-k�E��/��K�_��KqLC}/�¼��?,��}�`'��O��n��~5��n�P�\n��өm۹�O�� }[��s��P��z�_��:~?L?�N��tc��<ϳ�T�ߊB�]�݌4�"�]\|8�ū�� ��~߬_񫅬7�}�X6o^ƟK��t��i�.�q�l�XM��:��晻�w�õ��_��R�6iuw߸!n��C�֎<�[.F�7l��o��ì��v�~��= �Vf�`�r��X ���o��ԋ�4��Eg��V{�=F��%�s'?qŞG8x�� r��4�ҫp�il<��#�t􍾅Lٕ@��T��]�jѺi�i}<fc��g��CJ�\��Ȇ��^f��i�R�o��U�ۯ��SR��v��2�.�f�8��`�o�^A��:��)6b��z��B�l9��n�J�5U��r�ҽVlOe��Ik7�뫵�ST��WPb3՛ʶ3�~�䙸"Wur��à��O�yܭ��"��XCF�}��q�)��}V��֪k�d�j�G��]�FF��≺��vl�\�7��e��<�Sl�`��0��M��}%��EN�_ؤ��fJ��~��^w_��y(6�x�_�S��t�_��/~��Oܬ��e��?��߿��R�~��GV��>��U��i�?#_��ʹܾ9�e��g��W�f��ݒW�.+��>��_��ڌ�/��.�z��_{��/��o��nh��״{��ju\|�1��`Y�Ϯ?��u��g�.��{ן�Qtvu��?��x6��I��Cje��t�W�y�g��y?�h��͟�ϟڿ�R��L��C��ɻӏ~g��_��;3��?7s?\|��xS��ҿs\|��[v��]��ߞ�/��a�r)~��?��ê��e�T<��XT�?~p��:�d��(T��糪��o��Y+gY/�fU��/6/��d��t��a��G��>��͟��o��˛��?��}Va��o�8�Y׿��P�_��o�=\=sZ�'��v��U��ߒU�7>��\|�rv��f3��ߑ��Y��=yvo�\|m�Y��'r/��OAnL��ơkX �Z��U�6tg�}ӓ�@��q#;92��j2�&1��Yjh��V ߼�R��Mh��+�r`S�ڧ;�_9��HZ�;9�v�omU�آ7+�{��J6�&\|3EM#n Se[\|�WIJA뎼iDդM��\|�no%��5��b3j4��;�GV��Ow��<9��h��= �a�s�+��}�_q�<ft�8B (SӤ�M�Q�I�Ɛ{�Z-},��g6��&�ʮtU��z\%��%��+Қ��A�FN¸�0�R��۶��]��2,t�:�,��!<?@E� ��z�^��𖐖tkV�0��q�4�E�y��}a�� =>�[g��5ρ��>h��\^�3�:B�F9��j!�"yoJዊV�b+��P\|��<M�7�~�~��n n<��_O>?V�_ﺘ.ݦ��^�MQVl�>��jϮ��}�;yx��zn��ײc�^e��/��rs��\|��"܅+��\|Z�WP�d��}��\|%7w��'��>��_�O^��A��O��W7��7�,~�e��۫��Χ/�x�1��M>��\|�n_K�/?�H��>��'�Q\|��4�h� ��=Y�G�b_9�� yp��!��f���!\|�~��R��]�ݬ>Ό��ߌf^��Z�%�ۼy��>��1��S��}xU\M7n��𷍋�ף��Sm�oQSiC��O�+@��Z��u��A�y�C z:}�/n.�?��W�[��^nj��U�ak��m��O��ݻ��P�:�)��?�7�o��r��jckGt��G�A�X��]J��\|2�^]7�?�p�ǟO��x�o��},6�O�Ǘm��M��=�M?�� J�:7i��t~��s�(Yuǒ��:�'�Y�^�8]9ʞI0�yq��C�g56�z�]{�5 �ج �n̹�Bzr~��3��x�¦�p�Q�"�_{�s�+�� ng��G �0��o�vMm�j49��g��6B�l1{�l�D𨁠N�>U�9�~�3X��j�� μ�� G�uJ�9.F�v�QY >�V��x��g�Y�� k��A� g� ��)K亞C.P�?%ꖑ�M��n24�V�p��B(Lpl#�K(��&DJQϱ��Í��4ѨF��Y�N ؕ}��Y(��c�l��P��X�W�q��4��`��9�$[��e��T��j���>��h\^̋��͇�?��r��E�zz�]�^<t�jS�V��x�:�7��ݝ��^2�� 7��eO�ի��$ݫL�ug�P�mxI��m_[F�0`�}�Y��2'37W?9t�S�"+��^��'׸�K:��~��@B�Nt�rk��-u��hU�ٯDk9�y��3I�2ͧi�f�B��L�r(˧o�w�� @��/N�ŋӐ�/��q_v��O��:�N��GM�j��R~h��H݊�2�h��M��;�6��_�O�uT_�Sܿ�m_��ōن��;�~�5o#��җ]7�å�}�>"�[��ȡ��Q�9^@e��OGs��w��כ��k��ξ��o�% ��"��O ��]�a�o fo\��qхm�nې��'��皫!��fi�NGUŊ�z��6�8�iT\öN�@:iYR(��-A��.A�@6��A9�R��zH!F�@%k�NfsVn�?p�f </j/�#�>O�%�b��w�^y�:��D� ��FQ�FbZF�g h�J�<Ԫ&�=�i�푢��έ�P�"�b��g��6P� ��K\��i:�hJ�9-E� Iu��!�a^�8�V��0�88o�A:�-�� d(H͕�"��(��i��qh�f(��L�3�J��lPV�6nj\�<��@c��n!��!S�� Ί�}ő^��(�}�inC��BAB!� %$�a��(����¹7�}8�g�5�uW2ڎ�� 4pLԁ�,��>��r�t��bW!g��-��1� �Ù ��C�4 �mq��;��z��>6��L�u�4�ٝO�y�.s��/;��9�}��&��4��Q\��~��wF<-Ni�}pν�ga��Mcg��s��_�a?�3��}f�5�\|��щ-��6[$��j��)'PL�$��T9+�a#6�Y��h}V{/=��;�b��n��}�s��y}��1'�YOͪ�݉��؇�`ϳ��܈��H��/G��_�j�Y��ۋ��8�"y��;�b�"n�{!��(�}��c�}y��9�)��{/��JP ��O4��\|F�{��R�sU��G�^K�鴆Q).�1�MPy�m v�[��5�@�eZ��/@.��W�0��%&P��j��Ix�c��V�\Zx۫2�g�\�Pz(�ؐ�)v��̪4u�/��%��e��։Z%tm B��׉^�xW86M��\|�,�X�nR�!"qE#�k&��l=��d��l%�D��2X�J��V��h� �e ?"��Q#��"�smp�tLU��c�𢜎��L�c�[��%�{K�@F]R�G�RԀ�-j�$�� 8�?��X ��C�sw@��h��iB�� 4AFט��5PcvQ�� c % ��J[��#!��Ű��1�UV�\TX�CK�.!�&�o�ۢ��ݨ��y�ZQ�f�� F<;b�)��bH��ޅ{/Bxn7�4g�)�'��FL!g�@��ܰ�ܝ%.,qT�0g)t+;7k��y�E� ̏8�W~��؀�C[��ٍ�/�Y��B�!�`go0T�Ŝ�rE�gA೉�{̗�gt�:'k�^��<5��x��;R a@��Lp�<��a�0��4!Go��V��y��C��1Jd'��I��-�`�`��(L��"��Ǒ��~�R�ӿ9��Ѽ7/ÎjLy��\|��8�FpL��d܊4\EL�V��\|B4��ѣL�` l8t�-�.��ҒGL�p��YJ��:��{R�ࡢ�՛1��R@�A�+ݖ��Zs oDyt�p�Dz�� ym�� �&ph�!Ӓұa"]��6[�5@�ƮǎeCh�j�K<»�� jC� ��X~M�sQLE~�n�A�%G��DU�h:�^��C�9�꺆�(# ��L��n!>�>P7Ԫ��Uϧ�֚��wzst=�� �K!�£\<��h�[یK��u{�&��oP�-5�w��%꯴��v��bZB�ۊ[ �� K�X�s��/I��D��m�q�u�]l�� �� $ �[�k�i��F��#�he�h&J�zHB��c��IZ_�@f!��z�ن��e-!��ʜq�x'�V�-uh��6�7��P��E��\�Mj,m��رi]�/�pR�z�D!>�gTlQ&� h��y'Ӊ��G�&�$"u}͊�d�d�w�\.Z�}<��%ϲ�mʂ��Э��X��H+��}wt�0��m��S�J��]淼ZYv�z��]��o��[y<-��/��tO�D�n�dxW�e��9� ��mۺ.[�;��5�Ŭ��J�[��~�b�/�vO��'��&��֫MU�z��m�K��zM��<�n��H�5��?^��%iw�pg��r<��4 />4��j1��߽\|��ʋ��:��]e:�V^ �b��l�ͮ%t��Gi��=��N}�²z{?n+��^�%'a\ׇ�%mK9->��˞J/,�6�d�bu'�}y�\|��ѫ��Iפ�;L��d[4�N�rL=7�� #]�U��J��_��C~�<� ��nT��'q��˔ֹ\|�)�z�ر��_B[jw��Wi�Fb�N5��"�R�fa�� �#�l�ܬNL�� (H�4,�� ɶ�۵\�z��Չ4�s��E�y�Z`�rf�l�G��[ ),��-~��4̔�0ʰ��C��)O��N��u��1Gi��N�Be�S �h��T��<ީZCj�՛�9X`�P� ;�B��K��x�� mڊ�֯ �<� ��9INp��gԻ:�v�l��#:��Ȉ^W<��j��{��A�JL2J`��Ě:�u�� -K5ڛҳT �~��z��"�h�J@�u�G�1�jl�� �5�x��\��Ł (�M�rA7�Q�bvr��q�yˠ&�c��[�mΖ�'� �Z��¿[�m�珜@FuZdW7��Z-��o߸V/�P��u��l+S��&`� ±�7]o�΄$��6�M'?v�\OY�?��\᳻ ��i�6%��4_C�!j( �T Z��I&��8r:]��F~\_d�(瓛�6��l��j;\|��q��4��ܾl��v}��t-q"]�E�hQ��v7N�dJv�q��mq��@7(�z��Y�Q4_�u��ZS��gl��N�'m,ʸ��)'#E�6��}��+��h�ت�n� �3 ��)��ϓ��C]��}I�M�I�8�ο�ݑ��Ů��D�.�>,~Vl{k�=��Q�~2�Wc}�46�d�`c�EN��>_�7��cs>+Wu�Ŷ��+��@(#��d�L/ѐ6�d3��v��a��;��R��L8��m-��M.<�x��QM�+��u��B��<\3ڡ$砨��X(��uP\�̡�G��\�ǨkE5JB�9XLHx��OJ� ��x�:�_,�jI L��g3GH��L�>��9�z\|��9�,��e�/�j��X�0,:H [\n܏�7��Zͪ��}2K�<IQ3�N��b��5�2��:�F��X2X�gM\|fQ�Sda� ��Ѣ>ѫTt�`l̤A��6P��gJ[ge�k��p�x �`�4dA]>GmH)��Z�f\�p��N�̵�1�~Vg]4e�I_��0fL��󅉀݂�~B�+��3 ��NO�Q�G��y�i�Jrk@�:y�8p�5A5?/%��q��{!�ϩ��!3�7��]�$�9��9p��H^��i�߇��SX�%j��9��Ů��u��OG��r�r��ݢz��7�C�r��_�4�#�ի�]��}Q��-1�.Z_��]<숾�Y�Z��[��7G>��h6�Ae��VeWE��NUd�ʹ�ز�X��ٚ+Q~,�vu�g�~�Qd��-�2p��!��]��bxE��<$d�aZ�a�fwi��g3Û��޿lo�M\m�,�x']��x\5D@�\T3�4\|z�ʜ6'�.��'��.�E�,8��..T2"�i��v�Tԧv�;��ѥ�K}��]��8��-͡�q>��'�,��z�� urK�ٞ�x��iO�q��s.��ʙ��3� �5��e�S�ҿ.X G\|>��yɎ�J�m#��c>E_�J!g��d��_Keo��[Udw\Y{�c��ܖ��K�VG У��u�\EliC��m�y4}��!�pl�,`�@2`��ҹ��@"ʑ��k�V^��q:� �_+M� W�i囸t�op��څ�:��/3�� Lݨ��>thz��APP�7��FA��8�dP8�4��4�qQ��;��M��}Hv�Wf��d�s�8�E��vg�r�(��T��6YDi&A��ΏB��f� 4�ᴣ�q�M�!e�Fh��K�g�+T$�u �-o,>#i�b�W�&�h�B��:�j�g��I�@��@2��-�&D�R[��!��q�C58V\|�gbs��j/��y�X"�z��#��?��w�Q٫��:\]0�M�g��^]/��ӯ��_��b�nx$�� ʉX}9�#�E�f��bl:0��wNžYRi�\\|8��&�̗��W� O��o�5_~]<��?�7��=�դ��XN0=��O��A̾��>�E��~r�ەd!;4Ӎ��~}��U��b4Y=��ޕ÷�p;�ߊ��(`��CÛE�]Qv�e=�ҫU�]m��bv\7�ib��[rP,{x]��3O�ݪ;��M�ҥ�1ݾdb�PFl�`�ˆR��z��y �t��U�T V�w�+��p�n�P�1��<�z��k��<�c��^\y��;��/��k(�O7pZ��ǚBu��e�~qS��M[2��M�}]��_��n/Ȇ��a��]��Ĵ]� 9.K:}#�hK'k~�7�Tq�ڵ��˔�6��?�/��i��/[ �ffFQqv7�_��T��bP�k}9�b�Q��w�6$��G�eFy2XBt��6�!��!��^ߛ� zu݆8�~φ� �i6%��M��Y��眚�ɶ��%p��\|Y��f��^w�3��:��Rw]��hi�B�ފ�3��&��9�몁��[Z� �%oU� ��fc��r��'V��k� #� ��7 ��7$��6L�j23Ô!W=��B�8��v�@R}̙f+\|��z��ģ�\ב��̟8�J=�(�4��Nv��)��}?��XoX9�I�m#�kkR[��I��f=w7x�X�D׻��CJ��Y+Q�f>��.��2ݺ��n�\}�:�i��ܴ�:�^�2��:lC��J�Ъlmۊ��E��r�2^�X�E ��(�,��N�-=)��p^��ȸL��˖v\|9;B��?�%��s�֒Ӟ��]�ձ3r��m:�\�J�9�9�{Ulپi�@�s]��4��Y\ԓ)//TyQ�B{��pQ�J��M��H��cjۚJ��:�t?�zj��U��2��ج��6�zA��έ�2EoZ�E1~(�d��rƶ��:�[��u��Q�Ն�&�"��3��F�7�3��!��_�#��E�3D��c��Y��;?�:��1��(�1U_p��\��qgJBU1�r�e~r�c��d��Ⱥ�L<�U~\|C�려��4U��E2�?ͥH��ZYy�LM"S;�KE�<H��C [K��Z��"�y��E�\|MdA6�Qf~��3��b �v@#�T�V�2��% b6$ؖ�@l��* _Fmt��G��+�0��Ta�lךQ2�r'{'4v@�PK��:6lk#={M�� U�E�,D?W� O��^y�� i,Prb��9�y�� �I�9cz�c�N�L<�h$��@Iw��@h�� �"��d�S�� -�`�e^1\|�m�ਸ`�3H#R�t��d�_��M,c�u��VB��&�F#�%�r3�S(J�9��s��ס��Ȧ�" H�F�~��2n�_��"zNz\|��ֆ�ė9p��[�d��]��ӭ��f4�1��%"�;ط0uZ`s4��bBmD�k��.�p�=c9I5��:â �� ͫ�N"����D�:�t��$G$��g�1@��D�Cd�u��N�n�ߢ$d=��7ZR�z>�平p�Aa0�e�@��F�#N+��C;R��B��i$KR��q\u��$ �-��:�8>'��L(�c�v�� a�0��l^4��K�E3W�`�#�`=w�vJ�/�q�]Ah�=��-"#�[�PE� 7�;�,�O�� {G<#?�á/�� R��B�e-,`12��C��i�;XH�@�� 8��J�{ز�^5��Z�/��;��#��a9� ]�Y�n�#�+��w ��e<�pX>$��(��.��v�6W�d{��RL��C��dٜ\�zK��ڔ��ˇ��-D�N���g�}\|C�(�Ӆ=�]�U~I�˲�Uw<�q�T��]ܫm��2�^��<��}�b]^��bDB<�57͒T��5$�Y�6-�z1V�.�Ch��W��vb��R]��-w��o��H��5��qd��}��q��R ��fȺ��:\/'��מ��S,:I��%:��b��p-��Y��~]��'��r1� 6�t��p ��<B�-��^ͨt9��)��j #��k��DK��E��X��Fm��5Yk[?�ʦ"�㖇��o� 7�Q��T�n Kj T�4c�+s��g;�{��D_�9�:��i4��X��"��XA�Էe��F�1��fvM��r[2�>/�A�1�J2�Z�Hj��<<oF��[;Ӯ?