message: Add tutorial information to challenges w/ Hacking Instructor scripts
diff: hint: 'Look for an input field where its content appears in the HTML when its form is submitted.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/xss.html#perform-a-dom-xss-attack'
  key: localXssChallenge
  + tutorial:
  + order: 2
  -
  name: 'Database Schema'
  category: 'Injection'
  hint: 'You can solve this by tampering with the user interface or by intercepting the communication with the RESTful backend.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/broken-access-control.html#post-some-feedback-in-another-users-name'
  key: forgedFeedbackChallenge
  + tutorial:
  + order: 7
  -
  name: 'Forged Review'
  category: 'Broken Access Control'
  hint: 'Try different SQL Injection attack patterns depending whether you know the admin''s email address or not.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/injection.html#log-in-with-the-administrators-user-account'
  key: loginAdminChallenge
  + tutorial:
  + order: 4
  -
  name: 'Login Amy'
  category: 'Sensitive Data Exposure'
  hint: 'If you know Bender''s email address, try SQL Injection. Bender''s password hash might not help you very much.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/injection.html#log-in-with-benders-user-account'
  key: loginBenderChallenge
  + tutorial:
  + order: 9
  -
  name: 'Login Bjoern'
  category: 'Broken Authentication'
  hint: 'Try cracking Jim''s password hash if you harvested it already. Alternatively, if you know Jim''s email address, try SQL Injection.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/injection.html#log-in-with-jims-user-account'
  key: loginJimChallenge
  + tutorial:
  + order: 8
  -
  name: 'Login MC SafeSearch'
  category: 'Sensitive Data Exposure'
  hint: 'This one should be equally easy to a) brute force, b) crack the password hash or c) simply guess.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/broken-authentication.html#log-in-with-the-administrators-user-credentials-without-previously-changing-them-or-applying-sql-injection'
  key: weakPasswordChallenge
  + tutorial:
  + order: 5
  -
  name: 'Payback Time'
  category: 'Improper Input Validation'
  hint: 'We won''t even ask you to confirm that you did. Just read it. Please. Pretty please.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/miscellaneous.html#read-our-privacy-policy'
  key: privacyPolicyChallenge
  + tutorial:
  + order: 3
  -
  name: 'Privacy Policy Inspection'
  category: 'Security through Obscurity'
  hint: 'Try to find a reference or clue behind the scenes. Or simply guess what URL the Score Board might have.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/score-board.html#find-the-carefully-hidden-score-board-page'
  key: scoreBoardChallenge
  + tutorial:
  + order: 1
  -
  name: 'Security Policy'
  category: 'Miscellaneous'
  hint: 'Have an eye on the HTTP traffic while shopping. Alternatively try to find a client-side association of users to their basket.'
  hintUrl: 'https://pwning.owasp-juice.shop/part2/broken-access-control.html#view-another-users-shopping-basket'
  key: basketAccessChallenge
  + tutorial:
  + order: 6
  -
  name: 'Vulnerable Library'
  category: 'Vulnerable Components'
  