Skip to content
Yasmin FreitasCybersecurity Analyst, home page
PT, Ler em português
Back to projects
LabWeb applications

Web vulnerability analysis

Lab with OWASP Juice Shop and DVWA to practice finding and fixing OWASP Top 10 issues.

Study lab in an isolated, authorized environment using my own or intentionally vulnerable systems. No third-party systems were tested.

Problem

Understanding how a web flaw is exploited is what makes it possible to tune a WAF well and guide developers through the fix.

Technical goal

Practice scanning, manual verification and reporting against intentionally vulnerable apps on an isolated network.

How it was done

  1. Define scope: isolated Docker network, no internet egress, target apps only.

  2. Enumerate services and ports with Nmap.

  3. Run automated scanning with OWASP ZAP.

  4. Confirm findings manually with Burp Suite and discard false positives.

  5. Classify by OWASP Top 10 category and CVSS severity.

  6. Write the report with a code fix and a WAF rule recommendation for each finding.

Evidence

Lab topology: analysis workstation and targets on an isolated network.
docker-compose.ymlyaml
services:  juice-shop:    image: bkimminich/juice-shop    networks: [lab]  dvwa:    image: vulnerables/web-dvwa    networks: [lab] networks:  lab:    internal: true   # sem saída para a internet
Isolated target environment: the internal network blocks any internet egress.

Key takeaways

  • Automated scans find the obvious; manual verification separates real issues from noise.
  • A useful report says how to fix things, not just what's wrong.
  • A WAF helps, but it doesn't replace fixing the code.