OWASP Juice Shop Tutorial: Setup and First 10 Challenges

What Is OWASP Juice Shop?

OWASP Juice Shop is an intentionally insecure online shop, written in JavaScript and TypeScript, that you run on your own machine and hack on purpose. It covers the whole OWASP Top 10 plus many flaws from real applications, and every vulnerability is a challenge tracked on a built-in score board. It is free and open source under the MIT license.

The project has been around since 2014. It was started by Bjoern Kimminich, is maintained by volunteers, and holds OWASP Flagship status, the label OWASP gives its most mature projects. The current release on the main branch of the official GitHub repository is version 20.3.0.

What makes it different from older practice apps is the shape of the target. Juice Shop is an Angular single-page application talking to a Node.js REST API, which is how a lot of modern web apps are built. You end up reading JavaScript bundles, poking at JSON endpoints and editing browser storage, which is much closer to real bug bounty work than submitting a form on a PHP page.

The challenge file in the repository lists 116 challenges, spread across six difficulty levels:

How to Install OWASP Juice Shop

Use Docker. The project also ships packaged downloads and a source install, but those need a matching Node.js version (22, 24 or 26 at the time of writing), and version mismatches are where beginners lose their first evening. The container route takes three steps.

1. Install Docker. Docker Desktop on Windows or macOS, Docker Engine on Linux. Check it works with docker version.
2. Start Juice Shop. Run docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop. The first run downloads the image, which takes a minute or two.
3. Open it. Browse to http://localhost:3000. You should see a welcome banner and a product grid full of juice.

The 127.0.0.1 part of that command matters. It tells Docker to accept connections only from your own machine. Leave it out and Docker publishes the port on every network interface, so anyone on your Wi-Fi can reach a web app that was built to be broken.

Two things will confuse you if nobody warns you about them.

• The database wipes itself on every restart. The project calls this self-healing: if you break something, restart the container and it comes back clean. Your progress survives because Juice Shop saves it in a browser cookie for up to 30 days and restores it on the next visit. The score board settings also let you save a backup file.
• Some challenges show as unavailable in Docker. The project disables 17 potentially dangerous challenges, such as remote code execution and XXE, when it detects a container. That is a safety default, not a broken install. Setting NODE_ENV=unsafe turns them back on, but you will not need them for months.

A few challenges also need an AI provider configured before they can be solved, because they target a chatbot. Skip them at the start.

The Score Board Is Your Map

Juice Shop never shows you a link to its score board. The menu has a login, a basket and an about page, and nothing else that looks interesting. Finding the score board is the first 1-star challenge, and it teaches the habit that solves half the others: the browser already has the code, so read it.

Open your browser's developer tools (F12), go to the Sources tab (Debugger in Firefox) and open main.js. It is minified, so click the {} button to pretty-print it. Search for score and you will land in a block of Angular route definitions, one of which is score-board. Browse to http://localhost:3000/#/score-board, and a green "You successfully solved a challenge" banner appears, along with a small burst of confetti.

That route list is a gift. It names every page the developers built, including the ones they did not link to. Copy it into a notes file before you do anything else, because several later challenges are just "go to the page nobody linked".

Once you are on the score board, three features make it much easier to use:

• Difficulty filter. Hide everything above 2 stars. Seeing 116 challenges at once is the fastest way to feel lost.
• Hints. Each challenge has a Hints button that reveals clues one at a time. Use the first hint freely. Use the second only after twenty minutes of being stuck.
• Hacking Instructor. Challenges with a graduation cap icon have an interactive tutorial that walks you through the attack on screen. There are eleven of them, including Score Board, DOM XSS and Login Admin. They are the gentlest possible start.

If two or three challenges seem to be solved at the same time, that is normal. You can close a pile of "challenge solved" notifications in one go by holding Shift while clicking the X on any of them, which is also, fittingly, a 1-star challenge.

Your First 10 OWASP Juice Shop Challenges

This is the order we would give a friend on their first day. Each one teaches a different idea, and together they cover most of the OWASP Top 10 at a beginner level. Try each one for fifteen minutes before reading the solution below it. The struggle is the part that teaches you.

1. Score Board (1 star)

Covered above. Lesson: hidden is not the same as protected. If the client knows the route, so do you.

2. Error Handling (1 star)

Make the app throw an error it should have caught. The quickest way: request a REST endpoint that does not exist, such as http://localhost:3000/rest/qwertz. Instead of a polite 404, you get an error page with a stack trace and the names of the libraries the server uses. Lesson: error messages are free recon. Attackers collect framework names and file paths from them all the time.

3. Privacy Policy and Security Policy (1 and 2 stars)

Log in with any account you register and read the privacy policy. Then do what a careful researcher does before testing a site: request /.well-known/security.txt. That file is a real standard that tells researchers how to report bugs. Lesson: on a real program, read the rules and the disclosure contact before you send a single payload.

4. Confidential Document (1 star)

The About Us page links to a terms-of-use file at /ftp/legal.md. Delete the filename from the URL and browse to /ftp. The server lists the whole folder, and acquisitions.md is a document the shop never meant to publish. Lesson: when you see a file path, always try the folder above it.

5. Zero Stars (1 star)

The Customer Feedback form will not submit until you pick a star rating, so a zero-star review seems impossible. Fill in a comment and solve the captcha, then inspect the Submit button in DevTools. It carries a disabled attribute. Delete that attribute and click. The server accepts a rating of zero because only the browser was checking. Lesson: client-side validation is a user experience feature, not a security control.

6. DOM XSS (1 star)

Paste this into the search box and press Enter:

<iframe src="javascript:alert(`xss`)">

An alert box pops up. The search term was written into the page without being encoded, so the browser treated it as HTML. Lesson: anywhere your input shows up on the page is a place to test for cross-site scripting.

