Web application penetration test against OWASP Juice Shop

Orchard Labs puts every new tester through the same exercise before client work: a full penetration test of OWASP Juice Shop, a deliberately vulnerable web application built for training. The point is not to score points in the game; it is to work like a professional tester and produce a report a client would pay for.

You will test Juice Shop running on your own machine, so there is no question of touching a system you do not own. You will work to a scope, map the application, and then test for the common classes of web vulnerability: broken access control, injection, authentication weaknesses, and sensitive data exposure, among others. For each real finding you prove it with clear steps someone else can repeat, rate its severity using a standard method, and write a fix the development team could act on.

The deliverable is the report, because in this job the report is the product. A finding with no reliable steps to reproduce is worthless, and a severity rating with no reasoning is just an opinion. Done looks like at least 8 genuine vulnerabilities across at least 4 classes, each with evidence, a severity rating with its justification, and a concrete remediation. You also write a short methodology section so a reader knows what you did and did not test. Orchard Labs signs off when the report is something they could hand to a client with only light editing, and when a second tester can reproduce every finding from your steps alone.