OWASP Top 10 Penetration Testing
Introduction
The OWASP Top 10 is an awareness list of the most critical web application security risks, ranked from industry data and community input. The current release is OWASP Top 10:2025. It is not a full test plan and not a substitute for the Web Security Testing Guide or ASVS. It is the shared vocabulary clients, developers, and pentesters use when they say “we covered the Top 10.”
Relative to 2021, the 2025 list reorders several categories, expands vulnerable components into Software Supply Chain Failures, folds SSRF into Broken Access Control, and adds Mishandling of Exceptional Conditions as A10. If your report templates still say A01–A10:2021, update the mapping before you ship findings.
This post is a penetration testing walkthrough of each OWASP Top 10:2025 risk against OWASP Juice Shop, a deliberately vulnerable SPA with challenges that map to most categories. For engagement scope, Rules of Engagement, and how Top 10 / WSTG / ASVS fit together, see the companion web application penetration testing methodology.
Setup
Install Docker Engine if you do not already have it.
Run Juice Shop: docker run -p 3000:3000 bkimminich/juice-shop, or use a lab Compose stack that exposes Juice Shop on port 3000.
Open the app: http://localhost:3000 (or your lab URL).
Optional: Enable the Score Board (footer shopping-cart icon, or solve the Score Board challenge) to track solved challenges.
Tools: Browser DevTools (F12) and a proxy such as Burp Suite (proxy 127.0.0.1:8080; install Burp’s CA for HTTPS if needed).
Practice only against Juice Shop or other systems you are authorized to test.
A01:2025 – Broken Access Control
What it is: Access control decides who may see or do what. When it fails, users reach other people’s data (IDOR), admin-only functions as a normal user, or act as someone else because the server trusts client-supplied IDs or roles. In 2025, Server-Side Request Forgery (SSRF) is grouped here: if the server fetches a URL the attacker controls, that is also a failure of “who may cause the server to touch which resources.”
How to test (general)
Map roles and resources, then try horizontal and vertical privilege checks. Change object IDs in URLs and APIs. Call admin routes as a low-privilege user. For SSRF-shaped inputs (webhook, avatar URL, import-from-URL), try http://127.0.0.1, internal RFC1918 hosts, and cloud metadata URLs where in scope.
Juice Shop – Admin section
Register or log in as a normal user (for example test@test.com / Test123!).
Note the base URL (for example http://localhost:3000/#/). Juice Shop is an SPA; administration is often at #/administration.
Browse to http://localhost:3000/#/administration.
If Administration loads (user management, metrics, Application Configuration) while you are not an admin, access control is broken.
Optional: in Burp, call /rest/administration/application-configuration (or similar) and confirm admin data returns with a non-admin token.
Report: “Broken Access Control – Administration panel accessible to authenticated non-admin users; CWE-284, A01:2025.”
Juice Shop – View another user’s basket (IDOR)
Log in and add at least one item to your basket.
In DevTools → Network (or Burp), find the basket load (for example GET /rest/basket/1). Note the basket ID.
Change the ID and replay. If another user’s basket returns, you have IDOR.
Document request URL, modified ID, and evidence from the response.
Report: “Broken Access Control – Basket ID allows access to other users’ baskets (IDOR); CWE-639, A01:2025.”
Juice Shop – Forged feedback / review
Submit feedback or a review as yourself, then in Burp change the author/user ID in the payload and resend. If the app accepts it, document missing authorization on “who may post as whom.”
SSRF and CSRF mindset (A01:2025)
Juice Shop has limited direct SSRF challenges. For any parameter that might become a server-side URL (report abuse, fetch URL, avatar), try internal and metadata URLs and record what the server returns. Full SSRF procedures: OWASP Testing Guide.
Also treat CSRF (CWE-352) under A01:2025 when state-changing requests lack anti-CSRF tokens or SameSite protections. Forge feedback / change author ID without authorization belongs here as access control, not under A08.
Report (when found): “Broken Access Control / SSRF – Parameter X causes the server to fetch an internal or metadata URL; A01:2025.”
A02:2025 – Security Misconfiguration
What it is: Weak or default deployment settings: debug endpoints left on, verbose errors that leak paths or stack traces, missing security headers (CSP, HSTS, X-Content-Type-Options), or banners that advertise stack and version. Misconfiguration grew in prevalence in the 2025 data set and moved up from A05 in 2021.
How to test (general)
Inspect response headers, probe debug and docs paths, and force errors that might dump stack traces.
Juice Shop – Headers and paths
In DevTools → Network, open the main document or an API response → Headers. Note Server / X-Powered-By and whether CSP, HSTS, and nosniff are present.
Try paths such as /debug, /trace, /api-docs, /swagger. Document anything that returns stack traces, config, or version dumps.
Report: “Security Misconfiguration – Missing CSP (or HSTS), or debug/docs endpoint exposed; A02:2025.”
