# ZAP by Checkmarx Scanning Report

## Contents

## About This Report

### Report Parameters

#### Contexts

No contexts were selected, so all contexts were included by default.

#### Sites

The following sites were included:

- http://20.60.0.1:3000

(If no sites were selected, all sites were included by default.)

An included site must also be within one of the included contexts for its data to be included in the report.

#### Risk levels

Included: High, Medium, Low, Informational

Excluded: None

#### Confidence levels

Included: User Confirmed, High, Medium, Low

Excluded: User Confirmed, High, Medium, Low, False Positive

## Summaries

### Alert Counts by Risk and Confidence

This table shows the number of alerts for each level of risk and confidence included in the report.

(The percentages in brackets represent the count as a percentage of the total number of alerts included in the report, rounded to one decimal place.)

| Confidence
User Confirmed | High | Medium | Low | Total
--- | --- | --- | --- | ---
Risk | High | 0 (0.0%) | 0 (0.0%) | 0 (0.0%) | 1 (11.1%) | 1 (11.1%)
Medium | 0 (0.0%) | 2 (22.2%) | 2 (22.2%) | 0 (0.0%) | 4 (44.4%)
Low | 0 (0.0%) | 0 (0.0%) | 2 (22.2%) | 1 (11.1%) | 3 (33.3%)
Informational | 0 (0.0%) | 0 (0.0%) | 1 (11.1%) | 0 (0.0%) | 1 (11.1%)
Total | 0 (0.0%) | 2 (22.2%) | 5 (55.6%) | 2 (22.2%) | 9 (100%)

### Alert Counts by Site and Risk

This table shows, for each site for which one or more alerts were raised, the number of alerts raised at each risk level.

Alerts with a confidence level of "False Positive" have been excluded from these counts.

(The numbers in brackets are the number of alerts raised for the site at or above that risk level.)

| Risk
High (= High) | Medium (>= Medium) | Low (>= Low) | Informational (>= Informational)
--- | --- | --- | ---
Site | http://20.60.0.1:3000 | 1 (1) | 4 (5) | 3 (8) | 1 (9)

### Alert Counts by Alert Type

This table shows the number of alerts of each alert type, together with the alert type's risk level.

(The percentages in brackets represent each count as a percentage, rounded to one decimal place, of the total number of alerts included in this report.)

Alert type | Risk | Count
--- | --- | ---
SQL Injection | High | 1 (11.1%)
Content Security Policy (CSP) Header Not Set | Medium | 5 (55.6%)
Cross-Domain Misconfiguration | Medium | 5 (55.6%)
Missing Anti-clickjacking Header | Medium | 3 (33.3%)
Session ID in URL Rewrite | Medium | 5 (55.6%)
Private IP Disclosure | Low | 1 (11.1%)
Timestamp Disclosure - Unix | Low | 5 (55.6%)
X-Content-Type-Options Header Missing | Low | 5 (55.6%)
Modern Web Application | Informational | 5 (55.6%)
Total |  | 9

### Insights

This table shows information that is likely to be very relevant to you, but which is not related to vulnerabilities, or potentially even related to the application in question.

Level | Reason | Site | Description | Statistic
--- | --- | --- | --- | ---
Medium | Exceeded Low |  | Percentage of memory used | 83
Low | Warning |  | ZAP errors logged - see the zap.log file for details | 256
Low | Warning |  | ZAP warnings logged - see the zap.log file for details | 105
Info | Informational |  | Percentage of network failures | 2 %
Info | Informational | http://20.60.0.1:3000 | Percentage of responses with status code 1xx | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of responses with status code 2xx | 68 %
Info | Informational | http://20.60.0.1:3000 | Percentage of responses with status code 3xx | 28 %
Info | Informational | http://20.60.0.1:3000 | Percentage of responses with status code 4xx | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type application/javascript | 9 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type application/json | 4 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type application/octet-stream | 2 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type image/jpeg | 6 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type image/png | 3 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type image/x-icon | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type text/css | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type text/html | 66 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type text/markdown | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with content type text/plain | 1 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with method GET | 98 %
Info | Informational | http://20.60.0.1:3000 | Percentage of endpoints with method POST | 1 %
Info | Informational | http://20.60.0.1:3000 | Count of total endpoints | 171
Info | Informational | http://20.60.0.1:3000 | Percentage of slow responses | 42 %

## Alerts

1. ### Risk=High, Confidence=Low (1)

   1. #### http://20.60.0.1:3000 (1)

      1. ##### SQL Injection (1)

         1. GET http://20.60.0.1:3000/rest/products/search?q=%27%28

            Alert tags

            - POLICY_SEQUENCE =
            - OWASP_2021_A03
            - PCI_DSS
            - CWE-89
            - POLICY_QA_CICD =
            - POLICY_DEV_CICD =
            - OWASP_2025_A05
            - WSTG-v42-INPV-05
            - POLICY_API =
            - POLICY_DEV_FULL =
            - POLICY_QA_STD =
            - POLICY_QA_FULL =
            - POLICY_PENTEST =
            - HIPAA
            - OWASP_2017_A01
            - API_2023_API10
            - POLICY_DEV_STD =

            Alert description | SQL injection may be possible.

            Request

            Request line and header section (307 bytes)

                GET http://20.60.0.1:3000/rest/products/search?q=%27%28 HTTP/1.1
                host: 20.60.0.1:3000
                User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
                Accept: application/json, text/plain, */*
                Accept-Language: en-US,en;q=0.5
                Connection: keep-alive
                Referer: http://20.60.0.1:3000/

            Request body (0 bytes)

            Response

            Status line and header section (362 bytes)

                HTTP/1.1 500 Internal Server Error
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Content-Type: application/json; charset=utf-8
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:54:48 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5
                content-length: 309

            Response body (309 bytes)

                {
                  "error": {
                    "message": "SQLITE_ERROR: near \"(\": syntax error",
                    "stack": "Error: SQLITE_ERROR: near \"(\": syntax error",
                    "errno": 1,
                    "code": "SQLITE_ERROR",
                    "sql": "SELECT * FROM Products WHERE ((name LIKE '%'(%' OR description LIKE '%'(%') AND deletedAt IS NULL) ORDER BY name"
                  }
                }

            Parameter

                q

            Attack

                '(

            Evidence

                HTTP/1.1 500 Internal Server Error

            Solution

            Do not trust client side input, even if there is client side validation in place.

            In general, type check all data on the server side.

            If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'

            If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.

            If database Stored Procedures can be used, use them.

            Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!

            Do not create dynamic SQL queries using simple string concatenation.

            Escape all data received from the client.

            Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.

            Apply the principle of least privilege by using the least privileged database user possible.

            In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.

            Grant the minimum database access that is necessary for the application.

2. ### Risk=Medium, Confidence=High (2)

   1. #### http://20.60.0.1:3000 (2)

      1. ##### Content Security Policy (CSP) Header Not Set (1)

         1. GET http://20.60.0.1:3000

            Alert tags

            - OWASP_2021_A05
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - SYSTEMIC
            - CWE-693
            - OWASP_2017_A06
            - OWASP_2025_A02

            Alert description

            Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

            Request

            Request line and header section (228 bytes)

                GET http://20.60.0.1:3000 HTTP/1.1
                host: 20.60.0.1:3000
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
                pragma: no-cache
                cache-control: no-cache

            Request body (0 bytes)

            Response

            Status line and header section (467 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Accept-Ranges: bytes
                Cache-Control: public, max-age=0
                Last-Modified: Thu, 28 May 2026 13:41:08 GMT
                ETag: W/"26af-19e6ed14201"
                Content-Type: text/html; charset=UTF-8
                Content-Length: 9903
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:50:29 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (9903 bytes)

                <!--
                  ~ Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
                  ~ SPDX-License-Identifier: MIT
                  -->

