OWASP Juice Shop: anonymous to admin in two and a half minutes

Context

OWASP Juice Shop is an intentionally vulnerable web application and a common practice target. It ran in its own separate Docker container and was reached at localhost:3000.

What the skills did

• Recon. The login, product search, and file-serving features were mapped, along with the API endpoints behind them.
• Targeted validation. Each suspected issue was checked with the smallest proof that shows impact. Nothing was changed on the target.
• Access and data exposure. Without any account, the login path gave administrator access. A separate search weakness exposed the customer account records, and a public folder exposed files marked confidential.
• Lower-severity issues. The run also recorded a DOM-based cross-site scripting issue, weak password hashing, verbose error messages, and missing security headers.
• Reporting. Seven findings were written up across three reports and rendered to PDF.

What it shows

• Known targets are fast, which limits the number. The active phase took about two and a half minutes. That comes from a deliberately broken app with a published catalogue of flaws, so it says little about an unfamiliar one.
• Impact drives the rating. The two critical findings each needed a single request. The stakeholder summary explains their impact in plain terms: full admin control and exposure of every customer record. That framing is what leadership acts on.
• Read-only testing still proves the point. The run changed and deleted nothing and still showed complete compromise.

Lessons

• Fix the root cause, not the symptom. The two critical findings share a database query pattern, so one fix closes both break-in and data-theft paths.
• Note how timings were taken. These were timed by hand, so they are less precise than the Metasploitable2 log-based numbers.

Generated files

Three PDFs, rendered from Markdown by the skill's render script.