OWASP Juice Shop is a deliberately vulnerable web application — a realistic, modern e-commerce site intentionally built with over 100 security vulnerabilities so that developers, security engineers, and penetration testers can practice finding and exploiting them in a safe, legal environment.
It is the most widely used intentionally vulnerable web application in the global security community, maintained by the OWASP Foundation and originally created by Björn Kimminich.
This article explains what Juice Shop is, why it exists, what makes it different from older vulnerable applications, and how to run it right now.
What Is OWASP Juice Shop, Exactly?
Juice Shop simulates a real online juice store — complete with products, a shopping cart, user accounts, an admin panel, and a REST API. The application looks and behaves like a legitimate e-commerce site. Under the hood, every component contains security vulnerabilities that you are invited to find and exploit.
Unlike older vulnerable applications (DVWA, WebGoat) that feel like security labs, Juice Shop looks like a real production application. Its modern architecture — Angular SPA on the frontend, Node.js/Express on the backend, JWT for authentication, a REST API — mirrors the tech stack of real-world web applications.
Key facts about OWASP Juice Shop:
| Property | Detail |
|---|---|
| Maintained by | OWASP Foundation + Björn Kimminich |
| Source code | github.com/juice-shop/juice-shop |
| License | MIT (free, open source) |
| Challenges | 100+ across 6 difficulty levels |
| Docker image | bkimminich/juice-shop |
| Architecture | Angular + Node.js + Express + SQLite + JWT |
| First released | 2014 |
How to Start OWASP Juice Shop in 60 Seconds
The fastest way to run Juice Shop is with Docker:
docker run --rm -p 3000:3000 bkimminich/juice-shopOpen http://localhost:3000/ in your browser. That’s it — you now have a fully operational vulnerable e-commerce application ready to test against.
To access the scoreboard (which shows all 100+ challenges):
http://localhost:3000/#/score-boardFinding the scoreboard itself is the first Juice Shop challenge — it’s not linked from the navigation.
No Docker? Run from Source
git clone https://github.com/juice-shop/juice-shop.git
cd juice-shop
npm install
npm start
# Open http://localhost:3000/What Makes Juice Shop Different from DVWA and WebGoat?
DVWA (Damn Vulnerable Web Application) is a PHP/MySQL application — useful for PHP SAST benchmarking and teaching SQL injection fundamentals, but architecturally outdated.
WebGoat is a Java application with a structured lesson format — useful for Java SAST benchmarking and guided learning.
Juice Shop is different in three important ways:
1. Modern architecture. Juice Shop’s Angular SPA + REST API + JWT authentication is representative of how real web applications are built today. If you can find SQL injection in a legacy PHP app, you still need to practice finding the same class of vulnerability in a modern SPA architecture.
2. Challenge system with 100+ challenges. The built-in scoreboard tracks your progress across every category of the OWASP Top 10. One-star challenges are accessible to beginners. Six-star challenges require expert-level knowledge of the application internals.
3. CTF support. Juice Shop includes built-in CTF mode — making it suitable for competitive team training events, not just individual practice.
What Vulnerabilities Does Juice Shop Cover?
Juice Shop includes vulnerabilities from every category of the OWASP Top 10:
| OWASP Category | Juice Shop Examples |
|---|---|
| A01 — Broken Access Control | IDOR (accessing other users’ baskets), hidden admin section |
| A02 — Cryptographic Failures | Weak JWT secrets, insecure cookie configuration |
| A03 — Injection | SQL injection in login, NoSQL injection, Log injection |
| A04 — Insecure Design | Business logic flaws (negative cart quantities) |
| A05 — Security Misconfiguration | Missing security headers, CORS misconfiguration, verbose errors |
| A06 — Vulnerable Components | Outdated npm dependencies with known CVEs |
| A07 — Auth Failures | Password brute force, JWT algorithm confusion (RS256 → HS256) |
| A08 — Software Integrity | Insecure deserialization (coupon codes) |
| A09 — Logging Failures | Log injection, insufficient monitoring |
| A10 — SSRF | Server-Side Request Forgery via URL inputs |
Beyond the OWASP Top 10, Juice Shop includes XSS (reflected, stored, and DOM-based), XXE injection, path traversal, and dozens of application logic flaws.
The Juice Shop Scoreboard
The scoreboard at /#/score-board is your mission control. It lists every available challenge, organized by:
- Difficulty: ⭐ (beginner) to ⭐⭐⭐⭐⭐⭐ (expert)
- Category: Injection, XSS, Broken Auth, etc.
- Status: Solved (green checkmark) or unsolved
Each challenge has a hint icon (lightbulb). The official companion guide, Pwning OWASP Juice Shop, is available free at pwning.owasp-juice.shop if you need detailed walkthrough guidance.
Recommended starting order:
- One-star challenges — Learn the fundamentals (find the scoreboard, DOM XSS, zero-star feedback)
- Two-star challenges — First exploitation techniques (SQL injection login bypass, IDOR, reflected XSS)
- Three-star challenges — Multi-step attacks (admin section access, JWT forgery setup, XXE)
- Four- and five-star challenges — Advanced exploitation (JWT algorithm confusion, complex chained attacks)
Who Uses OWASP Juice Shop and Why?
