The story
OWASP Juice Shop is a deliberately vulnerable web app that OWASP maintains for security training. This repo is my personal lab notebook against it — not a polished writeup collection, but the actual step-by-step reasoning behind each challenge, in the order I really thought it.
I work it strictly black-box: exposed config files, backups, misconfigurations — all found through live recon against the running app, never by reading the public source. I deliberately attack the same problem with Burp Suite, ffuf, and Python to stay fluent across manual and automated tooling. The one place AI shows up is as a concept reference when I hit an unfamiliar term — never to find a vulnerability or generate a payload.
I'm publishing it unedited because clean Juice Shop writeups are everywhere; what's rare is the honest thought process behind solving something you don't already know the answer to. It keeps growing as I push into the harder tiers — which is exactly where the real learning is.
Marks in the margin
- Strictly black-box — every finding pulled from the live app, never its source.
- Cleared every 1-star challenge plus most of the 2- and 3-star tiers.
- Attacked the same bug with Burp, ffuf, and hand-rolled Python for tooling fluency.
- Documented the honest thought process: hypotheses, wrong turns, and pivots.
Published raw on purpose — the value isn't the answer, it's the reasoning, dead ends and all.