 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 14
Build Your First Web Security Lab with OWASP Juice Shop + Burp Suite
⚠️ LEARNING PURPOSE ONLY: This entire lesson is for educational and defensive cybersecurity learning. All practical exercises below are designed for a local training environment that you control. Do not apply these techniques to public websites, customer systems, or other people's accounts without explicit authorization.
Welcome to Day 14.
Today is an important milestone because we're moving from isolated Burp exercises to a realistic, deliberately vulnerable web application.
We'll use:
🧃 OWASP Juice Shop — intentionally vulnerable training application
🟠 Burp Suite Community Edition — HTTP interception and analysis
🐳 Docker — to run Juice Shop locally
🌐 Your browser/Burp's built-in browser
The official Juice Shop guide currently recommends Docker and exposes the application locally at localhost:3000. (OWASP Juice Shop)
🎯 Day 14 Learning Objectives
Today you'll learn:
What OWASP Juice Shop is
Why vulnerable applications are useful
Installing/running Juice Shop with Docker
Linux setup
Windows setup
macOS setup
Checking the container
Accessing Juice Shop
Connecting Burp Suite
Setting Burp scope
Capturing requests
HTTP History
Repeater
Identifying application endpoints
Creating a safe testing workflow
Building your first local web-security lab
1. What Is OWASP Juice Shop?
OWASP Juice Shop is a deliberately insecure web application designed for security training.
It contains many different security challenges.
That makes it ideal for learning:
Web Application
↓
Observe
↓
Understand
↓
Test
↓
Identify weakness
↓
Understand remediation
Instead of attacking a real website:
❌ Random Website
we use:
✅ Local Vulnerable Lab
2. Today's Lab Architecture
Your computer will contain everything:
YOUR COMPUTER
┌─────────────────────────────────────────┐
│ │
│ Browser │
│ │ │
│ ▼ │
│ Burp Suite │
│ │ │
│ ▼ │
│ 127.0.0.1:3000 │
│ │ │
│ ▼ │
│ Docker │
│ │ │
│ ▼ │
│ OWASP Juice Shop │
│ │
└─────────────────────────────────────────┘
The important part is:
127.0.0.1
That's your own computer.
3. Why Localhost?
When you use:
http://127.0.0.1:3000
you're communicating with a service running on your own machine.
That gives us a controlled environment.
Internet
│
X
│
│
Your Computer
│
└── Juice Shop
This is exactly what we want for learning.
4. Check Docker
You should already have Docker if you followed your previous lab setup.
🐧 Linux
docker --version
🪟 Windows PowerShell
docker --version
🍎 macOS
docker --version
You should receive something similar to:
Docker version ...
The exact version isn't important for today's exercise.
5. Check Docker Engine
Run:
docker info
On Windows PowerShell:
docker info
If Docker isn't running, you'll receive an error.
Start Docker Desktop on Windows/macOS, or start your Docker service on Linux.
6. Download Juice Shop
The official OWASP Juice Shop documentation currently gives this Docker command:
docker pull bkimminich/juice-shop
Run it on:
Linux
docker pull bkimminich/juice-shop
Windows PowerShell
docker pull bkimminich/juice-shop
macOS
docker pull bkimminich/juice-shop
This downloads the official Juice Shop Docker image.
7. Run Juice Shop
The official documentation currently recommends binding it specifically to localhost:
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Use the same command on:
Linux
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Windows PowerShell
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
macOS
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
8. Why Bind to 127.0.0.1?
Notice:
127.0.0.1:3000:3000
Rather than simply:
3000:3000
We're deliberately binding the application to your local machine.
Conceptually:
127.0.0.1:3000
↓
YOUR COMPUTER ONLY
This is a good security habit for a training lab.
9. Check the Container
Run:
docker ps
You should see something similar to:
CONTAINER ID
IMAGE
COMMAND
STATUS
PORTS
Look for:
bkimminich/juice-shop
and:
127.0.0.1:3000->3000/tcp
10. Check Logs
If the application doesn't load:
docker logs <container-id>
You can get the container ID with:
docker ps
For example:
docker logs abc123
Don't copy the example ID literally.
11. Open Juice Shop
Open:
http://127.0.0.1:3000
or:
http://localhost:3000
The official Juice Shop guide uses http://localhost:3000. (OWASP Juice Shop)
You should see the Juice Shop application.
🎉 Congratulations!
You've now created your first deliberately vulnerable web-security lab.
12. Test with curl
Before using Burp, let's confirm the application works.
Linux/macOS
curl -I http://127.0.0.1:3000
Windows
curl.exe -I http://127.0.0.1:3000
You should receive an HTTP response.
For example:
HTTP/1.1 200 OK
The exact headers may vary.