                <!doctype html>
                <html lang="en" data-beasties-container>
                <head>
                  <meta charset="utf-8">
                  <title>OWASP Juice Shop</title>
                  <meta name="description" content="Probably the most modern and sophisticated insecure web application">
                  <meta name="viewport" content="width=device-width, initial-scale=1">
                  <link rel="preconnect" href="https://fonts.googleapis.com">
                  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
                  <style>@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isQFJXGdg.woff2) format('woff2');unicode-range:U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isRFJXGdg.woff2) format('woff2');unicode-range:U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isfFJU.woff2) format('woff2');unicode-range:U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}</style>
                  <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
                  <script>
                    window.addEventListener("load", function(){
                      window.cookieconsent.initialise({
                        "palette": {
                          "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
                          "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
                        },
                        "theme": "classic",
                        "position": "bottom-right",
                        "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" }
                      })});
                  </script>
                <style>.bluegrey-lightgreen-theme{--mat-sys-background:#121316;--mat-sys-error:#ffb4ab;--mat-sys-error-container:#93000a;--mat-sys-inverse-on-surface:#2f3033;--mat-sys-inverse-primary:#005cbb;--mat-sys-inverse-surface:#e3e2e6;--mat-sys-on-background:#e3e2e6;--mat-sys-on-error:#690005;--mat-sys-on-error-container:#ffdad6;--mat-sys-on-primary:#002f65;--mat-sys-on-primary-container:#d7e3ff;--mat-sys-on-primary-fixed:#001b3f;--mat-sys-on-primary-fixed-variant:#00458f;--mat-sys-on-secondary:#283041;--mat-sys-on-secondary-container:#dae2f9;--mat-sys-on-secondary-fixed:#131c2b;--mat-sys-on-secondary-fixed-variant:#3e4759;--mat-sys-on-surface:#e3e2e6;--mat-sys-on-surface-variant:#e0e2ec;--mat-sys-on-tertiary:#173800;--mat-sys-on-tertiary-container:#82ff10;--mat-sys-on-tertiary-fixed:#0b2000;--mat-sys-on-tertiary-fixed-variant:#245100;--mat-sys-outline:#8e9099;--mat-sys-outline-variant:#44474e;--mat-sys-primary:#abc7ff;--mat-sys-primary-container:#00458f;--mat-sys-primary-fixed:#d7e3ff;--mat-sys-primary-fixed-dim:#abc7ff;--mat-sys-scrim:#000000;--mat-sys-secondary:#bec6dc;--mat-sys-secondary-container:#3e4759;--mat-sys-secondary-fixed:#dae2f9;--mat-sys-secondary-fixed-dim:#bec6dc;--mat-sys-shadow:#000000;--mat-sys-surface:#121316;--mat-sys-surface-bright:#38393c;--mat-sys-surface-container:#1f2022;--mat-sys-surface-container-high:#292a2c;--mat-sys-surface-container-highest:#343537;--mat-sys-surface-container-low:#1a1b1f;--mat-sys-surface-container-lowest:#0d0e11;--mat-sys-surface-dim:#121316;--mat-sys-surface-tint:#abc7ff;--mat-sys-surface-variant:#44474e;--mat-sys-tertiary:#70e000;--mat-sys-tertiary-container:#245100;--mat-sys-tertiary-fixed:#82ff10;--mat-sys-tertiary-fixed-dim:#70e000;--mat-sys-neutral-variant20:#2d3038;--mat-sys-neutral10:#1a1b1f;--mat-sys-level0:0px 0px 0px 0px rgba(0, 0, 0, .2), 0px 0px 0px 0px rgba(0, 0, 0, .14), 0px 0px 0px 0px rgba(0, 0, 0, .12);--mat-sys-level1:0px 2px 1px -1px rgba(0, 0, 0, .2), 0px 1px 1px 0px rgba(0, 0, 0, .14), 0px 1px 3px 0px rgba(0, 0, 0, .12);--mat-sys-level2:0px 3px 3px -2px rgba(0, 0, 0, .2), 0px 3px 4px 0px rgba(0, 0, 0, .14), 0px 1px 8px 0px rgba(0, 0, 0, .12);--mat-sys-level3:0px 3px 5px -1px rgba(0, 0, 0, .2), 0px 6px 10px 0px rgba(0, 0, 0, .14), 0px 1px 18px 0px rgba(0, 0, 0, .12);--mat-sys-level4:0px 5px 5px -3px rgba(0, 0, 0, .2), 0px 8px 10px 1px rgba(0, 0, 0, .14), 0px 3px 14px 2px rgba(0, 0, 0, .12);--mat-sys-level5:0px 7px 8px -4px rgba(0, 0, 0, .2), 0px 12px 17px 2px rgba(0, 0, 0, .14), 0px 5px 22px 4px rgba(0, 0, 0, .12);--mat-sys-corner-extra-large:28px;--mat-sys-corner-extra-large-top:28px 28px 0 0;--mat-sys-corner-extra-small:4px;--mat-sys-corner-extra-small-top:4px 4px 0 0;--mat-sys-corner-full:9999px;--mat-sys-corner-large:16px;--mat-sys-corner-large-end:0 16px 16px 0;--mat-sys-corner-large-start:16px 0 0 16px;--mat-sys-corner-large-top:16px 16px 0 0;--mat-sys-corner-medium:12px;--mat-sys-corner-none:0;--mat-sys-corner-small:8px;--mat-sys-dragged-state-layer-opacity:.16;--mat-sys-focus-state-layer-opacity:.12;--mat-sys-hover-state-layer-opacity:.08;--mat-sys-pressed-state-layer-opacity:.12;color:var(--mat-sys-on-surface);background-color:var(--mat-sys-surface)}html{font-family:var(--mat-sys-body-medium-font, Roboto, "Helvetica Neue", sans-serif)}.bluegrey-lightgreen-theme{--theme-primary:#438fff;--theme-primary-lighter:rgb(97.6, 161.229787234, 255);--theme-primary-light:rgb(118, 173.3829787234, 255);--theme-primary-darker:rgb(36.4, 124.770212766, 255);--theme-primary-dark:rgb(16, 112.6170212766, 255);--theme-primary-fade-10:#438fff;--theme-primary-fade-20:#438fff;--theme-primary-fade-30:#438fff;--theme-primary-fade-40:#438fff;--theme-primary-fade-50:#438fff;--theme-accent:#50a400;--theme-accent-lighter:rgb(94.9268292683, 194.6, 0);--theme-accent-light:rgb(104.8780487805, 215, 0);--theme-accent-darker:rgb(65.0731707317, 133.4, 0);--theme-accent-dark:rgb(55.1219512195, 113, 0);--theme-accent-fade-10:#50a400;--theme-accent-fade-20:#50a400;--theme-accent-fade-30:#50a400;--theme-accent-fade-40:#50a400;--theme-accent-fade-50:#50a400;--theme-warn:#ffb4ab;--theme-warn-lighter:rgb(255, 207.3214285714, 201.6);--theme-warn-light:rgb(255, 225.5357142857, 222);--theme-warn-darker:rgb(255, 152.6785714286, 140.4);--theme-warn-dark:rgb(255, 134.4642857143, 120);--theme-warn-fade-10:#ffb4ab;--theme-warn-fade-20:#ffb4ab;--theme-warn-fade-30:#ffb4ab;--theme-warn-fade-40:#ffb4ab;--theme-warn-fade-50:#ffb4ab;--theme-text:#e3e2e6;--theme-text-lighter:rgb(242.8666666667, 242.4333333333, 244.1666666667);--theme-text-light:rgb(253.4444444444, 253.3888888889, 253.6111111111);--theme-text-darker:rgb(200.5555555556, 198.6111111111, 206.3888888889);--theme-text-dark:rgb(160.8888888889, 157.5277777778, 170.9722222222);--theme-text-fade-10:#e3e2e6;--theme-text-fade-20:#e3e2e6;--theme-text-fade-30:#e3e2e6;--theme-text-fade-40:#e3e2e6;--theme-text-fade-50:#e3e2e6;--theme-text-invert-15:rgb(197.15, 196.45, 199.25);--theme-text-invert-30:rgb(167.3, 166.9, 168.5);--theme-background:#1f2022;--theme-background-lighter:rgb(45.5938461538, 47.0646153846, 50.0061538462);--theme-background-light:rgb(55.3230769231, 57.1076923077, 60.6769230769);--theme-background-darker:rgb(16.4061538462, 16.9353846154, 17.9938461538);--theme-background-dark:rgb(6.6769230769, 6.8923076923, 7.3230769231);--theme-background-darkest:hsl(220, 4.6153846154%, -1.2549019608%);--theme-thumbnail-border:1px solid #abc7ff;--mdc-filled-text-field-container-color:#0000;--mdc-filled-text-field-disabled-container-color:#0000;--theme-background:#3e3e3e;--theme-background-lighter:#4a4a4a;--theme-background-light:#5a5a5a;--theme-background-darker:#333638;--theme-background-dark:#303030;--theme-background-darkest:#2b2b2b;--theme-text:#e8ecef;--theme-text-lighter:#f2f5f7;--theme-text-light:#fff;--theme-text-darker:#b8c0c7;--theme-text-dark:#7f8a93;--mat-sys-surface:#333638;--mat-sys-on-surface:#e8ecef;--mat-sys-surface-container:#3e3e3e;--mat-sys-surface-container-high:#404244;--mat-sys-on-surface-variant:#b8c0c7;--mat-sys-outline:#5a5a5a;--mat-sys-outline-variant:#404244}.bluegrey-lightgreen-theme{--theme-warn:#f44336;--theme-warn-lighter:rgb(245.5877358491, 94.1358490566, 83.0122641509);--theme-warn-light:rgb(246.6462264151, 112.2264150943, 102.3537735849);--theme-warn-darker:rgb(242.4122641509, 39.8641509434, 24.9877358491);--theme-warn-dark:rgb(234.1839622642, 27.9622641509, 12.8160377358);--theme-warn-fade-10:#f44336;--theme-warn-fade-20:#f44336;--theme-warn-fade-30:#f44336;--theme-warn-fade-40:#f44336;--theme-warn-fade-50:#f44336;--mat-sys-error:#f44336;--mat-sys-on-error:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head>
                <body class="bluegrey-lightgreen-theme">
                  <app-root></app-root>
                <link rel="modulepreload" href="chunk-SCY7YOCS.js"><link rel="modulepreload" href="chunk-PX7UKXVL.js"><link rel="modulepreload" href="chunk-GNBEOV4E.js"><link rel="modulepreload" href="chunk-7O3TTE7G.js"><link rel="modulepreload" href="chunk-JCQ5N7PA.js"><link rel="modulepreload" href="chunk-UNFVUBM2.js"><link rel="modulepreload" href="chunk-524KQQJQ.js"><link rel="modulepreload" href="chunk-SI2GTEZM.js"><link rel="modulepreload" href="chunk-ZO2KHBRB.js"><link rel="modulepreload" href="chunk-7AKA75AX.js"><script src="polyfills.js" type="module"></script><script src="scripts.js" defer></script><script src="main.js" type="module"></script></body>
                </html>

            Solution | Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.

      2. ##### Session ID in URL Rewrite (1)

         1. POST http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=PvksdH8&sid=DDmfHO9swhgnxBKzAAAA

            Alert tags

            - CWE-598
            - OWASP_2021_A01
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - SYSTEMIC
            - WSTG-v42-SESS-04
            - OWASP_2017_A03
            - OWASP_2025_A01
            - POLICY_DEV_STD =

            Alert description | URL rewrite is used to track user session ID. The session ID may be disclosed via cross-site referer header. In addition, the session ID might be stored in browser history or server logs.

