Final Assessment
The final assessment is a timed, black-box web application penetration test against an unknown vulnerable application. You will have no prior knowledge of the application's vulnerabilities and must apply your full methodology to discover, exploit, and document findings within the time limit. This assessment is designed to simulate the conditions of a real client engagement.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Deploy Juice Shop
If Juice Shop is not already running, start it with 'docker run --rm -p 3000:3000 bkimminich/juice-shop' and access it at http://localhost:3000. Register a new user account for this capstone exercise and keep Burp Suite running throughout to capture all traffic. Review the score board at /#/score-board to see the full list of challenges organized by category and difficulty — this gives you a structured target list for the assessment. Set a goal of finding at least one vulnerability in each OWASP Top 10 category during this capstone exercise.
Map the attack surface
Spend 20 minutes exploring Juice Shop as a normal user, then review Burp Suite's HTTP history to build your endpoint inventory. Use Gobuster to discover hidden paths: 'gobuster dir -u http://localhost:3000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt'. Examine the JavaScript source files in the browser's developer tools Sources tab — Juice Shop's main.js contains a list of all application routes and API endpoints. Document every endpoint, parameter, and authentication requirement before beginning exploitation — a thorough attack surface map prevents you from missing vulnerabilities.
Test systematically
Work through your endpoint inventory methodically, testing each one against the relevant vulnerability classes. Start with authentication (login, registration, password reset), then move to authorization (IDOR, privilege escalation), then injection (SQL, XSS, command), then business logic (negative quantities, coupon abuse, workflow bypass). Use your OWASP Testing Guide checklist to ensure complete coverage. For each test, record the input, the expected behavior, the actual behavior, and whether it constitutes a finding. Systematic testing with documentation is what separates a professional assessment from random clicking.
Document findings in real time
As you discover each vulnerability, immediately document it with a screenshot, the Burp Suite request/response, and a brief description of the finding. Do not rely on memory or plan to document everything at the end — details fade quickly and you may forget the exact payload or URL that triggered the vulnerability. Use a structured note-taking tool such as a spreadsheet, CherryTree, or Obsidian to organize findings by severity as you go. Real-time documentation also helps you avoid retesting the same vulnerability multiple times, which wastes time during a time-limited engagement.
Write the report
Compile your Juice Shop findings into a complete penetration test report following professional standards. Include an executive summary, scope and methodology, findings summary table, and detailed findings with evidence. Rate each finding using CVSS v3.1 and map it to the relevant OWASP Top 10 category. The report should be written as if it were a real client deliverable — use professional language, avoid slang, and ensure every finding is clearly explained and actionable. Peer-review your report by reading it aloud to catch unclear sentences, then revise until every finding can be understood by both a technical developer and a non-technical manager.