OWASP Juice Shop: Setup, All Challenges & DAST Benchmarking

OWASP Juice Shop is the most widely used intentionally vulnerable web application in the security community. It’s a realistic, modern Node.js e-commerce application deliberately built with over 100 security vulnerabilities — covering every OWASP Top 10 category — so developers and security engineers can practice finding and exploiting them in a legal, isolated environment.

This guide covers everything you need to know about Juice Shop: what it is, how to get it running, what the challenges cover, how to use it for DAST scanner benchmarking, and what makes it different from other vulnerable applications.

What Is OWASP Juice Shop?

OWASP Juice Shop (created by Björn Kimminich and maintained by the OWASP Foundation) is a deliberately vulnerable web application that simulates a modern online juice store. Unlike older vulnerable applications that feel like security labs, Juice Shop looks and behaves like a real e-commerce site — with products, a shopping cart, user accounts, an admin panel, and a REST API.

Under the hood, every part of the application contains security vulnerabilities. The entire codebase is publicly available, and each vulnerability is categorized, scored by difficulty, and documented. The built-in scoreboard tracks which challenges you’ve solved.

Technology stack:

Frontend: Angular SPA (Single-Page Application)
Backend: Node.js + Express.js
Database: SQLite (default) or PostgreSQL
API: RESTful JSON API
Auth: JWT (JSON Web Tokens)

This modern architecture makes Juice Shop more representative of real-world web applications than older PHP/MySQL vulnerable apps. The same vulnerability patterns found in Juice Shop appear in production e-commerce platforms, financial applications, and enterprise APIs.

Getting Juice Shop Running in 60 Seconds

The fastest way to run Juice Shop is with Docker:

docker run --rm -p 3000:3000 bkimminich/juice-shop

Then open http://localhost:3000/ in your browser. That’s it — you have a fully functional vulnerable e-commerce application ready to attack.

Docker Setup Details

# Standard setup
docker run --rm -p 3000:3000 bkimminich/juice-shop

# Run in detached mode (background)
docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop

# Stop the container
docker stop juice-shop

# Access the scoreboard (see all challenges)
# http://localhost:3000/#/score-board

Running with Node.js (without Docker)

git clone https://github.com/juice-shop/juice-shop.git
cd juice-shop
npm install
npm start
# Open http://localhost:3000/

Reset the Application to Original State

To reset Juice Shop to its original state (clearing all your progress and the database):

# Stop and remove the container
docker stop juice-shop
docker rm juice-shop

# Start fresh
docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop

The Juice Shop Scoreboard

One of Juice Shop’s most useful features is its built-in scoreboard at /#/score-board. The scoreboard shows all 100+ challenges organized by:

Difficulty: ⭐ to ⭐⭐⭐⭐⭐⭐ (1 star = beginner, 6 stars = expert)
Category: Injection, XSS, CSRF, Sensitive Data Exposure, etc.
Status: Solved (green) or unsolved (grey)

When you solve a challenge, a popup notification appears and the scoreboard updates in real time. You can use the scoreboard as a curriculum — working through all one-star challenges first, then two-star, and so on.

Finding the Scoreboard Itself

Finding the scoreboard is actually the first Juice Shop challenge. It’s not linked from the main navigation — you have to either:

Navigate directly to http://localhost:3000/#/score-board
Find it by examining the JavaScript source
Look at the application’s API response for the navigation structure

This design teaches a real vulnerability concept: security through obscurity is not security. An API that returns all navigation items (including “admin” routes) to the frontend — even if those routes aren’t linked — discloses application structure.

Challenge Categories

Juice Shop covers every major web application vulnerability class. Here’s what each category contains and why it matters:

Injection (SQL, NoSQL, LDAP, Log)

Juice Shop contains multiple injection vulnerabilities, each in a different context:

SQL Injection in Login: The login form is vulnerable to classic SQL injection. A payload like ' OR '1'='1 in the email field bypasses authentication entirely. This is intentionally unobfuscated — use it to understand the fundamental mechanism before tackling more subtle patterns.

-- Juice Shop login bypass
Email: ' OR '1'='1'--
Password: (anything)

-- The query becomes:
SELECT * FROM Users WHERE email = '' OR '1'='1'-- AND password = '...'

SQL Injection in Search: The product search endpoint is also injectable. Try the search bar with SQL payloads to understand reflected SQL injection — where the injected query affects the results returned to the current user.

NoSQL Injection: Some challenge categories involve the application’s user data store, exposing MongoDB-style injection patterns where $gt, $ne, and similar operators can bypass query conditions.

Log Injection: Juice Shop has a challenge around injecting malicious content into application logs — teaching the log injection vulnerability class (CWE-117) that can obscure audit trails or inject false log entries.

