About OWASP Juice Shop
OWASP Juice Shop is an intentionally insecure web application for security training. It is run as an OWASP flagship project and is licensed under MIT.
What it does
Juice Shop includes hacking challenges based on the OWASP Top Ten and other real-world flaws. Each challenge has a difficulty level, and a scoreboard tracks the progress of the user. The project is also used as a target to check how well security tools cope with modern JavaScript frontends and REST APIs.
Key features
- Covers the OWASP Top 10 and more flaws
- Hacking challenges with difficulty levels
- Built-in scoreboard to track progress
- Tests scanners against a JavaScript frontend and REST API
- Written in TypeScript with Node.js and Angular
Who it's for
Juice Shop suits students, awareness trainers, CTF players and teams testing their security tools. Do not host it on a public server with real data, since it is designed to be broken.
Pricing and good to know
The project is open source under the MIT license, so it is free to download and run. The site links to documentation, a GitHub repository and a project page. Run it locally or in an isolated lab environment, and keep it away from production networks.
Highlights
- Covers the OWASP Top 10 and more flaws
- Hacking challenges with difficulty levels
- Built-in scoreboard to track progress
- Tests scanners against a JavaScript frontend and REST API
- Written in TypeScript with Node.js and Angular
