Project · Advanced · about 28 hours
A full security assessment of a practice web app
Threat model, test and report on OWASP Juice Shop end to end, then write the code fixes and detections a defender would add.
Skills:Application security, Communication, Penetration testing, Threat modelling
Part of: Cybersecurity Engineer
Data and licences
Brief
This project is for authorised, defensive learning only. Use the practice target provided, which is built to be tested, and never test systems you do not own or have written permission to test. OWASP Juice Shop is a deliberately vulnerable application published for exactly this purpose; run your own instance. This project joins offence and defence: find issues, then show how you would prevent and detect them.
What to build
Run Juice Shop locally and build a threat model with a data flow diagram, trust boundaries and STRIDE
Work through the application methodically using the OWASP Web Security Testing Guide, confirming each finding safely on your own instance
Write each finding with impact, reproduction steps, evidence and a CVSS-based rating
For the highest-rated findings, write the code fix (parameterisation, access checks, output encoding) and an automated test
Write detections (log signatures or rules) that would flag exploitation attempts
Deliverables
Repository with
threat-model.md,findings/,fixes/,detections/and an executive summary
How it is graded
Reviewers read the report as a client would, reproduce two findings on their own Juice Shop instance, and check your fixes and detections.
Stretch
Automate a subset of the checks as a repeatable script so a retest is quick.
Deliverables
- A threat model of the application with STRIDE and trust boundaries
- A test report with confirmed findings, business impact, reproduction steps and ratings
- For the top findings, the code-level fix and an automated test that would prevent it
- Detections that would catch exploitation attempts in logs
How a reviewer grades it
| Criterion | Weight | What good looks like |
|---|---|---|
| Threat model is thorough and drives the testing | 20% | |
| Findings are confirmed, prioritised and clearly reported with impact | 30% | |
| Fixes are correct and testable, showing a defender mindset | 30% | |
| Detections would catch real exploitation | 20% |