A03:2025 – Software Supply Chain Failures
What it is: An expansion of the old “vulnerable and outdated components” category. It covers compromised or vulnerable dependencies, build systems, and distribution pipelines, not only a stale library on disk. Community survey ranked this as a top concern. Juice Shop still teaches the dependency side well: intentionally outdated frontend packages with known CVEs.
How to test (general)
Inventory client and server components (filenames, package manifests, CDN URLs). Use Retire.js or SCA tooling. Ask how CI builds and signs artifacts. Look up versions in NVD before you cite a CVE.
Juice Shop – Outdated frontend libraries
DevTools → Sources (or Network): note library names and versions (comments or filenames such as angular-1.x.js).
Or run Retire.js against the page.
Confirm the version before citing a CVE. Older Juice Shop builds often ship AngularJS before 1.8.0 (CVE-2020-7676) and jQuery before 3.5.0 (CVE-2020-11022). Juice Shop keeps outdated deps on purpose for training.
Report: “Software Supply Chain Failures – Vulnerable client library version observed in the bundle (cite confirmed CVE); A03:2025.”
A04:2025 – Cryptographic Failures
What it is: Sensitive data exposed or weakened by crypto mistakes: cleartext passwords/tokens/PII in transit or at rest, weak algorithms, poor TLS, or keys and backups left reachable. Moved down from A02 in 2021 but remains a high-impact class.
How to test (general)
Hunt for backup and config paths, inspect API responses for secrets, and check TLS where HTTPS is in scope.
Juice Shop – Sensitive data exposure
Map menus, footer links, and APIs. Watch for /ftp, /backup, /.env, or config-style routes.
Try http://localhost:3000/ftp/ and related encryption-key or backup paths hinted by the app.
If any response contains passwords, API keys, or PII in cleartext, document as A04.
On HTTPS targets, check cert and cipher strength (browser or testssl.sh).
Report: “Cryptographic Failures – Sensitive data (backup / config) exposed in cleartext; CWE-319/522, A04:2025.”
A05:2025 – Injection
What it is: User input is treated as code or structured query language instead of data. SQL/NoSQL injection and XSS (reflected, stored, DOM) still live here. Injection remains heavily tested and CVE-rich even after dropping two places in the ranking.
How to test (general)
Fuzz every input and JSON field with SQL payloads, NoSQL operators, and XSS probes. Confirm reflected, stored, and DOM sinks.
Juice Shop – SQL injection at login
Open Login (#/login).
In Email try ' OR 1=1--, admin'--, or ' OR '1'='1 with an arbitrary password.
If you land authenticated, SQLi is confirmed.
In Burp, capture {"email":"...","password":"..."} and vary the email parameter.
Report: “Injection – SQL injection in login email allows authentication bypass; CWE-89, A05:2025.”
Juice Shop – SQLi to extract data
After confirming SQLi, use union- or error-based techniques (for example ' UNION SELECT 1,email,password,4,5 FROM Users--). Juice Shop challenges cover schema and credential exfiltration. Optional automation: sqlmap against the login JSON body with email as the injection point (authorized lab only).
Juice Shop – NoSQL injection (orders)
Find a JSON API that filters by user or order ID. Send operators such as {"userId": {"$gt": -1}} or id[$gt]=0. If other users’ orders return, document NoSQL injection under A05.
Juice Shop – XSS
Search: <script>alert(1)</script> or <img src=x onerror=alert(1)>.
Stored: same payloads in feedback, review, or profile fields that re-render later.
DOM: hash/query values written into the DOM without encoding.
API-only: persist XSS via Burp into a field the UI later renders.
Report: “Injection – Reflected or stored XSS in search/feedback; CWE-79, A05:2025.”
A06:2025 – Insecure Design
What it is: The workflow is wrong even when individual “bugs” are fixed: reusable coupons, client-trusted prices, missing rate limits. Testing asks what a user can do that the business never intended.
How to test (general)
Abuse checkout, discounts, registration, and support flows. Replay one-time tokens. Change price and quantity in transit.
Juice Shop – Business logic
Apply a coupon twice or across orders; document unlimited reuse.
Intercept add-to-basket or checkout; set "price": 0.01 or a negative quantity. If accepted, document insecure design.
Flood login or feedback with Intruder; note missing rate limit or CAPTCHA.
Report: “Insecure Design – Price/quantity manipulation, discount reuse, or missing rate limiting; A06:2025.”
A07:2025 – Authentication Failures
What it is: Attackers can authenticate as someone else or hijack a session: default credentials, weak passwords, broken JWT/session handling (alg: none, unsigned role claims), or predictable reset tokens. Same slot as 2021’s Identification and Authentication Failures, with a shorter name.
How to test (general)
Try defaults, password policy edges, logout/timeout/fixation, and JWT integrity.
