This repository documents a complete beginner-to-intermediate Web Application Penetration Testing (VAPT) assessment performed against OWASP Juice Shop.
The objective of this project was to understand the complete penetration testing methodology rather than simply running automated tools.
The assessment includes:
- Reconnaissance
- Application Mapping
- Authentication Testing
- Session Management
- SQL Injection Analysis
- Cross-Site Scripting (XSS)
- Insecure Direct Object References (IDOR)
- Cross-Site Request Forgery (CSRF)
- File Upload Security
- Security Header Analysis
- Rate Limiting Review
OWASP Juice Shop
Docker Image
bkimminich/juice-shop
Operating System
- Kali Linux
Virtualization
- VMware
Target
- OWASP Juice Shop (Docker)
- Burp Suite Community
- OWASP ZAP
- Nmap
- Nikto
- Gobuster
- ffuf
- Docker
- HTTP Request Analysis
- HTTP Response Analysis
- Burp Repeater
- Authentication Testing
- Session Analysis
- Reconnaissance
- Security Header Analysis
- Manual Web Application Testing
- Professional Documentation
- methodology.md
- reconnaissance.md
- authentication.md
- session-management.md
- sql-injection.md
- xss.md
- idor.md
- csrf.md
- file-upload.md
- security-headers.md
- rate-limiting.md
- findings.md
- recommendations.md
This project was performed only against OWASP Juice Shop running in a local lab environment for educational purposes.