OWASP Juice Shop CTF: Complete Setup Guide with CTFd (2026)

OWASP Juice Shop includes a built-in CTF (Capture the Flag) mode that transforms it from an individual training tool into a full competitive team event. In CTF mode, each solved challenge generates a unique flag string that participants submit to a central scoring platform — typically CTFd — to earn points for their team.

This guide covers everything you need to run a successful Juice Shop CTF event: Docker deployment, CTF_KEY configuration, flag generation, CTFd installation and integration, multi-team server setup, and tips for facilitating a productive event.

What Is Juice Shop CTF Mode?

In standard Juice Shop, completing a challenge triggers a congratulatory popup notification and marks the challenge as solved on the scoreboard. There is no flag, no submission, and no centralized scoring.

In CTF mode, Juice Shop replaces the popup with a flag string — a unique token tied to the specific challenge and your instance’s secret key. The format is typically:

juice_shop{a3f2d1...sha256hash...}

Participants copy this flag and submit it to the CTF platform to earn points. The CTF platform tracks which team submitted which flag, calculates scores, and displays a live leaderboard.

Why CTF mode is valuable for security training:

Creates healthy competition that motivates participants to explore the application thoroughly
Provides objective scoring that lets organizers track team progress
Prevents participants from just copying each other’s solutions (each flag is tied to the instance key)
Makes the event feel like a real CTF competition, building skills transferable to public CTF events (picoCTF, CTFtime competitions)

Prerequisites

To run a Juice Shop CTF event, you need:

Docker installed on the host server(s) — or Docker Compose for multi-team setups
A CTF platform — CTFd is the most widely used (open source, free)
Network access — participants need to reach Juice Shop; CTFd needs to be accessible to flag submitters
The juice-shop-ctf-cli npm tool — generates the CTFd challenge configuration from your instance key

Step 1: Choose Your Deployment Architecture

Single Instance (Shared)

All participants attack the same Juice Shop instance. Simplest to set up, but:

Participants may interfere with each other (someone else’s SQLi resets admin passwords, etc.)
First team to solve a challenge may spoil the approach for others watching network traffic

Good for: Small events (under 20 participants), informal training sessions, exploratory events where collaboration is acceptable.

Per-Team Instances

Each team gets their own isolated Juice Shop instance. More infrastructure, but:

No interference between teams
Each team’s challenge state is independent
More realistic — each team works through their own application

Good for: Competitive events, university courses, corporate security training where teams are scored independently.

Hybrid

One shared Juice Shop for exploration, a separate per-team instance for challenge submission. Participants can observe the shared instance to understand the application architecture before attacking their own instance.

Step 2: Configure CTF Mode with CTF_KEY

The CTF_KEY environment variable is the secret that Juice Shop uses to generate flags. Every challenge flag is derived from:

The challenge name
The CTF_KEY value
A HMAC-SHA256 operation

Generating a strong CTF_KEY:

# Generate a random 32-byte hex key (256 bits of entropy)
openssl rand -hex 32
# Example output: a3f2d1b8c94e5f07a1234567890abcdef...

# Or use Python
python3 -c "import secrets; print(secrets.token_hex(32))"

Starting Juice Shop with CTF mode enabled:

docker run -d \
  -p 3000:3000 \
  -e CTF_KEY="your_generated_secret_key_here" \
  --name juice-shop-ctf \
  bkimminich/juice-shop

Once running, navigate to http://your-server:3000/ and verify CTF mode is active: solve a challenge and confirm the popup shows a flag string instead of just a congratulations message.

Locking Down the Scoreboard in CTF Mode

By default, Juice Shop’s scoreboard is accessible at /#/score-board and shows all challenges with their names and difficulty. For competitive events, you may want to hide the challenge list so participants must discover vulnerabilities without a guided list.

docker run -d \
  -p 3000:3000 \
  -e CTF_KEY="your_secret_key" \
  -e HIDE_SCORE_BOARD="true" \
  --name juice-shop-ctf \
  bkimminich/juice-shop

With HIDE_SCORE_BOARD=true, the scoreboard is not accessible — making the event closer to a blind CTF where participants must find and identify vulnerabilities from scratch.