Broken Authentication

Authentication flaws are Juice Shop’s richest category:

JWT Algorithm Confusion: Juice Shop uses JWT for authentication. Several challenges exploit weaknesses in JWT implementation:

Forging admin tokens by exploiting the alg: none variant
RS256 → HS256 algorithm confusion (treating a public key as an HMAC secret)
Brute-forcing weak JWT secrets
Tampering with JWT payload fields

This is directly applicable to real-world API security — JWT vulnerabilities are among the most common authentication flaws in modern APIs.

Password Reset Flaws: The password reset flow contains security issues including:

Security questions with guessable answers (birthdate, favorite pet — publicly visible on user profiles)
Token predictability
User enumeration through error message differences

Login Rate Limiting: There is no brute-force protection on the login endpoint by default. Challenges involving the admin account password can be solved by brute force — teaching why rate limiting is essential.

Sensitive Data Exposure

Forgotten About Us Page: Juice Shop contains hidden pages not linked from the main navigation — accessible through directory brute-forcing or API enumeration.

Admin Credentials in Source: Developer comments and configuration files in the Juice Shop application sometimes contain sensitive information. Exploring the JavaScript source, network requests, and page source is part of the challenge methodology.

Insecure File Storage: Juice Shop stores certain files in accessible directories. Finding and accessing uploaded files, receipts, and configuration exports tests understanding of insecure file storage.

XML External Entities (XXE)

Juice Shop has an XML-accepting endpoint where XXE injection reads files from the server. The challenge involves crafting a malicious XML document with an external entity declaration that reads /etc/passwd:

<?xml version="1.0"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

Understanding this class of vulnerability is critical for any application that processes XML input — which remains common in enterprise SOAP APIs, document processing systems, and B2B integrations.

Broken Access Control

IDOR (Insecure Direct Object Reference): Juice Shop’s API endpoints expose object identifiers that can be manipulated. Accessing other users’ orders, changing other users’ reviews, and reading other users’ shopping baskets — all by modifying ID values in API requests — are core Juice Shop challenges.

This is OWASP API Security A1 (Broken Object Level Authorization / BOLA) and is the most commonly exploited vulnerability class in real-world API assessments.

Admin Section Access: Accessing the administration section (/#/administration) without being an admin — by forging authentication tokens or exploiting access control logic flaws — is one of the more complex multi-step challenges.

Cross-Site Scripting (XSS)

Juice Shop has all three XSS types:

Reflected XSS: The search functionality reflects user input in the page. A classic <script>alert('XSS')</script> injection demonstrates reflected XSS. More interesting challenges involve finding encoding bypasses that work when basic <script> tags are filtered.

Stored XSS: Product reviews and user comments are stored in the database and displayed to other users. Storing an XSS payload that executes when another user views the page demonstrates stored XSS — the more dangerous variant because it executes for every victim who views the page.

DOM-Based XSS: Juice Shop has DOM-based XSS vulnerabilities where client-side JavaScript insecurely processes URL fragments and writes them to the DOM. Finding these requires examining the Angular application’s client-side code, not just form inputs.

Security Misconfiguration

Error Handling: Triggering unhandled errors in Juice Shop can reveal stack traces, file paths, and internal application structure — demonstrating why verbose error handling is dangerous in production.

HTTP Security Headers: Juice Shop ships without complete security headers by default, making it a good target for understanding missing Content-Security-Policy, X-Frame-Options, and other headers.

CORS Misconfiguration: The application’s CORS policy can be tested with cross-origin requests to understand what the default configuration exposes.

Insecure Deserialization

Juice Shop has a challenge involving forged coupons — where the coupon format uses base64-encoded serialized data. Manipulating the serialized coupon data to forge illegitimate discounts demonstrates insecure deserialization at the application logic level.

Components with Known Vulnerabilities

The package.json in Juice Shop’s open-source repository intentionally includes outdated npm packages with known CVEs. The SCA challenge involves identifying which dependencies have known vulnerabilities. This teaches the skill of dependency scanning — an increasingly important part of application security.

Insufficient Logging and Monitoring

Challenges around log injection (inserting forged log entries), and the absence of alerting on suspicious behavior (repeated failed logins, unusually large downloads) demonstrate why logging and monitoring are part of the OWASP Top 10.

Using Juice Shop for DAST Scanner Benchmarking

OWASP Juice Shop is the standard benchmark for DAST (Dynamic Application Security Testing) tools. If you’re evaluating whether a DAST scanner is ready for your production web application, test it against Juice Shop first.

