Hacking Challenges

Covering various vulnerabilities and serious design flaws

OWASP Juice Shop covers all vulnerabilities from the latest OWASP Top 10 and more.

Challenge Difficulty

There's something to do for beginners and veterans alike

Score Board

Challenge progress is tracked on server-side

Immediate Feedback

Solved challenges are announced as push notifications

Coding Challenges

Identify the underlying code flaw and select an appropriate fix

Restore your Progress

Auto-saves your hacking progress and restores on server restart

The application cleanly reset on every startup and only restores challenge progress from a cookie.

Challenge Hints

All challenges come with one or more unlockable hints

Hacking Instructor

Some challenges come with an embedded interactive tutorial

Tutorial Mode

Complete all tutorials to unlock the entire Score Board

Cheat Detection

Solved challenges are rated based on cheating probability

Safety Mode

Some challenges are disabled by default in Docker and on Heroku

This is the case for all Stored XSS (due to risk of site defacement), all XXE challenges (because they can lead to instance death by segfault error) and the SSTi, Deserialization and some NoSQLi challenges (as they could have unforeseeable side effects on the hosting platform). We do not recommend to carelessly turn safety mode off!

MultiJuicer Platform

Official platform to run separate Juice Shop instances for training or CTF participants on a central Kubernetes cluster

Custom JuiceBalancer

Restricts number of users to team members and protects against illicit cross-team instance access

Simplicity & convenience

Trivial registration, transparent instance stickiness, CTF-friendly score board out-of-the-box, automatic light/dark mode

"Wargames"-style CTF view

Projector-friendly, animated view of team scores for live events

Various installation guides

Step-by-step guides for different platforms and cloud providers

MultiJuicer-To-Go

CTF Extension

Utility to host a hacking event on CTFd, FBCTF or RootTheBox

Simple Installation

Locally via npm i -g juice-shop-ctf-cli or as Docker container

Setup Wizard

Run juice-shop-ctf on the command line and let a wizard create a data-dump to conveniently import into CTFd, FBCTF, or RootTheBox

Configuration File Option

Run juice-shop-ctf --config myconfig.yml to use non-interactive mode passing in configuration via YAML file

ctfFramework: CTFd | FBCTF | RootTheBox
juiceShopUrl: http://localhost:3000
ctfKey: https://raw.githubusercontent.com/bkimminich/juice-shop/master/ctf.key
countryMapping: https://raw.githubusercontent.com/juice-shop/juice-shop/master/config/fbctf.yml
insertHints: none | free | paid
				

Flag codes in notifications

Can be conveniently copy-pasted into the CTF score server

Screenshots from CTF games

Your CTF score server instance will be ready-to-play in minutes

Re-branding

Fully customizable business context and look & feel

Configurative Customization

Customize the application via a simple YAML file

application:
  domain: juice-sh.op
  name: 'OWASP Juice Shop'
  logo: JuiceShop_Logo.png
  favicon: favicon_js.ico
  theme: bluegrey-lightgreen
  showVersionNumber: true
  showGitHubLinks: true
  numberOfRandomFakeUsers: 0
  altcoinName: Juicycoin
  privacyContactEmail: donotreply@owasp-juice.shop
  customMetricsPrefix: juiceshop
  social:
    twitterUrl: 'https://twitter.com/owasp_juiceshop'
    facebookUrl: 'https://www.facebook.com/owasp.juiceshop'
    [...]
[...]
				

Choose your own inventory

The YAML configuration allows you to override all products

products:
  -
    name: 'Product Name'
    price: 100
    description: 'Product Description'
    image: '(https://somewhe.re/)image.png'
    useForProductTamperingChallenge: false
    useForChristmasChallenge: false
    fileForRetrieveBlueprintChallenge: ~
    reviews:
      - { text: 'Customer review', author: jim }
  -
    name: 'Product with Lorem Ipsum description, filler image and random price'
				

Your config is validated on server startup to prevent broken or unsolvable challenges!

Modern Web-Architecture

JavaScript/TypeScript all the way from UI to REST API

Simple Installation

Comes with cloud, local and containerized run options

Multi-language support

Crowd-sourced UI translations for 40+ languages

Test Pyramid

Maximizing Test Automation & Code Coverage

DevOps Pyramid

Automated Build, CI/CD & Code Analysis

Integration Stacks

Convenient monitoring, notification and data integration capabilities

Solution Webhook

Sends a payload to a specified URL whenever a challenge is solved

{
    "solution": {
        "challenge": "localXssChallenge",
        "hintsAvailable": 2,
        "hintsUnlocked": 0,
        "cheatScore": 0,
        "totalCheatScore": 0.15,
        "issuedOn": "2025-09-04T18:24:33.027Z"
    },
    "ctfFlag": "b0d70dce...b85fac6785dba2349b",
    "issuer": {
        "hostName": "fv-az116-673",
        "os": "Linux (5.4.0-1031-azure)",
        "appName": "OWASP Juice Shop",
        "config": "default",
        "version": "19.0.0"
    }
}					

Grafana Dashboard

JSON template allows to import a dashboard into Grafana consuming and displaying all metrics gathered via Prometheus

Official Companion Guide

Available free of charge as an online resource and via Leanpub

Juice Shop Success Pyramid™

Some amazing facts & stats about the project

Project Roadmap

Becoming a Contributor

Visit our backlog on GitHub & translations on Crowdin

Issues labelled with  good first issue  and/or  help wanted  are the best starting point!

Official Juice Shop Jingle

Creative masterpiece by singer-songwriter Brian Johnson (100% AI-free!)