13. Test the HTML
Linux/macOS
curl http://127.0.0.1:3000
Windows
curl.exe http://127.0.0.1:3000
You'll receive the application's response.
You don't need to understand all of it yet.
14. Check the Docker Port
Linux/macOS
lsof -nP -iTCP:3000 -sTCP:LISTEN
or:
docker ps
Windows
netstat -ano | findstr :3000
This helps you understand which port the application is using.
15. Your Lab Now Looks Like This
┌───────────────────────────────┐
│ YOUR COMPUTER │
│ │
│ Browser │
│ │ │
│ ▼ │
│ http://127.0.0.1:3000 │
│ │ │
│ ▼ │
│ Docker │
│ │ │
│ ▼ │
│ OWASP Juice Shop │
│ │
└───────────────────────────────┘
Now let's add Burp.
🟠 16. Start Burp Suite
Open Burp Suite.
PortSwigger's current getting-started workflow includes:
Burp Proxy
Intercept
Target scope
HTTP history
Repeater
17. Use Burp's Built-In Browser
Here's a useful improvement from our previous lessons.
Current Burp versions include a built-in browser that is already configured to work with Burp. PortSwigger recommends it for getting started because proxy settings are automatically configured. (PortSwigger)
Go to:
Proxy
↓
Intercept
↓
Open Browser
This avoids manually configuring an external browser for today's basic lab.
18. Turn Intercept ON
In Burp:
Proxy
↓
Intercept
Set:
Intercept ON
Now open:
http://127.0.0.1:3000
in Burp's browser.
19. What Should Happen?
Your request should appear in Burp.
Something similar to:
GET / HTTP/1.1
Host: 127.0.0.1:3000
User-Agent: Mozilla/5.0
Accept: text/html
The exact request will vary.
20. Forward the Request
Click:
Forward
Burp sends the request to Juice Shop.
The application responds:
Juice Shop
↓
Response
↓
Burp
↓
Browser
PortSwigger documents this exact intercept → inspect → forward workflow. (PortSwigger)
21. Turn Intercept OFF
After you've confirmed it works:
Intercept OFF
This is important.
Modern web applications generate many requests.
You don't want to manually forward every:
CSS
JavaScript
Images
Fonts
API calls
22. Browse Juice Shop Normally
Now explore your local Juice Shop.
Click around:
Home
Products
Search
Login
Basket
Don't attempt vulnerability exploitation yet.
We're collecting normal application behavior.
23. Open HTTP History
In Burp:
Proxy
↓
HTTP history
You'll see requests.
For example:
GET /
GET /rest/products/search
GET /assets/...
GET /api/...
The exact endpoints may vary with the Juice Shop version.
PortSwigger's documentation explains that HTTP History records traffic passing through Burp, including when interception is turned off. (PortSwigger)
24. Identify the API
Juice Shop is a modern web application.
The browser doesn't simply download one HTML page.
It communicates with backend endpoints.
You may see requests resembling:
/rest/...
/api/...
This is extremely useful.
You're beginning to see the application's architecture.
25. Set Your Burp Target Scope
This is one of today's most important lessons.
Go to:
Target
↓
Site map
You should see your local target:
127.0.0.1:3000
Right-click it.
Choose:
Add to scope
PortSwigger recommends setting a target scope so Burp can focus on the hosts you're actually testing and reduce unrelated traffic. (PortSwigger)
26. Why Scope Matters
Even Burp's browser may generate requests to other services.
Without scope:
HTTP History
127.0.0.1
Analytics
Other websites
External resources
...
With scope:
IN SCOPE
│
└── 127.0.0.1:3000
│
├── /
├── /rest/...
└── /api/...
This keeps your investigation focused.
27. Filter HTTP History
In:
Proxy → HTTP history
Use the filter:
Show only in-scope items
Now you're focusing on your local Juice Shop traffic.
This is exactly the type of workflow PortSwigger recommends for keeping HTTP history manageable. (PortSwigger)
28. Analyze Your First Request
Select:
GET /
Look at:
Request
Method:
GET
Host:
127.0.0.1:3000
Path:
/
Response
Look at:
Status:
Content-Type:
Length:
Record the information.
29. Analyze a Product Request
Browse the application and select a product.
Then look at:
Proxy → HTTP history
Find the request generated by that action.
You might see an API request.
Study:
Method
URL
Headers
Parameters
Response
Don't modify it yet.
30. Send a Request to Repeater
Find an interesting read-only GET request.
Right-click:
Send to Repeater
Open:
Repeater
Now you have a controlled copy of the request.
31. Baseline
Before modifying anything:
Send
Record:
Status:
Length:
Response:
This is your baseline.
32. Modify One Safe Parameter
If the request contains a normal numeric parameter, you can change it within the local Juice Shop lab.