            Request

            Request line and header section (408 bytes)

                POST http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=PvksdH8&sid=DDmfHO9swhgnxBKzAAAA HTTP/1.1
                host: 20.60.0.1:3000
                User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
                Accept: */*
                Accept-Language: en-US,en;q=0.5
                Content-type: text/plain;charset=UTF-8
                Content-Length: 2
                Origin: http://20.60.0.1:3000
                Connection: keep-alive
                Referer: http://20.60.0.1:3000/

            Request body (2 bytes)

                40

            Response

            Status line and header section (213 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: http://localhost:4200
                Vary: Origin
                Content-Type: text/html
                Content-Length: 2
                Date: Thu, 28 May 2026 13:51:12 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (2 bytes)

                ok

            Parameter

                sid

            Evidence

                DDmfHO9swhgnxBKzAAAA

            Solution | For secure content, put session ID in a cookie. To be even more secure consider using a combination of cookie and URL rewrite.

3. ### Risk=Medium, Confidence=Medium (2)

   1. #### http://20.60.0.1:3000 (2)

      1. ##### Cross-Domain Misconfiguration (1)

         1. GET http://20.60.0.1:3000/robots.txt

            Alert tags

            - OWASP_2021_A01
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - SYSTEMIC
            - OWASP_2025_A01
            - OWASP_2017_A05
            - CWE-264

            Alert description | Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.

            Other info

            The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.

            Request

            Request line and header section (239 bytes)

                GET http://20.60.0.1:3000/robots.txt HTTP/1.1
                host: 20.60.0.1:3000
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
                pragma: no-cache
                cache-control: no-cache

            Request body (0 bytes)

            Response

            Status line and header section (378 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Content-Type: text/plain; charset=utf-8
                Content-Length: 28
                ETag: W/"1c-8HgF6mNyhsSFK0pascC9uB0wjX0"
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:50:30 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (28 bytes)

                User-agent: *
                Disallow: /ftp

            Evidence

                Access-Control-Allow-Origin: *

            Solution | Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance). Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.

      2. ##### Missing Anti-clickjacking Header (1)

         1. POST http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=PvksdH8&sid=DDmfHO9swhgnxBKzAAAA

            Alert tags

            - OWASP_2021_A05
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - CWE-1021
            - SYSTEMIC
            - WSTG-v42-CLNT-09
            - OWASP_2017_A06
            - OWASP_2025_A02

            Alert description | The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.

            Request

            Request line and header section (408 bytes)

                POST http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=PvksdH8&sid=DDmfHO9swhgnxBKzAAAA HTTP/1.1
                host: 20.60.0.1:3000
                User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
                Accept: */*
                Accept-Language: en-US,en;q=0.5
                Content-type: text/plain;charset=UTF-8
                Content-Length: 2
                Origin: http://20.60.0.1:3000
                Connection: keep-alive
                Referer: http://20.60.0.1:3000/

            Request body (2 bytes)

                40

            Response

            Status line and header section (213 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: http://localhost:4200
                Vary: Origin
                Content-Type: text/html
                Content-Length: 2
                Date: Thu, 28 May 2026 13:51:12 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (2 bytes)

                ok

            Parameter

                x-frame-options

            Solution

            Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.

            If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.

4. ### Risk=Low, Confidence=Medium (2)

   1. #### http://20.60.0.1:3000 (2)

      1. ##### Private IP Disclosure (1)

         1. GET http://20.60.0.1:3000/rest/admin/application-configuration

            Alert tags

            - OWASP_2021_A01
            - OWASP_2017_A03
            - OWASP_2025_A01
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - CWE-497

            Alert description | A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.
            Other info | 192.168.99.100:3000 192.168.99.100:4200

            Request

            Request line and header section (314 bytes)

                GET http://20.60.0.1:3000/rest/admin/application-configuration HTTP/1.1
                host: 20.60.0.1:3000
                User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
                Accept: application/json, text/plain, */*
                Accept-Language: en-US,en;q=0.5
                Connection: keep-alive
                Referer: http://20.60.0.1:3000/

            Request body (0 bytes)

            Response

            Status line and header section (389 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Content-Type: application/json; charset=utf-8
                Content-Length: 23513
                ETag: W/"5bd9-reVonwE2GOcMzw2LpzIkSqyB2OE"
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:51:11 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (23513 bytes)

