# CLR-6 practice range — OWASP Juice Shop + OWASP ZAP

A small, safe lab you run **on your own machine**: a deliberately vulnerable web
app (OWASP Juice Shop) and an automated web scanner (OWASP ZAP). The goal is to
learn how to stand up a practice environment and read a scanner's report — the
two everyday skills behind detection and assessment work.

> **Rules of engagement.** Run this only on a computer you own. Never aim Juice
> Shop or ZAP at any site or system you do not own and have explicit written
> permission to test. Keep the app bound to `localhost` (the compose file does
> this for you); do not expose it on the internet.

## What you need

- Docker (Docker Desktop on Windows/macOS, or Docker Engine on Linux).

## 1. Start the vulnerable app

From this folder:

```
docker compose up
```

Wait for the line `Server listening on port 3000`, then open
**http://localhost:3000** in your browser. You are looking at Juice Shop.

Juice Shop has a built-in **Score Board** that tracks the training challenges —
finding it is the very first one. It lives under the route `/#/score-board`.

## 2. Run an automated baseline scan with ZAP

ZAP's *baseline* scan is passive and quick: it spiders the app and reports
common issues (missing security headers, cookie flags, etc.) without attacking.

**Linux:**

```
docker run --rm --network host ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://localhost:3000
```

**macOS / Windows** (Docker Desktop):

```
docker run --rm ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://host.docker.internal:3000
```

The command ends with a summary line of four counters, for example:

```
FAIL: 0   WARN: 4   IGNORE: 0   PASS: 22
```

- **FAIL** — a rule that broke the configured fail threshold: review first.
- **WARN** — worth a look.
- **IGNORE** — rules you chose to mute.
- **PASS** — checks that passed.

`-t` sets the **target** URL. Each `WARN`/`FAIL` line above the summary names the
rule, its ID and the affected URLs — that is your reading material.

## 3. Clean up

```
docker compose down
```

## Where to go next

- Work through the Juice Shop Score Board challenges, easiest first.
- Read ZAP's docs on the baseline scan and on turning findings into a report.

Everything here is official, open-source software, used the way its authors
intend: for learning, in an environment you control.