For example, if you see:
?id=1
try another ordinary value:
?id=2
Then:
Send
Compare the responses.
33. What Are We Looking For?
At this stage, we're not trying to exploit anything.
We're asking:
Does the response change?
↓
Why did it change?
↓
What does this parameter control?
↓
What should the application normally allow?
This is reconnaissance and application understanding.
34. Response Comparison
Create a table:
| Test | Status | Length | Observation |
|---|---|---|---|
| Original | ___ | ___ | Baseline |
| Parameter A | ___ | ___ | ___ |
| Parameter B | ___ | ___ | ___ |
This habit will become extremely valuable later.
35. Don't Run Automated Scans Yet
Juice Shop is deliberately vulnerable, so automated scanning can produce a huge amount of information.
For now:
❌ Scanner
❌ Intruder
❌ Automated exploitation
❌ Random payloads
Instead:
✅ Proxy
✅ HTTP History
✅ Scope
✅ Repeater
✅ Manual analysis
Build your understanding first.
36. Linux — Complete Day 14 Setup
docker --version
Then:
docker pull bkimminich/juice-shop
Run:
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Check:
docker ps
Test:
curl -I http://127.0.0.1:3000
Optional:
curl http://127.0.0.1:3000
37. Windows — Complete Day 14 Setup
PowerShell:
docker --version
Pull:
docker pull bkimminich/juice-shop
Run:
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Check:
docker ps
Test:
curl.exe -I http://127.0.0.1:3000
38. macOS — Complete Day 14 Setup
Terminal:
docker --version
Pull:
docker pull bkimminich/juice-shop
Run:
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Check:
docker ps
Test:
curl -I http://127.0.0.1:3000
The official Juice Shop documentation supports Linux, macOS, and Windows Docker usage and currently documents the localhost Docker mapping used above. (OWASP Juice Shop)
39. Stop the Lab
When you're finished:
docker ps
Find the container ID.
Then:
docker stop <container-id>
Example:
docker stop abc123
Again, don't literally use abc123.
40. Start It Again Later
After stopping, you don't need to pull the image again.
List containers:
docker ps -a
Then:
docker start <container-id>
Check:
docker ps
41. Remove the Lab Container
If you want to remove it completely:
docker rm <container-id>
If you also want to remove the image:
docker images
Then:
docker rmi bkimminich/juice-shop
You don't need to do this today.
42. Important Docker Concept
Understand the difference:
IMAGE
↓
Template
CONTAINER
↓
Running instance
Think:
Juice Shop Image
↓
Docker Run
↓
Juice Shop Container
↓
localhost:3000
43. Troubleshooting — Port 3000 Already Used
If Docker says the port is already allocated, something else is using:
3000
Check.
Linux/macOS
lsof -nP -iTCP:3000 -sTCP:LISTEN
Windows
netstat -ano | findstr :3000
You can alternatively use another local host port, for example:
127.0.0.1:3001:3000
Then access:
http://127.0.0.1:3001
The container still listens on its internal port 3000.
44. Troubleshooting — Container Doesn't Start
Check:
docker ps -a
Then:
docker logs <container-id>
Look for:
ERROR
Exception
Port
Permission
Don't immediately reinstall everything.
Read the error first.
45. Troubleshooting — Browser Can't Connect
Check:
docker ps
Confirm the port mapping.
You want something similar to:
127.0.0.1:3000->3000/tcp
Then:
curl -I http://127.0.0.1:3000
If curl works but your browser doesn't, investigate the browser/proxy configuration.
46. Troubleshooting — Burp Doesn't See Traffic
Check:
1. Burp running?
2. Proxy listener active?
3. Using Burp's Browser?
4. Intercept configured correctly?
5. Target scope correct?
The easiest approach for today's exercise is:
Burp
↓
Proxy
↓
Intercept
↓
Open Browser
↓
http://127.0.0.1:3000
Burp's built-in browser is designed to work with Burp without separate proxy configuration. (PortSwigger)
47. Security Isolation
Your lab should look like:
INTERNET
│
X
│
┌───────┴───────┐
│ YOUR COMPUTER │
│ │
│ Burp │
│ ↓ │
│ Juice Shop │
│ ↓ │
│ Docker │
└───────────────┘
This is safer than exposing your vulnerable application to the internet.
48. Your Day 14 Workflow
Memorize this:
Permission
↓
Local Lab
↓
Docker
↓
Juice Shop
↓
Burp
↓
Set Scope
↓
Browse
↓
HTTP History
↓
Identify Requests
↓
Repeater
↓
Baseline
↓
Controlled Change
↓
Compare
↓
Document
🧪 Day 14 Main Practical Exercise
Part A — Start Juice Shop
Run:
docker pull bkimminich/juice-shop
Then:
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Part B — Verify
docker ps
Then:
curl -I http://127.0.0.1:3000
Part C — Open
Open:
http://127.0.0.1:3000
Part D — Burp
Open:
Burp Suite
↓
Proxy
↓
Open Browser
Part E — Intercept
Turn:
Intercept ON
Visit:
http://127.0.0.1:3000
Capture the request.