                {"config":{"server":{"port":3000,"basePath":"","baseUrl":"http://localhost:3000"},"application":{"domain":"juice-sh.op","name":"OWASP Juice Shop","logo":"JuiceShop_Logo.png","favicon":"favicon_js.ico","theme":"bluegrey-lightgreen","showVersionNumber":true,"showGitHubLinks":true,"localBackupEnabled":true,"numberOfRandomFakeUsers":0,"altcoinName":"Juicycoin","privacyContactEmail":"donotreply@owasp-juice.shop","customMetricsPrefix":"juiceshop","chatBot":{"name":"Juicy the Smart Assistant","avatar":"JuicyChatBot.png","model":"gemma4:e4b","llmMaxRetries":2,"sampleQuestions":["CHATBOT_PROMPT_RECOMMENDATION_SUMMER_PARTY","CHATBOT_PROMPT_RECOMMENDATION_POPULAR","CHATBOT_PROMPT_RECOMMENDATION_SUGAR_FREE","CHATBOT_PROMPT_RECOMMENDATION_START_DAY","CHATBOT_PROMPT_RECOMMENDATION_SEASONAL"]},"social":{"blueSkyUrl":"https://bsky.app/profile/owasp-juice.shop","mastodonUrl":"https://fosstodon.org/@owasp_juiceshop","twitterUrl":"https://twitter.com/owasp_juiceshop","facebookUrl":"https://www.facebook.com/owasp.juiceshop","slackUrl":"https://owasp.org/slack/invite","redditUrl":"https://www.reddit.com/r/owasp_juiceshop","pressKitUrl":"https://github.com/OWASP/owasp-swag/tree/master/projects/juice-shop","nftUrl":"https://opensea.io/collection/juice-shop","questionnaireUrl":null},"recyclePage":{"topProductImage":"fruit_press.jpg","bottomProductImage":"apple_pressings.jpg"},"welcomeBanner":{"showOnFirstStart":true,"title":"Welcome to OWASP Juice Shop!","message":"<p>Being a web application with a vast number of intended security vulnerabilities, the <strong>OWASP Juice Shop</strong> is supposed to be the opposite of a best practice or template application for web developers: It is an awareness, training, demonstration and exercise tool for security risks in modern web applications. The <strong>OWASP Juice Shop</strong> is an open-source project hosted by the non-profit <a href='https://owasp.org' target='_blank'>Open Worldwide Application Security Project (OWASP)</a> and is developed and maintained by volunteers. Check out the link below for more information and documentation on the project.</p><h1><a href='https://owasp-juice.shop' target='_blank'>https://owasp-juice.shop</a></h1>"},"cookieConsent":{"message":"This website uses fruit cookies to ensure you get the juiciest tracking experience.","dismissText":"Me want it!","linkText":"But me wait!","linkUrl":"https://www.youtube.com/watch?v=9PnbKL3wuH4"},"securityTxt":{"contact":"mailto:donotreply@owasp-juice.shop","encryption":"https://keybase.io/bkimminich/pgp_keys.asc?fingerprint=19c01cb7157e4645e9e2c863062a85a8cbfbdcda","acknowledgements":"/#/score-board","hiring":"/#/jobs","csaf":"/.well-known/csaf/provider-metadata.json"},"promotion":{"video":"owasp_promo.mp4","subtitles":"owasp_promo.vtt"},"easterEggPlanet":{"name":"Orangeuze","overlayMap":"orangemap2k.avif"},"googleOauth":{"clientId":"1005568560502-6hm16lef8oh46hr2d98vf2ohlnj4nfhq.apps.googleusercontent.com","authorizedRedirects":[{"uri":"https://demo.owasp-juice.shop"},{"uri":"https://juice-shop.herokuapp.com"},{"uri":"https://preview.owasp-juice.shop"},{"uri":"https://juice-shop-staging.herokuapp.com"},{"uri":"https://juice-shop.wtf"},{"uri":"http://localhost:3000","proxy":"https://local3000.owasp-juice.shop"},{"uri":"http://127.0.0.1:3000","proxy":"https://local3000.owasp-juice.shop"},{"uri":"http://localhost:4200","proxy":"https://local4200.owasp-juice.shop"},{"uri":"http://127.0.0.1:4200","proxy":"https://local4200.owasp-juice.shop"},{"uri":"http://192.168.99.100:3000","proxy":"https://localmac.owasp-juice.shop"},{"uri":"http://192.168.99.100:4200","proxy":"https://localmac.owasp-juice.shop"},{"uri":"http://penguin.termina.linux.test:3000","proxy":"https://localchromeos.owasp-juice.shop"},{"uri":"http://penguin.termina.linux.test:4200","proxy":"https://localchromeos.owasp-juice.shop"}]}},"challenges":{"showSolvedNotifications":true,"showHints":true,"showMitigations":true,"codingChallengesEnabled":"solved","restrictToTutorialsFirst":false,"overwriteUrlForProductTamperingChallenge":"https://owasp.slack.com","xssBonusPayload":"<iframe width=\"100%\" height=\"166\" scrolling=\"no\" frameborder=\"no\" allow=\"autoplay\" src=\"https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/771984076&color=%23ff5500&auto_play=true&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true\"></iframe>","safetyMode":"auto","csafHashValue":"7e7ce7c65db3bf0625fcea4573d25cff41f2f7e3474f2c74334b14fc65bb4fd26af802ad17a3a03bf0eee6827a00fb8f7905f338c31b5e6ea9cb31620242e843","metricsIgnoredUserAgents":["Prometheus","Alloy","promscrape","otelcol"]},"hackingInstructor":{"isEnabled":true,"avatarImage":"JuicyBot.png","hintPlaybackSpeed":"normal"},"products":[{"name":"Apple Juice (1000ml)","price":1.99,"deluxePrice":0.99,"limitPerUser":5,"description":"The all-time classic.","image":"apple_juice.jpg","reviews":[{"text":"One of my favorites!","author":"admin"},{"text":"Great! We'll have an apple party. Everyone brings an apple and - STUFFS IT DOWN EACH OTHER'S THROAT!","author":"basil"}]},{"name":"Orange Juice (1000ml)","description":"Made from oranges hand-picked by Uncle Dittmeyer.","price":2.99,"deluxePrice":2.49,"image":"orange_juice.jpg","reviews":[{"text":"y0ur f1r3wall needs m0r3 musc13","author":"uvogin"}]},{"name":"Eggfruit Juice (500ml)","description":"Now with even more exotic flavour.","price":8.99,"image":"eggfruit_juice.jpg","reviews":[{"text":"I bought it, would buy again. 5/7","author":"admin"}]},{"name":"Raspberry Juice (1000ml)","description":"Made from blended Raspberry Pi, water and sugar.","price":4.99,"image":"raspberry_juice.jpg"},{"name":"Lemon Juice (500ml)","description":"Sour but full of vitamins.","price":2.99,"deluxePrice":1.99,"limitPerUser":5,"image":"lemon_juice.jpg"},{"name":"Banana Juice (1000ml)","description":"Monkeys love it the most.","price":1.99,"image":"banana_juice.jpg","reviews":[{"text":"Fry liked it too.","author":"bender"}]},{"name":"OWASP Juice Shop T-Shirt","description":"Real fans wear it 24/7!","price":22.49,"limitPerUser":5,"image":"fan_shirt.jpg"},{"name":"OWASP Juice Shop CTF Girlie-Shirt","description":"For serious Capture-the-Flag heroines only!","price":22.49,"image":"fan_girlie.jpg"},{"name":"OWASP SSL Advanced Forensic Tool (O-Saft)","description":"O-Saft is an easy to use tool to show information about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations.","price":0.01,"image":"orange_juice.jpg","urlForProductTamperingChallenge":"https://www.owasp.org/index.php/O-Saft"},{"name":"Christmas Super-Surprise-Box (2014 Edition)","description":"Contains a random selection of 10 bottles (each 500ml) of our tastiest juices and an extra fan shirt for an unbeatable price!","price":29.99,"image":"undefined.jpg","useForChristmasSpecialChallenge":true},{"name":"Rippertuer Special Juice","description":"Contains a magical collection of the rarest fruits gathered from all around the world, like Cherymoya Annona cherimola, Jabuticaba Myrciaria cauliflora, Bael Aegle marmelos... and others, at an unbelievable price! <br/><span style=\"color:red;\">This item has been made unavailable because of lack of safety standards.</span>","price":16.99,"image":"undefined.jpg","keywordsForPastebinDataLeakChallenge":["hueteroneel","eurogium edule"]},{"name":"OWASP Juice Shop Sticker (2015/2016 design)","description":"Die-cut sticker with the official 2015/2016 logo. By now this is a rare collectors item. <em>Out of stock!</em>","price":999.99,"image":"sticker.png","deletedDate":"2017-04-28"},{"name":"OWASP Juice Shop Iron-Ons (16pcs)","description":"Upgrade your clothes with washer safe <a href=\"https://www.stickeryou.com/products/owasp-juice-shop/794\" target=\"_blank\">iron-ons</a> of the OWASP Juice Shop or CTF Extension logo!","price":14.99,"image":"iron-on.jpg"},{"name":"OWASP Juice Shop Magnets (16pcs)","description":"Your fridge will be even cooler with these OWASP Juice Shop or CTF Extension logo <a href=\"https://www.stickeryou.com/products/owasp-juice-shop/794\" target=\"_blank\">magnets</a>!","price":15.99,"image":"magnets.jpg"},{"name":"OWASP Juice Shop Sticker Page","description":"Massive decoration opportunities with these OWASP Juice Shop or CTF Extension <a href=\"https://www.stickeryou.com/products/owasp-juice-shop/794\" target=\"_blank\">sticker pages</a>! Each page has 16 stickers on it.","price":9.99,"image":"sticker_page.jpg"},{"name":"OWASP Juice Shop Sticker Single","description":"Super high-quality vinyl <a href=\"https://www.stickeryou.com/products/owasp-juice-shop/794\" target=\"_blank\">sticker single</a> with the OWASP Juice Shop or CTF Extension logo! The ultimate laptop decal!","price":4.99,"image":"sticker_single.jpg"},{"name":"OWASP Juice Shop Temporary Tattoos (16pcs)","description":"Get one of these <a href=\"https://www.stickeryou.com/products/owasp-juice-shop/794\" target=\"_blank\">temporary tattoos</a> to proudly wear the OWASP Juice Shop or CTF Extension logo on your skin! If you tweet a photo of yourself with the tattoo, you get a couple of our stickers for free! Please mention <a href=\"https://twitter.com/owasp_juiceshop\" target=\"_blank\"><code>@owasp_juiceshop</code></a> in your tweet!","price":14.99,"image":"tattoo.jpg","reviews":[{"text":"I straight-up gots nuff props fo'these tattoos!","author":"rapper"}]},{"name":"OWASP Juice Shop Mug","description":"Black mug with regular logo on one side and CTF logo on the other! Your colleagues will envy you!","price":21.99,"image":"fan_mug.jpg"},{"name":"OWASP Juice Shop Hoodie","description":"Mr. Robot-style apparel. But in black. And with logo.","price":49.99,"image":"fan_hoodie.jpg"},{"name":"OWASP Juice Shop-CTF Velcro Patch","description":"4x3.5\" embroidered patch with velcro backside. The ultimate decal for every tactical bag or backpack!","price":2.92,"quantity":5,"limitPerUser":5,"image":"velcro-patch.jpg","reviews":[{"text":"This thang would look phat on Bobby's jacked fur coat!","author":"rapper"},{"text":"Looks so much better on my uniform than the boring Starfleet symbol.","author":"jim"}]},{"name":"Woodruff Syrup \"Forest Master X-Treme\"","description":"Harvested and manufactured in the Black Forest, Germany. Can cause hyperactive behavior in children. Can cause permanent green tongue when consumed undiluted.","price":6.99,"image":"woodruff_syrup.jpg"},{"name":"Green Smoothie","description":"Looks poisonous but is actually very good for your health! Made from green cabbage, spinach, kiwi and grass.","price":1.99,"image":"green_smoothie.jpg","reviews":[{"text":"Fresh out of a replicator.","author":"jim"}]},{"name":"Quince Juice (1000ml)","description":"Juice of the <em>Cydonia oblonga</em> fruit. Not exactly sweet but rich in Vitamin C.","price":4.99,"image":"quince.jpg"},{"name":"Apple Pomace","description":"Finest pressings of apples. Allergy disclaimer: Might contain traces of worms. Can be <a href=\"/#recycle\">sent back to us</a> for recycling.","price":0.89,"limitPerUser":5,"image":"apple_pressings.jpg"},{"name":"Fruit Press","description":"Fruits go in. Juice comes out. Pomace you can send back to us for recycling purposes.","price":89.99,"image":"fruit_press.jpg"},{"name":"OWASP Juice Shop Logo (3D-printed)","description":"This rare item was designed and handcrafted in Sweden. This is why it is so incredibly expensive despite its complete lack of purpose.","price":99.99,"image":"3d_keychain.jpg","fileForRetrieveBlueprintChallenge":"JuiceShop.stl","exifForBlueprintChallenge":["OpenSCAD"]},{"name":"Juice Shop Artwork","description":"Unique masterpiece painted with different kinds of juice on 90g/m² lined paper.","price":278.74,"quantity":0,"image":"artwork.jpg","deletedDate":"2020-12-24"},{"name":"Global OWASP WASPY Award 2017 Nomination","description":"Your chance to nominate up to three quiet pillars of the OWASP community ends 2017-06-30! <a href=\"https://www.owasp.org/index.php/WASPY_Awards_2017\">Nominate now!