The story
OWASP Juice Shop is a deliberately vulnerable web application that OWASP maintains for security training. I run it locally in Docker and work through it as an independent study. This repository is the lab notebook rather than a polished writeup collection — it keeps the step-by-step reasoning behind each challenge in the order I actually thought it.
I hold the discipline strictly black-box. Exposed config files, stale backups, misconfigurations — all of it found by probing the running instance, never by opening the public source. I deliberately re-solve problems with Burp Suite, then ffuf, then a Python script, because I want the reasoning to survive a change of tooling. The one place AI appears in the process is as a concept reference when I hit an unfamiliar term; never to locate a vulnerability or write a payload.
I publish it unedited because clean Juice Shop writeups are everywhere. What's rare is an honest record of solving something you don't already know the answer to. It keeps growing as I push into the harder tiers, which is where the learning actually lives.
Marks in the margin
- Strictly black-box — every finding came from probing the running app, never from reading its source.
- Cleared every 1-star challenge, then most of the 2- and 3-star tiers.
- Re-solved the same problem with Burp, ffuf, and hand-written Python so the reasoning survives a change of tools.
- Documented the honest record: hypotheses, wrong turns, and what each failure ruled out.
Scope note: every test runs against a deliberately vulnerable training app I host myself in Docker. No third-party, production, or live system is ever a target.