{ "summary": { "title": "OWASP Juice Shop", "owner": "Björn Kimminich", "description": "OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!" }, "detail": { "contributors": [], "diagrams": [ { "cells": [ { "position": { "x": 64, "y": 173 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "B2C Customer (Browser)" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "actor", "zIndex": 1, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "c6776f4f-09fe-4d0d-ab68-09883ad42849" }, { "group": "right", "id": "9fcc50c6-38cb-4fb2-b723-339fdaff44d3" }, { "group": "bottom", "id": "7e8054b3-edd5-48de-ae7e-d3f7929cd40d" }, { "group": "left", "id": "bcac9bd9-5e96-4543-a765-a55adb00e727" } ] }, "id": "5c682ec9-c352-442e-b61c-2de8ed53ea22", "data": { "name": "B2C Customer (Browser)", "description": "", "type": "tm.Actor", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "providesAuthentication": false } }, { "position": { "x": 68, "y": 52 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "Google" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": "4 3" } }, "visible": true, "shape": "actor", "zIndex": 2, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "05c31410-6225-492d-9ea3-16a99c0c0d87" }, { "group": "right", "id": "616263cd-4c98-4a82-9048-e2b69c1146d4" }, { "group": "bottom", "id": "568d6f31-e14d-4492-bdc3-225c5ff83a6e" }, { "group": "left", "id": "05af6697-eaf0-4c43-bfd3-d54fbf1f82a0" } ] }, "id": "d02fa030-ca19-47ad-8920-0980cd87a351", "data": { "name": "Google", "description": "", "type": "tm.Actor", "isTrustBoundary": false, "outOfScope": true, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "providesAuthentication": false } }, { "position": { "x": 455, "y": 1 }, "size": { "width": 100, "height": 100 }, "attrs": { "text": { "text": "Angular\nFrontend" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "process", "zIndex": 3, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "1bddf582-043c-4d8e-9a53-350eac808b90" }, { "group": "right", "id": "904cbe19-3638-4feb-94e4-e7281b7794c2" }, { "group": "bottom", "id": "30575040-42af-4ef6-b2b9-1de13b9aa3d6" }, { "group": "left", "id": "014fad89-51ef-4f23-ad40-2988572f190a" } ] }, "id": "064304c2-9672-44f2-9e08-982d58145bc0", "data": { "name": "Angular\nFrontend", "description": "", "type": "tm.Process", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false } }, { "position": { "x": 468, "y": 228 }, "size": { "width": 100, "height": 100 }, "attrs": { "text": { "text": "Application\nServer" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "process", "zIndex": 4, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "9fe46cff-e8ce-4f15-913c-6f84d121ca8e" }, { "group": "right", "id": "2ab189f0-e92a-4292-b22e-677cb5ba0db3" }, { "group": "bottom", "id": "16f33942-bd56-4c33-97fa-7c5964fb6174" }, { "group": "left", "id": "460b2f47-430c-445e-b239-feef68ec5188" } ] }, "id": "edced7d1-6206-43bc-94ab-aa515977042a", "data": { "name": "Application\nServer", "description": "Node.js / Express", "type": "tm.Process", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false } }, { "position": { "x": 830, "y": 393 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "SQLite Database" }, "topLine": { "strokeWidth": 1.5, "strokeDasharray": null }, "bottomLine": { "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "store", "zIndex": 5, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "ca6ed148-1a03-4908-a70c-9fd8a6d5fdd1" }, { "group": "right", "id": "044c574c-0f06-4614-8ceb-1877c328f69b" }, { "group": "bottom", "id": "10cb232e-cec6-435a-a483-303fa4c164a5" }, { "group": "left", "id": "40178547-8efd-443f-a65a-224ffb9fc01c" } ] }, "id": "673196a0-0797-4c56-974b-b169ec27accb", "data": { "name": "SQLite Database", "description": "", "type": "tm.Store", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "isALog": false, "storesCredentials": false, "isEncrypted": false, "isSigned": false } }, { "position": { "x": 568, "y": 396 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "MarsDB NoSQL DB" }, "topLine": { "strokeWidth": 1.5, "strokeDasharray": null }, "bottomLine": { "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "store", "zIndex": 6, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "88d56605-49ad-4ac2-b1bd-45afd53a9d77" }, { "group": "right", "id": "4beacfc5-e9a2-4f2a-85dd-f4b134b227bf" }, { "group": "bottom", "id": "2d55750e-8983-4ad6-afe6-aaa5bf86a861" }, { "group": "left", "id": "c15e00af-a9dd-49f0-a64a-ea1a99b2e7c6" } ] }, "id": "38c5137f-1570-446a-9978-a98f84fe1c59", "data": { "name": "MarsDB