We attacked
OWASP Juice Shop
in 14.5s.

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Administration UI route reachable without auth check on frontend"
id: "e3aee626-13cb-4fe9-9de3-0364a9167b8b"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_274f87b785bcc98e99644e61.
    
    Detection gap observed:
    Probe a01-admin-public-001 confirmed vulnerable. Indicator matched: status=200. Administration UI route reachable without auth check on frontend
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_274f87b785bcc98e99644e61"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-07-25"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Starter rule — tune thresholds/filters for your environment before deploying

title: "OWASP A01 — Broken Access Control (IDOR / admin-route exposure) — OWASP A01 — Poison-null byte path traversal bypasses .md whitelist"
id: "d5e2c749-ffc0-48e6-8713-7f05af702c6a"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_caedf693d824bd47c3a64fb7.
    
    Detection gap observed:
    Probe a01-pathtraversal-ftp-001 confirmed vulnerable. Indicator matched: body~"dependencies". Poison-null byte path traversal bypasses .md whitelist
    
    Recommended defense:
    Aplicar verificação de autorização por recurso (não apenas autenticação). Validar ownership via tenant_id/user_id antes de retornar dados. Implementar rate-limit por usuário em endpoints de enumeração.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_caedf693d824bd47c3a64fb7"
  - "https://attack.mitre.org/techniques/T1190/"
date: "2026-07-25"
tags:
  - attack.t1190
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /api/Users
      - /rest/basket/
      - /api/Feedbacks/
      - /administration
      - /ftp/
  condition: selection
falsepositives:
  - "Legitimate admin access from allow-listed IPs"
level: high

Starter rule — tune thresholds/filters for your environment before deploying

title: "OWASP A05 — Security Misconfiguration (directory listing / sensitive file exposure) — OWASP A05 — FTP directory listing exposed at /ftp"
id: "2ff22d52-d80f-44fd-aaef-9f9b736b45fd"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_b62232809b9c2506791c81ad.
    
    Detection gap observed:
    Probe a05-ftp-listing-001 confirmed vulnerable. Indicator matched: body~"package.json". FTP directory listing exposed at /ftp
    
    Recommended defense:
    Desabilitar listagem de diretórios (autoindex off em nginx, Options -Indexes em Apache). Mover arquivos sensíveis para fora do webroot. Aplicar policy de "deny by default" em arquivos estáticos.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_b62232809b9c2506791c81ad"
  - "https://attack.mitre.org/techniques/T1083/"
date: "2026-07-25"
tags:
  - attack.t1083
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  selection:
    cs-uri-stem|contains:
      - /ftp
      - /.git
      - /.env
      - /encryptionkeys
    http_status: 200
  condition: selection
falsepositives:
  - "Intentionally-public asset directories"
level: medium

Starter rule — tune thresholds/filters for your environment before deploying

title: "OWASP A09 — Logging/Security Logging Failure (key/secret directory exposure) — OWASP A09 — Encryption keys directory listing leaks premium.key"
id: "a26d7775-a4a0-4ac2-9096-752e54ea3c73"
status: experimental
description: |
    Auto-generated starter rule from DoesItDefend finding fnd_e2f8947081ba132f2fe7558e.
    
    Detection gap observed:
    Probe a09-secret-keys-001 confirmed vulnerable. Indicator matched: body~"premium.key". Encryption keys directory listing leaks premium.key
    
    Recommended defense:
    Não expor diretórios de keys/secrets via webroot. Rotacionar chaves comprometidas. Centralizar gestão de segredos em Secret Manager/Vault.
author: "DoesItDefend (auto-generated)"
references:
  - "doesitdefend://finding/fnd_e2f8947081ba132f2fe7558e"
  - "https://attack.mitre.org/techniques/T1552/001/"
date: "2026-07-25"
tags:
  - attack.t1552.001
  - doesitdefend.severity.high
logsource:
  product: webserver
  category: access
detection:
  response_keywords:
    - premium.key
    - private.key
    - id_rsa
    - .pem
  condition: response_keywords
falsepositives:
  - "Public example keys clearly marked as canaries"
level: high

Starter rule — tune thresholds/filters for your environment before deploying