WSAR TechSecurity Testing Portfolio
Documented practice work on intentionally vulnerable training labs — summarized by vulnerability class, severity and remediation theme.
About this portfolio
Training labs only. Every item below comes from intentionally vulnerable practice applications (OWASP Juice Shop and DVWA) run locally on our own machine as authorized learning exercises. These are not client engagements, no production or third-party systems were tested, and no bug-bounty submissions or rewards are claimed. Findings are summarized at a high level for illustration; no exploitation steps or payloads are published.
- 36 findings documented across two labs
- 33 on OWASP Juice Shop, 3 on DVWA
- 4 Critical, 12 High, 20 Medium
- Coverage spans seven OWASP Top 10 (2021) categories
OWASP Juice Shop — 33 findings
OWASP Juice Shop is an intentionally insecure web application maintained by OWASP for training. Findings below were identified on a local, self-hosted instance.
| Finding | Vulnerability class | OWASP Top 10 (2021) | Severity (CVSS 3.1) | Remediation theme |
|---|---|---|---|---|
| Authentication bypass via SQL injection | SQL Injection | A03:2021 | Critical 9.8 | Parameterized queries and server-side input handling |
| Privilege escalation via mass assignment at registration | Mass Assignment | A08:2021 | Critical 9.8 | Allowlist bindable fields; never trust client role fields |
| Weak administrator password | Identification & Authentication Failures | A07:2021 | Critical 9.8 | Enforce strong password policy and remove defaults |
| JWT signature verification flaw (algorithm confusion / unsigned tokens) | Cryptographic Failures | A02:2021 | Critical 9.1 | Enforce expected algorithm and verify signatures |
| User table and credential disclosure via UNION SQL injection | SQL Injection | A03:2021 | High 7.5 | Parameterized queries; least-privilege database accounts |
| Account takeover via weak password-reset security question | Identification & Authentication Failures | A07:2021 | High 8.1 | Strengthen account recovery; avoid guessable questions |
| Sensitive document exposure via directory listing | Sensitive Data Exposure | A01:2021 | High 7.5 | Disable directory listing; protect static files |
| Order data exposure via NoSQL injection | NoSQL Injection | A03:2021 | High 7.5 | Disable risky operators; validate input |
| Server-side denial of service via NoSQL injection | NoSQL Injection | A03:2021 | High 7.5 | Disable risky operators; apply execution timeouts |
| Server-side request forgery via profile image URL | Server-Side Request Forgery | A10:2021 | High 7.6 | URL allowlist; block internal address ranges |
| Local file disclosure via XML external entity injection | XML External Entity (XXE) | A05:2021 | High 7.1 | Disable external entity resolution |
| Authentication bypass via SQL injection (second account) | SQL Injection | A03:2021 | High 8.1 | Parameterized queries |
| Authentication bypass via SQL injection (third account) | SQL Injection | A03:2021 | High 8.1 | Parameterized queries |
| Database schema disclosure via SQL injection | SQL Injection | A03:2021 | Medium 5.3 | Parameterized queries; suppress detailed errors |
| Insecure direct object reference on shopping baskets | Broken Access Control (IDOR) | A01:2021 | Medium 6.5 | Enforce object-level authorization checks |
| Review spoofing through missing identity binding | Broken Access Control | A01:2021 | Medium 4.3 | Bind actions to the authenticated identity server-side |
| Backup file leak via null-byte path handling | Security Misconfiguration | A05:2021 | Medium 5.3 | Validate input; restrict served file paths |
| Stack and SQL detail disclosure via verbose errors | Security Misconfiguration | A05:2021 | Medium 5.3 | Return generic errors; log details server-side |
| Forgeable discount coupons due to weak cryptography | Cryptographic Failures | A02:2021 | Medium 6.5 | Use signed tokens; validate values server-side |
| Bulk tampering of product reviews via NoSQL injection | NoSQL Injection | A03:2021 | Medium 6.5 | Validate input; restrict query operators |
| Denial of service via XML external entity injection | XML External Entity (XXE) | A05:2021 | Medium 6.5 | Disable external entities; enforce parser limits |
| Reflected cross-site scripting in order tracking | Cross-Site Scripting (XSS) | A03:2021 | Medium 6.1 | Output encoding and a strict content security policy |
| Payment bypass on membership upgrade | Insecure Design | A04:2021 | Medium 5.3 | Authorize purchases server-side |
| Cross-account basket modification | Broken Access Control | A01:2021 | Medium 4.3 | Enforce object-level authorization |
| Negative-quantity order business logic flaw | Insecure Design | A04:2021 | Medium 5.3 | Validate quantities and totals server-side |
| Open redirect | Broken Access Control | A01:2021 | Medium 4.7 | Allowlist redirect destinations |
| Feedback spoofing through missing identity binding | Broken Access Control | A01:2021 | Medium 4.3 | Bind actions to the authenticated identity server-side |
| Forgotten sales backup exposed via null-byte handling | Security Misconfiguration | A05:2021 | Medium 5.3 | Validate input; remove and restrict backup files |
| Misplaced detection-rule file disclosure | Security Misconfiguration | A05:2021 | Medium 5.3 | Keep sensitive files out of the web root |
| Unauthenticated metrics endpoint exposure | Security Misconfiguration | A05:2021 | Medium 5.3 | Authenticate and restrict monitoring endpoints |
| Access log disclosure | Security Logging & Monitoring Failures | A09:2021 | Medium 5.3 | Restrict access to log files |
| Empty user account creation | Identification & Authentication Failures | A07:2021 | Medium 4.3 | Validate registration input server-side |
| Order of a deleted product via server-side validation gap | Insecure Design | A04:2021 | Medium 5.4 | Validate product state server-side |
DVWA — 3 findings
DVWA (Damn Vulnerable Web Application) is an intentionally insecure PHP/MySQL application used for security training. Findings below were identified on a local, self-hosted instance.
| Finding | Vulnerability class | OWASP Top 10 (2021) | Severity (CVSS 3.1) | Remediation theme |
|---|---|---|---|---|
| OS command injection | OS Command Injection | A03:2021 | High 8.8 | Avoid shell calls; validate and escape input |
| Arbitrary file upload leading to remote code execution | Unrestricted File Upload | A03:2021 | High 8.8 | Validate file type; store outside the web root |
| Cross-site request forgery on password change | Cross-Site Request Forgery (CSRF) | A01:2021 | High 8.1 | Anti-CSRF tokens and SameSite cookies |
Talk to us — free 30-minute consultation
Tell us where you are stuck: hiring, field visibility, filings, website, or trade shows. English or Chinese.