OWASP Juice Shop and PortSwigger Web Security Academy are the two most widely recommended free resources for learning web application security in 2026. Both are excellent. Both are free. Both cover the OWASP Top 10. But they serve different purposes, different skill levels, and different use cases — and choosing the wrong one for your goal wastes time.
This guide compares Juice Shop and Web Security Academy on every dimension that matters for a security learner or practitioner: setup effort, vulnerability coverage, learning format, DAST/SAST benchmarking suitability, and which situations call for each.
Quick Summary
| OWASP Juice Shop | PortSwigger Web Security Academy | |
|---|---|---|
| Format | Free-form CTF application | Guided labs with theory + practice |
| Setup | Local (Docker or Node.js) | Browser-based, no install |
| Challenges | 100+ across 6 difficulty levels | 250+ labs across 20+ topics |
| Hints available | Yes (in-app lightbulb + companion book) | Yes (detailed step-by-step instructions) |
| Scoreboard | ✅ Built-in | ✅ Progress tracking |
| Best for beginners | ⚠️ After some foundational knowledge | ✅ Ideal for beginners |
| DAST benchmarking | ✅ Yes — deploy locally, scan with any tool | ❌ Browser-based, can’t scan locally |
| SAST benchmarking | ❌ Node.js only, complex for SAST | ❌ Not applicable |
| CTF mode | ✅ Built-in CTF flag generation | ❌ No CTF mode |
| Offline / air-gapped | ✅ Runs fully offline | ❌ Requires internet |
| Cost | Free (open source, MIT) | Free (labs), Pro subscription optional |
What Is OWASP Juice Shop?
OWASP Juice Shop is an intentionally vulnerable Node.js e-commerce application with over 100 security challenges built in. It runs locally via Docker or Node.js and presents itself as a realistic juice store — with products, a shopping cart, user accounts, and a REST API.
The key characteristic of Juice Shop is that it is a real-seeming application where vulnerabilities are embedded in the actual application logic. Finding a SQL injection in Juice Shop means finding it the same way you would in a real assessment: observing behavior, testing inputs, intercepting requests, and reasoning about how the application works.
# Start Juice Shop in 60 seconds
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Open: http://localhost:3000/
# Scoreboard: http://localhost:3000/#/score-boardJuice Shop is maintained by the OWASP Foundation and Björn Kimminich. It is free under the MIT license.
What Is PortSwigger Web Security Academy?
PortSwigger Web Security Academy is a free online learning platform created by PortSwigger — the company behind Burp Suite. It covers web application security through a combination of written explanations and browser-based labs that can be solved using Burp Suite (Community Edition is free).
Each topic follows a structured format:
- Explanatory content (what is SQL injection, how does it work, what are the variants)
- Worked example (demonstrating a specific attack)
- Labs (practical exercises at increasing difficulty)
The Academy covers over 20 security topics with 250+ labs, ranging from basic SQL injection to advanced HTTP request smuggling and server-side prototype pollution.
Learning Format: Guided vs. Open-Ended
This is the most important distinction between the two platforms.
PortSwigger Web Security Academy: Guided Learning
Web Security Academy presents topics in a structured curriculum:
- Apprentice labs — straightforward exploitation following clear patterns from the theory
- Practitioner labs — require combining techniques, reading application behavior, and adapting
- Expert labs — complex multi-step attacks requiring deep understanding of browser and HTTP behavior
Each lab has a clear success condition (you’ve “solved the lab” when the banner appears). The theory section tells you what the vulnerability is, why it exists, and what the attack looks like in general. The lab makes you execute it in a specific instance.
Best for: Learning a new vulnerability class from scratch, structured progression from basic to advanced, consistent feedback on whether your approach worked.
Limitation: The guided format can create a gap between “solving the lab” and “finding the vulnerability.” In a real assessment, you don’t know which vulnerability class you’re looking for — you have to discover it. Juice Shop’s open-ended format is better practice for this.
OWASP Juice Shop: Open-Ended Discovery
Juice Shop presents you with an application and says: find the vulnerabilities. The scoreboard tells you how many challenges exist in each category and their difficulty rating, but it does not tell you which endpoints are vulnerable, which inputs to test, or which payloads to use.
This more closely mirrors a real penetration test:
- Enumerate the application’s attack surface
- Identify input points (forms, URL parameters, API endpoints, file uploads)
- Test each for vulnerabilities
- Chain findings together for more complex attacks
Best for: Building the open-ended pattern recognition needed for real assessments, DAST scanner benchmarking, CTF training, and practicing methodology rather than specific technique execution.