Juice Shop – Weak defaults and JWT
Try common or in-app-hinted credentials (for example admin@juice-sh.op style challenges).
After login, copy the token from storage and decode it at jwt.io. Test alg: none and role tampering if the server accepts modified tokens.
Exercise forgot-password flows for token reuse or predictability.
Report: “Authentication Failures – Weak defaults or JWT integrity failure; A07:2025.”
A08:2025 – Software or Data Integrity Failures
What it is: The application or pipeline trusts software, code, or data artifacts without proving they were not tampered with. Typical issues: unsigned or auto-update packages, insecure deserialization, CI artifacts without provenance, and integrity checks skipped on plugins loaded from untrusted sources. This sits a level below A03 (supply chain of dependencies and build systems): A08 is “did we verify this blob/object before we executed or applied it?”
Client-supplied author IDs on reviews are authorization failures. Report those under A01 (forged feedback), not A08.
How to test (general)
Look for update endpoints, plugin/theme installers, serialized objects (Java/ObjectInputStream, Python pickle, PHP unserialize), webhook payloads that trigger code paths, and any “restore from backup” or “import config” that accepts client files without signature or hash verification.
Juice Shop – Coverage note
Juice Shop does not give a clean standalone “unsigned update” challenge the way a real CI/CD target would. Use it to practice spotting related integrity smells (for example user-controlled content that the app later treats as trusted script), then map XSS execution to A05 and unauthorized authorship to A01. For a full A08 finding on a real engagement, target auto-update channels, deserializers, and artifact signing.
Report (when found on a real target): “Software or Data Integrity Failures – Update/plugin/deserialized object accepted without signature or integrity check; A08:2025.”
A09:2025 – Security Logging and Alerting Failures
What it is: Security events (failed logins, admin access, injection attempts, privilege changes) are not logged, not protected, or not alerted on. Renamed slightly from 2021 to stress alerting, not just log storage.
How to test (general)
Trigger failures and privileged actions, then ask where logs land and whether anyone is paged. On Juice Shop, treat this as a recommendation finding.
Juice Shop – Observability
Perform a failed login and a successful SQLi or admin access. Document: “Ensure authentication failures and admin access are logged and alerted,” mapped to A09:2025.
Report: “Security Logging and Alerting Failures – No evidence of actionable logging for failed logins or admin access; A09:2025.”
A10:2025 – Mishandling of Exceptional Conditions
What it is: New in 2025. Applications fail open, leak internals through exceptions, or handle errors in ways that change security state (for example catching auth errors and continuing as anonymous with elevated leftovers, or returning stack traces that enable further attacks).
How to test (general)
Force invalid types, oversize payloads, missing fields, and mid-flow aborts. Watch for stack traces, fail-open authorization, and inconsistent session state after errors.
Juice Shop – Error and edge cases
Send malformed JSON, wrong content types, and truncated bodies to login and basket APIs; note verbose errors or stack traces (also overlaps A02).
Interrupt multi-step flows (checkout, registration) and retry out of order; document any privilege or cart state that sticks after a failure.
Recommend fail-closed authz, generic client errors, and detailed errors only in protected logs.
Report: “Mishandling of Exceptional Conditions – Verbose errors or fail-open behavior after malformed input; A10:2025.”
Quick reference: OWASP Top 10:2025 vs Juice Shop
OWASP Top 10:2025 | Juice Shop focus / example |
|---|---|
A01 Broken Access Control | Admin section, basket IDOR, forged feedback; SSRF/CSRF mindset |
A02 Security Misconfiguration | Headers, debug/docs paths, verbose errors |
A03 Software Supply Chain Failures | Outdated frontend libs / CVE confirmation |
A04 Cryptographic Failures | /ftp and backup/config exposure |
A05 Injection | SQLi login, schema/creds, NoSQL, XSS |
A06 Insecure Design | Coupon reuse, price/qty tamper, rate limits |
A07 Authentication Failures | Defaults, JWT alg/role tampering, reset tokens |
A08 Software or Data Integrity Failures | Limited JS coverage; prefer unsigned updates / deserialization on real targets; author-tamper → A01 |
A09 Security Logging and Alerting Failures | Recommend logging/alerting (limited direct challenge) |
A10 Mishandling of Exceptional Conditions | Malformed input, fail-open / verbose errors |
Summary
Juice Shop covers most of the OWASP Top 10:2025 for hands-on practice: access control and IDOR, misconfiguration, outdated components as a supply-chain slice, crypto exposure, injection, insecure design, auth and integrity flaws, plus recommendations for logging/alerting and exception handling. SSRF is no longer a standalone Top 10 row; treat it under A01. Expand from this list into full coverage with the OWASP Testing Guide and ASVS.
References
Register for instructor-led online courses today! https://www.darkrelay.com/courses
Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths
Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing
Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.
Comments