</a>","price":0.03,"image":"waspy.png","deletedDate":"2017-07-01"},{"name":"Strawberry Juice (500ml)","description":"Sweet & tasty!","price":3.99,"image":"strawberry_juice.jpeg"},{"name":"Carrot Juice (1000ml)","description":"As the old German saying goes: \"Carrots are good for the eyes. Or has anyone ever seen a rabbit with glasses?\"","price":2.99,"image":"carrot_juice.jpeg","reviews":[{"text":"0 st4rs f0r 7h3 h0rr1bl3 s3cur17y","author":"uvogin"}]},{"name":"OWASP Juice Shop Sweden Tour 2017 Sticker Sheet (Special Edition)","description":"10 sheets of Sweden-themed stickers with 15 stickers on each.","price":19.1,"image":"stickersheet_se.png","deletedDate":"2017-09-20"},{"name":"Pwning OWASP Juice Shop","description":"<em>The official Companion Guide</em> by Björn Kimminich available <a href=\"https://leanpub.com/juice-shop\">for free on LeanPub</a> and also <a href=\"https://pwning.owasp-juice.shop\">readable online</a>!","price":5.99,"image":"cover_small.jpg","reviews":[{"text":"Even more interesting than watching Interdimensional Cable!","author":"morty"}]},{"name":"Melon Bike (Comeback-Product 2018 Edition)","description":"The wheels of this bicycle are made from real water melons. You might not want to ride it up/down the curb too hard.","price":2999,"quantity":3,"limitPerUser":1,"image":"melon_bike.jpeg"},{"name":"OWASP Juice Shop Coaster (10pcs)","description":"Our 95mm circle coasters are printed in full color and made from thick, premium coaster board.","price":19.99,"quantity":0,"image":"coaster.jpg"},{"name":"OWASP Snakes and Ladders - Web Applications","description":"This amazing web application security awareness board game is <a href=\"https://steamcommunity.com/sharedfiles/filedetails/?id=1969196030\">available for Tabletop Simulator on Steam Workshop</a> now!","price":0.01,"quantity":8,"image":"snakes_ladders.jpg","reviews":[{"text":"Wait for a 10$ Steam sale of Tabletop Simulator!","author":"bjoernOwasp"}]},{"name":"OWASP Snakes and Ladders - Mobile Apps","description":"This amazing mobile app security awareness board game is <a href=\"https://steamcommunity.com/sharedfiles/filedetails/?id=1970691216\">available for Tabletop Simulator on Steam Workshop</a> now!","price":0.01,"quantity":0,"image":"snakes_ladders_m.jpg","reviews":[{"text":"Here yo' learn how tha fuck ta not show yo' goddamn phone on camera!","author":"rapper"}]},{"name":"OWASP Juice Shop Holographic Sticker","description":"Die-cut holographic sticker. Stand out from those 08/15-sticker-covered laptops with this shiny beacon of 80's coolness!","price":2,"quantity":0,"image":"holo_sticker.png","reviews":[{"text":"Rad, dude!","author":"rapper"},{"text":"Looks spacy on Bones' new tricorder!","author":"jim"},{"text":"Will put one on the Planet Express ship's bumper!","author":"bender"}]},{"name":"OWASP Juice Shop \"King of the Hill\" Facemask","description":"Facemask with compartment for filter from 50% cotton and 50% polyester.","price":13.49,"quantity":0,"limitPerUser":1,"image":"fan_facemask.jpg","reviews":[{"text":"K33p5 y0ur ju1cy 5plu773r 70 y0ur53lf!","author":"uvogin"},{"text":"Puny mask for puny human weaklings!","author":"bender"}]},{"name":"Juice Shop Adversary Trading Card (Common)","description":"Common rarity \"Juice Shop\" card for the <a href=\"https://docs.google.com/forms/d/e/1FAIpQLSecLEakawSQ56lBe2JOSbFwFYrKDCIN7Yd3iHFdQc5z8ApwdQ/viewform\">Adversary Trading Cards</a> CCG.","price":2.99,"deluxePrice":0.99,"deletedDate":"2020-11-30","limitPerUser":5,"image":"ccg_common.png","reviews":[{"text":"Ooooh, puny human playing Mau Mau, now?","author":"bender"}]},{"name":"Juice Shop Adversary Trading Card (Super Rare)","description":"Super rare \"Juice Shop\" card with holographic foil-coating for the <a href=\"https://docs.google.com/forms/d/e/1FAIpQLSecLEakawSQ56lBe2JOSbFwFYrKDCIN7Yd3iHFdQc5z8ApwdQ/viewform\">Adversary Trading Cards</a> CCG.","price":99.99,"deluxePrice":69.99,"deletedDate":"2020-11-30","quantity":2,"limitPerUser":1,"image":"ccg_foil.png","reviews":[{"text":"Mau Mau with bling-bling? Humans are so pathetic!","author":"bender"}]},{"name":"Juice Shop \"Permafrost\" 2020 Edition","description":"Exact version of <a href=\"https://github.com/juice-shop/juice-shop/releases/tag/v9.3.1-PERMAFROST\">OWASP Juice Shop that was archived on 02/02/2020</a> by the GitHub Archive Program and ultimately went into the <a href=\"https://github.blog/2020-07-16-github-archive-program-the-journey-of-the-worlds-open-source-code-to-the-arctic\">Arctic Code Vault</a> on July 8. 2020 where it will be safely stored for at least 1000 years.","price":9999.99,"quantity":1,"limitPerUser":1,"image":"permafrost.jpg","reviews":[{"text":"🧊 Let it go, let it go 🎶 Can't hold it back anymore 🎶 Let it go, let it go 🎶 Turn away and slam the door ❄️","author":"rapper"}]},{"name":"Best Juice Shop Salesman Artwork","description":"Unique digital painting depicting Stan, our most qualified and almost profitable salesman. He made a succesful carreer in selling used ships, coffins, krypts, crosses, real estate, life insurance, restaurant supplies, voodoo enhanced asbestos and courtroom souvenirs before <em>finally</em> adding his expertise to the Juice Shop marketing team.","price":5000,"quantity":1,"image":"artwork2.jpg","reviews":[{"text":"I'd stand on my head to make you a deal for this piece of art.","author":"stan"},{"text":"Just when my opinion of humans couldn't get any lower, along comes Stan...","author":"bender"}]},{"name":"OWASP Juice Shop Card (non-foil)","description":"Mythic rare <small><em>(obviously...)</em></small> card \"OWASP Juice Shop\" with three distinctly useful abilities. Alpha printing, mint condition. A true collectors piece to own!","price":1000,"quantity":3,"limitPerUser":1,"image":"card_alpha.jpg","reviews":[{"text":"DO NOT PLAY WITH THIS! Double-sleeve, then put it in the GitHub Arctic Vault for perfect preservation and boost of secondary market value!","author":"accountant"}]},{"name":"20th Anniversary Celebration Ticket","description":"Get your <a href=\"https://20thanniversary.owasp.org/\" target=\"_blank\">free 🎫 for OWASP 20th Anniversary Celebration</a> online conference! Hear from world renowned keynotes and special speakers, network with your peers and interact with our event sponsors. With an anticipated 10k+ attendees from around the world, you will not want to miss this live on-line event!","price":1e-20,"deletedDate":"2021-09-25","limitPerUser":1,"image":"20th.jpeg","reviews":[{"text":"I'll be there! Will you, too?","author":"bjoernOwasp"}]},{"name":"OWASP Juice Shop LEGO™ Tower","description":"Want to host a Juice Shop CTF in style? Build <a href=\"https://github.com/OWASP/owasp-swag/blob/master/projects/juice-shop/lego/OWASP%20JuiceShop%20Pi-server%201.2.pdf\" target=\"_blank\">your own LEGO™ tower</a> which holds four Raspberry Pi 4 models with PoE HAT modules <a href=\"https://github.com/juice-shop/multi-juicer/blob/main/guides/raspberry-pi/raspberry-pi.md\" target=\"_blank\">running a MultiJuicer Kubernetes cluster</a>! Wire to a switch and connect to your network to have an out-of-the-box ready CTF up in no time!","price":799,"quantity":3,"limitPerUser":1,"image":"lego_case.jpg","reviews":[{"text":"Check out the /#/photo-wall for some impressions of the assembly process!","author":"bjoernOwasp"}]},{"name":"DSOMM & Juice Shop User Day Ticket","description":"You are going to the OWASP Global AppSec San Francisco 2024? <a href=\"https://www.eventbrite.com/e/owasp-global-appsec-san-francisco-2024-tickets-723699172707\" target=\"_blank\">Get a ticket<sup>*</sup></a> for this amazing side event as well! Check the juice-packed agenda <a href=\"https://owasp.org/www-project-juice-shop/#div-userday2024\" target=\"_blank\">here</a> for all the details!<br><br><small><small><sup>*</sup>=scroll down to <strong>Elevate: DSOMM and Juice Shop User Day (Sept. 25)</strong> after clicking <em>Get Tickets</em> on Eventbrite. Ticket price set to only covers fees for room, AV, and catering throughout the day.</small></small>","price":55.2,"deletedDate":"2024-09-26","limitPerUser":1,"image":"user_day_ticket.png","reviews":[{"text":"The DSOMM Live Assessment session will even use Juice Shop as its \"real-world\" example!","author":"timo"},{"text":"We will showcase the amazing MultiJuicer Lego Tower at this event!","author":"jannik"}]},{"name":"Pineapple Juice (1000ml)","description":"Tropical refreshment from the finest sun-ripened pineapples.","price":2.99,"image":"pineapple_juice.png"},{"name":"Melon Juice (1000ml)","description":"Refreshing and sweet juice made from ripe melons.","price":2.49,"image":"melon_juice.png"},{"name":"Grape Juice (1000ml)","description":"Deep purple and full of antioxidants from selected grapes.","price":2.99,"image":"grape_juice.png"},{"name":"Dragonfruit Juice (500ml)","description":"Exotic and vibrant juice made from dragonfruit.","price":3.99,"image":"dragonfruit_juice.png"},{"name":"Berry Juice (1000ml)","description":"A delicious blend of fresh forest berries.","price":3.49,"image":"berry_juice.png"},{"name":"Basil Smoothie","description":"A unique blend of fresh basil and ginger for a healthy kick.","price":2.99,"image":"basil_smoothie.png","reviews":[{"text":"(ง'̀-'́)ง","author":"basil"}]},{"name":"Bragă (500ml)","description":"Traditional Balkan drink made from fermented millet. Lightly sweet-sour, refreshing, and naturally energizing.","price":2.49,"image":"braga.jpg"},{"name":"Elderflower Cordial (500ml)","description":"Floral and fragrant soft drink made from elderflowers. Traditionally enjoyed chilled.","price":3.29,"image":"elderflower_cordial.jpg"},{"name":"Sea Buckthorn Juice (500ml)","description":"Tangy and slightly sour juice, extremely rich in Vitamin C and antioxidants.","price":3.99,"image":"sea_buckthorn_juice.jpg"},{"name":"Pomegranate Drink (500ml)","description":"A sweet and tart refreshment inspired by classic grenadine flavors.","price":4.49,"image":"pomegranate_drink.jpg"}],"memories":[{"image":"magn(et)ificent!-1571814229653.jpg","caption":"Magn(et)ificent!","user":"bjoernGoogle"},{"image":"my-rare-collectors-item!-[̲̅$̲̅(̲̅-͡°-͜ʖ-͡°̲̅)̲̅$̲̅]-1572603645543.jpg","caption":"My rare collectors item! [̲̅$̲̅(̲̅ ͡° ͜ʖ ͡°̲̅)̲̅$̲̅]","user":"bjoernGoogle"},{"image":"favorite-hiking-place.png","caption":"I love going hiking here...","geoStalkingMetaSecurityQuestion":14,"geoStalkingMetaSecurityAnswer":"Daniel Boone National Forest"},{"image":"IMG_4253.jpg","caption":"My old workplace...","geoStalkingVisualSecurityQuestion":10,"geoStalkingVisualSecurityAnswer":"ITsec"},{"image":"BeeHaven.png","caption":"Welcome to the Bee Haven (/#/bee-haven)🐝","user":"evm"},{"image":"sorted-the-pieces,-starting-assembly-process-1721152307290.jpg","caption":"Sorted the pieces, starting assembly process...","user":"bjoernOwasp"},{"image":"building-something-literally-bottom-up-1721152342603.jpg","caption":"Building something literally bottom up...","user":"bjoernOwasp"},{"image":"putting-in-the-hardware-1721152366854.jpg","caption":"Putting in the hardware...","user":"bjoernOwasp"},{"image":"everything-up-and-running!-1721152385146.jpg","caption":"Everything up and running!","user":"bjoernOwasp"}],"ctf":{"showFlagsInNotifications":false,"showCountryDetailsInNotifications":"none","countryMapping":null,"systemWideNotifications":{"url":null,"pollFrequencySeconds":null}}}}

