search

snoopysecurity / dvws-node

Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.
GNU General Public License v3.0
442 stars 173 forks source link

Unable to login or create admin account #35

Closed mrchubbsy closed 1 year ago

mrchubbsy commented 2 years ago

I will caveat this with I'm fairly new to this type of work.

I've downloaded the Docker container to an AWS Linux2 host and have used the docker-compose.yml file to launch.

I understand there is no default user to logon with (or at least there is no information regarding a default admin logon / or if there is - it doesn't work!). With help from a colleague who knows more about this than I, we tried to use the details on the mass-assignment page to create an admin user. Unfortunately this was unsuccessful.

We also tried using curl, without success, getting a status 500 error

curl -f -d "username=foobar2&password=foobar2&admin=true" -H "Content-Type: application/x-www-form-urlencoded"  -X POST http://_**<IP_OF_HOST>**_/api/v2/users
curl: (22) The requested URL returned error: 500

curl -f -d "username=newuser&p@ssw0rd=foobar2&admin=true" -H "Content-Type: application/x-www-form-urlencoded"  -X POST http://_**<IP_OF_HOST>**_/api/v2/users
curl: (22) The requested URL returned error: 500

I would appreciate ANY help in getting started with this application.....

Many thanks,

Simon.

snoopysecurity commented 2 years ago

Hey, thanks for reporting this issue, i think there was a typo in [docker-compose.yml](https://github.com/snoopysecurity/dvws-node/blob/master/docker-compose.yml) Its been fixed now. Can you clone the latest version of dvws-node and try again? thanks

snoopysecurity commented 1 year ago

Your curl commands looks correct, it might be that the dockerfile had an issue. Can you clone the latest version of dvws-node, run the docker image (docker-compose up) and paste me the output

halfluke commented 1 year ago

I've used the docker version for a while, built and launched with "docker-compose up", and I haven't encountered this issue. Admin and non-admin users can be found in startup_script.js and they both work, and mass assignment works as well - via Burp at least.

snoopysecurity commented 1 year ago

awesome, good to hear, i ll close this issue. thanks