Step 3: Install the juice-shop-ctf-cli

The juice-shop-ctf-cli is a command-line tool that generates a CTFd-compatible export file from your Juice Shop instance and CTF_KEY. It creates all the challenge definitions — names, descriptions, point values, and expected flags — ready to import into CTFd.

# Install globally via npm
npm install -g juice-shop-ctf-cli

# Verify installation
juice-shop-ctf --version

Running the CLI:

juice-shop-ctf

The CLI prompts you for:

Juice Shop URL — the URL of your running Juice Shop instance (e.g., http://localhost:3000)
CTF secret key — the same CTF_KEY you set in the Docker environment variable
CTF framework — select CTFd (the default and most common choice)
Insert hints — whether to include challenge hints in CTFd (set to “Yes” for training events, “No” for competitive events)
Insert code snippets — whether to include vulnerable code snippets as hints in CTFd
Challenge categories — which challenge categories to include (defaults to all)

After answering the prompts, the CLI generates a OWASP_Juice_Shop.YYYY-MM-DD.zip file in the current directory.

Step 4: Set Up CTFd

CTFd is the most widely used open-source CTF platform. It handles flag submission, team registration, scoring, and the live leaderboard.

Install CTFd with Docker

# Clone CTFd
git clone https://github.com/CTFd/CTFd.git
cd CTFd

# Start CTFd
docker compose up -d

# CTFd is now running at http://localhost:8000

Initial CTFd Configuration

Navigate to http://your-ctfd-server:8000/
Complete the setup wizard:
- CTF Name — e.g., “Juice Shop Security CTF 2026”
- Description — brief description of the event
- Start time / End time — set the event window
- User mode — choose Teams for team-based competition
Create an admin account

Import the Juice Shop Challenge Configuration

In CTFd, go to Admin Panel → Import
Upload the .zip file generated by juice-shop-ctf-cli
CTFd will create all challenges with:
- Challenge names and descriptions
- Point values (scaled by Juice Shop difficulty: ⭐ = 100 pts, ⭐⭐⭐⭐⭐⭐ = 600 pts by default)
- The expected flag for each challenge
- Hints (if you selected “Yes” in the CLI)
Verify the import: go to Admin Panel → Challenges and confirm all Juice Shop challenges appear

Step 5: Multi-Team Deployment

For competitive events with per-team instances, deploy one Juice Shop container per team:

Docker Compose for Multiple Teams

# docker-compose.yml — 4 teams, each with their own Juice Shop instance
version: '3.8'

services:
  juice-shop-team1:
    image: bkimminich/juice-shop
    environment:
      - CTF_KEY=your_shared_secret_key_here
    ports:
      - "3001:3000"
    restart: unless-stopped

  juice-shop-team2:
    image: bkimminich/juice-shop
    environment:
      - CTF_KEY=your_shared_secret_key_here
    ports:
      - "3002:3000"
    restart: unless-stopped

  juice-shop-team3:
    image: bkimminich/juice-shop
    environment:
      - CTF_KEY=your_shared_secret_key_here
    ports:
      - "3003:3000"
    restart: unless-stopped

  juice-shop-team4:
    image: bkimminich/juice-shop
    environment:
      - CTF_KEY=your_shared_secret_key_here
    ports:
      - "3004:3000"
    restart: unless-stopped

# Start all team instances
docker compose up -d

# Team 1: http://your-server:3001/
# Team 2: http://your-server:3002/
# Team 3: http://your-server:3003/
# Team 4: http://your-server:3004/

Important: Use the same CTF_KEY for all instances. Since flags are derived from the key + challenge name, all instances generate the same flags for the same challenges — which means CTFd can validate flags from any team instance with a single challenge configuration.

Resource Planning for Multi-Team Deployment

Each Juice Shop instance uses approximately:

RAM: 200–400 MB
CPU: 0.1–0.5 CPU cores (idle), 1–2 cores (active scanning)
Disk: 500 MB (Docker image)

For a 10-team event (10 instances), plan for at least 4 GB RAM and 4 CPU cores. A t3.xlarge (AWS) or equivalent provides comfortable headroom.

