Skip to main content

E-Commerce Web Range

A compact black-box storefront: start unauthenticated and work the search and product parameters.

Run a Cracken operation against a deliberately vulnerable e-commerce storefront and see it work a black-box web assessment from an unauthenticated start. The app is a small product catalog with search, product pages, and a login — a compact surface that exercises the core web vulnerability classes.

Authorized lab range — scope strictly to it

http://44.223.238.255/ is a disposable, isolated lab target provided for testing Cracken, and you are authorized to assess it. Point Cracken only at 44.223.238.255. Running the same operation against any other host — including a production system that happens to share that address elsewhere — is unauthorized testing.

Prerequisites​

  • Access to a realm in your tenant.
  • A connected Tentacle with network reach to 44.223.238.255 on port 80.
  • Optional: the built-in Web App Pentest Playbook.

The target​

PropertyValue
URLhttp://44.223.238.255/
NameShopCo Electronics
TypePHP storefront on Apache
Example accountalice / alice123

The storefront exposes a product search (/search.php?q=), numeric product pages (/product.php?id=), and a login (/login.php). The search term is reflected back into the results heading and the search box, and product pages are keyed by a numeric id — both classic starting points for an assessment.

Run it in Cracken​

  1. Open or create a realm and confirm a Tentacle is connected.
  2. Create a new operation and select the Web App Pentest Playbook, or describe the goal yourself — for example: "Assess http://44.223.238.255/ as a black box. Map the site, then test the search and product parameters for injection and XSS, check for broken access control on object references, and review the login and error handling. Confirm each finding."
  3. Set the target to http://44.223.238.255/.
  4. Run the operation and approve actions according to its autonomy mode.

This range is a good fit for one top-level Web App Pentest operation. The playbook deliberately fans out private specialist sub-operations for reconnaissance, attack vectors, and verification.

What to expect Cracken to find​

A successful run maps the storefront and surfaces findings around its dynamic parameters, with the endpoints and any recovered credentials captured in the Cybergraph:

  • Reflected input in the search results — the q parameter is echoed into the page, a candidate for reflected XSS.
  • Injection on dynamic parameters — the search query and the numeric id on product pages are candidates for SQL injection.
  • Broken access control — numeric object references invite testing for access to records the current user should not see.
  • Information disclosure — verbose PHP errors leak server-side file paths, which the agent can fold into its picture of the target.

You have a clean PoC when the operation has confirmed findings against the search and product parameters and produced a report summarizing them.

Next steps​