Detailed Vulnerability Assessment Lab on
Section 2: OWASP Explained
OWASP stands for Open Worldwide Application Security Project.
It is a global, non-profit community focused on improving software security
What OWASP actually does
OWASP builds and shares:
Web application security standards
Security best practices for developers
Free security tools
Training labs and documentation
Real-world vulnerability knowledge
It is widely used in:
Cybersecurity engineering
Penetration testing
Secure software development
DevSecOps pipelines
Why OWASP matters
Most web attacks happen due to predictable mistakes like:
Broken authentication
SQL injection
Misconfigured servers
Weak access control
OWASP collects these patterns and standardizes them so teams can prevent them early.
This lab simulates a real VA workflow.
You will perform:
Asset discovery
Service enumeration
Web fingerprinting
Vulnerability discovery
Manual validation
Evidence collection
Risk classification
Remediation mapping
Target:
Item Value
Application OWASP Juice Shop
Host localhost
Port 3000
OS Ubuntu on WSL
Methodology OWASP Top 10
Phase 0: Environment Setup
Step 1: Install dependencies
sudo apt update
sudo apt install -y [Link] nmap nikto curl git jq
Verify:
docker --version
nmap --version
nikto -Version
Expected:
Docker installed
Nmap installed
Nikto installed
Step 2: Start Docker
sudo service docker start
Test:
docker ps
Expected:
CONTAINER ID IMAGE STATUS
No containers yet.
Phase 1: Deploy Target
Step 3: Pull and run Juice Shop
docker pull bkimminich/juice-shop
docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop
Check:
docker ps
Expected:
[Link]:3000->3000/tcp
Step 4: Verify target
Browser:
[Link]
Or terminal:
curl [Link]
Expected:
HTML response.
Evidence:
Take screenshot.
Save:
evidence/[Link]
Phase 2: Reconnaissance
Goal: discover exposed services.
Step 5: Basic TCP scan
Command:
nmap -sV -sC localhost -p 3000
What it does:
-sV service version detection
-sC default scripts
Expected:
3000/tcp open http [Link] Express
Document:
Port Service Version
3000 HTTP [Link]
Step 6: Full TCP sweep
nmap -p- localhost
Goal:
Check for additional ports.
Expected:
Mostly only 3000.
Risk note:
Extra ports = expanded attack surface.
Phase 3: HTTP Fingerprinting
Goal: enumerate headers and technologies.
Step 7: Response headers
curl -I [Link]
Check:
X-Powered-By
Content-Security-Policy
X-Frame-Options
Record:
Header Present Risk
CSP No XSS risk
X-Frame No Clickjacking
Step 8: Fetch source code
curl [Link] | less
Look for:
JS bundles
API references
comments
Search:
curl [Link] | grep api
Goal:
Find hidden endpoints.
Phase 4: Automated Web VA
Step 9: Nikto baseline scan
Run:
nikto -h [Link]
Observe:
Missing security headers
Dangerous files
Cookie issues
Record output.
Save:
nikto -h [Link] -output [Link]
Evidence:
[Link]
Phase 5: API Enumeration
This is critical.
Step 10: Open browser DevTools
Go to:
F12 → Network
Filter:
XHR
Refresh page.
Look for:
/api/Products
/api/Users
/api/Feedbacks
Document all endpoints.
Example:
Endpoint Method
/rest/products/search GET
/api/Users GET
Section 2: DVWA Labs
Target platform:
Damn Vulnerable Web Application (DVWA)
Set security level to:
Low
Lab 1: Command Injection
Module:
Command Injection
Objective
Execute system commands.
Input:
[Link] && whoami
Advanced:
[Link] && id
Expected Result
OS command output.
Vulnerability
Command Injection
Lab 2: File Inclusion
Module:
File Inclusion
Objective
Read sensitive files.
Payload:
../../../../etc/passwd
Expected Result
System file displayed.
Vulnerability
Local File Inclusion (LFI)
Lab 3: SQL Injection Blind
Module:
SQL Injection (Blind)
Objective
Detect time-based SQLi.
Payload:
1' AND SLEEP(5)-- -
Expected Result
Response delay.
Vulnerability
Blind SQL Injection
Lab 4: Stored XSS
Module:
XSS (Stored)
Objective
Store malicious script.
Payload:
<script>alert([Link])</script>
Submit comment.
Refresh page.
Expected Result
Persistent execution.
Vulnerability
Stored XSS
Validation Phase
Run scanner:
Use Nikto:
nikto -h [Link]
Use Nmap:
nmap -sV localhost -p 8081
Use Greenbone Vulnerability Management for comparison.
Final Deliverables
For each lab document:
Vulnerability name
Severity
Payload used
Screenshot
Risk impact
Mitigation
Example:
Lab Vulnerability Severity
OWASP 1 Broken Authentication High
OWASP 2 SQL Injection Critical
OWASP 3 XSS High
OWASP 4 File Upload Critical
DVWA 1 Command Injection Critical
DVWA 2 File Inclusion High
DVWA 3 Blind SQLi Critical
DVWA 4 Stored XSS High
This gives you a complete beginner pentesting workflow:
Recon → Scan → Exploit → Validate → Report.