WSAR TechAuthorized Local-Lab Security Testing
A training and practice portfolio from authorized security testing of a local OWASP Juice Shop instance — summarized at a high level by OWASP Top 10 category.
Scope & framing
Researcher
Qi Chen
Security researcher. Authorized local-lab practice and defensive research.
WSAR Tech
Operated by RECON RESCUE INC. Based in Katy, Texas. Contact: chenqi@wsartech.com.
Target
OWASP Juice Shop (bkimminich/juice-shop), self-hosted in Docker, bound to 127.0.0.1 only. OWASP publishes it specifically for training.
Findings summary — by category
Manual black/grey-box testing on the local instance. Findings span multiple OWASP Top 10 (2021) categories. The table below lists vulnerability classes and representative finding titles only. No exploitation steps, payloads, proof-of-concept code or reproduction procedures are published here.
| Vulnerability class | OWASP Top 10 (2021) | Representative finding | Remediation theme |
|---|---|---|---|
| SQL injection / authentication bypass | A03:2021 — Injection | Login bypass and account takeover via SQL injection | Parameterized queries; never interpolate input into SQL |
| UNION-based SQL injection (data disclosure) | A03:2021 — Injection | User-table and credential disclosure | Parameterized queries; least-privilege database accounts |
| NoSQL injection | A03:2021 — Injection | Unauthorized data read / bulk tampering via query operators | Validate input; restrict permitted query operators |
| Cross-site scripting (reflected / DOM) | A03:2021 — Injection | Reflected and DOM-based XSS | Output encoding and a strict content-security policy |
| Broken access control / IDOR | A01:2021 — Broken Access Control | Cross-account object access and function-level authz gaps | Enforce object- and function-level authorization server-side |
| Mass assignment — privilege escalation | A08:2021 — Software & Data Integrity | Privilege escalation to administrator at registration | Allowlist bindable fields; never trust client role fields |
| JWT signature verification / algorithm confusion | A02:2021 / A07:2021 | Forged / unsigned session tokens accepted | Enforce the expected algorithm and verify signatures |
| Weak credentials & insecure account recovery | A07:2021 — Identification & Auth Failures | Weak default passwords and weak security-question recovery | Enforce strong password policy; remove defaults; harden recovery |
| Cryptographic failures | A02:2021 — Cryptographic Failures | Forgeable tokens / coupons and exposed key material | Use signed tokens; protect key material; validate server-side |
| Server-side request forgery (SSRF) | A10:2021 — SSRF | Server-side fetch of an attacker-supplied URL | Allowlist outbound destinations; validate and restrict URLs |
| XML external entity (XXE) | A05:2021 — Security Misconfiguration | File disclosure and denial of service via XML entities | Disable external entities; enforce parser limits |
| Security misconfiguration & sensitive data exposure | A05:2021 — Security Misconfiguration | Directory listing, backup / config file and log exposure | Keep sensitive files out of the web root; return generic errors |
| Insecure design / business-logic flaws | A04:2021 — Insecure Design | Payment and quantity / workflow bypasses | Validate state, totals and workflow steps server-side |
| Logging & monitoring exposure | A09:2021 — Logging & Monitoring | Access-log and metrics-endpoint exposure | Authenticate and restrict monitoring and log endpoints |
OWASP Top 10 (2021) categories covered
- A01 Broken Access Control
- A02 Cryptographic Failures
- A03 Injection
- A04 Insecure Design
- A05 Security Misconfiguration
- A07 Identification & Authentication Failures
- A08 Software & Data Integrity Failures
- A09 Logging & Monitoring Failures
- A10 Server-Side Request Forgery
What this portfolio is not
- Not unauthorized scanning or testing of any third-party, production or external system.
- Not a guarantee of search rankings, outcomes, or an offer to “hack anything.”
- No exploit steps, payloads or proof-of-concept code are published.
- Real bug-bounty or platform submissions are not listed here, pending legal review.
Need authorized testing on your own systems?
WSAR Tech performs authorized, scoped security testing for web, mobile and API applications — under written authorization, with vulnerability reports mapped to the OWASP Top 10 and remediation guidance. See the Website Security Testing service.
Talk to us — free 30-minute consultation
English or Chinese. Based in Katy, Texas.