A scoped security assessment of a local OWASP Juice Shop application.
An authorized assessment of a local OWASP Juice Shop container using OWASP ZAP, HTTP inspection and manual validation, with detailed findings and remediation guidance.
My contribution
Conducted scoped application-security testing
Evidence / output
Six documented findings and a final assessment report
Source code, documentation and tests are available on GitHub.
01 / CONTEXT
Project context
Automated scanners surface potential issues, but a useful assessment must distinguish confirmed security effects, observations and unverified exploitability within a clearly defined test scope.
02 / EXECUTION
What I did
Created a local Docker-based OWASP Juice Shop test environment with explicit rules of engagement.
Used ZAP, browser inspection and repeatable HTTP requests to investigate authentication, authorization, injection and exposure weaknesses.
Manually validated SQL injection authentication bypass and cross-account basket access, with negative-control evidence where appropriate.
Wrote a final report with scoped findings, risk priorities and remediation recommendations.
SYSTEM FLOW
Authorized local assessment workflow
01Local Juice ShopDeliberately vulnerable Docker test target
02ZAP and manual requestsScoped browser and HTTP/API inspection
03Verification and controlsObserved effects and negative comparisons
04Sanitized findingsEvidence, limitations and remediation guidance
A documentation flow for an intentionally vulnerable local application; it does not depict testing against a live third-party service.
03 / VERIFICATION
Evidence and outcomes
Detailed finding write-ups record observed behavior and reproduction steps.
The assessment separates confirmed weaknesses from a DOM-injection case where independent script execution was not established.
Screenshots and request details are sanitized to avoid publishing sensitive tokens.
Selected source-backed examples from the linked repositories. Images are published from already-sanitized source files; report excerpts remain explicitly labelled.
SANITIZED SOURCE SCREENSHOT
Administrator login observed in local Juice Shop
Sanitized training-target screenshot shows the administrator identity and Login Admin challenge following the documented authentication-bypass test.
Sanitized OWASP ZAP Requester capture showing HTTP 200 and another account's basket data; independent saved token-to-session attribution is noted as incomplete in the finding.
Testing object-level authorization with two accounts
Can a second authenticated user read a basket owned by another account?
Method
In a local OWASP Juice Shop environment, the basket identifier was changed in a request made during the second user's session; the response was compared with the first account's baseline.
Observed / documented
The target returned HTTP 200 with the other account's identifiable basket contents. The observed impact was unauthorized read access.
Limits of the evidence
The record does not establish unauthorized editing or a verified remediation. Independent saved attribution of the requester token to the second account remains incomplete.
Testing was authorized and restricted to an intentionally vulnerable local application. This was not an assessment of a production or third-party service.