Step 6: Register Teams in CTFd

Before the event starts, register teams (or let teams self-register):

Team Self-Registration (Recommended)

In CTFd Admin → Settings → Registration
Enable team registration
Provide participants with the CTFd URL and a registration token (optional)
Each team registers a team name and password, then members join the team

Pre-Register Teams (Controlled Events)

For controlled corporate training events:

CTFd Admin → Users → Add User — create one admin user per team
CTFd Admin → Teams → Add Team — create teams and assign users

Distribute team credentials and Juice Shop instance URLs before the event starts.

Step 7: Event Facilitation

Before the Event

Test all instances — verify each Juice Shop URL loads and CTF mode is active (solve one challenge and confirm a flag appears)
Test CTFd flag submission — submit a known flag from each team instance to CTFd and verify it is accepted
Prepare a hints document — even with hints disabled in CTFd, prepare a “phone a friend” hints doc that the facilitator can share with stuck teams
Set a clear scope — communicate which challenges are in scope and which are not (e.g., you may want to exclude the most difficult 6-star challenges for a beginner event)
Brief participants on tools — have Burp Suite Community Edition installed, point to browser DevTools tutorial

During the Event

Monitor the leaderboard — CTFd’s live leaderboard shows which teams are scoring; check it every 15–30 minutes to see if any teams are stuck with 0 points
Provide gentle nudges — if a team has 0 points after 30 minutes, give them the hint for the easiest ⭐ challenge (finding the scoreboard) to unblock them
Have Juice Shop instances ready to reset — if a team accidentally breaks their instance (e.g., deletes all users), know how to stop and restart their container

# Reset a specific team's instance
docker compose restart juice-shop-team2

After the Event

Screenshot the final leaderboard — CTFd doesn’t permanently display historical leaderboards
Export results — CTFd Admin → Export to download CSV of all flag submissions
Debrief — walk through the top 3–5 challenges: show how they work, what the vulnerability is, and how to prevent it in real applications
Tear down — stop and remove all Juice Shop containers

docker compose down -v

Common Juice Shop CTF Challenges to Include

For a well-balanced CTF event, include challenges across multiple categories and difficulty levels. Recommended mix for a 2-hour corporate training event:

Beginner Track (⭐–⭐⭐)

These challenges are solvable by participants with no prior security experience using only a browser and DevTools:

Challenge	Category	Points	Technique
Find the Score Board	Security Misconfiguration	100	Navigate to `/#/score-board`
DOM XSS	XSS	100	`<iframe src="javascript:alert('xss')">` in search
Privacy Policy	Sensitive Data	100	Read the privacy policy
Zero Stars	Improper Validation	100	Bypass star rating via DevTools
View Basket	Broken Access Control	200	IDOR on basket API
Login Admin	SQL Injection	200	`' OR '1'='1'--` in email
Confidential Document	Sensitive Data	100	Access `/ftp/acquisitions.md`
Password Strength	Broken Authentication	200	Brute-force admin password

Intermediate Track (⭐⭐⭐)

For participants with some web security knowledge who understand HTTP requests and API calls:

Challenge	Category	Points	Technique
Reflected XSS	XSS	300	XSS in order tracking URL
Admin Section	Broken Access Control	300	Discover `/#/administration`
Payback Time	Business Logic	300	Negative cart quantity
Login Jim	SQL Injection	300	Target-specific SQL injection
Bjoern’s Favorite Pet	Broken Authentication	300	Security question answer
Upload Size	Improper Validation	300	Bypass file size limit

Advanced Track (⭐⭐⭐⭐–⭐⭐⭐⭐⭐)

Reserved for participants with intermediate security skills:

Challenge	Category	Points	Technique
Forged Feedback	Broken Access Control	400	Post review as another user
Forgotten Developer Backup	Sensitive Data	400	Null byte injection
JWT Issues	Broken Authentication	400–500	JWT algorithm confusion
XXE Data Access	XXE	400	XML external entity injection

Scoring Configuration

The juice-shop-ctf-cli assigns points based on challenge difficulty by default. Customize point values in CTFd after import:

Recommended scoring for a 2-hour event:

Difficulty	Default Points	Recommended
⭐ (1 star)	100	100–150
⭐⭐ (2 stars)	200	150–250
⭐⭐⭐ (3 stars)	300	250–350
⭐⭐⭐⭐ (4 stars)	400	350–500
⭐⭐⭐⭐⭐ (5 stars)	500	500–750
⭐⭐⭐⭐⭐⭐ (6 stars)	600	750–1000

Dynamic Scoring (First Blood Bonus)

CTFd supports dynamic scoring where the first team to solve a challenge gets bonus points. Enable in CTFd Admin → Settings → Scoring. This rewards speed and depth of exploration.

