OWASP Juice Shop

Main Selling Points

• Free and Open source: Licensed under the MIT license with no hidden costs or caveats
• Easy-to-install: Choose between node.js, Docker and Vagrant to run on Windows/Mac/Linux as well as all major cloud providers
• Self-contained: Additional dependencies are pre-packaged or will be resolved and downloaded automatically
• Beginner-friendly: Hacking Instructor scripts with optional tutorial mode guide newcomers through several challenges while explaining the underlying vulnerabilities
• Gamification: The application notifies you on solved challenges and keeps track of successfully exploited vulnerabilities on a Score Board
• Self-healing: Wiped clean and repopulated from scratch on every server startup while automatically persisting progress in your browser or via manual local backup
• Re-branding: Fully customizable in business context and look & feel to your own corporate or customer requirements
• CTF-support: Challenge notifications optionally contain a flag code for your own Capture-The-Flag events
• Coding Challenges: Over 20 hacking challenges come with an additional Coding Challenge where finding and fixing the responsible code flaw can be trained
• Interoperability: Integrate with your own training systems via WebHook, monitor the extensive metrics or consume challenge information directly via API or file import

Screenshots

Application Architecture

Latest Releases

• 2024-09-09T16:06:22Z: juice-shop v17.1.1
• 2024-08-05T15:07:20Z: juice-shop v17.1.0
• 2024-05-24T21:08:54Z: juice-shop v17.0.0
• 2024-04-22T13:36:03Z: juice-shop v16.0.1
• 2023-12-19T15:35:41Z: juice-shop v16.0.0
• 2023-11-03T20:11:03Z: juice-shop v15.3.0
• 2023-10-03T21:17:58Z: juice-shop v15.2.1
• 2023-09-22T16:37:04Z: juice-shop v15.2.0
• 2023-09-08T13:03:29Z: juice-shop v15.1.0
• 2023-05-19T23:00:51Z: juice-shop v15.0.0
• 2023-02-14T14:08:37Z: juice-shop v14.5.1
• 2023-02-07T15:08:44Z: juice-shop v14.5.0
• 2023-01-04T05:43:07Z: juice-shop v14.4.0
• 2022-11-12T10:07:13Z: juice-shop v14.3.1
• 2022-09-24T13:49:03Z: juice-shop v14.3.0

CTF Extension

• 2024-10-25T14:30:28Z: juice-shop-ctf v11.0.0
• 2023-10-11T22:23:15Z: juice-shop-ctf v10.0.1
• 2023-09-01T10:31:42Z: juice-shop-ctf v10.0.0
• 2022-08-23T16:13:55Z: juice-shop-ctf v9.1.2
• 2022-08-03T04:31:18Z: juice-shop-ctf v9.1.1
• 2022-07-31T20:52:39Z: juice-shop-ctf v9.1.0
• 2022-01-16T20:18:28Z: juice-shop-ctf v9.0.0
• 2021-09-26T18:28:42Z: juice-shop-ctf v8.2.3

MultiJuicer

• 2024-11-10T19:45:11Z: multi-juicer v8.0.0-rc.0
• 2024-10-06T00:25:23Z: multi-juicer v7.3.2
• 2024-09-19T13:26:34Z: multi-juicer v7.3.1
• 2024-09-10T09:40:37Z: multi-juicer v7.3.0
• 2024-04-19T17:48:27Z: multi-juicer v7.2.2
• 2023-12-21T11:11:28Z: multi-juicer v7.2.1
• 2023-12-21T11:05:26Z: multi-juicer v7.2.1-rc.0
• 2023-12-20T11:17:36Z: multi-juicer v7.2.0
• 2023-11-08T18:33:41Z: multi-juicer v7.1.0
• 2023-10-18T18:04:26Z: multi-juicer v7.0.1

Roadmap

• Auction off up to ten unique anniversary NFT artworks to true Juice Shop fans

• Complete the Angular 17 migration of the frontend

• Re-write all MultiJuicer server components in Go (✅ completed. coming with upcoming 8.0.0 release)

• Better MultiJuicer ScoreBoard listing solved challenges by team.

• Pay back other accumulated technical debt and harmonize codebase overall

• Bring overall test coverage back over 90%+

Challenge Categories

The vulnerabilities found in the OWASP Juice Shop are categorized into several different classes. Most of them cover different risk or vulnerability types from well-known lists or documents, such as OWASP Top 10, OWASP ASVS, OWASP Automated Threat Handbook and OWASP API Security Top 10 or MITRE’s Common Weakness Enumeration.

Challenge Tags

Tags do not represent vulnerability categories but serve as additional meta information for challenges. They mark certain commonalities or special types of challenges - like those lacking seriousness or ones that probably need some scripting/automation etc.

Hacking Instructor Tutorials

Click on a link in the table below to launch a step-by-step tutorial for that particular challenge on our public https://demo.owasp-juice.shop instance. If you are entirely new to the Juice Shop, we recommend doing them in the listed order. With the (optional) Tutorial Mode you can even enforce that the 12 tutorial challenges have to be performed gradually in order to unlock the other 95 challenges.

Coding Challenges

For 27 challenges an additional coding challenge is available. In their “Find It” phase they teach spotting vulnerabilities in the actual codebase of the Juice Shop. In the “Fix It” phase the user then chooses the most appropriate fix from a list. Solve any of the hacking challenges below to enable a button on the Score Board that launches the corresponding coding challenge:

Mitigation Links

For many solved challenges links to mitigation techniques are presented on the Score Board by offering a link to a corresponding OWASP Cheat Sheet explaining how to avoid that kind of vulnerability in the first place. The following cheat sheets are referred to by OWASP Juice Shop as mitigation links:

• Authentication Cheat Sheet
• Authorization Cheat Sheet
• Choosing and Using Security Questions Cheat Sheet
• Credential Stuffing Prevention Cheat Sheet
• Cross-Site Request Forgery Prevention Cheat Sheet
• Cross Site Scripting Prevention Cheat Sheet
• Cryptographic Storage Cheat Sheet
• DOM based XSS Prevention Cheat Sheet
• Denial of Service Cheat Sheet
• Error Handling Cheat Sheet
• File Upload Cheat Sheet
• Forgot Password Cheat Sheet
• Injection Prevention Cheat Sheet
• Input Validation Cheat Sheet
• JSON Web Token for Java Cheat Sheet
• Key Management Cheat Sheet
• Logging Cheat Sheet
• Mass Assignment Cheat Sheet
• Multifactor Authentication Cheat Sheet
• REST Security Cheat Sheet
• SQL Injection Prevention Cheat Sheet
• Server Side Request Forgery Prevention Cheat Sheet
• Unvalidated Redirects and Forwards Cheat Sheet
• User Privacy Protection Cheat Sheet
• Vulnerability Disclosure Cheat Sheet
• Vulnerable Dependency Management Cheat Sheet
• Web Service Security Cheat Sheet
• XML External Entity Prevention Cheat Sheet
• XS Leaks Cheat Sheet

CTF Extension

The Node package juice-shop-ctf-cli helps you to prepare Capture the Flag events with the OWASP Juice Shop challenges for different popular CTF frameworks. This interactive utility allows you to populate a CTF game server in a matter of minutes.

Supported CTF Frameworks

The following open source CTF frameworks are supported by juice-shop-ctf-cli:

• CTFd
• FBCTF
• RootTheBox

Official Companion Guide

Pwning OWASP Juice Shop is the official companion guide for this project. It will give you a complete overview of the vulnerabilities found in the application including hints how to spot and exploit them. In the appendix you will even find complete step-by-step solutions to every challenge.

The ebook is published under CC BY-NC-ND 4.0 and is online-readable for free at https://pwning.owasp-juice.shop. The latest officially released edition is also available for free at https://leanpub.com/juice-shop in PDF, Kindle and ePub format.

Official Multi User Platform

Multi User Juice Shop Platform to run separate Juice Shop instances for training or CTF participants on a central Kubernetes cluster. MultiJuicer comes with a built-in leader board and its own dedicated Juice Balancer for instance isolation.

Official Jingle

Official OWASP Juice Shop Jingle written and performed by Brian Johnson

Endorsed Open Source Projects

The tools listed above are provided by third parties outside the OWASP Juice Shop project scope. For support or feature requests please use the support channels or issue trackers mentioned by these projects.

Project Supporters

You can attribute your donation to the OWASP Juice Shop project by using this link or the green “Donate”-button while on any tab of the Juice Shop project page!

Top Supporters

In order to be recognized as a “Top Supporter” a company must have donated $1000 or more a) to OWASP while attributing it to Juice Shop or b) as a restricted gift to OWASP Juice Shop in the last 12 months.

All Corporate Supporters

• secuvera^{(2018/2019/2023)}
• mindsetters OG⁽²⁰²³⁾
• Heyhack⁽²⁰²²⁾
• Schutzwerk⁽²⁰²²⁾
• New Work SE^(2019/2021)
• RandoriSec⁽²⁰²¹⁾
• Wild West Hackin’ Fest⁽²⁰²⁰⁾
• Denim Group^(2018-2019)
• PlexTrac⁽²⁰¹⁹⁾
• Silpion⁽²⁰¹⁹⁾
• iteratec⁽²⁰¹⁷⁾
• eSailors⁽²⁰¹⁶⁾
• XING⁽²⁰¹⁶⁾

All Individual Supporters

• Björn Kimminich

• Jeroen Willemsen

• Soron Foster

• Bendik Mjaaland

• Timo Pagel

• Benjamin Pfänder

• Kevin Chung

• Brian Johnson

• Omar Santos

• Merlyn Albery

• Alper Basaran

• Jediah Logiodice

• Kenyo Kaneda

• Ian Sexton

• You want to appear on this list? Donate to OWASP here! 🤲

All Corporate-sponsored Code Contributions

• #1221, #1356: Panasonic Information Systems Company Europe^(2019-2020)

In order to be recognized as a “Corporate-sponsored Code Contribution” an official written confirmation of waiving all IP to the contributed code must be formally submitted to the OWASP Foundation.

LeanPub Royalties

$1,251.68 of royalties from Björn Kimminich’s eBook have been donated to the project between 09/2017 and 07/2019.

MultiJuicer Maintenance

MultiJuicer was originally developed (and is still maintained primarily) by iteratec. It became an official part of the OWASP Juice Shop project 05/2023.

The OWASP Foundation is very grateful for the support by the individuals and organizations listed. However, please note, the OWASP Foundation is strictly vendor neutral and does not endorse any of its supporters.