This is a demonstration report, not a client engagement. All testing was performed against OWASP WebGoat — a deliberately-vulnerable application hosted locally for training. No third-party systems were tested. Content shows our reporting format and depth.
OWASP WebGoat — findings & remediation
A scoped assessment of an intentionally-vulnerable Java practice target, demonstrating Verfend’s verify → explain → retest methodology.
Scope & authorisation
Target. A single instance of OWASP WebGoat deployed on an isolated local host under our control. WebGoat is published by the OWASP Foundation expressly for security training.
Authorisation. Testing was performed against our own instance only. No production system, customer data or third-party asset was in scope or accessed.
Method. Grey-box testing aligned to OWASP ASVS and the OWASP Web Security Testing Guide; findings verified manually and retested after remediation.
Executive summary
The assessment confirmed five issues. Insecure deserialization allows code execution from attacker-controlled objects, and a broken access-control check lets a user act outside their role. Token and parser weaknesses (JWT, XXE) follow, with verbose errors leaking internal detail. All findings were reproduced manually, prioritised by real impact, and retested after the fixes below.
| ID | Finding | OWASP | Severity | Retest |
|---|---|---|---|---|
| WG-01 | Insecure deserialization → RCE | A08 | HIGH 8.1 | ✓ resolved |
| WG-02 | Broken access control / privilege escalation | A01 | HIGH 7.5 | ✓ resolved |
| WG-03 | JWT weaknesses (“none” alg / weak key) | A02 | MED 6.5 | ✓ resolved |
| WG-04 | XML external entity (XXE) injection | A05 | MED 6.5 | ✓ resolved |
| WG-05 | Verbose errors / information disclosure | A05 | LOW 3.7 | ↻ accepted |
Findings in detail
Insecure deserialization → RCE
# base64 of a serialized object with a delay gadget token=rO0ABXNy...<gadget>... # server blocks for the injected sleep → execution confirmed response time: 5038 ms (payload executed)
- Object o = new ObjectInputStream(in).readObject(); + var mapper = new ObjectMapper(); // JSON, no polymorphic types + Task t = mapper.readValue(in, Task.class);
Broken access control / privilege escalation
# standard user calls admin endpoint directly POST /access-control/users Cookie: role=user 200 OK → new admin account created (no server-side check)
JWT weaknesses (“none” algorithm / weak key)
# header rewritten, signature stripped { "alg": "none" } . { "user": "admin" } . 200 OK → accepted as admin
WG-04 (XXE) and WG-05 (verbose errors / information disclosure) are abridged in this public sample, each with evidence, remediation and retest status.
Methodology & standards
Disclaimer. Illustrative sample for demonstration only. OWASP® and WebGoat are projects of the OWASP Foundation, used here as a public training target; Verfend is not affiliated with OWASP. “Verfend” is a working brand for a local concept. No third-party systems were tested and no real client data appears in this document. A security assessment reflects a defined scope and point in time and does not guarantee the absence of other issues.