A shopping basket request intended to return one customer’s items can instead return another customer’s record when the application fails to enforce ownership. An attacker may need only a valid session and a visible object reference, not malware or access to the server. This course tests that kind of boundary failure only in a fixed isolated lab, where each claim comes from an observable HTTP request and response rather than an exploit chain.
Our authorized target is OWASP Juice Shop at http://app.lab:3000, mapped to 10.0.0.20; testing originates only from Kali at 10.0.0.10. The lab has no internet route, so a request captured by Burp represents traffic between the tester and the application, not traffic to an external service. The application and its data store remain distinct boundaries even though we observe only the application’s HTTP behavior. Let’s trace the boundaries that keep the lab evidence meaningful:
This diagram shows where evidence belongs: the intercepted request and returned response at the browser and Burp boundary. A response such as an unexpected 200 OK, an error body that exposes implementation details, or data belonging to another lab account is evidence only when we preserve the request that produced it.
With the network boundary fixed, rules of engagement are the operational constraints that state what we may test, how we may test it, and which effects remain off limits. The allowed target is only 10.0.0.20, and the allowed interface is HTTP to app.lab:3000. Requests to another IP address, external DNS name, or service are outside scope even if a browser or proxy makes them convenient to reach.
The rules prohibit persistence, denial of service, credential reuse beyond the provided lab accounts, payload tuning intended to bypass protections, and scanning unrelated addresses. These limits preserve the lab, prevent accidental expansion of impact, and keep a finding focused on the web application behavior under review. The Computer Fraud and Abuse Act in the United States and the Computer Misuse Act 1990 in the United Kingdom illustrate why written authorization and defined scope matter; neither reference is legal advice. We can weigh each constraint against the evidence it requires: