Basic Security Audit of OWASP Juice Shop
Target Application: OWASP Juice Shop
Testing Environment: Ubuntu Virtual Machine safe lab
environment with Docker container
1. Objective
The objective of this task was to perform a beginner-level security audit on a legal
vulnerable-by-design practice website. For this audit, I used OWASP Juice Shop, which
is intentionally vulnerable and designed for security training.
The audit focused on identifying, documenting, and manually verifying at least three
vulnerability categories:
• SQL Injection
• Application Error Disclosure
• Missing Content Security Policy Header
2. Scope
This security audit was performed only against a local instance of OWASP Juice Shop
running on my own machine. No real production website or third-party system was
tested.
In-scope target:
OWASP Juice Shop (http://127.0.0.1:3000)
Out of scope:
Any real public/production website
Any system without explicit permission
3. Environment Setup
OWASP Juice Shop was run locally using Docker. After starting the container, I verified
that the container was running with:
sudo docker ps
The Docker output showed the Juice Shop container running and mapped to local port
3000. The application was then accessed in the browser at: http://localhost:3000/#/
, 4. Methodology
4.1 Manual Exploration
I opened OWASP ZAP and used the Manual Explore feature to connect ZAP with the
local Juice Shop instance.
4.2 Browser Developer Tools
I used Firefox Developer Tools, especially the Network tab, to inspect requests,
responses, and HTTP headers.
Target Application: OWASP Juice Shop
Testing Environment: Ubuntu Virtual Machine safe lab
environment with Docker container
1. Objective
The objective of this task was to perform a beginner-level security audit on a legal
vulnerable-by-design practice website. For this audit, I used OWASP Juice Shop, which
is intentionally vulnerable and designed for security training.
The audit focused on identifying, documenting, and manually verifying at least three
vulnerability categories:
• SQL Injection
• Application Error Disclosure
• Missing Content Security Policy Header
2. Scope
This security audit was performed only against a local instance of OWASP Juice Shop
running on my own machine. No real production website or third-party system was
tested.
In-scope target:
OWASP Juice Shop (http://127.0.0.1:3000)
Out of scope:
Any real public/production website
Any system without explicit permission
3. Environment Setup
OWASP Juice Shop was run locally using Docker. After starting the container, I verified
that the container was running with:
sudo docker ps
The Docker output showed the Juice Shop container running and mapped to local port
3000. The application was then accessed in the browser at: http://localhost:3000/#/
, 4. Methodology
4.1 Manual Exploration
I opened OWASP ZAP and used the Manual Explore feature to connect ZAP with the
local Juice Shop instance.
4.2 Browser Developer Tools
I used Firefox Developer Tools, especially the Network tab, to inspect requests,
responses, and HTTP headers.