            Evidence

                192.168.99.100:3000

            Solution | Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.

      2. ##### X-Content-Type-Options Header Missing (1)

         1. GET http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=Pvksd6e

            Alert tags

            - OWASP_2021_A05
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - SYSTEMIC
            - CWE-693
            - OWASP_2017_A06
            - OWASP_2025_A02

            Alert description

            The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

            Other info | This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. At "High" threshold this scan rule will not alert on client or server error responses.

            Request

            Request line and header section (292 bytes)

                GET http://20.60.0.1:3000/socket.io/?EIO=4&transport=polling&t=Pvksd6e HTTP/1.1
                host: 20.60.0.1:3000
                User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
                Accept: */*
                Accept-Language: en-US,en;q=0.5
                Connection: keep-alive
                Referer: http://20.60.0.1:3000/

            Request body (0 bytes)

            Response

            Status line and header section (230 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: http://localhost:4200
                Vary: Origin
                Content-Type: text/plain; charset=UTF-8
                Content-Length: 96
                Date: Thu, 28 May 2026 13:51:11 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (96 bytes)

                0{"sid":"DDmfHO9swhgnxBKzAAAA","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}

            Parameter

                x-content-type-options

            Solution | Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

5. ### Risk=Low, Confidence=Low (1)

   1. #### http://20.60.0.1:3000 (1)

      1. ##### Timestamp Disclosure - Unix (1)

         1. GET http://20.60.0.1:3000

            Alert tags

            - OWASP_2021_A01
            - OWASP_2017_A03
            - OWASP_2025_A01
            - POLICY_PENTEST =
            - CWE-497
            - SYSTEMIC

            Alert description | A timestamp was disclosed by the application/web server. - Unix
            Other info | 1666666667, which evaluates to: 2022-10-24 22:57:47.

            Request

            Request line and header section (228 bytes)

                GET http://20.60.0.1:3000 HTTP/1.1
                host: 20.60.0.1:3000
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
                pragma: no-cache
                cache-control: no-cache

            Request body (0 bytes)

            Response

            Status line and header section (467 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Accept-Ranges: bytes
                Cache-Control: public, max-age=0
                Last-Modified: Thu, 28 May 2026 13:41:08 GMT
                ETag: W/"26af-19e6ed14201"
                Content-Type: text/html; charset=UTF-8
                Content-Length: 9903
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:50:30 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (9903 bytes)

                <!--
                  ~ Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
                  ~ SPDX-License-Identifier: MIT
                  -->

                <!doctype html>
                <html lang="en" data-beasties-container>
                <head>
                  <meta charset="utf-8">
                  <title>OWASP Juice Shop</title>
                  <meta name="description" content="Probably the most modern and sophisticated insecure web application">
                  <meta name="viewport" content="width=device-width, initial-scale=1">
                  <link rel="preconnect" href="https://fonts.googleapis.com">
                  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
                  <style>@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isQFJXGdg.woff2) format('woff2');unicode-range:U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isRFJXGdg.woff2) format('woff2');unicode-range:U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isfFJU.woff2) format('woff2');unicode-range:U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}</style>
                  <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
                  <script>
                    window.addEventListener("load", function(){
                      window.cookieconsent.initialise({
                        "palette": {
                          "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
                          "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
                        },
                        "theme": "classic",
                        "position": "bottom-right",
                        "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" }
                      })});
                  </script>
                <style>.bluegrey-lightgreen-theme{--mat-sys-background:#121316;--mat-sys-error:#ffb4ab;--mat-sys-error-container:#93000a;--mat-sys-inverse-on-surface:#2f3033;--mat-sys-inverse-primary:#005cbb;--mat-sys-inverse-surface:#e3e2e6;--mat-sys-on-background:#e3e2e6;--mat-sys-on-error:#690005;--mat-sys-on-error-container:#ffdad6;--mat-sys-on-primary:#002f65;--mat-sys-on-primary-container:#d7e3ff;--mat-sys-on-primary-fixed:#001b3f;--mat-sys-on-primary-fixed-variant:#00458f;--mat-sys-on-secondary:#283041;--mat-sys-on-secondary-container:#dae2f9;--mat-sys-on-secondary-fixed:#131c2b;--mat-sys-on-secondary-fixed-variant:#3e4759;--mat-sys-on-surface:#e3e2e6;--mat-sys-on-surface-variant:#e0e2ec;--mat-sys-on-tertiary:#173800;--mat-sys-on-tertiary-container:#82ff10;--mat-sys-on-tertiary-fixed:#0b2000;--mat-sys-on-tertiary-fixed-variant:#245100;--mat-sys-outline:#8e9099;--mat-sys-outline-variant:#44474e;--mat-sys-primary:#abc7ff;--mat-sys-primary-container:#00458f;--mat-sys-primary-fixed:#d7e3ff;--mat-sys-primary-fixed-dim:#abc7ff;--mat-sys-scrim:#000000;--mat-sys-secondary:#bec6dc;--mat-sys-secondary-container:#3e4759;--mat-sys-secondary-fixed:#dae2f9;--mat-sys-secondary-fixed-dim:#bec6dc;--mat-sys-shadow:#000000;--mat-sys-surface:#121316;--mat-sys-surface-bright:#38393c;--mat-sys-surface-container:#1f2022;--mat-sys-surface-container-high:#292a2c;--mat-sys-surface-container-highest:#343537;--mat-sys-surface-container-low:#1a1b1f;--mat-sys-surface-container-lowest:#0d0e11;--mat-sys-surface-dim:#121316;--mat-sys-surface-tint:#abc7ff;--mat-sys-surface-variant:#44474e;--mat-sys-tertiary:#70e000;--mat-sys-tertiary-container:#245100;--mat-sys-tertiary-fixed:#82ff10;--mat-sys-tertiary-fixed-dim:#70e000;--mat-sys-neutral-variant20:#2d3038;--mat-sys-neutral10:#1a1b1f;--mat-sys-level0:0px 0px 0px 0px rgba(0, 0, 0, .2), 0px 0px 0px 0px rgba(0, 0, 0, .14), 0px 0px 0px 0px rgba(0, 0, 0, .12);--mat-sys-level1:0px 2px 1px -1px rgba(0, 0, 0, .2), 0px 1px 1px 0px rgba(0, 0, 0, .14), 0px 1px 3px 0px rgba(0, 0, 0, .12);--mat-sys-level2:0px 3px 3px -2px rgba(0, 0, 0, .2), 0px 3px 4px 0px rgba(0, 0, 0, .14), 0px 1px 8px 0px rgba(0, 0, 0, .12);--mat-sys-level3:0px 3px 5px -1px rgba(0, 0, 0, .2), 0px 6px 10px 0px rgba(0, 0, 0, .14), 0px 1px 18px 0px rgba(0, 0, 0, .12);--mat-sys-level4:0px 5px 5px -3px rgba(0, 0, 0, .2), 0px 8px 10px 1px rgba(0, 0, 0, .14), 0px 3px 14px 2px rgba(0, 0, 0, .12);--mat-sys-level5:0px 7px 8px -4px rgba(0, 0, 0, .2), 0px 12px 17px 2px rgba(0, 0, 0, .14), 0px 5px 22px 4px rgba(0, 0, 0, .12);--mat-sys-corner-extra-large:28px;--mat-sys-corner-extra-large-top:28px 28px 0 0;--mat-sys-corner-extra-small:4px;--mat-sys-corner-extra-small-top:4px 4px 0 0;--mat-sys-corner-full:9999px;--mat-sys-corner-large:16px;--mat-sys-corner-large-end:0 16px 16px 0;--mat-sys-corner-large-start:16px 0 0 16px;--mat-sys-corner-large-top:16px 16px 0 0;--mat-sys-corner-medium:12px;--mat-sys-corner-none:0;--mat-sys-corner-small:8px;--mat-sys-dragged-state-layer-opacity:.16;--mat-sys-focus-state-layer-opacity:.12;--mat-sys-hover-state-layer-opacity:.08;--mat-sys-pressed-state-layer-opacity:.12;color:var(--mat-sys-on-surface);background-color:var(--mat-sys-surface)}html{font-family:var(--mat-sys-body-medium-font, Roboto, "Helvetica Neue", sans-serif)}.bluegrey-lightgreen-theme{--theme-primary:#438fff;--theme-primary-lighter:rgb(97.6, 161.229787234, 255);--theme-primary-light:rgb(118, 173.3829787234, 255);--theme-primary-darker:rgb(36.4, 124.770212766, 255);--theme-primary-dark:rgb(16, 112.6170212766, 255);--theme-primary-fade-10:#438fff;--theme-primary-fade-20:#438fff;--theme-primary-fade-30:#438fff;--theme-primary-fade-40:#438fff;--theme-primary-fade-50:#438fff;--theme-accent:#50a400;--theme-accent-lighter:rgb(94.9268292683, 194.6, 0);--theme-accent-light:rgb(104.8780487805, 215, 0);--theme-accent-darker:rgb(65.0731707317, 133.4, 0);--theme-accent-dark:rgb(55.1219512195, 113, 0);--theme-accent-fade-10:#50a400;--theme-accent-fade-20:#50a400;--theme-accent-fade-30:#50a400;--theme-accent-fade-40:#50a400;--theme-accent-fade-50:#50a400;--theme-warn:#ffb4ab;--theme-warn-lighter:rgb(255, 207.3214285714, 201.6);--theme-warn-light:rgb(255, 225.5357142857, 222);--theme-warn-darker:rgb(255, 152.6785714286, 140.4);--theme-warn-dark:rgb(255, 134.4642857143, 120);--theme-warn-fade-10:#ffb4ab;--theme-warn-fade-20:#ffb4ab;--theme-warn-fade-30:#ffb4ab;--theme-warn-fade-40:#ffb4ab;--theme-warn-fade-50:#ffb4ab;--theme-text:#e3e2e6;--theme-text-lighter:rgb(242.8666666667, 242.4333333333, 244.1666666667);--theme-text-light:rgb(253.4444444444, 253.3888888889, 253.6111111111);--theme-text-darker:rgb(200.5555555556, 198.6111111111, 206.3888888889);--theme-text-dark:rgb(160.8888888889, 157.5277777778, 170.9722222222);--theme-text-fade-10:#e3e2e6;--theme-text-fade-20:#e3e2e6;--theme-text-fade-30:#e3e2e6;--theme-text-fade-40:#e3e2e6;--theme-text-fade-50:#e3e2e6;--theme-text-invert-15:rgb(197.15, 196.45, 199.25);--theme-text-invert-30:rgb(167.3, 166.9, 168.5);--theme-background:#1f2022;--theme-background-lighter:rgb(45.5938461538, 47.0646153846, 50.0061538462);--theme-background-light:rgb(55.3230769231, 57.1076923077, 60.6769230769);--theme-background-darker:rgb(16.4061538462, 16.9353846154, 17.9938461538);--theme-background-dark:rgb(6.6769230769, 6.8923076923, 7.3230769231);--theme-background-darkest:hsl(220, 4.6153846154%, -1.2549019608%);--theme-thumbnail-border:1px solid #abc7ff;--mdc-filled-text-field-container-color:#0000;--mdc-filled-text-field-disabled-container-color:#0000;--theme-background:#3e3e3e;--theme-background-lighter:#4a4a4a;--theme-background-light:#5a5a5a;--theme-background-darker:#333638;--theme-background-dark:#303030;--theme-background-darkest:#2b2b2b;--theme-text:#e8ecef;--theme-text-lighter:#f2f5f7;--theme-text-light:#fff;--theme-text-darker:#b8c0c7;--theme-text-dark:#7f8a93;--mat-sys-surface:#333638;--mat-sys-on-surface:#e8ecef;--mat-sys-surface-container:#3e3e3e;--mat-sys-surface-container-high:#404244;--mat-sys-on-surface-variant:#b8c0c7;--mat-sys-outline:#5a5a5a;--mat-sys-outline-variant:#404244}.bluegrey-lightgreen-theme{--theme-warn:#f44336;--theme-warn-lighter:rgb(245.5877358491, 94.1358490566, 83.0122641509);--theme-warn-light:rgb(246.6462264151, 112.2264150943, 102.3537735849);--theme-warn-darker:rgb(242.4122641509, 39.8641509434, 24.9877358491);--theme-warn-dark:rgb(234.1839622642, 27.9622641509, 12.8160377358);--theme-warn-fade-10:#f44336;--theme-warn-fade-20:#f44336;--theme-warn-fade-30:#f44336;--theme-warn-fade-40:#f44336;--theme-warn-fade-50:#f44336;--mat-sys-error:#f44336;--mat-sys-on-error:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head>
                <body class="bluegrey-lightgreen-theme">
                  <app-root></app-root>
                <link rel="modulepreload" href="chunk-SCY7YOCS.js"><link rel="modulepreload" href="chunk-PX7UKXVL.js"><link rel="modulepreload" href="chunk-GNBEOV4E.js"><link rel="modulepreload" href="chunk-7O3TTE7G.js"><link rel="modulepreload" href="chunk-JCQ5N7PA.js"><link rel="modulepreload" href="chunk-UNFVUBM2.js"><link rel="modulepreload" href="chunk-524KQQJQ.js"><link rel="modulepreload" href="chunk-SI2GTEZM.js"><link rel="modulepreload" href="chunk-ZO2KHBRB.js"><link rel="modulepreload" href="chunk-7AKA75AX.js"><script src="polyfills.js" type="module"></script><script src="scripts.js" defer></script><script src="main.js" type="module"></script></body>
                </html>