��6��ua��@��K��yX�Nw.s��P��'kܫ��Y��n��g@�9�x'v�`6��ll]ħz��rA�AG��Rhۖ��~%ܩ�꟫ѿ��ꋇV�s^W��ܿpC� Bة��o�q�okm�q��qHm��n��#��{�o�T~�e�{��\�s+�oC��&�@�\|�6��3U�{�1�PA=�\|��q��X<�Ϸ�!�tY�9�\|�$Z_��k��}��mQf��cxA �-��Z�v ��5�/��R~z`Z��A=9�d�k�]{+Ƿ-�v�^�8�_M��qq��T��t��,��0��0 k;��A�$v��d͇]��^;��F��zue��<7z��s8^��z�1��D�x��ش>-��1�ٶ\�r!ʁ��)��Z�ځ��_�xt��_��eIXP�J��fm��Ae�n�^Tki�~rq�P�2;�yW��"�=s�.�1ƫf��!��`�SE�a��Tnr��ڱE��2�N�]F��$ ��Ƈ �V��t��kgRMx��}L�k7�b��3�nҎ�F5�� =��)My �p�r-��:�)�x�mv��B�+��\�]�� ٩-�W, ��뵚z�{��a�I,��um�!ݿY��O�e��men�S�7m�Z��NԃS�0��@g��)��&xj�x��P�$V��t2�V0�KZQ�lg��$6^��Θ��M3��C= �wK8�� _L�u��QV�ꮦ!�j�{k�?057�w��l��F=�Jm��}$�F��,u�K��;R��:q}L�]Q+ �X`6�^ؔ�F�N-IOQp ��ټ��,D7?�)��)�1�U��t� �7YP�^/�5[�i��n �6%� ��l��a�Q��C��\ϱG��d@�3�Uu�-O��\�h�3�ߊȫV�/߶}H�b��e�G� :�JX <4��-� K;U��_��@��kT��~> ��Q�SsY�9� ��q��:C��1�f�dKTC��LD��k�d��`E&"��Q{�<��ŝh.)�� D�i��/l��\,9B8�a̦u��n�F �CM�ծ��(Z?��ǒd�$�ڿj�.5"��VS�u��P��@��)�Ȍ0�!��P�L�0�n G�R�fİ�rT��A��`�@��s�6 �N��cE�UA r��B�z��l\|d�F��zP&\|��vW��1qP2�uB��f�6t��Ȱq�lMBj��3ꥈt)zY;�p��Ȁ��%�?��--e�d�e��i��έ��$�`��z�Z�d۶pNt�#\��!�U�8�y�NCEm�1@��Iգ� z�Da_WK�2��5�[ݴ-��ܩ��&��tU��`�uM�-�m.��@�B�b�X�J�)5��8 ?��\|�9�!&[$6��,rV�\�0��ʐڊ�r��Ou�'��s"��r�}�$�#v&PҪ[�B(إ赀:�S ��׌��A��j_�Yω(. (x�`�\q�Ԅ[� ��v_n� �A4��H��R�MՌc$I��V�z��x�+}�.h��p�O�l䔏b�pҝ�:��c�_��?~3>�$~��z)j�t{p��1��Iw��foо0��o�~u�^��+�z ��0T�7��Qo��A�έoE��B.�t��ˡ��9%j6�Vp�Hi�k��. �D__B��A��X@!��:��rG�>7T�%��+8��Y�R��ɋ{n��1�#+��n'.`��p��'��D Ʈ\|�w�48Gۡ��N9Nq��K�K꧟�z�Z�b$qaʓ?-��u�Q�e�A,l��~G�.�Ds��{��:�S֯�ܑ��#��\���W��?��"��ӯ��\wd�;[q��oc��P��u&�+�ȴ{��C6��gJ#ƦJLAxa��{��© ��Aw, ��-��9$&�w�׼Ob �.��ogt�Z��,E�8�AoÀ�� `)�\ 3x=trs��]&8Э�� 1$�� N��&"�Jpd0�@X�}��&JW[�Y8չY��s ��M.;)��K�ݤzbթ��lmj�c#$>�&��`�K8��K��[n!;8\|RD+�AОQ[��[�A!DYhjg�v�! �h~��:\| �[`�DV�Ԓ�`Be�9��А��56iZp�/�.@�8�;6u�%��#�\�p(�7��(�ݣa�%=[Ɩ(E�5$2��X��f'�[L��U��N��%vk�l��V=E�Ke��`�b5�k �dm��p��H�_��?��/�u��p@� �+�`��E�8��n��I��mOJ=[��Q�O��r ��2��,��4�M��B!��x��G\|��c y�p,��P>g��PJkB��Z��^8��itib; ݜ-�%N��8��@x�B[�6��]7(�M�K�3��<F�N�3��go�Ǫ�^t��C\�:�[m<Y\|bL��.M�H �J��5j��e.(J�G K�`状��kqL�xM� �s��ٔ�(\|�ɤ�J>%X�R��å�ZĔp��ZRV�z8E\|�t�a۝��X�pi�/�"uބ�x8��W�K�8>��#;��]�Mk]�p�7+��{� t 1;��S#NpXP��pbx�B@b�5�5p� 8�雺)��85��%�j��v�D��&S�R� f�[UAF�5�yl:g^)�Vg ��8��.\|�y{�&��`��X�r��ިb�2�mP�\|�諛ùiYI�L��+)C�Nf�i͚F��owͮ0�(�DV�!já��΂��=� 펁��t\(�Wݢ�ܘ5SX��&b�R\|��K.R^�Ɂ4��+��D:�F� n�T��Ц���5@D��sHjU��x�S�l�($�.��U�Q�LCB�ݣIL� ~k�pF%@V�S]��`E]�&�nSF�0��>kh�c��@�$I��e�V�yZz�Ț1-��)��˥X.A". ZͲ��t1.L��ۺ[�J֙H��HŬi�E#Ƹ��y��S�5�깮%]��^�K1�>+�ϊ� ��ϋ],�!��%�KIS.�w⮿Y�<��cٮq;~� '��ogz�?L�AsQ~vٱ��f7�㩜>4��~��U��wQtE��b۟�Ϧ��u�%V�%��4_~�mV�\|��7\|\|e��1�3��"�I��)�9P��=nV�"\|sۛ,��[L=��^��봝�%)ī��?��w�b� �wt��"��G�'��\�,��_�_�m��3p��l�+�#tlXeK�8��D�o�P[�E%���V%=�d�VY�w�g+D6lB��j�7d��m�\uh��Wk][��&3y�;K��,��䟺50��EY�2(;��T�Q�'-�7��i_ڐ.�!��#ݐW�)�7��B�ru�c��Z�.7�ˍ0Y\��Qi�vP�}�a �H%[G4�E?��+��8��bh �fЊcˣ,��p0�6�H�A��W��L�F��X�!��B�E�R��\b�@I�8��q��G� � �`��a��d u4D0�쌾 G��@s`%ϖ�� 0V#J���K!dP9M)��s'��Ƹ U�t�� :��<��v5"(ƸBEk��::Y��<W)gI6V��H?D�8��;�Ìcv��_�~[)) ��u�zj��V�) ��U�^Ar�t��38O9#8�RBl� %�<�fHUk�0��e��u-�+��L �Z�(��"��7[h��_>\i`��S@��[t T\r�/s�MWjt��t#�J �Xic�Y��t��pZL�}k!�"��[=�^U.t80��͈g��[5��L�M3��6� ~�A�Ӱ_�� HT�B�](��(��Y��_G)uc ��-0��}FOP�N 1Cp��A[@6�B1u��5�8q�2��A��&( 6��]��ƌ�f�x�no�)�o��75��{�F��B�T��"h6�Z�P`��U��P2i(�(>i��jD�3��l�D�.�D�(��jtP�o ��Y[��ƪF�SaTU��֐�=�Mh"4��)X��&Xt��"6�V���(�ֶ:KUF+xz��d�}��V�ժ�c�tC 0@�flUmDL��\��4��n�ݙsȋfM�ہv��O��}��z{Ü/��>��ڬ��7�&z[��=ɀ(�r%�Z.��F�k�I�٫mE�0��Ԡ�&��9��yW�fEZ�<m��M�W��(�V�)��P篪mu��T>�ZW\| ��@�Q�5�k��n3�m��V��R�� C��k:��ڬ�'c}aV��s lB\�5}Pa�D��7�z�pT5�~>O��%/z� ��] ��;�q�J)>�%pЫud�+^��՝g�-��Nҳ�� U�.