Sample Deliverable

A ReconX security report, start to finish

This is a real report generated by ReconX against theOWASP Juice Shop demo application, a deliberately vulnerable app used for demonstration. Every scan produces the same consultancy-grade deliverable in PDF, Markdown, DOCX, and JSON.

TargetOWASP Juice Shop (demo application)
ProfileStandard, authenticated endpoints seeded
DateAugust 16, 2026
Generated byReconX by CloudDrove v2.1.1
1Critical
0High
4Medium
0Low
1Info
6Total

Findings

Critical

SQL Injection in parameter 'q'

/rest/products/search?q=CWE-89A03:2021 InjectionConfidence: Certain

The product-search endpoint concatenates the q parameter directly into a SQL query. Injecting a single quote returns a database error, and a UNION payload returns arbitrary rows, confirming injection.

Evidence
GET /rest/products/search?q=test'
-> HTTP 500  Error: SQLITE_ERROR: near "'%'": syntax error
Proof of concept
curl "https://target/rest/products/search?q=test'"
Remediation

Use parameterized queries / prepared statements for every database interaction. Never concatenate user input into SQL strings.

Medium

Possible NoSQL injection in parameter 'q'

/rest/products/search?q=CWE-943A03:2021 InjectionConfidence: Tentative

An operator-style payload produced a markedly different response (HTTP 200 baseline vs HTTP 500 injected), indicating the input reaches a query engine without type validation. Flagged tentative for manual confirmation.

Evidence
Baseline status: 200   Injected status: 500
Proof of concept
curl "https://target/rest/products/search?q[$ne]=1"
Remediation

Validate and type-cast input before it reaches the datastore; reject query operators in user-supplied string fields.

Medium

Sensitive endpoint exposed: /metrics

/metricsCWE-538A05:2021 Security MisconfigurationConfidence: Firm

A Prometheus-style /metrics endpoint is publicly reachable (HTTP 200). Operational metrics can leak internal hostnames, route names, traffic volumes, and version details useful to an attacker.

Evidence
GET /metrics -> HTTP 200 (metrics payload returned)
Proof of concept
curl "https://target/metrics"
Remediation

Restrict /metrics to the monitoring network or require authentication; never expose it to the public internet.

Medium

Email authentication hardening (SPF & DMARC missing)

DNSCWE-290A05:2021 Security MisconfigurationConfidence: Certain

No SPF or DMARC records were found for the domain, and no DKIM keys at common selectors. Without these, any server can spoof mail from the domain. (Grouped: 2 medium + 1 informational finding.)

Evidence
SPF: none    DMARC: none    DKIM: not found at common selectors
Remediation

Publish an SPF record, a DMARC policy (start at p=quarantine, move to p=reject), and DKIM keys for your sending selectors.

Every finding in a real report also includes reproduction steps, a replayable curl proof of concept, complete unclipped HTTP evidence, OWASP Top 10 coverage, and (when a prior scan exists) differential analysis of what changed.

Want a report like this for your own systems?

ReconX runs authorized, in-scope assessments and delivers a report you can hand to engineering.

Request access