Lesson 13 of 15

Lab: Hack a Vulnerable App

This hands-on lab puts you in the role of a penetration tester conducting a full assessment of a deliberately vulnerable web application. You will apply the complete web app testing methodology — from reconnaissance through exploitation and reporting — without step-by-step guidance. This lab is designed to build the independent problem-solving skills required for real engagements.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Apply the complete web application testing methodology independently. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Web applications are the most common attack surface in modern security. The OWASP Top 10 vulnerabilities alone account for the majority of real-world breaches. Mastering web application security opens the door to bug bounty programs, penetration testing contracts, and application security roles.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Lab: Hack a Vulnerable App · Objective 1 of 4

VIDEO

Loading video…

Set up Juice Shop

OWASP Juice Shop is a modern, intentionally vulnerable Node.js web application that covers all OWASP Top 10 categories and many more. Install it with Docker using 'docker run --rm -p 3000:3000 bkimminich/juice-shop' and access it at http://localhost:3000. Unlike DVWA, Juice Shop has a realistic modern UI and does not tell you where the vulnerabilities are — you must find them yourself, making it a much more realistic training environment. The application includes a built-in score board at /#/score-board that tracks your progress as you solve challenges.

Map the attack surface

Spend 15–20 minutes exploring Juice Shop as a normal user: browse products, register an account, add items to the cart, and go through the checkout flow. While exploring, keep Burp Suite running to capture all HTTP traffic. After your manual exploration, review Burp's HTTP history to build a complete list of all API endpoints, parameters, and authentication mechanisms you observed. Pay attention to the JavaScript source files loaded by the application — they often contain API endpoint paths, commented-out debug code, and hardcoded credentials that are not visible in the rendered UI.

Test authentication

Attempt to log in with common default credentials (admin@juice-sh.op with password admin123), then test for SQL injection in the login form by entering ' OR 1=1-- as the email address. Try to access the admin panel at /#/administration without being logged in as an admin. Test the password reset flow for logic flaws — does it leak the security question answer, or can the reset token be predicted? Authentication is the highest-priority target in any web application assessment because a broken authentication mechanism can give an attacker full access to every user's account.

Test for injection vulnerabilities

Test every input field and API parameter for SQL injection, command injection, and template injection using the probing techniques from earlier lessons. Use Burp Suite's Intruder to systematically fuzz each parameter with a list of injection payloads. In Juice Shop, the search functionality, product reviews, and feedback form are all worth testing. For each injection point you find, determine the full impact: can you read the database, write to it, execute OS commands, or read files from the server? The severity of an injection vulnerability depends entirely on what you can do with it.

Test authorization

After registering a regular user account, attempt to access admin-only functionality by manipulating requests in Burp Suite. Try accessing /api/Users/ to enumerate all user accounts, /api/Feedbacks/ to read all customer feedback, and /api/Complaints/ to access support tickets. Test IDOR by placing an order and then accessing /api/Orders/<id> with sequential IDs to read other users' orders. Check whether the application enforces authorization on the API layer separately from the UI layer — many applications hide admin buttons in the UI but fail to protect the underlying API endpoints.

Write the report

Compile all your Juice Shop findings into a structured penetration test report following the format from the previous lesson. For each challenge you solved, write a finding entry with the vulnerability type, affected endpoint, reproduction steps, impact, and remediation. Juice Shop challenges are rated by difficulty (1–6 stars) which roughly corresponds to severity — use this as a starting point for your CVSS scoring. The goal of this exercise is not just to find vulnerabilities but to practice communicating them clearly — a finding that cannot be explained in writing is a finding that cannot be fixed.

Previous: Writing Pentest Reports Next Lesson