�]��q��-]SkV�͢Ue�EU�To��fF�{˦�b�be R�9��'C��AE��jI��r��o��k��޸�mRX�L5��ѹ��Q��Z�'��:��H:#E��׷�^�f$�撑vJ�5�?A�Vr��Iv�K'؝�;� 8�#�6�i,��q�_�ꖔ�@=�)�wᄭ��(�A>Ҿ �H1��s�B�ȃ��o"$�F��4&۫��[�:�,��o� DV�xܡ�� m�-IYm��˃��vL ��r1��%��v�Lb��.��&Q4F� 8Ri�؞?eGZ��#�e�J�2��j�˴�m�L��d�։[�X��.�d�'�ץO�й��ݦn�@=��P��J��Y�~;��+עT�r�z#Mx�?Z�7��)t�ɡ;,��" ��A��?у��S8��W�&ֵ�p vUM��Xj�s�Ő�q-��3ؙі��_� �\|ME��AnuL��V�d�=�+� �'ܮc:�jI�[��V@�\|/V��0o��7��A5��-d#G��q��of��y�v�U��'��T��ޚ��W��\|=[�ٶzXn��c�$K3> i�q��$��Q�J��qC��"��LYYU]��==Lc0�f\p3�%��7��OD�9�1@��>��/o��>bzy��q!�ǳ�>��c�s��+��P��?��U��G_��Œo��:��˟��ß~ӕ_�^��x�2�ߩ��}q=��[��c3��ٻ��:��K)w�b��[��{�ů~�<����?��ْ�c�X��j�'}Y��O_��v��˟=�t�_��Y��_O��?��e��6��7��OO��etg�ս8� ��a��?>�aP�v׷/��kJ�{~��e��T��G�ŗ?�Y�\|u��4_>Oȧ�ga��_��^ſ��gkv� E��/��՝�G,��P=P�n��6��_��ϊ�^�A'��5qS/��7��_��mƧ�&��?~�}��y��Y4��d/��[��r3{��7?~9��i��^ћ�p��fxP��/-3�C��P�>�g��L�c�+��<�n3M�~�eG��G_�� gqm9k��@CU<�[�RKU ��>,��f��ĻYbƵ�ҪG\��Y�s��\;��q�V%�r��/�+�l_�ϳ��Օl�a-7ݭA�n��}�ч#�;6��ԏ�9��i߬��'2�'�о��rS�L�y��d5��K�P�vkT��:��Dp��=%� �ʸ;��dW��N��r7nd%k�h̎�I�=��H]⁶�\|m]z=^�M ��FOZj:F�{-C�ٍ�d��;ԃ�h2Zz6��~�,x�ڵC?P�`P6��kV.?4��]PY�t�� P�n��\�� v�+V�~u��'� �#5��@fw��$͵��s7��E7�,��w��O�'�J�i ��zSF�)# F�9"E-��x%�6D�6S��y�黶Q�jJ�B�@\|��(vl��(�͚w%+I8�#2Gb�H��`tc��K�i��hG$�I��+Y��7\|h@��u5tb�]w1R�ޕ95U�[�#�j��m�n@;��JU��.��꭯�J(��I�G�DK��>��H٭��P��ޔ<5Xw�Mov�F2�5�J�F�L��Ĵ3]�Z�� N�wU�>��_��<��5<�sfgX��zl)޴ �ؓ`@'��<1�J^��=��j�vE� D��x��9�ej�ʑo�g �( >��zF��ʵG�I�Ҁ�+/I:��i� ��r��c9��T��u��Ճ�.�U�2v��$G.-5�Q��d:r�Uݦ";&�AUU�,�1��T �a{��!�\|z�7�� îV��T�` �a�рX�e��Iz(��!u�.�̄��eXʺtvN{f��tT{��/ ��r� �LC��p�1�&GL2�O�CFʐ�� �)3��n�M�r��iV �Z7��P�?0M1��#�юf��C��ƩtD/W%� ,9��}4\|<F.�o �q��"�MM�bz��\u��RY� � {��;JY�\|rQ��ƍtH��%5R��=i�&��;��ilA�Q�2�`a\�d@��1p},��<m ig��DU��̃�m�� 2ڐ\��"��#s.�a�ܥ.��<oA%��l:��Ѧ�m��޾S߾��Yq!>>c��_,7��A[��둪�뺜�~�_]� Ю�i�g�E�Q��_�o�o��2��=��j��q��~�o�0��G��-��ş��G��e��H��zvV��/��f�~��_g�?!5�h�E]��k��g.�g�w�{��?��^�n2ś��{��q��n{պ��Wo!�߼�V/>��w��՛��-Q�'�7��(~,��"��qĈ��$�{{�swq~\|䷓Cy�Zr��s��9�犜��Nu� �!�k~��d��'O��Gy��~��W��G7` �?��o��L5��f��L��=m�F�[cv_��K?��:��N��>o̧�7ח��uI�q��=m7c��g��~�� $"e�u�.H�_�_��٥�/�&�Re�Y��f��/�-zqx��k�H��t�Rӕ�X��`��Sn�0yz(��~}�6ʕ§\|��DM 2��9��2�ƥ[��PW��4'V��M��^��<�b6�Vq��cZU���Л.{V�\8��g��[:��ֺ�W��(��G�〱�mu~l�mh��(�¬A��u�X�[KE��ꖹl�K��%k۵�[Y��ES7ny�L3ئ��\��_��0��b��yWbm(�2��͖��Y��uN��A�Ck10�Ǚ�yM��:�5J`�gI-� /�� T);�Rq��=��j��ѣc�Q}�� (�a�C�y��A�\de��<ZZv�39^'��a�7.�T�v+U11��&de2�lvn�/͂S��kH��nM��U��xL�`�U�k�s�:�Q� ��nF�ָ�iSSOG�ă��)�� �(��椠DR�n��&Jj�K�绍[�A��\�TY{ ��N ��J�.%�~�J,�m>�ph}�P�j��K��A��rY�[Q��Ru��M�֭�.�5K��#�N�H]�-;-X�9r�^9F!��i�H��[�fJW)��`�\Z�Z��ӃU>��J��HEAᆐ�K�#�2��y��@�J��?��s��me��T��ME��$�X(cI�T$��iY��a�S�f��@�9!HJZa^# Y�av�Q�C�W�� ) B��,Og��H�� J{�@`8�"��T�O��m}�ӐZq��0"]jg�a8 #��\|_�'4��Iuue۲�k;oquvdoo^�Y��b�^��+�㣕��_�d��+�n�o@�sR�r�>�� c-ȑq�]F�F��\.O�~(��ACy��̔��/��j��-Q}��vQKF��fm��C]�3G��Kn({>��{T�r��Osο�� `�ֲ�KU��o�� L?d��ת>��a_��Y��[�,�B��rX<�r0dm�}��Z�v��}��!��7ޓM��Ʀ� ꛑ[��^�ӣ�^��ID��F̏�.�r�m�򛶲�L��Q�@��QzeA!��v��L��&��X�}ӻ��V��WΔ��v�\|7��7u��]�ah'�:��˸l�1��ꢓ�1��y��ѹƻv�6$ӂB��lªʴ�v��Ho�n�LoqA-��E.��]>D<��Y��Z�]��d��8�7ez�p�2�ƒҀ$�E��N��X́��S�.Z1֩��ɷ�r��үd�2v�7�QіP3D��`�jG��A�U�lNq�l�Eۓ�AӔ�N�Ԍ� X�r6��+-��}Yw��B�8�n�@��I��'A��#u�&!�Q�Z��^��We�?撩f\|�8%��>݂�M)WKt2]) �_�mh�M�f �P�� -bFI6tw֑��t�t\G�&U�3(�ENi2��L��pn��hYo׵�}i��> x��̀�#`%8Z��N�<�=h�͕ ��R zM��eZ�냧��X)�a�]��ӛNH�h�p�("u��K* ��)չ��]�� V ��h��,��h,h!P~��MC�&+'��4�X:�w\|�SA�\��bj�A㴫�DWz��UyZi"�X��z$��Z}�p/:R��H�V�R��,ay�p��#-(��P%�(fZnX��h�:�v��l�іnT��GX��IU�Մk�\|.l�GOdZ�GK��IlvX�yJ�c��u�N�=�Y1A�ަ��n�Ikcc��C�v&$��,��LF-h8��Ay�΂��a��@�RD j�s�e�Ce��S �B��e��5ڋ较�&#��֎�=��VR%k�$H�X X0�+֥��>�A�[�A��`�J�(�][�! �h#&�FgG��ike[�2�R��a�X<�5{��G�7�x��R��#7�E$6�w��M��Tnr�E��f�=��6k�d\��m�-��_�/�b��B[�܀A�U �Tm��Ԝ<y4�G�т[6u�o@�R$_�]��t��R��a��g��U�'X��_��d��<J��^�a��s�q��<�h��=����r��g�^��z��+�ʦ�u��cCujn L��I��`�,&�b!