Overview
OWASP Juice Shop bills itself as "probably the most modern and sophisticated insecure web application." It is a deliberately vulnerable application built to be hacked, used for security training, awareness demonstrations, Capture-The-Flag (CTF) events and as a guinea pig for testing security tools against a real-world, JavaScript-heavy stack.
It is the first JavaScript-only application listed in the OWASP Vulnerable Web Applications Directory. The front end is an Angular single-page application styled with Angular Material, while the back end is a Node.js / Express server exposing a RESTful API, with SQLite (via Sequelize) and a MarsDB NoSQL store backing the data.
Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications.
Vulnerability Coverage
Juice Shop deliberately contains vulnerabilities spanning the entire OWASP Top 10 and far beyond, so a single application can be used to teach almost every common web weakness class:
- Injection - SQL injection and NoSQL injection
- Broken Authentication and weak session / credential handling
- Broken Access Control and insecure direct object references
- Cross-Site Scripting (XSS) - reflected, stored and DOM-based
- Sensitive Data Exposure and Cryptographic Issues
- XML External Entities (XXE) and Insecure Deserialization
- Security Misconfiguration and use of Vulnerable / outdated Components
- Broken Anti-Automation, Unvalidated Redirects and Security through Obscurity
Hacking Challenges
Hacking is gamified through 112 challenges of varying difficulty, rated from ★ (trivial) to ★★★★★★ (hardest). Your first task is usually to find the hidden Score Board, which then tracks your progress and unlocks a real-time push notification each time a challenge is solved over WebSocket.
- 112 challenges total, including 33 with optional coding (fix-the-code) challenges and 13 guided tutorials
- Categories include Injection, Broken Authentication, Sensitive Data Exposure and XXE
- Categories include Broken Access Control, Security Misconfiguration and Cross-Site Scripting
- Categories include Insecure Deserialization, Vulnerable Components and Cryptographic Issues
- Categories include Broken Anti-Automation, Unvalidated Redirects, Security through Obscurity and Improper Input Validation
- A built-in Hacking Instructor offers interactive, step-by-step tutorials for beginners
Deployment, CTF & Customization
Juice Shop runs anywhere: from source via npm on Node.js, as an official Docker image, with Vagrant, or via one-click deploy to major cloud providers on Windows, macOS and Linux. It is highly customizable and supports re-theming and rebranding for tailored trainings.
For competitions, the companion juice-shop-ctf-cli tool generates challenge data that can be imported into popular CTF frameworks such as CTFd, FBCTF and RootTheBox, while the MultiJuicer project orchestrates many isolated instances for multi-user classroom or event use.
A free companion book, "Pwning OWASP Juice Shop" by project leader Björn Kimminich, documents every challenge with hints and full solutions and is published online and on Leanpub under CC BY-NC-ND 4.0.
History & Status
Juice Shop was started in 2014 by Björn Kimminich and is now co-led with Jannik Hollenbach. It was promoted to OWASP Flagship project status in 2018, recognizing it as one of OWASP's most mature and widely used projects. Released under the permissive MIT License, it remains free and open source, with v20.0.0 shipped on 2026-05-12.