[ CLASSIFIED_INTEL ]
CASE_LOG_091 // TARGET: OWASP_JUICE_SHOP

DATE: 2026-01-26
[cite_start]ASSET: OWASP Juice Shop v16.x (Latest LTS) [cite: 7]
THREAT: INTENTIONALLY_COMPROMISED

// 01. SYSTEM_ANALYSIS

Target asset is a sophisticated Single Page Application (SPA) designed as a self-contained training environment. [cite_start]Architecture relies entirely on the JavaScript/TypeScript Ecosystem with no external database dependencies[cite: 8, 55].

[cite_start]

TIER	TECHNOLOGY	ARCHITECTURAL DETAILS
FRONTEND	Angular + Material	SPA structure in /frontend/src/app. Uses Angular Material & ngx-translate. [cite_start]Compiled to minified JS[cite: 12, 13, 14].
BACKEND	Node.js + Express	RESTful API on Node 18-22 LTS. [cite_start]Custom middleware handles security logic (security.denyAll)[cite: 7, 17].
DATA LAYER	SQLite + MarsDB	Primary relational store (juiceshop.sqlite) + In-memory NoSQL (MarsDB) for ephemeral data[cite: 22, 23, 30].

// 02. FUNCTIONAL_INTELLIGENCE

[cite_start]

Asset simulates a B2C e-commerce platform with comprehensive REST API coverage documented via Swagger/OpenAPI[cite: 18, 58, 61].

[cite_start]
• Identity: Users, Wallets, and Security Questions[cite: 25].
[cite_start]
• Commerce: Products, Baskets, Orders, and Delivery Tracking[cite: 26].
[cite_start]
• Ops: Complaints (file upload via multer) and Recycles[cite: 18, 27].
[cite_start]
• Gamification: “Score Board” tracking 110+ challenges via internal SQLite tables[cite: 28].

// 03. VULNERABILITY_LANDSCAPE

[cite_start]

The following vectors are HARDCODED_FLAWS mapped to OWASP Top 10 for training purposes[cite: 59].

[cite_start] [cite_start] [cite_start] [cite_start]

VECTOR	IMPLEMENTATION	COMPONENT
SQL INJECTION	Unsafe query construction in search/login	Sequelize (raw queries) [cite: 50]
BROKEN AUTH	JWT signed with “alg: none” vulnerability	jsonwebtoken@0.4.0 [cite: 34, 50]
XSS	Sanitization bypass via outdated library	sanitize-html@1.4.2 [cite: 18, 50]
SENSITIVE DATA	Weak hashing (MD5 variants) for passwords	insecurity.js [cite: 34, 50]

// 04. OPERATIONAL_DIRECTIVES

[cite_start]
• >> 1. DEPLOYMENT: Official Docker images (x64/ARM64) or Kubernetes via MultiJuicer for CTF events[cite: 10, 52].
• >> 2. AUTOMATION: CI/CD maintains 90%+ coverage. [cite_start]E2E tests (Cypress) auto-solve challenges[cite: 13, 40, 41].
[cite_start]
• >> 3. ARCHITECTURE: 100% JS stack allows “Run Anywhere” capability (Windows/Linux/macOS)[cite: 8, 10, 54].