��1�!�-m5��hӮ�-�aB��Q7@�og<��{�v��֨#�)� !+FsYtڀ�m�u��ɷq��0�K�Էy��#j J��~��Ў S�� ��a��v��S�n_�<��BHѥ� �<��ٺ�RK�x�u5��ۍ�p5)}��M��@_�<+��Lo� .4�W�Z@��\�P-4(jas�<;��hc$h�i��h<��H{$�1UcJ��/J��.�� H4�;^��Z��5��1�؞�!lJ��k�W��5��Ũe/#X� x��QR�o�ŋAK9PcE(̇��Z7�.� �6Ԃ��U�Ro�T�_�: �:��xM�]D�K �`\|YF��z�)^�N�th��#VP��l�Aƀ".�ʀi��it:4\��֬�"̦��Z=�j�Oj�L�STm#`��䤪+2}a��!�T-�K!S�Q�&qR��%p��u�f�Qʡ�pf ��mh��KăA(��=�W arO<��2(z�Ӣ ��y4�:D��X��帴s��/�\|��/��v��t��~�^k/q�P>C�E��W��_�[v1�Wٮ}��Z��&^w��6�GK��y��r��-@�]��]��ͳ�\|��Y5k�X��ųW��d�η%X��ٖ~��ǟ�g�+4]v�?�/��M�^��j>��CC{y��y��n)�&^��y(�f ʎ_�on��J-w�O�Ckv��Uk�~�p\|t��<��> ��7��t��o�F_�f0��O�TߟU/�p�׾U�͗W͋�{m��'a�hb�M��b��><gbs\��Es�?��?4glh��-��=��?�?ٲ�5_-��7GpΎ��P��7�_Tw��o_��?��^�'qc�B�o�-�w�yp?�yA��\|��;T��w�.wW��e�oە��>/�h}��pA��_��.N��n?��e��<�o�l��7%=��7/�-�_��K8��gx^�溮��軹�� �ɳ�8.��{o��rvFb盤b?+��MU��n��>��$� �b�[��p(� h��m�3ˏ�˖Ev��g�m�o߻��8g-;��[�{�/�/7S��.�H��a�4�^+t��z�^�J\|S��s9�ȶ_�or��o.w5z��QQn� 6��w�%ƟѤz�̘�oJ�P��t��fz?殖�E�u{"��<��B=[g_�k��_� �0u�e}F��,-��_��▎�+�{i�eOi��p�� _�U�ʳa3��ӳv��jd#q��%m�\�6!��Y��}6��~T��62̼8.��˳�bS��QJtї��ӫ��Ԩݛ�1��g��B0�+A��V�3�{0�S#�xW C�.�öm5�2�A.?5N<�4ٰ�(��dz��ͰnA"�+3痬��yu��"�� �))yv�/9\|O�U�m��o"o��J�~��R��ɎS��Y�U�2b��b[�l��U��z��(��r&jw+��qC>��?J��=yM��s��Ǽ��cq��~�7��\|kwZ�b��/��u�r%��lB��@ɼ��͜/��n��@��݃��/��p��g�U1��~e9�z�J�r@c]`��(ز�j��_�P��l�]�-sn��e�Z��Y9��z�B�a��-5�De��G�yBp��Ӄ=]�n��f��-F�b㍚��o@!��>��Wf�J��eI��d_���u�7��t��Ͼ��+��Z��P��w��~ig��:� e �g��i��+�G0��t�p�ml�-��&��٤�{��l9<��{4��7�8��w�T�M��;�z��^ݲ��B��\ ^~Iщ YR��Ttb�@Sew��R�EwR�5�g8��x��%U1�ɛm��e�n玻5�W��d�(��i)�Yܭ��&�r��V��T�Ez-k�:oc�G܀]rc��\`p�7�$�F�P��h�f? �G��Ƣf-;�m��I�6�@��L��v�}d�7VP�e��\��-�[k��Q��ȃ��݂t셋�#�4�`X2�~��n[�G�?z��1�{��0!kIz�M��`P;��2�T�>�C�z��#�SS=��N ��Wn˝��̳��/Kp��;~j��E�k1�h�GUUr�U�D ��?M�[�~"��]�R��FcM�I9oq�Xe@�\�Z� $&,"z�+����TO(�� ��6\|%��n��V�N��q�G$r�`�%�$8+��=��N]��0�\3�Li�a�S�='Z�Y��j��A!�/2E}Ӈ��'��u�E��MFu;�G�=�s(7%z�` ��:Gv��L4HO4�{�"[]9�\e��ԏ�o�۵��t� �8�_1a�T�q��~�==_Q:��N�Wm��N�́�-݅��Vs֘U�8�b蘥�C�f,8D��0��U\�z�!�Ub��S��ƾ�a\v�4�Au"[B!�H��hU��4pR(�\�]��Q!�Q�xȋF��q�%Lf`�c˩60v�c��R")3��W"�Gn�(G��7-�Tw�3E��h �(g�L�]=.9ؠ��0��i#�6L��P�Y �:ՀJ�fs ��Y�u��=�_�0F�x�H9�޵8�~"4�B:)�/� ��p4�D�� w�}oRQ4��\|G�7:m��J�Y(Oy�!5��P�]rX��~4>�)��q[��[��G�"5� ��y�1�`�S�1�ֶO��}�C X�i��t�`7����XuQJל�9E_��M�)�!~`��~�u:�:x��Կ�C4.R�따 ��z?�`��M�8�\�>�K��)�R~��ե��30`��"�4�/\|��:��o��k�d}��K�pG��i2��iK��F�e��po2Uҕ1��I1X~}�p�� [39y SF��pI��T8��x)��P�t��,3��EO�PE��U��0Ʃ�.�m؀ o4�U�� 8�,��ѩ��>�2Tn�4�y��l�EbH��P��ty@LT��&2�rIO:�� `�S��}��+�'�!�P��F��HO��BT��A\|F�?��7�S��Ni��ÈbL�ͫ�zCg�O�a��-L+3,ՔK�o`%~[1C�;)X�w��iH�kDz"�}�X(�3B��Xb�8f�V�I�,� ��T��\�ڧ�_�m<W�(s��PLҮA�N#��e��T�m�E�)�7F5)��C�--��9r0u�ڈHx��^�$s��^�mk1o��&VB��! ��{�_�9�r��EVuCS�EOo��G�L�s�/Н��bꖫ��j{/�3�f7k��<�Ò[y��c��]^�+��A�p��`��/C]M��cKx��ef�_��ĭZW?!�ꂳ��X=Y����FTw�`�# ��~��̓��]��k��h;�� n�u�t��;�ګ�4�'�U�[_b��i[j��k�nk�N_G�Z��`m�:8��Я�U��ldW��ǣ�q�ċ�W��ْͷˑS+TWx��┇�a�B� :�3� t�Ș�_Oa1�E��a�"4��ⲂE�$O'Ҩ�j�WBӉy��B�#Wt�y�Q+��&l\~��^,��:�%��˾�>�N#��h[��M�"��w��e�{IP4i�ͧ��Kw�^��Tl��W�fh��~{/ڡ�67�ۿ��ܔ�6/yA3��T�I_�o�3 �'ˁ)Ϋfai�8U�F��L�ʙ�ä��a�[?i��E�:��˽��Dk�T�@�MyS�~֌ul�=��je��-�W� ΢��q�׳a�WD ��S�6��$Ѭ �C��dA7,��AL��s�_��2��#�>�indy03H�� `�x$�F��w5�Wv�x�b��_��O2"��T�_Iz��#�Z��˼��-��O-fa]��F�o��@�Gݰ�`�� ��j�8-��\|��L0�eӴ�� #��I�<kɛ\|��X�롦��;�v�"_�}��9 ��)P�7�}�!8:��m�[��nY�=�D��=<u�'N�U��Z9P��l�͟�B�t�[��n�_2�<5��QBQ0﷩�t�3�.�3�\�ǒ�KSXK�� }c��.G�S=��RvSOzӟ� � ��p� �4#W�J��yz�ޥ��8{�J2��D�t�`�m��z�k��0�K�)�2�Zr�5L��}��cP��\|�s��u;%q�_�Y� ��،ыb�ƨ��l��-~$;p��<��Y�G�,έ��F(�}��X�8Z��s�Z2�\|�L��3��e7��8t=I��ǠY��]A�)S��;��.