Get Started
← Ethical hacking · Mission 2 of 15

Web app pentesting with Burp Suite

Course 1 built you a legal target: OWASP Juice Shop running in Docker on your own PC. Now you meet the tool professional web testers reach for first, Burp Suite. You install the free Community Edition, send your browser's traffic through it so you can watch and change it, read one real request and its reply byte for byte, change a single value in Repeater and resend it, and then solve three genuine Juice Shop challenges the proper way: logging in as the administrator through SQL injection, walking into the admin section, and reading another customer's shopping basket. Every request in this mission goes to 127.0.0.1 and nowhere else.

56 minIntermediateTools: FreeStep 1 free
Tested 10 Oct 2026 · OWASP Juice Shop v20.2.0 (image bkimminich/juice-shop) running in Docker Engine 29.1.3 and published to 127.0.0.1:3000, exactly as course 1 sets it up, on Windows 11. The three challenges below (Login Admin, Admin Section, View Basket, all two-star) were solved for real against that container and confirmed via its own Score Board and challenge API. Honesty note: there are no screenshots of Burp's own window because it is a Java desktop app that cannot be captured on a headless machine, so Burp's buttons, tabs and panels are described from its 2025 interface while every request and response shown is genuine traffic to and from your Juice Shop.
Burp Suite Community Edition installed, with its built-in browser sending every request through Burp so you can see and change your own traffic, and no change to your system-wide proxy settings
The core skill of reading a raw HTTP request and its response (method, address, headers, parameters, cookies and the login token) and changing one part in Repeater before resending it
Three real Juice Shop challenges solved by tampering with traffic, each one teaching a named class of web vulnerability: SQL injection, broken access control and insecure direct object reference
Before you start
  • Course 1, Build a hacking lab, finished, so you can start OWASP Juice Shop at 127.0.0.1:3000 ↗ in Docker. This mission uses that exact lab, and the legal rules you learned there still apply in full
  • Windows 11 (Burp Suite also runs on macOS and Linux, and the steps are nearly identical). Written for Windows 11
  • About 1GB of free disk space for Burp Suite Community and the Java runtime bundled with it
  • If the terminal is new to you, the Level 0 lesson Install anything from GitHub covers the basics first
01/08The rules, and fire up your lab0 done
STEP 01 of 08~5 min

The rules, and fire up your lab

Reset the one line that keeps this legal, then start the target you built in course 1, so everything that follows points only at your own machine.

  1. This is course 2 of the ethical-hacking track, and it stands on course 1, Build a hacking lab. The single rule from that lesson has not changed and never will: you may only test systems you own, or that the owner has given you permission in writing to test. OWASP Juice Shop is built and published to be attacked, it runs entirely on your own PC, and it is reachable only from 127.0.0.1. That is what makes everything below lawful. Pointing the very same tool and the very same requests at a real website, shop or account you do not own is a computer-misuse offence (in the UK, the Computer Misuse Act 1990), whatever your intention.

    CarefulBurp Suite can send any request anywhere. In this mission you only ever send requests to your own Juice Shop at 127.0.0.1:3000. Never point Burp, or anything you learn here, at a website, a company, an employer, a friend's machine or anything else you do not own or have written permission to test. Keep it in the lab, or on the practice platforms built to invite it.

  2. Now start the lab. If Docker Desktop is not already running, start it from the Start menu and wait for the whale icon in the system tray to go steady. Then bring Juice Shop back with the one command from course 1 (use docker start if you stopped it last time, or the full docker run if you removed it):

    Wake the lab (or use the full docker run from course 1 if it is gone)
    docker start juice-shop

  3. Give it a few seconds, then confirm it really is the deliberately vulnerable app by asking it its own version, the same check you used in course 1:

    Confirm the target is up
    curl.exe http://127.0.0.1:3000/rest/admin/application-version
    Output
    {"version":"20.2.0"}

  4. Open 127.0.0.1:3000 ↗ in any browser and you should see the Juice Shop front. That is your target for the whole lesson.

    TipA quick memory test for the rest of the track: before you send any request, ask "is this going to 127.0.0.1, my own lab?". If the answer is not a clear yes, stop.
✓
CheckpointThe version command prints {"version":"20.2.0"} (or a newer number) and Juice Shop opens at 127.0.0.1:3000.
If it breaksdocker start says: No such container: juice-shop + 1 more
docker start says: No such container: juice-shop
You removed it since course 1, which is fine. Recreate it with the full command from course 1: docker run -d --name juice-shop --network juice-lab -p 127.0.0.1:3000:3000 bkimminich/juice-shop. If the network is also gone, run docker network create juice-lab first.
The browser can't connect to 127.0.0.1:3000
The app takes a few seconds to wake up. Wait 20 seconds and reload. Check it is running with docker ps. If it is not listed, read its start-up messages with docker logs juice-shop.
Still stuck? Ask the community
Next mission · Ethical hackingFind bugs before attackers do: fuzzing your own code
→