            Evidence

                1666666667

            Solution | Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

6. ### Risk=Informational, Confidence=Medium (1)

   1. #### http://20.60.0.1:3000 (1)

      1. ##### Modern Web Application (1)

         1. GET http://20.60.0.1:3000

            Alert tags

            - OWASP_2021_A05
            - POLICY_QA_STD =
            - POLICY_PENTEST =
            - SYSTEMIC
            - OWASP_2017_A06
            - OWASP_2025_A02
            - POLICY_DEV_STD =

            Alert description | The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
            Other info | No links have been found while there are scripts, which is an indication that this is a modern web application.

            Request

            Request line and header section (228 bytes)

                GET http://20.60.0.1:3000 HTTP/1.1
                host: 20.60.0.1:3000
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
                pragma: no-cache
                cache-control: no-cache

            Request body (0 bytes)

            Response

            Status line and header section (467 bytes)

                HTTP/1.1 200 OK
                Access-Control-Allow-Origin: *
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                Feature-Policy: payment 'self'
                X-Recruiting: /#/jobs
                Accept-Ranges: bytes
                Cache-Control: public, max-age=0
                Last-Modified: Thu, 28 May 2026 13:41:08 GMT
                ETag: W/"26af-19e6ed14201"
                Content-Type: text/html; charset=UTF-8
                Content-Length: 9903
                Vary: Accept-Encoding
                Date: Thu, 28 May 2026 13:50:29 GMT
                Connection: keep-alive
                Keep-Alive: timeout=5

            Response body (9903 bytes)

                <!--
                  ~ Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
                  ~ SPDX-License-Identifier: MIT
                  -->