�ㅦ�BIo��i�Gn�x34yk��hJP$�V�ރLY�t�R�� `�HG��@�`�r�e&)pL��y�+ �Y�c_�LY>l�V�1��o��j��E��?�rl�GE��FK�ReZ��+�X��hC��Җ�m�Q� ��+P��T�! J`ӗs�]�R�#p䩊�(xYda$2�(D�ͭ�?�F��E �aݏX�&)+��fc�zQ��q`��&ѦV��pwC7��l��lG@q��L��W�2��%iK��8��xx�wu�I��ҔouX��z+M{<Fگ�Ir�N�>�}�\Ÿ�=�3�&:��37��_�H�:��Ӟ� (h-D��GYz8P�=� !%HnCD ��A��gG�cȥ}b��XUc��Գ�w�r�5�A�)c2��(y"�y�]��IYY��H��@ׂ�OK2F�:��I��R'�{e��Ԏ��Y��"շ�8H�Y�q�� ]�^��w�Cq(��.vہ�k� Ӿ�UE�K�dM�r��M86�傈��mt��PI�,��2q�#��1M�J�,q?�b+�A��=@�A.�>l��[�Q�?zR@a��B��80^��uvpD��C�4��Rs܃ ��v.�z�5T��aKd/��6�+��"��@dD\-s�l��%�c��K�.v��V��;u���)��v$�F�䘭LW֠��K\�7 #�{p7j>o�v�'��,r��C�T�m�2��~�"�o�/E�&�l76샤4G�P50\ ��-h,�zm͗��P��]?o\|Ɉ��Mׄ��4}F��'��<�=d�ӱyu݈qI�rH�J�T�UO�ʌ�kJn7�6�9#y�x�X(��t{e�p߱�$�_6�:��\�7��s��h��}A'g�m��\|j��)��w�)ؕ\��A�X��Ej�<Rg��q��i�g�@�]�kJ'L>��ٺ��}�@��00 ��Z�\|3R�;+FU��A�ױ/[rWRA�Ȯ�zc��l��%��q� ��Ϲ�2mE�+��7�$�s؊J�!��Iο��[Ѽ�8R ��\�lcL�6}��=��1�+T��Z�UL]t�+�>�R��趤��Ϝ�r��Zl�� ��f�h&o��-��[�}R4 C��ݎ�t�m�� �J�ni�Ž��fb�!Ƭb�9�Eb,��馭\|��dv�vL�y��pL�LU#��&/I'KRy!+��!B;�SQ�sJ�b�GN��ۙ�� $\|�}�b�m�w ԫY"� &�mC��2ս~!��D��3��]��m �n(��L�`pjU��e��N�\��@a�l��'�@\�??B �!7��@애Ŵ7h��0Ш���q��]��H�\n� ��zhJT f=ܲAcڎ٦,Fn��`oY�ن��ů�D��}ȳ��i;X�� �Զ0튆A��^C�;&�Y�?��P�b�<u� ��ⳮװP�;�MӅ�xG;�LQ�!=^a3+`z��Q�v�� '�ej'��KQ,��K��,��ګ�؇��Rn��EOxZwQڍ�{p��!��A{�O�Թ$t�T�m#H"�b�#-�le)��۽�"��j�>�F�C�6�"P�A�-��1(&P0�.4�H��~�w -!`�� �km�Z�`��3n�P��ڼ@�H?Ne��ܦa��z���D{ѫ�?��p��ڥ�-gP��d��E ��Í^w�N�W��V~ǆY�@�� )��k�� �2l��ʙ -��_�R�Mܷ&z��֍��Ϻ ��p�.%��H��p�6ݦ=��7HO��{V��F͹{z�4JБ�o�큁��l^kz��5)C�TNh3�ۅ�'��䁞�=��kwcF�ƭQ�@ǵ��yS�cOW��~s>��b�E��v]Y�aZ��!��:c�1�ۗFK��iEef��)ڝ��C��~��ig7�sx��3�\|��Xg�c�TQ݀Fm�5��]K�f��p�1�!U�9��Yl�z%A4b2�Ȅ�[^W!o9�� k�բg�-ǈ�a%Y�ma�Z�Ʀ�6��D�� L)�E^z�؜�%��L�y�wd��/:��s>�m^ԓ݃I5�/�@$Ò�1��z� �ѵ��B�;��s;�`�2�@.��_�'SH��KJˆ��yk�K"��`A�X�M��Ȏ�j�oKF��e0e��p�0'��m�$8��MWEpN��(�"��t��f�҉kI��ds^�6i�҆<5>��8՗�\|��j��հ�<?��L�ѥ��~�\�~'V\��!�z��9P��㜿</��@�ۼ�م�͚��)�?l��]�P��(�H�m6��TN�˝�j�i�-٨�^��^�w�5�j�ШY�.�� D��œ2�A�6��k��݅t��}κ�K�77�'YFފe�y��W_��q�ը{P'�w�K�_�!N�/0��'��o�q��T�� l�Q��C}ꭟR��\|�'K@[}qk�I̛��h�'��gw3�WaX�q�މׅ��]JAg\|��¶�&��:w,�\~��O,�(J��/�oG5�>�&�+=�Tu;��Չ6��U<�ǵ��o�;.~u�l�m��yX�'+)S�o��ߜ��ѹk��=x]>��P�POú!:�Ƽ�W۷#�8�~�/��Q��au;V��b�0^_�wcQ�st�tO�?A}�s�UC\|(�m�/�͒�;��\�F��#�H�qlח�t+�{j�AȱTy��E/� ��p�򇛦]Ӽϳ��@�/�zx�e��Z0 U5UYى-�1S�e��ޜ�Eq.2ͫ��jj�ˑ��.x�Z�ַJ��ky1��w�)N?ǈ��'��xyl�˝)��t]��MG�tw6Y�ώ�$t�'o��5_�\|��i��2�^?��+,O, >��Z�Q_��RUo6��#��xݎ��L,z��v1�%��u#��c�WgF}E�'��WJ��7��^:��C�-�3vwv�\|^��Է?��6��z�z�#��~��Ǯ��S�z-��Vp�Z�o^\|�,`��5+��peNC��a�&ʛ�~��ś9�pڭ̾>��R�:L4�.� <-�݁��"^~J��Cx��J�{��V��ՙ�-\|�]��g;4f��.��˛�%&��Tl��黹�r;��Y��y�UƸV.� 7'��]I��x\| x5Y��K�]e�]��JZ_��u��h�� ��T��r&�Ԣu�&��ύ��/p��'఍X��1g��8��`��j�d��m�V2�^�:�� ��F�Cl�n�5�p�hbC�.�vMZ(M (�zM�� m��J��S�#Z�ASz0dK�H�� Mk��'��١3�=��H�dl�[8�20�-�J�љV��:�ħd`�6��N��E A�L��[��I��ڽA�J�k0��p�ԅ�� �5h8��]�"��x/��ƪ�x� �$Ū�,#uSѢ��[O��#N5��~͘ԩ�Nn��e#2s��'�fk�f�R�"F�6%R�8��G= �Am��<��H�u��G�͐oK[ԵA�zF�Xڳ�zP 0�d��ld�פ6L#<�K�!�'� ��p ��TH�Q�a� q[k�o�\|�-ڎ@��m)ьFTwn�R�41h!�Lz��ܖc=�>�b��d��蹅s��eE��`�b�x��M��!��6x�d^~JA0��h%�٢blW��Q�uw:rio[�l��)T9}��;�7��r�o ��&�i��#��2}�'l�ۨq/m�"�+��d��X�� $"��ˈ�=/�&U(�0ҚXK�5`�m�ܮ+j��SI��>ߵ�I�5�ߠuap?�5FcvK�S��ݤ<꣸<��{-(��D1�y�Onz[�Ӹ�;N�tu\:�&��u��K��Y�_��̖��B/܁��ZA�L�U�:�R��e�^� ��=�Xz_�ݥ�=��ՠ1ͻ>s#�BE3m2�0�C��vg�߆B�kP�Q ��S�ێ��0�.�k��pP���Q�� wGpW�n�Ѕ�e�%��Px��1�V�`@}� �ƒϤ m卲0�Ӝt G��@�� �0��m��[�a�P��V��҇1�_P��S��ew�zW^cƝ�@$��~He ��0S�jv��<�Ԁk�;;c[�vV� ��L��\o[��W=�k��t6�"I�{��!+8T��8��a�^ NM��kFvCF��C&�>:2u��%u.L��)NU%"��S��.�-�ԅ$8X_a��[�i�r��đv�yjO�Tm�ھ��`��Z�q��h�$U;KF0U��e\��`�R Ҵ7�;G��E,��;��ΰa�괰`�9��J��d�x�E�v��۔�D�8��7��f_�ߟ�Q?U\|�X��A�?��\|��c��lEh�˗�ۇ��'-`X�?�l��F�~h��v��ӧZ��M��:�w7��X3}/7�~G�6E�Vj`��Q��_b��u��Z�V�>T�rWl[��_6aS�~��ӞĻ�ʵ��G��+=V��;��o[��k+�x_m!