What a Good DAST Scanner Should Find in Juice Shop

Vulnerability	Category	Difficulty
SQL injection in login form	Injection	Easy (unobfuscated)
Reflected XSS in search	XSS	Easy
Missing security headers	Misconfiguration	Easy
CORS misconfiguration	Misconfiguration	Easy
Insecure JWT (alg: none)	Auth	Medium
IDOR in basket API	Access Control	Medium
Stored XSS in reviews	XSS	Medium
XXE in XML upload	XXE	Medium
SSRF via image URL	SSRF	Hard
SQL injection (blind)	Injection	Hard

Run your DAST scanner against a local Juice Shop instance with authentication configured. A scanner that misses the unobfuscated SQL injection in the login form, the reflected XSS in the search bar, or the missing security headers is not ready for your production application.

DAST Benchmarking Procedure

# Step 1: Start Juice Shop
docker run -d -p 3000:3000 bkimminich/juice-shop

# Step 2: Wait for startup
sleep 10
curl http://localhost:3000/  # Should return HTML

# Step 3: Configure your DAST scanner
# - Target: http://localhost:3000/
# - Auth: Register a test account, then configure the scanner with those credentials
# - Example: [email protected] / admin123 (default admin - challenge specific)

# Step 4: Run your scanner
# Verify it finds at minimum:
# - SQL injection (login form, search endpoint)
# - Reflected XSS (search bar)
# - Missing Content-Security-Policy header
# - Missing X-Content-Type-Options header

Configuring Authenticated Scanning

Most of Juice Shop’s interesting attack surface is behind authentication. To test authenticated endpoints:

Register a test account at http://localhost:3000/#/register
Configure your DAST scanner to log in with those credentials before scanning
Verify the scanner can access authenticated pages like /#/profile and /api/users/me
Run a full authenticated scan

An unauthenticated scan of Juice Shop only tests the login page, product listing, and a few public endpoints — roughly 20% of the attack surface.

Juice Shop for CTF Events

Juice Shop is widely used for Capture The Flag (CTF) events in corporate security training. It includes a CTF mode that generates unique flags (tokens) for each solved challenge, making it suitable for competitive team exercises.

Setting Up CTF Mode

# Install the Juice Shop CTF CLI
npm install -g juice-shop-ctf-cli

# Or use the environment variable to set a CTF secret
docker run -d -p 3000:3000 \
  -e CTF_KEY=your_secret_key_here \
  bkimminich/juice-shop

In CTF mode, solved challenges display a unique flag string instead of a congratulatory popup. Teams submit these flags to the CTF platform (CTFd, FBCTF) to score points.

Juice Shop vs. Other Vulnerable Web Applications

Feature	OWASP Juice Shop	DVWA	WebGoat	bWAPP
Modern SPA architecture	✅ Angular	❌ Traditional HTML	❌ Traditional HTML	❌ Traditional HTML
REST API surface	✅ Full REST API	Limited	Limited	Limited
Challenge system with scoring	✅ 100+ challenges	❌	❌	❌
CTF mode	✅ Built-in	❌	❌	❌
JWT vulnerabilities	✅ Multiple	❌	✅ Some	❌
GraphQL	⚠️ Limited	❌	❌	❌
Best for DAST benchmarking	✅ Modern apps	✅ PHP apps	✅ Java apps	✅ Breadth
Best for SAST benchmarking	❌ Complex architecture	✅ PHP SAST	✅ Java SAST	✅ PHP SAST
Difficulty level	Beginner to Expert	Beginner to Intermediate	Beginner to Intermediate	Intermediate to Advanced

When to choose Juice Shop: For DAST benchmarking modern SPA+REST API applications, CTF-style training events, understanding JWT and modern auth vulnerabilities, and practicing against a realistic application architecture.

When to use something else: For SAST benchmarking (Juice Shop’s Node.js architecture is complex — use DVWA for PHP SAST benchmarking or WebGoat for Java). For breadth of unusual vulnerability types (bWAPP covers 100+ vulnerability classes). For structured step-by-step learning (WebGoat’s lesson format is more guided).

Tips for Getting Started with Juice Shop

For Beginners

Start with the one-star challenges — open the scoreboard and sort by difficulty. One-star challenges are intentionally straightforward and teach the most fundamental concepts.
Use the hints — each challenge on the scoreboard has a hint (click the lightbulb icon) if you’re stuck. There’s also a companion book, “Pwning OWASP Juice Shop,” available free at pwning.owasp-juice.shop.
Open your browser’s developer tools — the Network tab in Chrome/Firefox DevTools is essential. Watch the API requests the application makes as you navigate — you’ll see the REST API structure, authentication tokens, and data flows.
Start with SQL injection — the login form SQL injection is the quintessential beginner challenge. If you’re new to security, this one demonstrates the fundamental concept of injection attacks clearly and immediately.