Part F — Forward
Click:
Forward
Then turn:
Intercept OFF
Part G — Browse
Use Juice Shop normally.
Visit:
Home
Products
Search
Part H — History
Open:
Proxy
↓
HTTP history
Part I — Scope
Add:
127.0.0.1:3000
to Burp's target scope.
Then filter history to:
In-scope only
Part J — Repeater
Select one interesting GET request.
Send it to:
Repeater
Send the original request.
Record the baseline.
Part K — Modify
Change one harmless parameter.
Send again.
Compare:
Status
Length
Headers
Body
📊 Day 14 Lab Report
Complete:
╔══════════════════════════════════╗
║ DAY 14 LAB REPORT ║
╚══════════════════════════════════╝
Operating System:
____________________________
Docker Version:
____________________________
Juice Shop:
Running / Not Running
Local URL:
____________________________
Container ID:
____________________________
Burp Version:
____________________________
Burp Proxy:
____________________________
Target Scope:
____________________________
Request Method:
____________________________
Request Endpoint:
____________________________
Status Code:
____________________________
Response Length:
____________________________
Parameter Tested:
____________________________
Original Value:
____________________________
Modified Value:
____________________________
Observed Difference:
____________________________
🧠 Day 14 Questions
Answer these in your notes.
1.
What is OWASP Juice Shop?
2.
Why is Juice Shop useful for ethical hacking training?
3.
What is Docker?
4.
What is the difference between a Docker image and a container?
5.
Why are we binding Juice Shop to 127.0.0.1?
6.
What port is Juice Shop using in today's lab?
7.
What is Burp Proxy?
8.
What is HTTP History?
9.
Why should you define a Burp target scope?
10.
What is a baseline?
11.
Why should you modify one parameter at a time?
12.
Why shouldn't you immediately run automated scans?
13.
Why is a deliberately vulnerable application safer for learning?
14.
What is the difference between a request and response?
15.
What should you do if you discover an interesting endpoint on a real website that isn't yours?
Answer: Don't test it unless you have explicit authorization and it is within the defined scope.
🏆 Day 14 Challenge
Complete this:
🧃 JUICE SHOP
│
▼
Browse Normally
│
▼
Capture Request
│
▼
HTTP HISTORY
│
▼
Choose Request
│
▼
REPEATER
│
┌─────┴─────┐
▼ ▼
ORIGINAL MODIFIED
│ │
▼ ▼
RESPONSE RESPONSE
│ │
└─────┬─────┘
▼
COMPARE
│
▼
DOCUMENT
Your goal is not to find a vulnerability today.
Your goal is to demonstrate that you can:
Run → Browse → Intercept → Scope → Analyze → Repeater → Modify → Compare → Document.
🔐 Day 14 Ethical Rule
LEARNING PURPOSE ONLY: OWASP Juice Shop is intentionally vulnerable, but that does not mean you should transfer the same tests to real websites. Keep today's work inside your local Juice Shop environment.
PortSwigger's own documentation warns that Burp can have unexpected effects on applications and recommends using it against non-production systems until you're familiar with it. (PortSwigger)
Your lab should remain:
127.0.0.1
↓
Docker
↓
Juice Shop
↓
Burp
No real targets are required.
📚 Official References
✅ Day 14 Summary
Today you learned:
OWASP Juice Shop
Docker-based security labs
Localhost security
Docker images
Docker containers
Port mapping
Juice Shop startup
Burp's built-in browser
Burp Proxy
Intercept
Forward
HTTP History
Target Scope
Repeater
Baseline testing
Controlled parameter modification
Response comparison
Linux commands
Windows PowerShell commands
macOS commands
Troubleshooting
🔑 Most Important Lesson
A professional ethical hacker doesn't need to attack real systems to learn. A properly designed local lab provides a safe environment to understand the same concepts.
🔜 Day 15 — Your First Web Vulnerability: Authentication & Access Control
Tomorrow we'll start studying vulnerabilities using your local Juice Shop lab.
We'll cover:
Authentication vs authorization
Login workflow
Sessions
Access-control concepts
Horizontal vs vertical access
How to identify authorization boundaries
Burp Repeater for controlled testing
Safe vulnerability analysis
Understanding impact
How developers fix access-control problems
Linux, Windows & macOS lab commands
🔐 LEARN → BUILD → OBSERVE → TEST AUTHORIZED LABS → UNDERSTAND → SECURE.
No comments:
Post a Comment