Chapter 55 — Project 3: break and fix a vulnerable application

Brief

Do a full security assessment of a deliberately-vulnerable app: find issues across every OWASP category, write them up like a professional report, then fix a representative subset in code with tests that prove closure — and re-test to confirm.

Target options (pick one, all legal to test)

   * OWASP Juice Shop        (Node/Angular; the reference target)
   * OWASP WebGoat           (Java; guided lessons)
   * DVWA / bWAPP            (PHP; classic)
   * a "vulnerable by design" app in YOUR stack (django-DefectDojo's
     test fixtures, RailsGoat, NodeGoat, etc.) -- best for the FIX phase

For the fix phase you need the source, so favour a target whose code you can edit and redeploy.

Phase 1 — Assess (use the Ch 48 methodology)

   Proxy everything through Burp/ZAP. Work the methodology: map -> auth &
   session -> access control -> input handling -> client-side -> business
   logic -> infra/misc.

   Find and evidence AT LEAST:
     [ ] 2x Injection (e.g. SQLi + command/NoSQL/SSTI)
     [ ] 2x XSS (two of reflected/stored/DOM)
     [ ] 2x Broken access control (IDOR + BFLA/mass-assignment/path-trav)
     [ ] 1x Authentication/session/JWT
     [ ] 1x CSRF or SSRF or CORS
     [ ] 1x Cryptographic failure (weak hash, missing TLS, secret in JS,
             predictable token)
     [ ] 1x Security misconfiguration (headers, exposed file, debug
             endpoint, default creds, verbose error)
     [ ] 1x Vulnerable component (retire.js / SCA)
     [ ] 1x Business-logic flaw (price tampering, coupon abuse, race,
             step-skipping)

Phase 2 — Report (this is a real skill)

One document, per-finding sections, ordered by risk:

   Title | Severity (CVSS v3.1 vector + score) + business impact
   Affected: endpoint(s), parameter(s), preconditions
   Steps to reproduce: numbered, copy-pasteable, with the exact
     request/response (redacted) as evidence
   Root cause: the actual code/config defect (name the class)
   Remediation: specific, with a code sketch and the relevant OWASP
     cheat-sheet link
   References: CWE id, OWASP, any CVE
   Retest: (filled in Phase 4)

   Plus: an executive summary (5 sentences, no jargon), a findings table,
   and a methodology/scope statement.

Phase 3 — Fix (in code)

Pick at least 5 findings spanning ≥4 categories and fix them properly in the source:

   Injection      -> parameterised queries / exec-array / sandboxed
                     template; NOT input filtering as the primary control.
   XSS            -> context-aware output encoding / framework autoescape +
                     a strict nonce CSP; DOMPurify for rich text.
   Access control -> ownership in the query; centralised authz guard;
                     field allowlist DTO; 404 not 403.
   Auth/JWT       -> pin alg, verify aud/iss/exp, rotate session on login,
                     Secure/HttpOnly/SameSite cookie.
   CSRF/SSRF      -> synchronizer token + SameSite; allowlist + post-
                     resolution IP check + no redirects.
   Crypto         -> Argon2id; TLS enforced; move the secret server-side.
   Misconfig      -> add the headers; remove the debug route; fix the error
                     handler; update the component.

   For each fix: write a TEST (unit or integration) that FAILS against the
   vulnerable code and PASSES after the fix. This is your regression proof.

Phase 4 — Re-test

Re-run each original exploit against the patched build. Fill in the "Retest" field: Fixed / Partially fixed / Not fixed, with evidence. Note any fix that broke functionality.

Deliverable

~/sec-lab/projects/p3-breakfix/ with: report.md (the full assessment), fixes/ (the patched source or a diff/patch set), tests/ (the regression tests), and retest.md.

Definition of done

• ≥12 findings across ≥6 OWASP categories, each with reproducible evidence.
• A report a stranger could act on: exec summary, findings table, CVSS, root cause, remediation, references.
• ≥5 findings fixed in code across ≥4 categories, using the correct control (not a filter/WAF band-aid).
• A failing-then-passing test for every fix.
• Re-test documented; no fix silently broke the app.

Rubric (/100)

   Coverage & correctness of findings ......... 25
   Evidence quality (reproducible, clear) .... 15
   Report professionalism (structure, CVSS,
     exec summary, remediation) .............. 20
   Fixes use the right control ............... 25
   Regression tests prove closure ........... 10
   Re-test rigour ........................... 5