Limitation: Without prior knowledge of what you’re looking for, Juice Shop can be frustrating for complete beginners. The companion book (pwning.owasp-juice.shop) helps significantly.
Vulnerability Coverage
PortSwigger Web Security Academy Topics (selected)
| Topic | Lab Count | Best Labs |
|---|---|---|
| SQL injection | 18 labs | Blind SQLi with conditional responses, time-based blind SQLi |
| Cross-site scripting | 30 labs | Reflected XSS into HTML context, stored XSS with event handlers |
| CSRF | 12 labs | CSRF with SameSite cookie bypass |
| Clickjacking | 5 labs | Clickjacking with form input data prefilled |
| DOM-based attacks | 7 labs | DOM XSS using web messages, DOM clobbering |
| CORS | 4 labs | CORS with trusted null origin, internal network pivot |
| XXE injection | 9 labs | Blind XXE with out-of-band interaction |
| SSRF | 7 labs | SSRF with filter bypass |
| HTTP request smuggling | 22 labs | HTTP/2 request splitting |
| Server-side template injection | 7 labs | SSTI in Freemarker, Velocity, Pebble |
| Insecure deserialization | 10 labs | Java deserialization with gadget chains |
| JWT attacks | 8 labs | JWT algorithm confusion with RS256 → HS256 |
| OAuth authentication | 6 labs | Stealing OAuth access tokens |
| Web cache poisoning | 14 labs | Exploiting cache poisoning for XSS delivery |
| HTTP host header attacks | 7 labs | Password reset poisoning via host header |
| Business logic vulnerabilities | 12 labs | Bypassing flawed validation of inputs |
| Access control | 13 labs | IDOR, horizontal and vertical privilege escalation |
| Path traversal | 6 labs | Path traversal with traversal sequence filtering |
Total: 250+ labs across categories including advanced topics that Juice Shop does not cover (HTTP request smuggling, web cache poisoning, OAuth).
OWASP Juice Shop Categories
Juice Shop covers the OWASP Top 10 and more across 100+ challenges:
- Injection — SQL injection (login, search), NoSQL injection, Log injection
- Broken Authentication — JWT algorithm confusion, password brute force, account enumeration
- Sensitive Data Exposure — hidden files, confidential documents, API data leaks
- XXE — XML external entity injection
- Broken Access Control — IDOR, admin panel access, mass assignment
- Security Misconfiguration — verbose errors, directory listing, CORS misconfig
- XSS — reflected, stored, and DOM-based
- Insecure Deserialization — forged coupon codes
- Components with Known Vulnerabilities — outdated npm packages
- Insufficient Logging — log injection, missing alerts
What Juice Shop doesn’t cover: HTTP request smuggling, web cache poisoning, advanced OAuth attacks, Java-specific deserialization gadget chains, and several advanced topics that Web Security Academy’s specialized labs address in depth.
Who Should Start with Which?
Start with Web Security Academy If:
You’re new to web security. Web Security Academy’s structured format — theory first, then labs — means you learn the “why” alongside the “how.” A beginner who jumps into Juice Shop without any prior knowledge will spend most of their time confused about what they’re looking for.
You want to learn specific vulnerability classes efficiently. If you need to quickly understand how SSRF works, or how JWT algorithm confusion attacks work, the Academy’s topic-by-topic structure is much faster than exploring Juice Shop’s open-ended challenges.
You want structured progression. The Apprentice → Practitioner → Expert lab progression provides clear milestones. You know when you’ve mastered a topic at each level.
You can’t run local software. Juice Shop requires Docker or Node.js. Web Security Academy runs entirely in the browser — useful for corporate environments with software installation restrictions.
Start with (or Add) Juice Shop If:
You want to build open-ended assessment skills. Once you’ve learned what SQL injection looks like from Web Security Academy, Juice Shop teaches you to find SQL injection when you don’t know it’s there. This is the gap between knowing vulnerability theory and finding vulnerabilities in production.
You’re preparing for a CTF. Juice Shop’s built-in CTF mode generates real flags. The open-ended format is closer to CTF challenges than Web Security Academy’s guided labs.
