Contents
OWASP Juice Shop is an online juice store with vulnerabilities built in on purpose. It runs on your own computer, so you can practice attacks without harming anyone.
According to the project, it covers every category of the OWASP Top 10 plus many other flaws found in real applications. It is made for training, demos, CTFs, and as a target for security tools.
This review is for people who want to learn web vulnerabilities hands-on. After reading it, you can do the following:
- Start Juice Shop with Docker and open it in your browser
- Use the score board to see the challenges and your progress
- Use it as a practice target for ZAP and Nuclei
What Juice Shop offers
- Challenges: Find and exploit a hidden vulnerability in the app to solve a challenge. Difficulty is rated from one to six stars.
- Score board: Lists every challenge and how many you have solved. Finding the score board is itself one of the first challenges.
- Hacking Instructor: Some challenges come with an on-screen tutorial that walks you through the steps.
- Practice for scanners: You can try ZAP’s active scan or Nuclei’s templates without damaging a real site.
Try it safely with Docker
-
Install Docker.
-
Pull the image:
docker pull bkimminich/juice-shop -
Start it. Writing
127.0.0.1:3000:3000means only your own computer can open it.docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop -
Open
http://localhost:3000in your browser. -
To stop it, open another terminal, run
docker psto find the container ID, and rundocker stop <container ID>. Because you used--rm, the container is removed when it stops.
Ways to run it
| Method | Outline | Good for |
|---|---|---|
| Docker | The steps above | Trying it quickly |
| From source | Install Node.js, git clone, then npm install and npm start |
Reading the code too |
| Packaged distribution | Download the zip for your OS from GitHub releases, unpack it, and run npm start |
People who can’t use Docker |
Running from source or a packaged distribution needs Node.js. The official guide lists 22.x, 24.x, and 26.x as the supported versions.
Use it with ZAP
Keep Juice Shop running, open ZAP, and enter http://localhost:3000 in URL to attack on the Quick Start tab. The ZAP review has the full steps. If an active scan breaks the data, restart the container to get a clean copy.
Cautions
- Don’t put Juice Shop where the internet can reach it. It is vulnerable on purpose, so others can take it over. With Docker, publish it on
127.0.0.1only, as shown above. - Don’t enter real passwords or personal data.
- The
safetyModesetting turns off some challenges that could cause harm in container environments. The official guide says to change it only at your own risk. - Don’t use what you learn here on other people’s sites without permission.
Read next
Sources
- Official repository (juice-shop/juice-shop)github.com/juice-shop/juice-shop
- Pwning OWASP Juice Shop: Running OWASP Juice Shoppwning.owasp-juice.shop/companion-guide/latest/part1/running.html
- Pwning OWASP Juice Shop: Challenge trackingpwning.owasp-juice.shop/companion-guide/latest/part1/challenges.html
- Pwning OWASP Juice Shop: Customizationpwning.owasp-juice.shop/companion-guide/latest/part4/customization.html
Checked on 2026-10-24
Similar tools
Nuclei
Impact Can harm othersA command-line scanner that sends requests following steps written in YAML templates and checks the responses for known vulnerabilities and misconfigurations.
- Purpose
- Audit
- Type
- Command line
- Difficulty
- Intermediate
- License
- PermissiveMIT
- Category
- Vulnerability scanning / Web security
ZAP
Impact Can harm othersA free web app scanner that sits between your browser and a web app, records the traffic, and looks for vulnerabilities. Formerly OWASP ZAP, now ZAP by Checkmarx.
- Purpose
- Audit
- Type
- Desktop app
- Difficulty
- Intermediate
- License
- PermissiveApache-2.0
- Category
- Web security / Vulnerability scanning