NoSQL DB", "description": "", "type": "tm.Store", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "isALog": false, "storesCredentials": false, "isEncrypted": false, "isSigned": false } }, { "position": { "x": 828, "y": 255 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "Local File System" }, "topLine": { "strokeWidth": 1.5, "strokeDasharray": null }, "bottomLine": { "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "store", "zIndex": 7, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "070ca341-9f2d-4bdf-b960-40fc904b49b4" }, { "group": "right", "id": "b35394a9-5c07-439d-b522-bf6edde4a5a7" }, { "group": "bottom", "id": "c5421f55-91b8-4c72-b3d4-9a5089d94f66" }, { "group": "left", "id": "c90f1a42-5a45-4d63-8688-ca2e99dd126a" } ] }, "id": "00ae7380-5510-4772-8f98-d83df41035b6", "data": { "name": "Local File System", "description": "", "type": "tm.Store", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "isALog": false, "storesCredentials": false, "isEncrypted": false, "isSigned": false } }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": true, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "" } }, "position": 0.5 } ], "id": "9982f3c3-a7ed-459b-b89a-ca11dc7450e2", "trustBoundaryIds": [], "source": { "cell": "5c682ec9-c352-442e-b61c-2de8ed53ea22" }, "target": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "vertices": [ { "x": 355, "y": 146 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": "4 3" } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "OAuth2", "description": "", "outOfScope": true, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": true, "isPublicNetwork": true, "protocol": "", "threats": [], "trustBoundaryIds": [ "4177b57c-c42f-43c2-9b95-682c87da652f" ] }, "labels": [ { "attrs": { "label": { "text": "OAuth2" } }, "position": 0.5 } ], "id": "1506e181-e42a-4ed7-b9ee-0bf6a8f0a442", "trustBoundaryIds": [], "source": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "target": { "cell": "d02fa030-ca19-47ad-8920-0980cd87a351" }, "vertices": [ { "x": 337, "y": 35 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "API Requests", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "API Requests" } }, "position": 0.5 } ], "id": "81505751-e49c-496a-9797-29407b0e93eb", "trustBoundaryIds": [], "source": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "target": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "vertices": [ { "x": 420, "y": 200 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Invoices", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Invoices" } }, "position": { "distance": 0.4545744602063211, "offset": -14.064892638757218 } } ], "id": "c114469f-7138-42f1-ae13-830a6d6deb0a", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "00ae7380-5510-4772-8f98-d83df41035b6" }, "vertices": [ { "x": 683, "y": 236 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": true, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "" } }, "position": 0.5 } ], "id": "262877c8-7115-40c7-8d75-b4c421fa0a31", "trustBoundaryIds": [], "source": { "cell": "82095edc-bdca-448b-8c28-ed1aaba2e9e9" }, "target": { "cell": "2f427832-3419-4b43-ae77-338f8636ca2b" }, "vertices": [] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Orders", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Orders" } }, "position": 0.5 } ], "id": "c547ffa4-11d2-4db6-be4f-abbe815cc691", "trustBoundaryIds": [], "source": { "cell": "2f427832-3419-4b43-ae77-338f8636ca2b" }, "target": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "vertices": [] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Product Inventory", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Product Inventory" } }, "position": 0.5 } ], "id": "1ee7b5ca-e60b-433f-a902-5423526acfee", "trustBoundaryIds": [], "source": { "cell": "12bf3793-217c-4863-b430-718182257f1a" }, "target": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "vertices": [] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "User Management", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "User Management" } }, "position": 0.5 } ], "id": "7a41a372-7a13-4185-97f0-24389f516785", "trustBoundaryIds": [], "source": { "cell": "0191343a-8439-45d7-b9e4-6b052f91415d" }, "target": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "vertices": [ { "x": 679, "y": 18 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "all other data", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "all other data" } }, "position": 0.5 } ], "id": "b45420c1-79a9-446b-8496-7c9989127ccb", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "673196a0-0797-4c56-974b-b169ec27accb" }, "vertices": [] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Orders", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Orders" } }, "position": 0.5 } ], "id": "7c0e8247-8233-4d0c-a76a-5aa93f693672", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "38c5137f-1570-446a-9978-a98f84fe1c59" }, "vertices": [ { "x": 509, "y": 385 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Reviews", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Reviews" } }, "position": 0.5 } ], "id": "d7376660-7b81-4636-a0e3-80b5418bb0b9", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "38c5137f-1570-446a-9978-a98f84fe1c59" }, "vertices": [ { "x": 565, "y": 378 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Invoices", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": true, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Invoices" } }, "position": 0.5 } ], "id": "9810296f-d7c5-40fe-a603-5adf11075eb3", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "5c682ec9-c352-442e-b61c-2de8ed53ea22" }, "vertices": [] }, { "shape": "trust-boundary-curve", "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Boundary", "name": "", "description": "", "isTrustBoundary": true, "hasOpenThreats": false, "crossingFlows": [ "1506e181-e42a-4ed7-b9ee-0bf6a8f0a442" ], "containedElements": [ "d02fa030-ca19-47ad-8920-0980cd87a351" ] }, "labels": [ { "attrs": { "label": { "text": "Trust Boundary" } } } ], "id": "4177b57c-c42f-43c2-9b95-682c87da652f", "trustBoundaryIds": [], "source": { "x": 93, "y": 19 }, "target": { "x": 65, "y": 146 }, "vertices": [ { "x": 252, "y": 54 }, { "x": 246, "y": 143 } ] }, { "shape": "trust-boundary-curve", "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Boundary", "name": "", "description": "", "isTrustBoundary": true, "hasOpenThreats": false, "crossingFlows": [], "containedElements": [] }, "labels": [ { "attrs": { "label": { "text": "Trust Boundary" } } } ], "id": "7b50075d-f344-4fe4-afdb-ef5fe1ea7013", "trustBoundaryIds": [], "source": { "x": 183, "y": 441 }, "target": { "x": 286, "y": 124 }, "vertices": [ { "x": 310, "y": 320 } ] }, { "shape": "trust-boundary-curve", "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Boundary", "name": "", "description": "", "isTrustBoundary": true, "hasOpenThreats": false, "crossingFlows": [], "containedElements": [] }, "labels": [ { "attrs": { "label": { "text": "Trust Boundary" } } } ], "id": "6507bd58-dfef-4c3f-a851-5d27c53988f8", "trustBoundaryIds": [], "source": { "x": 772, "y": 161 }, "target": { "x": 784, "y": 1 }, "vertices": [ { "x": 787, "y": 90 } ] }, { "shape": "trust-boundary-curve", "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Boundary", "name": "", "description": "", "isTrustBoundary": true, "hasOpenThreats": false, "crossingFlows": [], "containedElements": [] }, "labels": [ { "attrs": { "label": { "text": "Trust Boundary" } } } ], "id": "83ff5e5b-39b0-4df9-abaa-964368be5ec0", "trustBoundaryIds": [], "source": { "x": 417, "y": 128 }, "target": { "x": 616, "y": 156 }, "vertices": [] }, { "shape": "trust-boundary-curve", "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Boundary", "name": "", "description": "", "isTrustBoundary": true, "hasOpenThreats": false, "crossingFlows": [], "containedElements": [] }, "labels": [ { "attrs": { "label": { "text": "Trust Boundary" } } } ], "id": "b0b5bdd7-2ebd-4425-a1cc-325f89b43559", "trustBoundaryIds": [], "source": { "x": 749, "y": 492 }, "target": { "x": 753, "y": 198 }, "vertices": [ { "x": 775, "y": 346 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "Configuration", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "Configuration" } }, "position": 0.5 } ], "id": "f086ee68-331a-4d79-9e9f-3cf88e7db4f5", "trustBoundaryIds": [], "source": { "cell": "00ae7380-5510-4772-8f98-d83df41035b6" }, "target": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "vertices": [ { "x": 663, "y": 260 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Actor", "name": "Accounting (Browser)", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [], "providesAuthentication": false, "isALog": false, "storesCredentials": false, "isSigned": false, "crossingFlows": [], "containedElements": [] }, "labels": [ { "attrs": { "label": { "text": "Logging" } }, "position": 0.5 } ], "id": "e6f41c33-4885-4f7f-b662-96e285a075dd", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "00ae7380-5510-4772-8f98-d83df41035b6" }, "vertices": [ { "x": 737, "y": 306 } ] }, { "shape": "flow", "attrs": { "line": { "stroke": "#333333", "targetMarker": { "name": "block" }, "sourceMarker": { "name": "" }, "strokeDasharray": null } }, "width": 200, "height": 100, "zIndex": 10, "connector": "smooth", "data": { "type": "tm.Flow", "name": "API Responses", "description": "", "outOfScope": false, "isTrustBoundary": false, "reasonOutOfScope": "", "hasOpenThreats": false, "isBidirectional": false, "isEncrypted": false, "isPublicNetwork": false, "protocol": "", "threats": [], "trustBoundaryIds": [] }, "labels": [ { "attrs": { "label": { "text": "API Responses" } }, "position": 0.5 } ], "id": "16fd1f9b-7cb7-4989-b3f4-3f15cc4f4773", "trustBoundaryIds": [], "source": { "cell": "edced7d1-6206-43bc-94ab-aa515977042a" }, "target": { "cell": "064304c2-9672-44f2-9e08-982d58145bc0" }, "vertices": [ { "x": 514, "y": 150 } ] }, { "position": { "x": 66, "y": 296 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "B2B Customer (Browser)" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "actor", "zIndex": 13, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "6960ec9d-aa2b-4bb9-a151-2869cad971c9" }, { "group": "right", "id": "0d29792d-6520-41f2-9ede-ceb3fd8de70c" }, { "group": "bottom", "id": "305958ed-8101-456f-a9aa-75ef38e01cc3" }, { "group": "left", "id": "6d2a01c5-68ae-4f13-91e8-15bd541c0104" } ] }, "id": "82095edc-bdca-448b-8c28-ed1aaba2e9e9", "data": { "name": "B2B Customer (Browser)", "description": "", "type": "tm.Actor", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "providesAuthentication": false } }, { "position": { "x": 307, "y": 338 }, "size": { "width": 100, "height": 100 }, "attrs": { "text": { "text": "B2B API" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "process", "zIndex": 14, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "ba838aa1-af7c-4026-9eb8-89cfb51f2cd3" }, { "group": "right", "id": "3c755b3d-f8e9-4beb-bcb9-c57a4f990e2f" }, { "group": "bottom", "id": "196cf667-e843-4592-ab4a-8ddb2af7d05d" }, { "group": "left", "id": "f293f5c5-9445-43ce-8e54-e0b0d2a94357" } ] }, "id": "2f427832-3419-4b43-ae77-338f8636ca2b", "data": { "name": "B2B API", "description": "", "type": "tm.Process", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false } }, { "position": { "x": 844, "y": 1 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "Admin (Browser)" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "actor", "zIndex": 17, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "287b1341-cdb7-49ed-91ae-09b318194681" }, { "group": "right", "id": "34e472f5-b7d7-4f28-87cc-19a0021df08f" }, { "group": "bottom", "id": "118a4d60-189a-42f1-893a-cd17c624306e" }, { "group": "left", "id": "a0ad1418-944f-4a25-951a-58783ee2a992" } ] }, "id": "0191343a-8439-45d7-b9e4-6b052f91415d", "data": { "name": "Admin (Browser)", "description": "", "type": "tm.Actor", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "providesAuthentication": false } }, { "position": { "x": 847, "y": 107 }, "size": { "width": 160, "height": 80 }, "attrs": { "text": { "text": "Accounting (Browser)" }, "body": { "stroke": "#333333", "strokeWidth": 1.5, "strokeDasharray": null } }, "visible": true, "shape": "actor", "zIndex": 18, "ports": { "groups": { "top": { "position": "top", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "right": { "position": "right", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "bottom": { "position": "bottom", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } }, "left": { "position": "left", "attrs": { "circle": { "r": 4, "magnet": true, "stroke": "#5F95FF", "strokeWidth": 1, "fill": "#fff", "style": { "visibility": "hidden" } } } } }, "items": [ { "group": "top", "id": "559d7d53-a0a3-472e-bb1d-028d9ae4203f" }, { "group": "right", "id": "55887021-a044-4c0c-ac74-1fb4fd1fb959" }, { "group": "bottom", "id": "44361896-3ad1-41b1-b023-91d5cd93ed99" }, { "group": "left", "id": "4cd0a9d3-c470-4807-b42b-6613fcc1269d" } ] }, "id": "12bf3793-217c-4863-b430-718182257f1a", "data": { "name": "Accounting (Browser)", "description": "", "type": "tm.Actor", "isTrustBoundary": false, "outOfScope": false, "reasonOutOfScope": "", "threats": [], "hasOpenThreats": false, "providesAuthentication": false } } ], "version": "2.6.0", "title": "OWASP Cornucopia", "description": "These are the OWASP Cornucopia threats connected with the OWASP Juice Shop challenges", "thumbnail": "./public/content/images/thumbnail.eop.jpg", "id": 0, "diagramType": "EOP" } ], "diagramTop": 10, "threatTop": 100, "reviewer": "Johan Sydseter" }, "version": "2.6.0" }