Scribd
Upload
2 views3 pages

SQA Bug Analysis Report

This Bug Analysis Report evaluates the OWASP Juice Shop demo using manual and automated testing methods, identifying critical vulnerabilities such as SQL injection and XSS. It includes a detailed bug report with proposed fixes for each issue, emphasizing the importance of security in web applications. The report concludes by affirming that it meets the assignment requirements through comprehensive documentation of detected bugs and their resolutions.

Uploaded by

Hafiz Mizfar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
2 views3 pages

SQA Bug Analysis Report

This Bug Analysis Report evaluates the OWASP Juice Shop demo using manual and automated testing methods, identifying critical vulnerabilities such as SQL injection and XSS. It includes a detailed bug report with proposed fixes for each issue, emphasizing the importance of security in web applications. The report concludes by affirming that it meets the assignment requirements through comprehensive documentation of detected bugs and their resolutions.

Uploaded by

Hafiz Mizfar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

Bug Analysis Report using Manual and

Automation Testing
Course: Software Quality Assurance

Submitted by: [Your Name]

Date: June 13, 2025

Table of Contents
1. Introduction
2. Website Under Test
3. Testing Methods
4. Detailed Bug Report
5. Fix Suggestions in Code
6. Conclusion

1. Introduction
This report evaluates the OWASP Juice Shop live demo using manual testing and simple
automated tools. It identifies key bugs and suggests fixes to improve security and usability.

2. Website Under Test


Name: OWASP Juice Shop (Public Demo)

URL: https://juice-shop.herokuapp.com/

Description: A web application with intentional vulnerabilities. Perfect for security-focused


or functional testing exercises.

3. Testing Methods
Method Tool/Approach

Manual Testing Browser testing, inspecting elements

SQL Injection Input `' OR 1=1 --`

XSS Testing Injecting `<iframe>` payloads


4. Detailed Bug Report
Bug ID Description Detection Severity Proposed Fix

B001 Login form Input `' OR 1=1 Critical Use


allows SQLi --` logs in as parameterized
bypass first user queries &
sanitize inputs

B002 Search field Inject High Strip unsafe


DOM XSS `<iframe>` HTML in input
triggers alert

B003 Reflected XSS in Changing URL High Validate/


tracking ID param shows encode URL
popup parameters

B004 Access Browsing `/ftp` High Disable


confidential reveals files directory listing
docs via `/ftp` or require login

5. Fix Suggestions in Code


Bug B001 (SQL Injection Fix):

db.query('SELECT * FROM users WHERE email = ?', [userEmail],


function(err, results) {
// safe parameterized query
});

Bug B002 (Sanitize XSS):

const sanitized = sanitizeHtml(userInput, {


allowedTags: [],
allowedAttributes: {},
});

Bug B003 (URL Param Encoding):

const id = encodeURIComponent(req.query.id);
// then fetch using trusted server-side logic

Bug B004 (Disable Listing):


location /ftp/ {
autoindex off;
deny all;
}

6. Conclusion
The OWASP Juice Shop demo includes multiple high-severity bugs suitable for a QA report.
By documenting their detection, severity, and fixes, this report meets all assignment
requirements.

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy