Lab 15 · Web Security Testing Basics Lab (Practice Sites Only)

🎯 Objective

Learn how professional web security testing is scoped, performed and reported — on a target built to be tested.

🧩 Skills You Will Practice

• OWASP Top 10 concepts
• Security headers
• Input validation behaviour
• Professional reporting

🧰 What You Need

• An intentionally vulnerable practice app such as OWASP Juice Shop running locally OR a legal practice platform (TryHackMe / PortSwigger Web Security Academy)
• Browser DevTools
• Report template in your notes

📋 Step-by-Step Tasks

1. READ THE SCOPE FIRST: your only authorised targets in this lab are a locally installed practice app or a named practice platform that invites testing. Write that scope sentence at the top of your report before touching anything.
2. Set up the practice target locally or open the practice platform lab. Confirm in writing in your notes: this target is designed to be attacked for learning.
3. Work the headers check: open DevTools Network tab, reload, and record which security headers are present or missing (for example Content-Security-Policy, X-Content-Type-Options). Missing headers on the practice app are findings — write them as findings.
4. Work the input check inside the practice app only: enter test strings in its forms (long text, special characters, script-like text in the practice environment) and record how the app responds. You are observing validation behaviour, not attacking a real service.
5. Work the authentication check on the practice app: test its demo login for error-message quality (does it reveal whether the username exists?), lockout behaviour and session handling observations offered by the practice lab.
6. Write the professional report: for each finding — title, severity (Low/Medium/High with a reason), evidence (what you observed), and the fix a developer should apply. No drama, no exaggeration.
7. Close the lab properly: shut down the local practice app, keep the report, and state in one line the legal rule: the same actions on any real website without written permission would be a crime.

✅ Expected Result / Deliverable

A scoped security report on a practice target only: headers, input and authentication findings, each with severity, evidence and a developer fix — written like a junior penetration tester.

⚠️ Common Mistakes

• Testing a real website just to check — that is unauthorised access, not research
• Reporting findings without evidence or with invented severity
• Skipping the written scope