                <!doctype html>
                <html lang="en" data-beasties-container>
                <head>
                  <meta charset="utf-8">
                  <title>OWASP Juice Shop</title>
                  <meta name="description" content="Probably the most modern and sophisticated insecure web application">
                  <meta name="viewport" content="width=device-width, initial-scale=1">
                  <link rel="preconnect" href="https://fonts.googleapis.com">
                  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
                  <style>@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isQFJXGdg.woff2) format('woff2');unicode-range:U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isRFJXGdg.woff2) format('woff2');unicode-range:U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;}@font-face{font-family:'VT323';font-style:normal;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/vt323/v18/pxiKyp0ihIEF2isfFJU.woff2) format('woff2');unicode-range:U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}</style>
                  <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
                  <script>
                    window.addEventListener("load", function(){
                      window.cookieconsent.initialise({
                        "palette": {
                          "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
                          "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
                        },
                        "theme": "classic",
                        "position": "bottom-right",
                        "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" }
                      })});
                  </script>
                <style>.bluegrey-lightgreen-theme{--mat-sys-background:#121316;--mat-sys-error:#ffb4ab;--mat-sys-error-container:#93000a;--mat-sys-inverse-on-surface:#2f3033;--mat-sys-inverse-primary:#005cbb;--mat-sys-inverse-surface:#e3e2e6;--mat-sys-on-background:#e3e2e6;--mat-sys-on-error:#690005;--mat-sys-on-error-container:#ffdad6;--mat-sys-on-primary:#002f65;--mat-sys-on-primary-container:#d7e3ff;--mat-sys-on-primary-fixed:#001b3f;--mat-sys-on-primary-fixed-variant:#00458f;--mat-sys-on-secondary:#283041;--mat-sys-on-secondary-container:#dae2f9;--mat-sys-on-secondary-fixed:#131c2b;--mat-sys-on-secondary-fixed-variant:#3e4759;--mat-sys-on-surface:#e3e2e6;--mat-sys-on-surface-variant:#e0e2ec;--mat-sys-on-tertiary:#173800;--mat-sys-on-tertiary-container:#82ff10;--mat-sys-on-tertiary-fixed:#0b2000;--mat-sys-on-tertiary-fixed-variant:#245100;--mat-sys-outline:#8e9099;--mat-sys-outline-variant:#44474e;--mat-sys-primary:#abc7ff;--mat-sys-primary-container:#00458f;--mat-sys-primary-fixed:#d7e3ff;--mat-sys-primary-fixed-dim:#abc7ff;--mat-sys-scrim:#000000;--mat-sys-secondary:#bec6dc;--mat-sys-secondary-container:#3e4759;--mat-sys-secondary-fixed:#dae2f9;--mat-sys-secondary-fixed-dim:#bec6dc;--mat-sys-shadow:#000000;--mat-sys-surface:#121316;--mat-sys-surface-bright:#38393c;--mat-sys-surface-container:#1f2022;--mat-sys-surface-container-high:#292a2c;--mat-sys-surface-container-highest:#343537;--mat-sys-surface-container-low:#1a1b1f;--mat-sys-surface-container-lowest:#0d0e11;--mat-sys-surface-dim:#121316;--mat-sys-surface-tint:#abc7ff;--mat-sys-surface-variant:#44474e;--mat-sys-tertiary:#70e000;--mat-sys-tertiary-container:#245100;--mat-sys-tertiary-fixed:#82ff10;--mat-sys-tertiary-fixed-dim:#70e000;--mat-sys-neutral-variant20:#2d3038;--mat-sys-neutral10:#1a1b1f;--mat-sys-level0:0px 0px 0px 0px rgba(0, 0, 0, .2), 0px 0px 0px 0px rgba(0, 0, 0, .14), 0px 0px 0px 0px rgba(0, 0, 0, .12);--mat-sys-level1:0px 2px 1px -1px rgba(0, 0, 0, .2), 0px 1px 1px 0px rgba(0, 0, 0, .14), 0px 1px 3px 0px rgba(0, 0, 0, .12);--mat-sys-level2:0px 3px 3px -2px rgba(0, 0, 0, .2), 0px 3px 4px 0px rgba(0, 0, 0, .14), 0px 1px 8px 0px rgba(0, 0, 0, .12);--mat-sys-level3:0px 3px 5px -1px rgba(0, 0, 0, .2), 0px 6px 10px 0px rgba(0, 0, 0, .14), 0px 1px 18px 0px rgba(0, 0, 0, .12);--mat-sys-level4:0px 5px 5px -3px rgba(0, 0, 0, .2), 0px 8px 10px 1px rgba(0, 0, 0, .14), 0px 3px 14px 2px rgba(0, 0, 0, .12);--mat-sys-level5:0px 7px 8px -4px rgba(0, 0, 0, .2), 0px 12px 17px 2px rgba(0, 0, 0, .14), 0px 5px 22px 4px rgba(0, 0, 0, .12);--mat-sys-corner-extra-large:28px;--mat-sys-corner-extra-large-top:28px 28px 0 0;--mat-sys-corner-extra-small:4px;--mat-sys-corner-extra-small-top:4px 4px 0 0;--mat-sys-corner-full:9999px;--mat-sys-corner-large:16px;--mat-sys-corner-large-end:0 16px 16px 0;--mat-sys-corner-large-start:16px 0 0 16px;--mat-sys-corner-large-top:16px 16px 0 0;--mat-sys-corner-medium:12px;--mat-sys-corner-none:0;--mat-sys-corner-small:8px;--mat-sys-dragged-state-layer-opacity:.16;--mat-sys-focus-state-layer-opacity:.12;--mat-sys-hover-state-layer-opacity:.08;--mat-sys-pressed-state-layer-opacity:.12;color:var(--mat-sys-on-surface);background-color:var(--mat-sys-surface)}html{font-family:var(--mat-sys-body-medium-font, Roboto, "Helvetica Neue", sans-serif)}.bluegrey-lightgreen-theme{--theme-primary:#438fff;--theme-primary-lighter:rgb(97.6, 161.229787234, 255);--theme-primary-light:rgb(118, 173.3829787234, 255);--theme-primary-darker:rgb(36.4, 124.770212766, 255);--theme-primary-dark:rgb(16, 112.6170212766, 255);--theme-primary-fade-10:#438fff;--theme-primary-fade-20:#438fff;--theme-primary-fade-30:#438fff;--theme-primary-fade-40:#438fff;--theme-primary-fade-50:#438fff;--theme-accent:#50a400;--theme-accent-lighter:rgb(94.9268292683, 194.6, 0);--theme-accent-light:rgb(104.8780487805, 215, 0);--theme-accent-darker:rgb(65.0731707317, 133.4, 0);--theme-accent-dark:rgb(55.1219512195, 113, 0);--theme-accent-fade-10:#50a400;--theme-accent-fade-20:#50a400;--theme-accent-fade-30:#50a400;--theme-accent-fade-40:#50a400;--theme-accent-fade-50:#50a400;--theme-warn:#ffb4ab;--theme-warn-lighter:rgb(255, 207.3214285714, 201.6);--theme-warn-light:rgb(255, 225.5357142857, 222);--theme-warn-darker:rgb(255, 152.6785714286, 140.4);--theme-warn-dark:rgb(255, 134.4642857143, 120);--theme-warn-fade-10:#ffb4ab;--theme-warn-fade-20:#ffb4ab;--theme-warn-fade-30:#ffb4ab;--theme-warn-fade-40:#ffb4ab;--theme-warn-fade-50:#ffb4ab;--theme-text:#e3e2e6;--theme-text-lighter:rgb(242.8666666667, 242.4333333333, 244.1666666667);--theme-text-light:rgb(253.4444444444, 253.3888888889, 253.6111111111);--theme-text-darker:rgb(200.5555555556, 198.6111111111, 206.3888888889);--theme-text-dark:rgb(160.8888888889, 157.5277777778, 170.9722222222);--theme-text-fade-10:#e3e2e6;--theme-text-fade-20:#e3e2e6;--theme-text-fade-30:#e3e2e6;--theme-text-fade-40:#e3e2e6;--theme-text-fade-50:#e3e2e6;--theme-text-invert-15:rgb(197.15, 196.45, 199.25);--theme-text-invert-30:rgb(167.3, 166.9, 168.5);--theme-background:#1f2022;--theme-background-lighter:rgb(45.5938461538, 47.0646153846, 50.0061538462);--theme-background-light:rgb(55.3230769231, 57.1076923077, 60.6769230769);--theme-background-darker:rgb(16.4061538462, 16.9353846154, 17.9938461538);--theme-background-dark:rgb(6.6769230769, 6.8923076923, 7.3230769231);--theme-background-darkest:hsl(220, 4.6153846154%, -1.2549019608%);--theme-thumbnail-border:1px solid #abc7ff;--mdc-filled-text-field-container-color:#0000;--mdc-filled-text-field-disabled-container-color:#0000;--theme-background:#3e3e3e;--theme-background-lighter:#4a4a4a;--theme-background-light:#5a5a5a;--theme-background-darker:#333638;--theme-background-dark:#303030;--theme-background-darkest:#2b2b2b;--theme-text:#e8ecef;--theme-text-lighter:#f2f5f7;--theme-text-light:#fff;--theme-text-darker:#b8c0c7;--theme-text-dark:#7f8a93;--mat-sys-surface:#333638;--mat-sys-on-surface:#e8ecef;--mat-sys-surface-container:#3e3e3e;--mat-sys-surface-container-high:#404244;--mat-sys-on-surface-variant:#b8c0c7;--mat-sys-outline:#5a5a5a;--mat-sys-outline-variant:#404244}.bluegrey-lightgreen-theme{--theme-warn:#f44336;--theme-warn-lighter:rgb(245.5877358491, 94.1358490566, 83.0122641509);--theme-warn-light:rgb(246.6462264151, 112.2264150943, 102.3537735849);--theme-warn-darker:rgb(242.4122641509, 39.8641509434, 24.9877358491);--theme-warn-dark:rgb(234.1839622642, 27.9622641509, 12.8160377358);--theme-warn-fade-10:#f44336;--theme-warn-fade-20:#f44336;--theme-warn-fade-30:#f44336;--theme-warn-fade-40:#f44336;--theme-warn-fade-50:#f44336;--mat-sys-error:#f44336;--mat-sys-on-error:#fff}@media screen and (-webkit-min-device-pixel-ratio:0){}</style><link rel="stylesheet" href="styles.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="styles.css"></noscript></head>
                <body class="bluegrey-lightgreen-theme">
                  <app-root></app-root>
                <link rel="modulepreload" href="chunk-SCY7YOCS.js"><link rel="modulepreload" href="chunk-PX7UKXVL.js"><link rel="modulepreload" href="chunk-GNBEOV4E.js"><link rel="modulepreload" href="chunk-7O3TTE7G.js"><link rel="modulepreload" href="chunk-JCQ5N7PA.js"><link rel="modulepreload" href="chunk-UNFVUBM2.js"><link rel="modulepreload" href="chunk-524KQQJQ.js"><link rel="modulepreload" href="chunk-SI2GTEZM.js"><link rel="modulepreload" href="chunk-ZO2KHBRB.js"><link rel="modulepreload" href="chunk-7AKA75AX.js"><script src="polyfills.js" type="module"></script><script src="scripts.js" defer></script><script src="main.js" type="module"></script></body>
                </html>

            Evidence

                <script>
                    window.addEventListener("load", function(){
                      window.cookieconsent.initialise({
                        "palette": {
                          "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
                          "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
                        },
                        "theme": "classic",
                        "position": "bottom-right",
                        "content": { "message": "This website uses fruit cookies to ensure you get the juiciest tracking experience.", "dismiss": "Me want it!", "link": "But me wait!", "href": "https://www.youtube.com/watch?v=9PnbKL3wuH4" }
                      })});
                  </script>

            Solution | This is an informational alert and so no changes are required.

## Appendix

### Alert Types

This section contains additional information on the types of alerts in the report.

1. #### SQL Injection

   Source | raised by an active scanner (SQL Injection)
   CWE ID | 89
   WASC ID | 19

   Reference

   1. https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

2. #### Content Security Policy (CSP) Header Not Set

   Source | raised by a passive scanner (Content Security Policy (CSP) Header Not Set)
   CWE ID | 693
   WASC ID | 15

   Reference

   1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
   2. https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
   3. https://www.w3.org/TR/CSP/
   4. https://w3c.github.io/webappsec-csp/
   5. https://web.dev/articles/csp
   6. https://caniuse.com/#feat=contentsecuritypolicy
   7. https://content-security-policy.com/

3. #### Cross-Domain Misconfiguration

   Source | raised by a passive scanner (Cross-Domain Misconfiguration)
   CWE ID | 264
   WASC ID | 14

   Reference

   1. https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy

4. #### Missing Anti-clickjacking Header

   Source | raised by a passive scanner (Anti-clickjacking Header)
   CWE ID | 1021
   WASC ID | 15

   Reference

   1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options

5. #### Session ID in URL Rewrite

   Source | raised by a passive scanner (Session ID in URL Rewrite)
   CWE ID | 598
   WASC ID | 13

   Reference

   1. https://seclists.org/webappsec/2002/q4/111

6. #### Private IP Disclosure

   Source | raised by a passive scanner (Private IP Disclosure)
   CWE ID | 497
   WASC ID | 13

   Reference

   1. https://datatracker.ietf.org/doc/html/rfc1918

7. #### Timestamp Disclosure - Unix

   Source | raised by a passive scanner (Timestamp Disclosure)
   CWE ID | 497
   WASC ID | 13

   Reference

   1. https://cwe.mitre.org/data/definitions/200.html

8. #### X-Content-Type-Options Header Missing

   Source | raised by a passive scanner (X-Content-Type-Options Header Missing)
   CWE ID | 693
   WASC ID | 15

   Reference

   1. https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
   2. https://owasp.org/www-community/Security_Headers

9. #### Modern Web Application

   Source | raised by a passive scanner (Modern Web Application)