OWASP Juice Shop Web Application Penetration Testing Lab

This project is a hands-on web application penetration testing lab based on OWASP Juice Shop, a deliberately vulnerable web application designed for security training.

The goal of this project is to demonstrate a complete beginner-friendly web security testing workflow using:

• Docker
• OWASP Juice Shop
• OWASP ZAP
• Burp Suite Community Edition
• Manual web application testing
• OWASP Top 10 mapping
• CVSS-based risk rating
• Mitigation recommendations
• Secure coding examples

All testing activities are performed only in a local lab environment against an intentionally vulnerable application.

This project is for educational and portfolio purposes only.

All tests were performed in a local, controlled and intentionally vulnerable lab environment. No real systems, third-party websites or unauthorized targets were tested.

The lab environment is built on Windows 11 Pro using Docker Desktop.

Windows 11 Pro
   |
   |-- Docker Desktop
   |      |
   |      |-- OWASP Juice Shop Container
   |
   |-- Browser
   |-- OWASP ZAP
   |-- Burp Suite Community Edition
   |-- PowerShell / curl

The main goals of this project are:

• Build a local web security testing lab
• Understand how vulnerable web applications behave
• Compare automated scanning with manual testing
• Practice Burp Suite Intercept and Repeater workflows
• Identify and document common web vulnerabilities
• Map findings to OWASP Top 10 categories
• Assign approximate CVSS risk ratings
• Provide mitigation recommendations
• Write a professional penetration testing style report

This project currently includes:

• Docker installation and verification
• OWASP Juice Shop container deployment
• OWASP ZAP automated scan
• Manual discovery of hidden Score Board
• DOM Based Cross-Site Scripting test
• Directory Listing discovery
• Sensitive file exposure validation
• HTTP header checks using curl
• Docker log evidence collection
• Burp Suite browser workflow
• Login request interception with Burp Proxy
• Manual request replay with Burp Repeater
• SQL Injection authentication bypass test
• JWT / authentication token analysis
• OWASP Top 10 mapping
• CVSS-based risk rating
• Mitigation recommendations
• Secure coding examples
• PDF report for internship application

This repository is being developed as a portfolio project for Web Application Security and Penetration Testing.

The project demonstrates a complete beginner-friendly testing workflow:

Lab Setup
   ↓
Automated Scanning
   ↓
Manual Testing
   ↓
Burp Suite Analysis
   ↓
Finding Documentation
   ↓
OWASP Top 10 Mapping
   ↓
CVSS Risk Rating
   ↓
Mitigation Recommendations

Future improvements may include:

• More Burp Suite test cases
• Additional Juice Shop challenges
• Basic log analysis
• Report version 2 in English
• GitHub Pages portfolio page

owasp-juice-shop-pentest-lab/
│
├── README.md
├── report/
│   └── OWASP_Juice_Shop_Initial_Web_Security_Report_EN.pdf
│
├── screenshots/
│   ├── docker/
│   ├── zap/
│   ├── burp/
│   ├── findings/
│   └── evidence/
│
├── findings/
│   ├── 01-dom-xss.md
│   ├── 02-directory-listing.md
│   ├── 03-sensitive-data-exposure.md
│   ├── 04-sql-injection-login.md
│   └── 05-jwt-analysis.md
│
├── notes/
│   ├── commands.md
│   ├── burp-suite-workflow.md
│   ├── owasp-top-10-mapping.md
│   └── cvss-risk-rating.md
│
└── mitigation/
    ├── secure-coding-examples.md
    └── recommendations.md

Through this project, I practiced:

• Setting up a Docker-based security lab
• Running and validating a vulnerable web application
• Using OWASP ZAP for automated scanning
• Understanding the limitations of automated tools
• Performing manual web application testing
• Collecting technical evidence
• Documenting findings in a structured format
• Thinking from both attacker and defender perspectives

Muvahhhid Computer Engineering student focused on Web Application Security, Penetration Testing and Red/Blue Team fundamentals.