Juice Shop
A deliberately insecure web shop for practicing finding and exploiting security flaws.
- Stars
- 14.3k
- Forks
- 20.4k
- Licence
- MIT
- Language
- TypeScript
- Last update
- 6 days ago
- Type
- App
What it is
OWASP Juice Shop is a web application full of intentional security holes. It is built to be attacked, so people can learn how common vulnerabilities work in a safe, legal setting. The README says it covers vulnerabilities from the entire OWASP Top Ten plus other real-world flaws, and it is used in security training, demos, CTF competitions, and as a test target for security tools.
- Run it locally with npm start and browse to localhost:3000 to explore the shop
- Work through security challenges covering OWASP Top Ten categories
- Point a security scanner at a local instance to see what it detects
- Use the official companion guide for hints and walkthrough material
Great for
- Security students learning web vulnerabilities hands-on
- Trainers running awareness workshops or demos
- CTF players looking for practice challenges
- Teams testing their own security scanning tools against a known-vulnerable target
Not ideal for
- Anyone who wants to run it as a real online shop, since it is intentionally insecure
- Public deployment: the README says the demo instance is for deployment tests only and has no guaranteed uptime
- People without basic web or command-line familiarity, since setup requires Node.js or Docker
How to get it
- 1
Install with a package manager
You'll need: Node.js (a supported LTS version; see the README compatibility table) · Git (for cloning from source) · Docker (optional, for the container option)
Clone the repository from source
git clone https://github.com/juice-shop/juice-shop.git --depth 1Install dependencies
npm installStart the application
npm start - 2
Run it
- Install Node.js using a version listed as supported in the README
- Clone the repository and cd into the juice-shop folder
- Run npm install, then npm start
- Open http://localhost:3000 in your browser
- 3
Get the most out of it
- Read the official companion guide at pwning.owasp-juice.shop for challenge hints and setup details
- Configure a local or cloud AI provider if you want the AI/LLM-dependent challenges to work (see the external dependencies docs)
- Use the Docker option with docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop to avoid local Node setup
- Browse the project page at owasp-juice.shop for the full feature list and architecture overview
Downloads
Strengths
- Covers a broad range of OWASP Top Ten vulnerabilities in one app
- Multiple install options: from source, packaged downloads, Docker, or Vagrant
- Open source under the MIT license and an OWASP flagship project
Trade-offs
- Some challenges need an AI/LLM provider, which requires extra configuration per the docs
- Supported Node.js versions and packaged builds vary; check the compatibility table before installing
- Intentionally vulnerable, so it must be kept off the public internet and out of production networks
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| juice-shop (this) | 14.3k | App | beginner | 6 days ago | Security students learning web vulnerabilities hands-on |
| Ciphey | 21.7k | App | beginner | 5 days ago | CTF players working through encoding puzzles |
| hacker-roadmap | 15.7k | Curated list | beginner | 3.1 years ago | Beginners who want an overview of penetration testing concepts and vocabulary |
| PayloadsAllTheThings | 82.3k | Curated list | beginner | 6 days ago | Penetration testers who want a quick reference of payload variations for a known vulnerability class |
| h4cker | 30k | Curated list | beginner | 14 days ago | Students looking for a structured starting point in cybersecurity |
| spiderfoot | 24.2k | App | intermediate | 7 months ago | Security professionals doing reconnaissance during penetration tests or red team exercises |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.