OWASP Juice Shop

What it is

OWASP Juice Shop is a deliberately broken online store, built with a modern JavaScript stack, that packs in vulnerabilities from the entire OWASP Top Ten alongside dozens of other real world flaws, from broken authentication and injection to business logic bugs. It is maintained under the OWASP Foundation umbrella by project leaders Björn Kimminich and Jannik Hollenbach, with a long list of community contributors. Unlike a static list of vulnerable code snippets, it behaves like a real application, so you have to actually explore it, form hypotheses, and confirm them, which is much closer to how appsec work feels in practice.

How to run it

The project can be run by cloning the repository and starting it with Node.js and npm, by pulling the official Docker image, by downloading a packaged build for Windows, macOS or Linux, or with Vagrant. It runs on your own machine, so the only target you are testing is your own local copy. Nothing here requires payment or an account; it is fully open source under the MIT license, so it can also be self hosted for a workshop, a training session, or a CI pipeline testing a security scanner.

What it is used for

Beyond individual practice, Juice Shop shows up constantly as the target application in web security training courses, as a CTF challenge base (many CTFs build custom challenges directly on it), and as a benchmark for evaluating security scanning tools, since its vulnerabilities are documented and its behaviour is consistent. Working through it methodically, ideally against the categorised challenge list the project publishes, gives a genuinely broad tour of how common web vulnerabilities look in a real application, which makes the defensive side, secure coding and code review, much easier to understand.

Free versus paid

Entirely free and open source. There is no paid tier, though the OWASP Foundation and contributors do accept sponsorship.

Who it suits

Developers who want to understand security from the offensive side of their own stack, QA and testers moving into security testing, and anyone doing structured appsec study who wants a consistent target rather than a new toy app for every topic.

Ethics and scope

Juice Shop is built to be attacked and ships with no real user data or real backend systems, so there is nothing to authorise: it is a sanctioned target by design. Run it locally and test only your own copy. Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme.

Common questions

Do I need security experience first? Some web development familiarity helps more than security experience; the challenges assume you can read JavaScript and follow HTTP requests. Is there a hint system? Yes, an official companion guide and community write-ups exist for when a challenge stalls. Is it kept up to date? Yes, it is actively maintained with regular releases.