�y��WK{ �˱a'��ؐ�/?��7�E.^n�q��8����9.嚶j�T�N��o�W��<�7�5��f��mz8��<l��{m^6��6��6+��?z9��\0��y��c��w�w��n��Z�%ɲ�>�?� iF#@��iQ�U]u�TG��Z�>2�UUu��t�`�0�� F3~�g��P}3�w�k��a_�� q6�+`$o�Ҍ�v^�.k�Ջ��ۗ(�.l��d��J=��y�B��m1pV_��:�1�y��_W�Xh��f��N�0I�?��^�x��?N>��Sq�N�pH�?v�{�㰱��ޕZp��;��6M.K�5nDQ��Ġ�j�Հ˚�eoe�2�pP}]ŉ�!�!#dC�Aw\©�1I�lM0֚��V�]�p�z��n�6R6��ue@�~f��-�<7�#\yl��Vm�;�iيR�n=��h��C�T�� xH�}�O%u̧f��:'w}t%�W��T�J��a�B�#SOV�P$�f<��)�v��bX�ex�6�̈cUj�kЂ͞�2��t@�>Zo{q�ߺ�ڠ��yK(�U'��9[H��Eم��EL5O�{��M�@l�sE�+��o�h�� K�+>�Ϯ1@�"ε�ؖ��+��[R:׮rlʒ��T��ۈ�T�^}K�N��I%rQ�;�� ^Ili�a�'�� ��!j,��H%o��:U�Vmj� qb0��5Ã�T +E�Z��)g�ҕ3Jc�ʷ@L+ Px/�1��Ԡף�<�!H��y�5\��;�F��әIU��Nq��U4�>U.nm��`X�lS#Ѷ�@�^CARb��b,�!�F�~?��\|�� v�f =T<U��R�#M ��p��x��j��ZU�:�<�0XH �Z�p HQ�<�>U��0�Z�TJEr�r��L�~qV��r�s��2��jJAD�`e�H��N9��9�_� �URqJY�ӕ�-��ԌR��T��D ��M�;� n��y��$�)H3��85ƚ::7)�X�Y��RRz�Q��"3�ee>(q��43{�3�˙��pu�lW��r��R�]/�b� -7{w�\��T��<m��s��_K[��b��?~��ו-�W�W�s�l޽��<<^7��~\|��_�»��7��N�'~�˟��B��M�D��%1�{�Ff��l5>��o��߄�F[��[ӈ�onk�~��Jà��xf��y��PG� ��X��f�?�_�r��j:f��>4ot��\�]ٔHgD�P=��^p��>_ۚ�`<�;�_��b�+F��{��?�m�rw��TeG�zz��h��헫�n�wg�އ��22�ϒ��+��?��o�Z�o~\�P�2pA��I��q��y��# �+T��n�c5�?T��~�r�!��i[�][��;�1�]!)�9��v�`ՠu�c��<��T9A%(Z+ pf��pO�a�'%�t��UG��ҍn�2��6�A��P3��T�9��[�F'o\�\yƈ6�a��i��R�Vj��"l�G�4!⹑��x�cW%%(��ȺAhc#�M@�/J°[��N��{B&@NF�C��rp@Q��5�:�N�,��nU��,��DJ1�yxj��B۾�4r8lu�a@�)0��Fz��և�뻞��"5��M��l��$�X��1��`� &��T��6�b��w$fC]fƗq��؄k&��v�.�TQ��mʣ�&Ϙڃ4��WE�ODm!�Q]�ؾH�Bp^�˥��u�IXk��/CKBzMTׄ!إ��;�u��1�)��[��٨Џ��3�H,{�E��,@a�p~��ƵVƴ�2�YҀ�#�Ωg6�/� p��K@c��ߩxRγ(�wĬTn��(78]�<�H`� hKsxk,c�F J�ܷ��BE�lt��@U��E�Z]��`d�S�R�6+ʘH9��3�(��ւϋX�6I�&��F��XPX�tXC��=�U��]�W�M�ad&y�sa�jEI vs�!?�R�gq@��x�r��ݽ�񐚚�}�]R��d��I�-#"$�h�f�J��n�ǧ��ga�xb�m��C}8mF �Jf�aU��tyǧ�n{�},.{}i�;��'}�>��M�ʑ��o��]���Kmu֠�ǥO9��G�]�m&��c"F~B�[��3ayOokI&��]dN��z��N�<u� ��R2�m@��Q��{3nHJ#x��\|{��~��PW�?n��Q�w#U��qw��]V��z0�P�0�KzB�'�oR;Sݏ�v_� 30�%��C��2l�D6�i'��x�m��5�u8�_��u��N�ć��[T��m�uq�u��Uc�ި�n��a�V�2�a�-e��+z�-��a�O`�L��T^��JkQZ�3V<�>ص��տ�o��h�� 0��ަ��ɷdd$2G��Ӷ�Rѯ��ۙ�w��]��tΚ�S��ԙ˳�W� ��G�6��F7o�&��U�㏹��c�,\ܯ�9�OW�k��S+��>~N��<7��Eo�7�[~@��g�JJ�-]u~~�Hٷ�wz��P��+m?5O��r��t�U��w�\|u��j��X�x��\|f�;��9P�_�@Ygo>=��w��G��w�,r�\|�8��^E��^��JM�~�D��w��_��?��jG�iϻ�6��߲��_H�q">�fV��d��S޾:�~��8=r��'�7��7��_��6��{-��%��z��N�/�ݭ��a��z1m��R��-�+`�_�[;�3k��\|�u��_��@�^��.�ހ�7�uS�z�<Vλ��I��폫�FpЀE�ߙ��q;-��h6{�5��X?d_��;(�C]��&��Gʌ� [�ܥ�@��2t�vO��xU��~$�?�}j^��]��$s=S`��b^��<L�\|[�MC�� ϒ�B]aI`y�@zd�� �b��P=� ��9eo�Z� �;�m��NJ-i��a�Y��c�5Y#��I� M�kV4� �ē�-�R2cj�y�EϚb��\|�s��hp�1y��[�)d;��c8� Ւ��;_�΀�d�'��I��?��t��n��@�t`>h��v��r�� D��9��vP��B"��)��W�9��.Ut��`��}]E+U�"P��穐�0��hG�P��]}�i`��i� ;�R�A>�v�$ �nh(垱�"ӥ�M��ؤ�[��HY�}:�/q�ZR��)�U)��<� U�D�� I�P�h&9�e��M�@D Б��"�<� ~�N�S�j��s:f�L}�BM��)}��4��~d��F��PL?gt>F(��N��s�fJ\|��x�ڕ�S��"I��X�T�(��+��g��V�V�)+6�k��I:%X>O��S,Ů��~��pM�%�3�aS?gec��4ʔ#jL �i�Uj�ʨ��hYJ�e��z>�Ϗ�.��L��)Ŕ��2� �� .iR�P�.$��R�O��U��c��Z��W��I��R[-�T��j�V& 6��4�(ͭL��`�) 8�=�O�� X�?��j�4O:�㊴:�CZ딖+��;�<Q4-v�y�k�T��kp_�I� r�4�6V�d��; &��v�9�hu�{��`b��ݨ��n=��x �dV��f�~{9V\|�.Y� ��{1��L��;ܨ�eu�O�Z_�\|(��} �q�:��\|ӫNJF3/g��UK�0\�� q�i-�'��6��+�6��whR�� j��_��r�^��X�/� ـ�z��pT��\�l1x4"��l\{��).�ر�q��-�;�4�H)-�w��V�:�[��9�I�7]廬mU5��Q=/j�=�s�Gyؐ.��\|s�>�p�Jޤ��\|X��}G��O�(<ת�~�ᢶB��m�+�K��1��$U�#�w6Ǔ�(� ��Di�Ҩv�8L��}ʌȋ!��0a+��Aޝ0�i��7J�E�Z��0��wY��X�E��]��r�Z�~��;�p�Άi�V��M��i��gE�h��v�� \g��C ǣ{h��k��8�x3y��nys��N�~3��Ť�O��m8��6��9�S��Q��(gn\�O?�{��+"O�q�7�7��h=��]S?8`+�v�tzu8 X��7��.��xw)q矚>�\|�Kw ۑ�R��G�P��鿚�:��=��V��ۛ��nY�ح��j��'��"��ŧF޶��}ohB��8� }�߱`��ҿ8��M��pVѻ�;��6l�+v�?�g��}U ~\�W�_��p'P?�ףf�x��н�ۀ�h=l�� S'��v�$��or�~�<��ޠ��\|]د��h��7w��4�Q�cyTۋ��}x��v.