ART OF VECTOR

Web application

Web Application Penetration Test — Lab Sample

Self-hosted OWASP Juice Shop instance in the Art of Vector lab (intentionally vulnerable training application). Not a client system.

2026-08-12 · Public lab sample · no client data

Executive Summary · Scope · Methodology · Risk Rating · Findings · Evidence · Impact · Remediation · Retest

Executive Summary

Testing of a lab Juice Shop deployment identified three confirmed web-application issues: stored cross-site scripting in a user-controlled review field, broken access control on an administrative function, and session handling that did not expire after password change. No production systems were in scope. The same report structure is used for client engagements.

Scope

In scope: the Juice Shop web UI on an isolated lab host, unauthenticated and authenticated customer roles, and the checkout / review / account settings flows. Out of scope: denial-of-service, social engineering, and third-party payment providers. Testing window: 12 August 2026, lab network only.

Methodology

Work followed OWASP WSTG: mapping the application, reviewing authentication and session handling, testing access control between roles, and validating input handling on user-generated content. Automated coverage was used only to list routes; every finding below was reproduced manually and confirmed twice.

Risk Rating

Ratings use CVSS v3.1 as a starting point, then adjust for reachability (internet-facing vs. authenticated) and business impact (account takeover, data exposure, admin function abuse). Informational items are omitted from this public sample.

Findings

Evidence, impact, and remediation sit under each finding — the same order used in client PDFs.

WEB-01HighCVSS 7.1

Stored cross-site scripting in product reviews

Evidence
A review submitted from a standard customer account was rendered unsanitized in the product page HTML. Subsequent visits as a second lab user executed the injected script in that browser context. Screenshots retained in the lab workpapers; payload text is not published in this public sample.
Impact
A user who can post a review could run script in another customer’s session — session theft, account actions, or phishing inside the application origin.
Remediation
Encode output in the review renderer. Enforce a content security policy that disallows inline script. Add automated tests that reject markup in review fields. Retest after the template and CSP change.
WEB-02HighCVSS 8.1

Broken access control on an administrative function

Evidence
An authenticated customer could invoke an administration route that the UI does not expose. The server accepted the request without a role check. Response body showed data reserved for the admin role in the lab dataset.
Impact
A low-privilege account could read or change records intended for operators — inventory, user lists, or configuration, depending on the same pattern in a real product.
Remediation
Enforce authorization on the server for every privileged route. Deny by default. Add regression tests for horizontal and vertical privilege checks. Retest with both customer and admin tokens.
WEB-03MediumCVSS 5.4

Session remains valid after password change

Evidence
After a password change in Account Settings, a previously issued session cookie still authorized API calls until natural expiry. Observed on the lab instance with two parallel sessions.
Impact
A stolen session survives credential rotation. Account recovery does not cut off an active attacker.
Remediation
Invalidate all sessions for the user on password change, email change, and explicit logout. Document the behavior in the security notes for the product.

Retest

Retest is included after remediation of High findings. Scope of retest: WEB-01 through WEB-03 only, on the same lab build or the patched client build. New features are a new engagement.

Engage

Put your controls under test.

Client reports use this structure with your hosts and evidence under NDA. Public samples omit payloads and live targets.