Security Learners and Practitioners
Juice Shop provides a legal, realistic target for practicing web application penetration testing. It covers the full OWASP Top 10 in a modern architecture, making it far more representative of real-world assessments than older PHP/Java vulnerable apps.
Development Teams
Running Juice Shop in security training sessions helps developers understand what vulnerabilities look like from an attacker’s perspective — making them significantly better at writing secure code.
Security Teams Running CTFs
Juice Shop’s built-in CTF mode generates unique flags per challenge. It is widely used for corporate security training events, university security courses, and competitive team exercises.
AppSec Engineers Benchmarking Scanners
Before deploying a DAST or SAST scanner against production code, run it against Juice Shop first. A scanner that misses the unobfuscated SQL injection in Juice Shop’s login form — the most obvious SQL injection test case that exists — will miss similar patterns in your production application.
Minimum DAST scanner benchmark against Juice Shop:
| Vulnerability | What to Verify the Scanner Finds |
|---|---|
| SQL injection in login form | Classic ' OR '1'='1'-- bypass |
| Reflected XSS in search | <iframe src="javascript:alert('xss')"> in search bar |
| Missing security headers | Content-Security-Policy, X-Content-Type-Options |
| Directory listing | /ftp/ accessible without authentication |
| CORS misconfiguration | Permissive Access-Control-Allow-Origin policy |
OWASP Juice Shop vs. Other Vulnerable Applications
| Application | Architecture | Best For |
|---|---|---|
| OWASP Juice Shop | Angular + Node.js REST API | DAST benchmarking modern SPAs, security training, CTF |
| DVWA | PHP + MySQL | PHP SAST benchmarking, basic injection practice |
| WebGoat | Java + Spring | Java SAST benchmarking, structured learning |
| bWAPP | PHP | Breadth of vulnerability types (100+) |
| NodeGoat | Node.js + Express | Node.js/Express SAST benchmarking |
Most security programs use Juice Shop for DAST testing and at least one language-specific app (DVWA for PHP, WebGoat for Java) for SAST benchmarking. See our full OWASP Juice Shop alternatives comparison for a detailed breakdown.
Running Juice Shop with Authenticated Scanning
A significant portion of Juice Shop’s attack surface is behind authentication. To test authenticated areas, configure your DAST scanner with credentials:
- Register a test user at
http://localhost:3000/#/register - Note the credentials you created (e.g.,
[email protected]/Test1234!) - Configure your DAST scanner to log in with those credentials before scanning
- Verify the scanner can access the profile page at
/#/profileand basket API at/api/BasketItems
An unauthenticated scan of Juice Shop only covers ~20% of its attack surface — primarily the product listing page, login form, and registration form. The most interesting vulnerabilities (IDOR, JWT flaws, admin panel access) require authentication.
Juice Shop CTF Mode
For running a competitive security training event:
# Install the Juice Shop CTF CLI
npm install -g juice-shop-ctf-cli
# Run Juice Shop with CTF flag generation
docker run -d -p 3000:3000 \
-e CTF_KEY=your_secret_key_here \
bkimminich/juice-shopIn CTF mode, solving each challenge generates a unique flag string. Teams submit these flags to a CTF platform (CTFd is the most common choice) to score points. The Juice Shop CTF CLI generates the corresponding CTFd challenge configuration automatically.
Frequently Asked Questions
Is OWASP Juice Shop free?
Yes. Juice Shop is completely free and open-source under the MIT license. The Docker image is free on Docker Hub (bkimminich/juice-shop). The source code is free on GitHub. The companion guide Pwning OWASP Juice Shop is free online.
Does Juice Shop work on Apple Silicon (M1/M2/M3) Macs?
Yes. The official Docker image supports both AMD64 and ARM64 architectures. Running docker run --rm -p 3000:3000 bkimminich/juice-shop on an Apple Silicon Mac with Docker Desktop works without any special configuration.
How many challenges does Juice Shop have?
Current versions of Juice Shop have over 100 challenges. The exact count changes with each major release as new challenges are added. The scoreboard always shows the current complete list for the version you are running.
Is Juice Shop safe to run on a production server?
No. Juice Shop is intentionally vulnerable. It should only be run in an isolated local environment (Docker container on your laptop, private VM) or a dedicated isolated training environment. Never expose it to the internet or run it alongside production systems.
What is the hardest challenge in Juice Shop?
Six-star challenges are the most difficult. These include forging JWT tokens using algorithm confusion attacks, exploiting subtle application logic flaws, and chaining multiple vulnerabilities together to achieve a non-obvious outcome. Completing all six-star challenges puts you in the top percentile of Juice Shop users.
Summary
OWASP Juice Shop is:
- The most realistic and widely used vulnerable web application for security practice
- Free, open-source, and maintained by the OWASP Foundation
- A modern Node.js/Angular application with 100+ challenges covering the full OWASP Top 10
- The industry-standard benchmark for DAST scanner validation
- Runnable in under 60 seconds with Docker:
docker run --rm -p 3000:3000 bkimminich/juice-shop
Whether you are learning web application security for the first time, benchmarking a DAST scanner before production deployment, or running a team training event — OWASP Juice Shop is the starting point.
Offensive360 DAST is benchmarked against Juice Shop on every release to verify scanner detection accuracy. Book a demo — see what your codebase actually contains, results in minutes. Or see our complete Juice Shop guide for setup instructions, challenge walkthroughs, and DAST benchmarking details.