Á7��skqY��Gz�(�?cߜ�Sv�F6g;�^� Ci!�1�oPsn��2'V�8;FBN��k��3�n6Z"�tJ 0��a2��Q��0UXVH��]яh43A8uX��\|��e��7 �ۋ��V[~d��`�x;L��<+��)]�A��ުQ�E:/6`�!;Q�� L�8R{=(��vDS�O籝�0�-�7 �o��8P{�N�S �P��wt'<"�a�P�ػ\|��x6�:�zt��b�H Z\1��սI�6U4�߂��(�j�J>��0x�6+�Ū ��L�k��@`��j��]lOh}��1��R��X��-��Qg��uY$�'jRy��;��R��w�C�1��X�2�G�M�$��29�H)J�4�#��R�fmP��i_��M�[��+ٸ�Mv�\��n/vhŪL�� m��[�MΌgWe�'+��K��0�f��[)Cđ<jJ5�#z9��"}sc��ཿDC�� �c��Ep�I��%o�nm��5��]e��]S��We̖ �t��7�~�A�\_�U�"�>��NoЦX��V="mk;��3��v% ��m�0x��0 ��fYz4x�sm �x� ~�<(k��E�� Ÿ��ܸ5ү�+�)O��y��&��-zbݑϫNt�"%��F�nW��f�hN�nܮ�S�L9_�Q�>Ba��Mw�)Fk�Y6&�8��Y��V�Z��c�4����]��bG��d�;�/��;=��?e��7�8��×W}�\��v>��B��C#��W��Ve�o��XU\|�)_i�g\��e��-�毵�y��=�ԏ$��Ư�8z��oi3�HߗsO��'��w�/~��?ϟ�M�v�]�c��A�2��G��j��W�l�A��uW\|�/�6��Y#�n��f�.�7w��XL'^U�n~��Y��#�ミFv�g��r�?�S��i� �r3��㺲�x\|r\|&j�N�I��Z�O�h��k��8�￬�?�/��'�C�~{��״m�l��H߸��^�p5w�w_��g�`��i��B߭�K�$�ʼ�:�u\+��'w)��?֬{,�5]�w��ö��c�f��A��J{�$#jӣ�O.��.PlD��x,W�r��ݱRȘO��b�N� ;+N5x�y��7Us~ORUj6gS��ה�5��Jv�JV��E̺��X�H7��n�cw�^P��`�;�(�5⛲��&fы�N�)/�0�~�ī)k��,��u�X��Y�ܨ��t��1ED#��eب9Al�Z�L$�\xB[2 ��[��0ZH�D��H�8pUb�9~�B��-��`m.�SKZ�"XW��j�@�+�� J -c�BŬ�RX��4�1X�. ��H��QW�vB�H��w��J�i]1� �� ��ǆ�wN5��A��]M+�f�U��VP��ZL�=ѻ#Uڪ�Q��d�J��@��lp��&]�o�E-o�A�g�>�ws+��)�ңݻ0P�d(��@t�p��(�ƅ&��Q��d�bpޤ�[�io��T0 Uj�V�^f�i�)K��A��_�y;ͮ k�?Ӧ�4�rᔝ@3�T!�3\|e��&�d�LbNz��;ʸ!$ 8��M�}�Ըt9\�A ۦ�ED�\K�� ̴��4N�F r�e��Z�HqF`��`�n%��L��)�դ�v$B�&�cWӜ�D"Џ�j�N��:� 6�� E��F��I�R��қ�6�jnM�o�⩙�iO�� .\�s�Ȳo�.uX�=�,��Ӷ&�ؖ�9��T-2쒮� ��#�vW"��;)JJA�t��I��b��J��mi�loa lL�A��ԖZ��׀8�L6��]�soS��<��brH�G6�w=�۫�!��UfL�R�' �(�R�q%�eT�O�^w.uāK4��;��Ŝ�d��tt��#1��A��-kWN��$�r��i�>[�КCNm�>�2S�R�e�ā��D��Ë5��fOڣ�KН��0�N��=HK��R�� J�3�3)B�q�"� 0GCz�ɦ,-��\|1��ٺ�� y 3$��R�ƇI ��d�d=�h[U�}��H�3.iJq�c�6��vִ�[ŷ�%)��sU��)0P�z�X��Y��`�=�U�<�w¾C��9��F�R�T�а��tj S�6T��6tx� ��k��D��AL��ނ�f��/�L5��N �z��-Cʢ��v!�֔�o�a�m�v�7�!��AνEq�C۷�@��?7�-�b�8(Z�=��i[{� �2X��q~�Xţ��W�1A�l�7�l��"1d��ƧG�R��Uה�u$�5ʔU�vN�wYjѮ��+��.��~�C&;m��w4��<c_Ϸ�×D#�ډ@@��Z]�w��gti��F\|��S�n�q�&��MXI�.�_��Nb��il1��$��K�ڌ9�_5�׍ZΠ�l��Lq\|^��_�b�lWƫ�@�o��Q:]�,�� ��C�65b�.}�WuEh��m��2^9��u9=��9w�=��Ӭ��[�u[��Q�7GÛ��:�T�M4��!�;İi�y�Q��+W��Dv{;��j/�Z]_�+��?�V��j�92��\|P�'�#�Q~�njV;��T��,x]30�}��}~��EN��]�8'��h��Oݵ��G��}�ݣ-x�S�K�-R�#�J��7M��swk;yw+;3#ڡ�10B�6��¯Ai��;��Tg �K �,Ď�l�E>`3�hT�X۴��\|l3v�� ,ډߌl/�bƪ�ާ�Xl�՝7�pn��)��d~`��+7�4��Lzt�;��_��K7Y�C��]$G�b5��5(б<��En(6z��=Q"��7��i�e�u��ͷr��d�� [�Z�b��<�Vwz�f[��Dv]o�{�� 6�?}��֘EU��QC~}(��2�zJ�� ,v�ZސA3Wu�߻6f[2wc�� 9��$�\|��D�kЅ�@;�x��":�`k�F�1�4��>�'��J;'��ԁ�s9V8h�yi, 'K�S6Չ�i�-7��7`ԁ�;�哂��M�� s �V��u�u%�@�o贤��O]{��VH[6��@�t��ř��#��lD@E�GA��["8�P5 ��ڗuJ5��mFU��1U��(�Ķ+ݐN�faRA~��8�pN�.L�c�p�n��/)֧�:�ePy��E��a/�NC�I<J�F!Uj��q�$�Qd�;}w�!v��}��C�� m!l�~lPgԯX�++c��2� ��7�b�oa�N8u��,J��f��V&R�a�\|��ZU+l�;�"� ��'��[��֨�45 10��#PM��T�P�&e0�E�6, >p��R�/�<qT��(�"��&[HJmm��er�]��4�;�Gc�zj+e׫Z��MW��`��'.`K�Ů)��S��O]9�C�}ʑ��Ma(`=�%JR�y�UJ��;-��+��3��qiRk��cS��N��{� ����wbf<�AQ\|�_�� C�6<L��r�� �҂ܣ 2uZ��%"�F��U��B'C+F��@Ƙ PX��r�u�2�Đ,{��6hu�cm*1�%sZ�0 �iN�sG4H��v ��R�1��`�.� ��u�

ZAP Scanning Report

Generated on Fri, 3 May 2024 16:52:11

ZAP Version: 2.14.0

ZAP is supported by the Crash Override Open Source Fellowship

Summary of Alerts

Alerts

Passing Rules

Sites

https://clients1.google.com

No Authentication Statistics Found

https://update.googleapis.com

No Authentication Statistics Found

https://optimizationguide-pa.googleapis.com

No Authentication Statistics Found

https://content-autofill.googleapis.com

No Authentication Statistics Found

https://accounts.google.com

No Authentication Statistics Found

https://cdnjs.cloudflare.com

No Authentication Statistics Found

http://localhost:3000

Alert Detail