Lab 2 — Application exploitation
Kick-off in week 7 · due in week 9
Context
A vulnerable application is deployed in your lab (Juice Shop, DVWA, or an equivalent imposed in the classroom). The RoE authorizes application exploitation inside the perimeter.
Learning objectives
- Move from Top 10 theory to reproducible exploits.
- Write professional findings, actionable in a remediation meeting.
- Estimate business impact beyond the technical score.
Expected deliverable
A report of 8 to 12 pages containing, for each of the three chosen vulnerabilities:
- OWASP category (A01 to A10).
- Functional context — what the page or API under attack normally does.
- Complete request — paste
curl -vor a Burp Repeater capture. - Observed response — relevant excerpt, not the entire response.
- Business impact — access to data, account takeover, etc.
- Concrete remediation — minimal code or configuration, tested if possible.
The three vulnerabilities must belong to three different categories of the Top 10.
Grading grid (100 points)
| Criterion | Points |
|---|---|
| Reproducibility of the three attacks | 30 |
| Quality of evidence (request/response/impact) | 25 |
| Diversity and relevance of chosen categories | 10 |
| Quality of proposed remediations | 20 |
| Business impact estimation | 10 |
| Writing clarity | 5 |
Fatal mistakes
- An exploitation that only works half the time, with no explanation.
- A generic remediation ("filter inputs") without precise code or configuration.
- Attacking an application outside the perimeter.