7. Login Admin (2 stars)

This is the classic SQL injection login bypass. On the login page, enter this as the email and anything as the password:

' or 1=1--

The single quote closes the email string in the server's SQL query, or 1=1 makes the condition true for every user, and -- comments out the password check. The database returns its first user, who happens to be the administrator. Lesson: the moment you type a single quote and the app behaves differently, you have found something worth digging into.

8. Admin Section (2 stars)

Remember the route list from main.js? One of the routes is administration. Browsing to /#/administration as a normal user gives you a 403. Do it while logged in as the admin from challenge 7 and the page opens, with a list of every registered user and all customer feedback. Lesson: one bug often opens the door to the next. Real findings are usually chains.

9. Five-Star Feedback (2 stars)

Still logged in as admin, use the administration page to delete every 5-star review. It is a small challenge, but it shows what an attacker does once they have admin access: damage the business, quietly.

10. View Basket (2 stars)

Log in as yourself and add a product to your basket. Open DevTools, go to Application, then Session Storage, and find a value named bid, your basket ID. Change it by one and reload the basket page. You are now looking at someone else's shopping basket. This is an IDOR, an insecure direct object reference, and bug bounty hunters love this bug class because finding it needs no special tools. Lesson: if an ID is a number, try the next number.

That is ten challenges, and you have touched broken access control, injection, XSS, security misconfiguration and sensitive data exposure. Most beginners take two or three evenings to get here, which is a good pace.

Tools Worth Adding After the First Evening

Everything above needs nothing but a browser. Around the 3-star level, you will start to feel the limits of DevTools, and two tools fix that.

• An intercepting proxy. Burp Suite Community Edition or OWASP ZAP sits between your browser and Juice Shop and lets you pause, edit and replay every request. Many 3-star challenges, like placing an order for a negative quantity, are much easier when you can edit the JSON body before it reaches the server. Pick one and stick with it. We would pick Burp, since it is the industry default for web testing.
• The REST API itself. Juice Shop's front end calls endpoints like /api/Products and /rest/products/search?q=. Open them directly in the browser or with curl. Plenty of challenges are easier to solve against the API than through the pretty interface, and that is true of real targets too.

In practice, the people who stall on Juice Shop are rarely missing a tool. They are skipping the boring step of writing things down. Keep a notes file with every route, endpoint, user email and error message you see. By the 3-star challenges, that file is doing half the work.

Juice Shop CTF Mode: Turn It Into a Practice Competition

If your real goal is to play CTF competitions, Juice Shop has a feature most guides skip. Start it with the ctf configuration and every solved challenge shows a flag code you can submit to a scoreboard, exactly like a jeopardy-style CTF:

docker run -d -e "NODE_ENV=ctf" -p 127.0.0.1:3000:3000 bkimminich/juice-shop

CTF mode also hides the hints and the GitHub ribbon, so it feels less like a tutorial and more like a contest. If you lose a flag, click the "solved" label on the score board to show the notification again.

To run an event for a club, class or group of friends, the project's juice-shop-ctf-cli tool (npm install -g juice-shop-ctf-cli) generates an import file for CTFd, FBCTF or RootTheBox, with every challenge, category and point value already filled in. Each player still needs their own Juice Shop instance, and all instances must share the same secret key, set with the CTF_KEY environment variable, so the flags match. The details are in the CTF chapter of the official companion guide.

We like this as a first competition for a simple reason. Most beginners' first live CTF goes badly: the challenges are too hard, the clock is running and nobody explains anything. A Juice Shop CTF with friends keeps the scoreboard pressure and the flag submission ritual, while the targets stay at a level you can actually solve. Do this once and your first real event will feel familiar.

When You Get Stuck: Hints, the Guide and Spoilers

Juice Shop comes with a free official book, Pwning OWASP Juice Shop, which you can read online or download as a PDF. Part II explains each vulnerability category with hints. The appendix has a full step-by-step solution for every challenge.

The appendix is useful and dangerous in equal measure. Read a solution too early and you learn the answer to one puzzle instead of the way of thinking that solves the next ten. A rule that works: before opening a solution, write down three things you tried and why each one failed. If you cannot list three, you have not tried hard enough yet. If you can, read the solution and then redo the challenge from scratch without looking.

For a broader view of where Juice Shop fits, our DVWA tutorial covers the other classic local target. DVWA shows you the vulnerable PHP source for every module, which makes it better for understanding root cause. Juice Shop hides its bugs and makes you find them, which makes it better practice for real testing. Doing both is the strongest free start in web security.

What Juice Shop Will Not Teach You

Juice Shop is a web application, and only a web application. You will not touch Linux privilege escalation, network scanning, Active Directory or binary exploitation here. Real CTF competitions have categories for all of those, so treat Juice Shop as your web track, not your whole training plan.

Some challenges are also deliberately silly. The score board tags them as Shenanigans or Contraption, which means they are there for fun rather than realism. They are fine to play, but do not judge your progress by them.

Finally, you always know there is a bug. Every challenge on the score board tells you something is broken and roughly where. Real applications do not, and the step from "I know there is an IDOR somewhere" to "I wonder if there is anything here" is what lab platforms and bug bounty programs train next.

Legal and Ethical Considerations

• Keep it on localhost. Bind the port to 127.0.0.1 as shown above. A public Juice Shop is an open invitation to anyone running a scanner.
• Never try these payloads on live sites. Typing ' or 1=1-- into a login form you do not own is unauthorized access under laws like the Computer Fraud and Abuse Act in the US and the Computer Misuse Act in the UK.
• Use bug bounty programs for real targets. They give you written permission and a scope. Read the scope before testing.
• Leave the demo instance alone. The maintainers host it for previewing releases, not for attacking.

Frequently Asked Questions