You need a DAST benchmarking target. This is the most important practical distinction: Juice Shop runs locally, meaning you can point any DAST scanner at it and measure what the scanner finds versus what you know is there. Web Security Academy’s labs run in PortSwigger’s cloud and cannot be scanned by external tools.
You’re training a team. Juice Shop’s CTF mode and scoreboard make it ideal for competitive team security training events. Web Security Academy is a primarily individual learning platform.
You need offline/air-gapped operation. Juice Shop runs entirely offline once the Docker image is downloaded. Web Security Academy requires an internet connection.
DAST Scanner Benchmarking: Juice Shop Wins Clearly
If you’re evaluating DAST tools — deciding which scanner to use before deploying it against your production application — Juice Shop is the essential benchmark and Web Security Academy cannot serve this purpose.
Why Juice Shop Is the Standard DAST Benchmark
Locally deployable: You run Juice Shop in Docker on your own machine. You can point any DAST scanner at http://localhost:3000/ and measure its findings.
Known vulnerability inventory: Every vulnerability in Juice Shop is documented and categorized. You can verify exactly which vulnerabilities your scanner found and which it missed.
Authenticated scanning support: Juice Shop’s REST API allows DAST tools to authenticate and scan the full application — the same authentication-aware scanning they’d perform against your production app.
Modern architecture: Juice Shop’s Angular SPA + REST API architecture is representative of real production web applications. A DAST scanner that handles Juice Shop well is likely ready for your modern web app.
What a DAST Scanner Should Find in Juice Shop
At minimum, a production-ready DAST scanner should detect:
| Vulnerability | Juice Shop Location | Difficulty |
|---|---|---|
| SQL injection | Login form, product search | Easy |
| Reflected XSS | Search bar (<iframe src="javascript:alert('xss')">) | Easy |
| DOM-based XSS | Order tracking page URL parameter | Easy |
| Missing Content-Security-Policy | All pages | Easy |
| Missing X-Content-Type-Options | All responses | Easy |
| CORS misconfiguration | REST API endpoints | Medium |
| Directory listing | /ftp/ directory | Easy |
| Information disclosure | Error messages with stack traces | Easy |
| JWT issues | Authentication tokens | Hard |
| IDOR | Basket API (/api/BasketItems/?BasketId=) | Medium |
A scanner that misses the SQL injection in Juice Shop’s login form — the most unobfuscated, well-documented SQL injection test case in existence — is not ready for your production application.
Testing procedure:
# Step 1: Start Juice Shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# Step 2: Register a test account
# Navigate to http://localhost:3000/#/register
# Step 3: Configure your DAST scanner
# Target: http://localhost:3000/
# Auth: your test account credentials
# Scan mode: authenticated full scan
# Step 4: Run the scan and compare findings to the known vulnerability listOffensive360 DAST is benchmarked against Juice Shop on every release to verify scanner detection accuracy. You can book a demo with results in minutes — see what your codebase actually contains.
SAST Benchmarking: Neither Is Ideal
If you’re evaluating SAST tools (static code analysis), neither Juice Shop nor Web Security Academy is the ideal benchmark.
For SAST benchmarking, use:
- DVWA for PHP SAST tools
- WebGoat for Java SAST tools
- NodeGoat for Node.js SAST tools
- DVWA, WebGoat, or a real codebase for Fortify, Checkmarx, or Veracode evaluation
Juice Shop’s Node.js architecture is complex and uses many abstraction layers, making taint analysis results harder to reason about. DVWA’s PHP code is straightforward and well-understood — a SQL injection in vulnerabilities/sqli/source/low.php is immediately recognizable, and a SAST tool that misses it demonstrably fails the benchmark.
See our OWASP Juice Shop alternatives guide for a complete breakdown of which vulnerable applications are best for specific benchmarking needs.
Using Both Together: The Optimal Learning Path
Most security practitioners who reach an intermediate level end up using both platforms, because they complement each other:
Recommended Learning Sequence
Phase 1: Foundation with Web Security Academy (4–8 weeks)
Work through these Academy topics in order:
- SQL injection — all Apprentice and Practitioner labs
- Cross-site scripting — reflected, stored, and DOM-based (Apprentice + Practitioner)
- Authentication vulnerabilities — login bypass, brute force, MFA bypass
- Access control — IDOR, privilege escalation
- File path traversal — all labs
- SSRF — Apprentice and Practitioner
This foundation ensures you know what each vulnerability class looks like before encountering it in Juice Shop.
