Skip to main content

OWASP Juice Shop Overview

What is OWASP Juice Shop?​

OWASP Juice Shop is a modern, intentionally insecure web application written in Node.js, Express, and Angular. It represents a realistic e-commerce application with numerous security vulnerabilities, making it an excellent platform for learning web application security.

What You Will Learn​

  • Modern web application vulnerabilities
  • RESTful API security issues
  • Client-side security challenges
  • Authentication and session management flaws
  • Data protection and privacy issues
  • Security misconfigurations

Prerequisites​

Tools Required​

  • Web Browser - Chrome or Firefox with developer tools
  • Burp Suite (Recommended) - For intercepting and manipulating requests
  • Postman (Optional) - For API testing
  • Command Line Tools (Optional) - curl for API testing

Knowledge Required​

  • Basic understanding of web applications
  • Familiarity with browser developer tools
  • Understanding of REST APIs
  • Basic knowledge of JavaScript and Angular

Launch the Lab​

Open OWASP Juice Shop in CSN Labs →

Scenarios​

Beginner​

Intermediate​

  • More scenarios coming soon

Advanced​

  • More scenarios coming soon

Suggested Learning Order​

  1. Start with Broken Authentication to understand how authentication mechanisms can be bypassed or exploited
  2. Explore the application's API endpoints using browser developer tools
  3. Try to identify vulnerabilities through manual testing
  4. Use Burp Suite to intercept and analyze requests

Safety & Ethics Note​

Important: These labs are for educational purposes only. Only use these techniques in authorized environments. Unauthorized access to computer systems is illegal and unethical. Always obtain proper authorization before testing any system.

Common Pitfalls​

  • Not Exploring the Application: Take time to understand the application's functionality before attempting exploits
  • Ignoring API Endpoints: Modern applications often have REST APIs that may have different vulnerabilities than the web interface
  • Not Using Developer Tools: Browser developer tools provide valuable information about requests, responses, and client-side code
  • Skipping Documentation: Read error messages, API documentation, and source code comments for clues