Steps:
- Run OWASP Juice Shop (Docker: docker run --rm -p 3000:3000 bkimminich/juice-shop).
- Configure Burp Suite as your browser proxy. In Firefox: Manual proxy 127.0.0.1:8080.
- Explore the app and use Burp’s Proxy to capture requests. Practice: modify cookies, replay requests, inspect parameters.
- Try common tests: Broken access control, reflected XSS (inject <script>alert(1)</script> into search fields), insecure direct object references. Use Burp Intruder for parameter fuzzing (careful on rate).
What you’ll learn: proxy workflow, intercepting and manipulating requests, basic web vulnerabilities.
Safety: Only test intentionally vulnerable apps or systems with permission.
- Title: Safe SQL Injection Practice — DVWA + Parameterized Query Fixes
Post: Practice SQLi to understand both attack and defense.