Goal

Complete Lab 4 — SBOM Generation & Software Composition Analysis for OWASP Juice Shop bkimminich/juice-shop:v19.0.0. Generate SBOMs using Syft and Trivy, perform vulnerability scanning with Grype and Trivy, and produce a comprehensive toolchain comparison across package detection, vulnerability coverage, license analysis, and secrets scanning.

Changes

• labs/submission4.md — full lab report covering all 3 tasks
• labs/lab4/syft/juice-shop-syft-native.json — Syft SBOM in native JSON format (3.6 MB, 1,001 packages)
• labs/lab4/syft/juice-shop-syft-table.txt — Syft human-readable package table
• labs/lab4/syft/grype-vuln-results.json — Grype vulnerability scan results (117 findings)
• labs/lab4/syft/grype-vuln-table.txt — Grype human-readable vulnerability table
• labs/lab4/trivy/juice-shop-trivy-detailed.json — Trivy full scan JSON (116 findings)
• labs/lab4/trivy/juice-shop-trivy-table.txt — Trivy human-readable table
• labs/lab4/trivy/trivy-secrets.txt — Trivy secrets scan (2 findings: RSA private key + JWT token)
• labs/lab4/trivy/trivy-licenses.json — Trivy license scan (28 unique license types)
• labs/lab4/analysis/sbom-analysis.txt — Package and license count analysis
• labs/lab4/analysis/vulnerability-analysis.txt — Vulnerability severity breakdown
• labs/lab4/comparison/accuracy-analysis.txt — Package and CVE overlap comparison
• labs/lab4/comparison/grype-cves.txt — Grype unique CVE list (90 IDs)
• labs/lab4/comparison/trivy-cves.txt — Trivy unique CVE list (88 IDs)
• labs/lab4/comparison/syft-packages.txt — Syft package list for diff
• labs/lab4/comparison/trivy-packages.txt — Trivy package list for diff

Testing

• Verified all SBOM files generated successfully with Get-Item and file size checks
• Confirmed package counts via PowerShell and jq queries against generated JSON files
• Validated vulnerability results by parsing grype-vuln-results.json and juice-shop-trivy-detailed.json with ConvertFrom-Json
• Cross-referenced CVE overlap using PowerShell set comparison (-contains) on extracted ID lists
• Confirmed secrets scan output by reading trivy-secrets.txt
• Verified analysis files populated correctly with Get-Content

Artifacts & Screenshots

• Grype found 117 vulnerabilities (11 Critical, 60 High, 31 Medium, 3 Low, 12 Negligible)
• Trivy found 116 vulnerabilities (10 Critical, 55 High, 33 Medium, 18 Low)
• Only 26 CVEs in common between tools (~17% overlap) — confirming complementary database coverage
• Trivy secrets scan found 2 hardcoded secrets: RSA private key in lib/insecurity.ts and JWT token in test spec
• Syft detected 1,001 packages (990 npm, 10 deb, 1 binary); Trivy detected 997 packages
• 988 packages in common between tools; divergence caused by Debian version string formatting differences

Checklist

• PR title is clear and descriptive
• Documentation updated if needed
• No secrets or large temporary files committed