David Munene

Performed a full web application penetration test of OWASP Juice Shop following the OWASP Testing Guide v4, covering authentication, authorization, API, client-side and business-logic testing. Produced both a technical findings report and a business-facing executive summary. - Identified 13 vulnerabilities (2 Critical, 6 High, 5 Medium) mapped to the OWASP Top 10 (2021). - Exploited SQL injection for authentication bypass and admin takeover, and JWT manipulation for privilege escalation to administrator. - Demonstrated reflected and DOM-based XSS (escalating to JWT exfiltration via a listener), IDOR on baskets, and BOLA on feedback submission. - Found an unauthenticated /api/Users endpoint, /ftp directory exposure, verbose error/information disclosure, and a business-logic flaw accepting negative quantities (negative-total checkout) - Tooling: Burp Suite, Nmap, Wappalyzer, jwt.io, CyberChef, RockYou wordlist

Performed a full web and API penetration test of OWASP's crAPI application, following a structured methodology aligned to the OWASP API Security Top 10, PTES, and NIST SP 800-115. Covered the full cycle from reconnaissance and endpoint enumeration through exploitation and post-exploitation, and produced both a technical findings report and a business-facing executive report. - Identified 6 vulnerabilities (4 Critical, 2 High) across 18 API endpoints. - Exploited Broken Object Level Authorization (BOLA) on service-report and order endpoints, accessing other users' PII by enumerating sequential IDs. - Demonstrated JWT algorithm confusion / signature bypass (forging alg:none tokens) and chained it into privilege escalation from user to admin by tampering with the role claim. - Found excessive data exposure leaking other users' emails and vehicle IDs, and an unrestricted file upload allowing non-image files (RCE/XSS pathway). - Tooling: Burp Suite, Postman, Nmap, jwt.io, CyberChef - Delivered a technical report (findings, PoC, CVSS, remediation) and an executive report translating each finding into business and compliance impact

Designed and deployed an isolated virtualised lab for hands-on security testing and skill development. Built on VirtualBox with segmented networks for safe, repeatable practice, using Kali Linux as the attack platform with a core toolkit of Metasploit, Nmap, Burp Suite, and Wireshark. The lab supports focused web and API exploitation practice against deliberately vulnerable targets.