This is a demonstration report, not a client engagement. All testing was performed against OWASP Juice Shop — a deliberately-vulnerable application hosted locally for training. No third-party systems were tested. Content shows our reporting format and depth.
OWASP Juice Shop — findings & remediation
A scoped assessment of an intentionally-vulnerable practice target, demonstrating Verfend’s verify → explain → retest methodology.
Scope & authorisation
Target. A single instance of OWASP Juice Shop (v15.x) deployed on an isolated local host under our control. The application is published by the OWASP Foundation expressly for security training.
Authorisation. Testing was performed against our own instance only. No production system, customer data or third-party asset was in scope or accessed.
Method. Grey-box testing aligned to OWASP ASVS and the OWASP Web Security Testing Guide; findings verified manually and retested after remediation.
Executive summary
The assessment confirmed six issues, led by an authentication bypass via SQL injection that grants administrative access without credentials. Access-control gaps allowed one account to reach another’s data, and a confidential file store was reachable without authentication. All findings were reproduced manually, prioritised by real impact, and retested after the fixes below.
| ID | Finding | OWASP | Severity | Retest |
|---|---|---|---|---|
| JS-01 | SQL injection → authentication bypass | A03 | CRIT 9.1 | ✓ resolved |
| JS-02 | Broken access control (IDOR) on baskets | A01 | HIGH 7.1 | ✓ resolved |
| JS-03 | Confidential file store exposed (/ftp) | A05 | HIGH 7.5 | ✓ resolved |
| JS-04 | DOM cross-site scripting in search | A03 | MED 6.1 | ✓ resolved |
| JS-05 | JWT accepts “none” algorithm | A02 | MED 5.3 | ✓ resolved |
| JS-06 | Security headers missing (CSP/HSTS) | A05 | LOW 3.7 | ↻ accepted |
Findings in detail
SQL injection → authentication bypass
# request body { "email": "' OR 1=1--", "password": "x" } # response — authenticated as first user (admin) HTTP/1.1 200 OK { "authentication": { "token": "eyJhbGciOi...", "role":"admin" } }
- db.query("SELECT * FROM Users WHERE email='"+email+"'") + db.query("SELECT * FROM Users WHERE email = ?", [email])
Broken access control (IDOR) on baskets
# logged in as user #6, request basket #1 GET /rest/basket/1 Authorization: Bearer <user-6 token> 200 OK → returns basket of user #1 (not owner)
Confidential file store exposed
# directory listing reachable unauthenticated GET /ftp/ 200 OK acquisitions.md coupons_2013.md.bak package.json.bak
JS-04 (DOM XSS), JS-05 (JWT “none” algorithm) and JS-06 (missing security headers) are abridged in this public sample, each with evidence, remediation and retest status.
Methodology & standards
Disclaimer. Illustrative sample for demonstration only. OWASP® and Juice Shop are projects of the OWASP Foundation, used here as a public training target; Verfend is not affiliated with OWASP. “Verfend” is a working brand for a local concept. No third-party systems were tested and no real client data appears in this document. A security assessment reflects a defined scope and point in time and does not guarantee the absence of other issues.