Juice Shop CTF on TryHackMe

If deploying your own CTFd + Juice Shop infrastructure is too complex, TryHackMe hosts OWASP Juice Shop as a managed room with guided challenges. TryHackMe handles all the infrastructure — participants access a private Juice Shop instance through the browser or VPN.

When TryHackMe is sufficient:

Informal training events where full CTF scoring isn’t needed
When participants need guided hints alongside the challenges
When infrastructure management capacity is limited

When you need your own CTFd + Juice Shop:

Competitive events with teams and live leaderboards
Corporate events with custom challenge selection
Events where participant progress must be exported and reported
Air-gapped training environments (no internet access)

Frequently Asked Questions

How many participants can one Juice Shop instance handle?

A single Juice Shop Docker container handles 10–20 concurrent active users comfortably on a t3.medium (2 vCPU, 4GB RAM) or equivalent. For events with more participants, use per-team instances or a more powerful host. Juice Shop is CPU-bound during active scanning rather than memory-bound.

Can the CTF_KEY be changed mid-event?

No. Changing CTF_KEY invalidates all previously generated flags — participants who already solved challenges and noted their flags will be unable to submit them. Set the CTF_KEY before the event starts and do not change it.

Do participants need to install anything?

For most Juice Shop challenges, a modern browser with DevTools is sufficient. For intercepting and modifying HTTP requests (required for many intermediate challenges), participants should have Burp Suite Community Edition installed. For advanced challenges involving command-line tools, a Linux environment (Kali Linux or similar) is useful.

What if two teams find the same flag?

Because all instances use the same CTF_KEY, both teams generate the same flag for the same challenge. CTFd handles this correctly — if Team A submits a flag first, Team B can still submit the same flag and receive points. CTFd tracks first-blood (first submission) separately from successful submissions.

The flag design (same flag across all instances) means flag sharing is possible. In practice, competitive pressure discourages sharing — teams want to earn the points themselves. For maximum integrity, use per-instance keys and generate separate CTFd challenge sets per team, but this adds significant operational complexity.

Can we run Juice Shop CTF without internet access?

Yes. Once the Docker image is pulled, Juice Shop runs completely offline. CTFd also runs offline once deployed. Pre-pull both images before the event:

docker pull bkimminich/juice-shop
docker pull ctfd/ctfd

This is important for air-gapped corporate training environments.

Summary

Running OWASP Juice Shop as a CTF event:

Generate a CTF_KEY — openssl rand -hex 32
Start Juice Shop with CTF mode — docker run -d -p 3000:3000 -e CTF_KEY="..." bkimminich/juice-shop
Generate the CTFd config — juice-shop-ctf-cli (point it at your instance + key)
Deploy CTFd — docker compose up -d in the CTFd repo
Import the config — upload the .zip to CTFd Admin → Import
Register teams — let teams self-register or pre-register them
Deploy per-team instances — Docker Compose with one service per team (same CTF_KEY)
Run the event — monitor the leaderboard, provide hints to stuck teams
Debrief — walk through key challenges after the event ends

The full setup takes approximately 30–60 minutes for a 4-team event. The payoff is a structured, competitive security training experience where participants build real web application security skills in a legal, controlled environment.

For the complete Juice Shop challenge guide including setup, walkthroughs, and DAST benchmarking, see our OWASP Juice Shop guide. For the full scoreboard and challenge list by category, see our Juice Shop scoreboard guide.

Offensive360 DAST is benchmarked against OWASP Juice Shop on every release. Book a demo to see what authenticated DAST scanning finds in your web application.