OWASP Juice Shop
Intentionally insecure Node.js web application covering the OWASP Top 10 and beyond, with built-in score board.
Technical Architecture & Overview
OWASP Juice Shop is an insecure web application written in Node.js, Express, and Angular that contains a large number of hacking challenges of varying difficulty, covering the entire OWASP Top Ten along with other flaws found in real-world applications. A score board tracks solved challenges, and Docker deployment takes one command. The project also describes its use as a test target for security scanners and pentesting proxies.
Targeted Technical Use Cases
Self-paced web exploitation practice and as a realistic target for testing DAST tooling.
Evaluation & Trade-offs
Core Strengths
- +Large challenge set on a modern JavaScript stack.
- +Built-in hacking instructor and scoreboard.
- +OWASP Flagship project maintained by a team of volunteers.
Trade-Offs & Limitations
- -The built-in Hacking Instructor offers tutorials for only some challenges.
- -JavaScript stack does not cover classic compiled-app flaws.
Defensive Security Application
Developer security training and regression testing for web scanners against known flaws.
Frequently Asked Questions
What is OWASP Juice Shop?→
OWASP Juice Shop is an insecure web application written in Node.js, Express, and Angular that contains a large number of hacking challenges of varying difficulty, covering the entire OWASP Top Ten along with other flaws found in real-world applications. A score board tracks solved challenges, and Docker deployment takes one command. The project also describes its use as a test target for security scanners and pentesting proxies.
What is OWASP Juice Shop used for?→
Self-paced web exploitation practice and as a realistic target for testing DAST tooling.
What are the strengths of OWASP Juice Shop?→
- +Large challenge set on a modern JavaScript stack.
- +Built-in hacking instructor and scoreboard.
- +OWASP Flagship project maintained by a team of volunteers.
What are the limitations of OWASP Juice Shop?→
- +The built-in Hacking Instructor offers tutorials for only some challenges.
- +JavaScript stack does not cover classic compiled-app flaws.
How is OWASP Juice Shop used defensively?→
Developer security training and regression testing for web scanners against known flaws.