This project was completed as part of the Future Interns Cyber Security Internship (Task 01).
The objective of this assessment was to perform a passive, non-destructive security assessment on the OWASP Juice Shop demo application using industry-standard tools.
No exploitation, brute-force attacks, or destructive testing were performed during this assessment.
- Application: OWASP Juice Shop
- URL: https://demo.owasp-juice.shop/
- Assessment Type: Passive Security Assessment
The assessment included:
- HTTP Response Header Analysis
- Network Exposure Scan
- OWASP ZAP Passive Scan
- Firefox Developer Tools Verification
- Evidence Collection
- Risk Classification
The assessment excluded:
- Active Exploitation
- Brute Force
- Denial of Service (DoS)
- Authentication Bypass
- Vulnerability Exploitation
- Kali Linux
- OWASP ZAP
- Nmap
- Firefox Developer Tools
- curl
| Finding | Risk |
|---|---|
| Missing Content Security Policy (CSP) | Medium |
| Permissive Cross-Origin Resource Sharing (CORS) | Medium |
| Missing HTTP Strict Transport Security (HSTS) | Low |
| Private IP Address Disclosure | Low |
- Medium Risk : 2
- Low Risk : 2
- High Risk : 0
- Critical Risk : 0
Evidence collected includes:
- Target screenshots
- Response headers
- Nmap scan output
- OWASP ZAP passive scan alerts
- Firefox DevTools verification
- Implement a restrictive Content Security Policy (CSP)
- Enable HTTP Strict Transport Security (HSTS)
- Restrict CORS to trusted origins
- Remove internal IP address information from public responses
FUTURE_CS_01/
│
├── evidence/
│ ├── headers/
│ ├── nmap/
│ ├── screenshots/
│ └── zap/
│
├── report/
│ ├── FUTURE_CS_01_Report.md
│ └── FUTURE_CS_01_Report.pdf
│
└── README.md
Mohammad Aliraza Muphid Koke
Future Interns Cyber Security Internship
Task ID: FUTURE_CS_01
This assessment was performed only against the publicly available OWASP Juice Shop demo application using passive and non-destructive techniques for educational purposes.