For Intermediate Practitioners

Explore the API directly — Juice Shop’s REST API is documented at http://localhost:3000/api-docs. Access it directly with curl or a REST client to understand the full attack surface beyond what the frontend exposes.
Examine the JavaScript source — the Angular application source contains comments, hardcoded paths, and logic that reveals hidden functionality. Opening http://localhost:3000/main.js and searching for route definitions, API calls, and configuration values reveals much of the application’s structure.
Try multi-step challenges — intermediate challenges often require chaining multiple techniques: find a piece of information, use it to access an endpoint, exploit that endpoint to escalate privileges. This is how real-world attacks work.

For Advanced Practitioners

Target the JWT challenges — Juice Shop’s JWT implementation has multiple weaknesses. Forging admin tokens using algorithm confusion requires understanding both the JWT specification and common implementation pitfalls.
Attempt the 5-star and 6-star challenges — these require creative thinking, deep understanding of JavaScript, and often multiple chained exploits. Completing them puts you in the top percentile of Juice Shop users.
Run automated DAST scanning — point a full DAST scanner at your Juice Shop instance and compare what the scanner finds versus what you’ve manually discovered. This measures scanner effectiveness and identifies scanner blind spots.

What the Vulnerabilities in Juice Shop Look Like in Production

Every vulnerability category in Juice Shop maps directly to vulnerabilities found in real enterprise applications. Here’s how:

SQL injection in Juice Shop’s login → SQL injection in enterprise login forms using string-concatenated queries (found in legacy PHP/ASP.NET applications regularly)

JWT algorithm confusion in Juice Shop → The same vulnerability exists in production APIs using libraries with insecure default configurations or custom JWT verification logic

IDOR in Juice Shop’s basket API → BOLA (Broken Object Level Authorization) is the #1 OWASP API Security risk and is present in a significant percentage of real REST APIs

Stored XSS in Juice Shop reviews → Any application that stores user input and renders it without encoding is vulnerable — forums, comment systems, CRM notes, ticket systems

Missing security headers in Juice Shop → A majority of production web applications have at least one missing security header. Juice Shop’s defaults model this common misconfiguration.

Practicing on Juice Shop builds the pattern recognition needed to find these same vulnerability classes in production applications — where the code is more complex, the context is less obvious, and the consequences of missing them are real.

Benchmarking Your Scanner Against Juice Shop

Before deploying a DAST tool against your production application, verify it finds known vulnerabilities in Juice Shop. A scanner that misses the unobfuscated SQL injection in Juice Shop’s login form — the most basic, well-known SQL injection test case — will miss similar patterns in your production code.

Offensive360 DAST is benchmarked against Juice Shop on every release. You can verify scanner performance yourself:

Run a one-time DAST scan of your web application for $500 — authenticated scanning with results within 48 hours, no subscription required
See Offensive360’s DAST scanner in action against Juice Shop — live demonstration against a deliberately vulnerable application or your own

Frequently Asked Questions

Is OWASP Juice Shop free?

Yes. Juice Shop is a free, open-source project maintained by the OWASP Foundation. The source code is on GitHub at github.com/juice-shop/juice-shop under the MIT license. The Docker image is freely available on Docker Hub at bkimminich/juice-shop.

How many challenges does Juice Shop have?

Juice Shop currently has over 100 challenges across all difficulty levels and categories. New challenges are added with each major release. The exact count changes with each version — the scoreboard always shows the current complete list.

Can I use Juice Shop in a classroom or training program?

Yes. Juice Shop is specifically designed for use in security training, education, and awareness programs. The CTF mode supports competitive team exercises. The companion book “Pwning OWASP Juice Shop” is available free for use in training programs.

Does Juice Shop work on Apple Silicon (ARM) Macs?

Yes. The official Docker image (bkimminich/juice-shop) supports both AMD64 and ARM64 architectures. Running it on Apple Silicon Macs with Docker Desktop works without any special configuration.

What’s the difference between Juice Shop versions?

The current stable version is available at bkimminich/juice-shop:latest. Specific version tags (e.g., bkimminich/juice-shop:v17.0.0) are available if you need a pinned version for a training environment or CTF event. Version-specific challenge sets may differ slightly.

Can automated scanners solve Juice Shop challenges?

Some challenges can be solved by automated scanners — SQL injection, reflected XSS, and security misconfiguration checks will be found by any competent DAST tool. Many challenges require human reasoning (reading source code, chaining multi-step exploits, manipulating business logic). Automated tools and human testers complement each other on Juice Shop just as they do in real assessments.

Summary

OWASP Juice Shop is the best single tool for learning modern web application security. Its realistic Node.js SPA architecture, 100+ challenges across every OWASP Top 10 category, built-in CTF support, and active maintenance make it the industry standard for:

Security training and skill development
DAST scanner benchmarking
Developer security awareness programs
CTF events and competitive security training

Get it running with one Docker command: docker run --rm -p 3000:3000 bkimminich/juice-shop — and start with the scoreboard at http://localhost:3000/#/score-board.