Phase 2: Application to Juice Shop (ongoing)
With the foundation from Phase 1, work through Juice Shop’s challenges:
- Complete all ⭐ one-star challenges — they should feel straightforward
- Work through ⭐⭐ two-star challenges — the SQL injection login bypass and reflected XSS
- Move to ⭐⭐⭐ three-star challenges — multi-step attacks, IDOR, access control
- Try ⭐⭐⭐⭐ four-star challenges — JWT algorithm confusion, stored XSS, XXE
Phase 3: Advanced Academy Topics (parallel with Juice Shop)
As you encounter more complex Juice Shop challenges, return to the Academy for deeper theory:
- JWT attacks — the Academy’s JWT labs directly map to Juice Shop’s JWT challenges
- XXE injection — Academy labs teach the technique; Juice Shop challenges you to find the endpoint
- Business logic vulnerabilities — Academy covers the theory; Juice Shop has multiple business logic challenges
Phase 4: Real-World Practice (DAST benchmarking)
Once you’re consistently solving three- and four-star Juice Shop challenges, point a DAST scanner at your Juice Shop instance and compare what the scanner finds to what you found manually. This step:
- Teaches you where scanners are effective (SQL injection, XSS, missing headers)
- Teaches you where scanners fail (JWT algorithm confusion, business logic flaws, complex IDOR)
- Builds the knowledge to interpret DAST scanner output critically in a real assessment
Common Questions
Which platform is better for OSCP preparation?
Both contribute to OSCP preparation, but web application skills are only one component of OSCP. Web Security Academy’s labs more directly map to the web vulnerability testing required in OSCP’s practical exam. Juice Shop is less relevant to OSCP specifically because it doesn’t cover network exploitation, privilege escalation, or Active Directory — which make up most of the OSCP exam.
For OSCP web preparation: Web Security Academy (SQL injection, XSS, file path traversal, SSRF, authentication vulnerabilities).
Can I use Juice Shop and Web Security Academy in a corporate training program?
Yes. Both are designed for training use. Juice Shop’s CTF mode makes it particularly suitable for competitive team training events. Web Security Academy’s structured curriculum and progress tracking make it suitable for self-paced developer security training.
Does PortSwigger Web Security Academy require Burp Suite Pro?
No. The Academy’s labs can be completed with Burp Suite Community Edition, which is free. Some advanced techniques (automated scanning, certain active attack features) are only available in Burp Suite Pro, but all Academy labs are solvable with the free version using the browser’s developer tools.
Is Juice Shop harder than Web Security Academy labs?
Juice Shop’s difficulty is less predictable than the Academy’s tiered system. One-star Juice Shop challenges can be solved quickly. Four- and five-star challenges require deep knowledge of the application internals and often take significantly longer than even Expert-rated Academy labs. The open-ended format also means “difficulty” includes the challenge of finding the right endpoint to test — not just executing the right payload.
How much time should I spend on each?
A realistic time estimate for someone learning web security seriously:
- Web Security Academy (Apprentice + Practitioner level): 100–200 hours
- Web Security Academy (Expert level): 200+ additional hours
- Juice Shop (one- and two-star challenges): 8–15 hours
- Juice Shop (three- and four-star challenges): 20–40 hours
- Juice Shop (all challenges including five- and six-star): 60–100+ hours
Most practitioners find Web Security Academy easier to fit into a structured learning schedule; Juice Shop works better in extended practice sessions.
Summary
Use Web Security Academy when:
- Learning a vulnerability class for the first time
- You want structured progression with guided hints
- You can’t install local software
- You want to master advanced topics (HTTP smuggling, web cache poisoning, OAuth)
Use OWASP Juice Shop when:
- Practicing open-ended vulnerability discovery (real assessment preparation)
- Benchmarking DAST scanners before production deployment
- Running a team CTF or security training event
- You need offline/air-gapped operation
Use both when:
- Building toward intermediate or advanced web security skills
- Preparing for penetration testing roles or bug bounty programs
Neither platform replaces the other. The most effective security practitioners use Web Security Academy to learn techniques and Juice Shop to practice applying them without guidance — the same way they’ll apply them in real assessments.
Need to benchmark a DAST scanner against Juice Shop before deploying it to production? Offensive360 DAST tests authenticated web applications for the full OWASP Top 10, including injection vulnerabilities, broken access control, and security misconfigurations. Book a demo — results in minutes. Or book a demo to see the scanner in action.