Pentesting OWASP Juice Shop with LLMs

This is a repository intended to be a self-contained playground for testing the vulnerable web application OWASP Juice Shop with a combination of large language models (LLMs) and automated testing tools.

Installation

Install Docker and docker-compose.

Run:

docker-compose up -d

to bring up

1. a Python analysis environment with a running jupyter notebook server on localhost:8888, along with the ChatGPT API python interface. To get the link with validation token, run docker-compose logs analysis.
2. a running instance of OWASP Juice Shop running on localhost:9993.
3. a running instance of OWASP ZAP running on localhost:9090/zap/

Ports are configured in the compose file and can be changed as you see fit.

ZAP reports

The ZAP docker image comes with automated endpoint scans which generate reports. Once the environment is up, to do a baseline scan run:

docker-compose exec zap zap-baseline.py -t http://juice-shop:3000 -g ./reports/gen.conf -r ./reports/report.html -J ./reports/report.json

Activate Burp

First time setup

Follow the instructions (option 2) here.

Pay attention to the "Few things to keep in mind", specifically activate burp pro when building the docker iamge and then use the built pro version as a base image to avoid re-activating!

derived base image henceforth