juice-shop / pwning-juice-shop

Antora/Asciidoc content for Bjoern Kimminich's free eBook "Pwning OWASP Juice Shop"
https://pwning.owasp-juice.shop
Other
218 stars 129 forks source link

Unclear solution for resetting Benders password via forgot password. #17

Closed mtesauro closed 6 years ago

mtesauro commented 6 years ago

I recently used Juice Shop in a training and discovered that, depending on what web resource you find, the company Bender used to work for is written as Stop'n'Drop or Stop-and-Drop This caused a great deal of frustration for the students as they discovered the 'answer' only to find out that a spelling variant kept them from solving the challenge.

Issue:

Solution for Reset Bender's password via the Forgot Password mechanism

Reproduce:

  1. Starting at the wikipedia article for Bender at https://en.wikipedia.org/wiki/Bender_(Futurama) you'll find a link to Suicide Booths in that article (as of the filing of this issue)
  2. Follow that link to https://en.wikipedia.org/wiki/Suicide_booth which has a Futurama sub-section
  3. In this section, is the following text: In the world of Futurama, Stop-and-Drop suicide booths...

Suggested Fix:

Consider loosing up the verification for completion of this challenge by allowing alternate spellings of Bender's company name or at least mention the existence of the alternative spelling in the solutions.

As an instructor, I'd solved this challenge long enough ago to remember that I found the answer on a wiki and defaulted to Wikipedia. I didn't recall that wikia has a different spelling that the Juice Shop challenge relies on. The alternate spelling was close enough to what I recalled that I expected it to work and, of course, it didn't. I don't know of a canonical reference for Futurama so being loose on the accepted value or providing a note/warning in the solutions would help avoid confusion of instructors and frustration by students using Juice Shop.

This is a micro-quibble in an otherwise fantastic OWASP project.

bkimminich commented 6 years ago

I'll add a hint mentioning that when a seemingly correct answer fails, trying an alternative spelling might save the day! Thanks!