OWASP Juice Shop

What is OWASP Juice Shop?

OWASP Juice Shop is a deliberately vulnerable web application built for learning and practising web security. It mimics a modern online juice store, complete with catalogue, basket, user accounts, reviews and a REST API, but it is riddled with security flaws on purpose. It is an OWASP flagship project, open source, and built on current technology (Node.js, Express and Angular), which makes it far closer to a real-world application than the classic PHP-based labs.

Its vulnerabilities cover the whole OWASP Top 10 and much more: SQL injection, XSS, broken access control, cryptographic failures, poorly validated JWTs, sensitive data exposure, XXE, SSRF and flawed business logic. Each flaw is a challenge rated from one to six stars, and the app itself detects when you solve one.

What Juice Shop is used for

• Learning web hacking from scratch against a legal target you can break without worry.
• Practising with tools such as Burp Suite or OWASP ZAP against a modern single-page app backed by an API.
• Training developers: seeing a bug from the attacker's side makes the case for secure coding better than any slide.
• Running internal CTFs at companies, universities or meetups.
• Testing scanners and WAFs in a controlled environment.

How to install Juice Shop

Docker is the quickest route. Two commands and the shop is running:

docker pull bkimminich/juice-shop
docker run --rm -p 3000:3000 bkimminich/juice-shop

Open http://localhost:3000 in your browser. Because of --rm, stopping the container wipes your progress and the app goes back to a clean state, which is handy if you break something.

If you would rather run it from source, you need a Node.js version supported by the project:

git clone https://github.com/juice-shop/juice-shop.git --depth 1
cd juice-shop
npm install
npm start

Important: do not expose Juice Shop to the Internet. It is vulnerable by design; run it locally or on an isolated lab network.

How to use Juice Shop: practical examples

Find the Score Board

The first challenge is finding the Score Board, the hidden page listing every challenge, its difficulty and which ones you have solved. There is no visible menu link. Hint: the app is an Angular SPA, so its routes are defined in the JavaScript your browser downloads. Open developer tools, look through main.js and search for interesting route names. That first step teaches a core lesson: nothing on the client side is secret.

Set up a proxy

Before going further, route your browser through Burp Suite or ZAP. Juice Shop talks to its API constantly (paths like /rest/ and /api/), and seeing those requests is key to most challenges.

SQL injection on the login

A classic challenge is logging in as the administrator without knowing the password. Try input in the email field that breaks the SQL query, for example:

' OR 1=1--

with any password. If it works, the query returns the first user in the table. Then ask yourself why it worked and how to prevent it (parameterised queries).

XSS in the search bar

The search field reflects what you type back into the page. Try a classic payload built on an HTML tag with an event handler, or an iframe with a special URL scheme, and watch how Angular handles it. Juice Shop rewards you once code runs in the page's context.

Explore the API

curl -s http://localhost:3000/api/Products | head -c 500
curl -s "http://localhost:3000/rest/products/search?q=apple"

Checking what each endpoint returns outside the UI often reveals fields that should not be public and access control problems.

Hacking Instructor and coding challenges

Some challenges come with interactive tutorials (Hacking Instructor) that walk you through step by step. Several also have a coding challenge phase: after exploiting the bug you are shown the source code and must pick the vulnerable line and the right fix. It is a great way to close the loop between attack and defence.

Pro tips

• Start with one- and two-star challenges and work upwards; five- and six-star ones require chaining several techniques.
• Use the official guide sparingly: the free book Pwning OWASP Juice Shop explains every challenge and its solution. Only read it after you have been stuck for a good while.
• Write up each vulnerability with the payload, root cause and mitigation; that is the backbone of a pentest report.
• Pair it with theory: the PortSwigger Web Security Academy covers each vulnerability class in depth.
• For a CTF, the juice-shop-ctf-cli tool generates challenges and flags for platforms such as CTFd.

Pros and cons

Pros	Cons
Free and open source	The sheer number of challenges can overwhelm at first
Modern stack (SPA + REST API)	Without a persistent container, progress is lost
Automatically detects solved challenges	Solutions for everything are published
Covers the OWASP Top 10 and beyond	Web security only

Juice Shop alternatives

• DVWA: simpler and more classic, with security levels to compare code.
• PortSwigger Web Security Academy: comprehensive free online labs.
• PentesterLab: progressive web exercises, partly paid.
• HackTheBox: full machines where the web is just one piece.

Frequently asked questions

Is OWASP Juice Shop free?

Yes. It is an open-source OWASP project you can run on your own machine at no cost.

Where is the Juice Shop Score Board?

It is hidden on purpose: finding it is the first challenge. Look through the app's JavaScript for the defined routes.

Do I need to know how to code?

Not to get started, but understanding HTML, JavaScript and HTTP helps enormously, especially for the higher-star challenges.

Can I host it on a public server?

Not a good idea. Being vulnerable by design, anyone could attack it and use it as a foothold. Keep it local or on an isolated network.

If you want to strengthen your HTTP, Linux and command-line foundations with hands-on exercises, visit the Hackers en Acción Academy.