JuicedShop Security Lab Series: Logging and Monitoring Failures
Solution overview
Type: Red Team
Who Should Play: Security analysts, penetration testers, application security engineers, and technical leaders want to deepen their understanding of web application vulnerabilities through hands-on offensive techniques.
Objective:
In this mini game, you'll explore what happens when a web application's internal monitoring tools are exposed without proper access controls. JuicedShop uses open, source observability software to track metrics and log activity, but without secure signatures or protections, this tool becomes a liability.
You'll uncover sensitive logs by identifying weak points in how monitoring data is stored and accessed. By doing so, you'll gain insight into user behavior, potentially revealing credentials, internal endpoints, or administrator activity, all from information that should have been tightly guarded.
Why it matters: Logging and monitoring are critical for detecting and responding to attacks, but when misconfigured, they can enable them. This mini game reinforces the need for strong operational security, even around tools meant to protect the system.
About the JuicedShop Mini Game Series:
Challenge yourself in a dynamic, hands-on mini game series based on OWASP Juice Shop, a purposefully vulnerable web application replicating real-world security flaws in a safe, sandboxed environment. This interactive experience includes ten unique mini games, each aligned with a specific vulnerability from the OWASP Top Ten - the most critical web application security risks recognized by the industry.
Whether you're exploring web app security for the first time or refining advanced ethical hacking skills, this series offers an engaging, gamified way to practice identifying, exploiting, and understanding common flaws found in modern websites.
Included Mini Games:
- JuicedShop Security Lab Series: Broken Access Control
- JuicedShop Security Lab Series: Cryptographic Failures
- JuicedShop Security Lab Series: Injection Attacks
- JuicedShop Security Lab Series: Insecure Design
- JuicedShop Security Lab Series: Security Misconfiguration
- JuicedShop Security Lab Series: Vulnerable and Outdated Components
- JuicedShop Security Lab Series: Identification and Authentication Failures
- JuicedShop Security Lab Series: Software and Data Integrity Failures
- JuicedShop Security Lab Series: Logging and Monitoring Failures
- JuicedShop Security Lab Series: Server-Side Request Forgery (SSRF)
These bite-sized mini games are designed to sharpen offensive testing techniques and deepen your understanding of how vulnerabilities can be discovered and exploited in real-world scenarios.
How to Get Started
- Click the "Launch lab" button on the right side of this page
- Once inside the virtual environment, watch the video in the "Start Here" tab of your lab gateway for next steps
- Good luck and have fun!