{"name":"juice-shop: Practice Web Application Security with OWASP","description":"OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws.","github":"https://github.com/juice-shop/juice-shop","url":"https://osrepos.com/repo/juice-shop-juice-shop","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/juice-shop-juice-shop","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/juice-shop-juice-shop.md","json":"https://osrepos.com/repo/juice-shop-juice-shop.json","topics":["typescript","web-app","security","education","web-security-training","ctf","vulnerable-web-app"],"keywords":["typescript","web-app","security","education","web-security-training","ctf","vulnerable-web-app"],"stars":null,"summary":"OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws.","content":"## Overview\n\nOWASP Juice Shop is a deliberately insecure web application built with TypeScript. It gives security learners and practitioners a realistic target for exploring vulnerabilities across the OWASP Top Ten and other flaws found in real-world applications.\n\nThe project is intended for security training, awareness demonstrations, CTFs, and testing security tools. It can run locally from source, as a packaged application, or in Docker, and includes an official companion guide with vulnerability explanations and challenge solutions.\n\n## Key Features\n\n- Covers vulnerabilities from the OWASP Top Ten alongside other application security flaws.\n- Provides challenges for hands-on security practice and CTFs.\n- Supports local setup from source with Node.js, packaged distributions, and Docker.\n- Offers an official companion guide with hints, explanations, and challenge solutions.\n- Documents CTF support, trainer guidance, and custom rebranding.\n- Includes some challenges that require configuration of an AI/LLM provider.\n\n## Use Cases\n\n- Security trainers can use it for guided exercises and awareness demonstrations.\n- CTF organizers can use its challenge environment for hands-on events.\n- Learners can practice finding and understanding web application vulnerabilities in a purpose-built target.\n- Security-tool developers can use it as a test application when evaluating their tools.\n\n## Our Take\n\nJuice Shop is an actively maintained, MIT-licensed training target with regular commits and releases, but its contributor activity is heavily concentrated in one person.\n\n**Good fit if:**\n- You need a deliberately vulnerable web application for security training, CTFs, or tool testing.\n- Your team can run a Node.js application or Docker container and wants an accompanying guide to the challenges.\n- You want an MIT-licensed project with recent releases and responsive issue and pull-request handling.\n\n**Look elsewhere if:**\n- You need a production-safe storefront rather than an intentionally insecure training application.\n- Your environment cannot support Node.js 22–26 or Docker-based deployment.\n- Your project requires maintainer activity to be broadly distributed, since most contributions come from one person.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-10-23 (1 day ago) |\n| Commits, last 90 days | 100+ |\n| Releases, last 12 months | 9 (latest v20.3.0, 2026-10-11) |\n| Contributors | 100+ (top contributor: 86% of commits) |\n| Issues closed, last 90 days | 14+ (typically closed in 2 days) |\n| Pull requests merged, last 90 days | 14 (typically merged in 2 days) |\n| Project age | 12 years |\n\nChecked on 2026-10-24 with the GitHub API.\n\n## Project Facts\n\n- Language: TypeScript\n- License: MIT\n- Stars: 14.2k\n- Forks: 20.2k\n- Topics: 24pullrequests, application-security, appsec, ctf, hacking, hacktoberfest, javascript, owasp\n- Website: https://owasp-juice.shop\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Node.js 22 - 26 (from package.json)\n- A Dockerfile, so it can run in a container\n- A test suite and automated checks on GitHub Actions\n\n## Getting Started\n\nWith Node.js installed, clone the repository, install dependencies, and start the app:\n\n```sh\ngit clone https://github.com/juice-shop/juice-shop.git --depth 1\ncd juice-shop\nnpm install\nnpm start\n```\n\nOpen `http://localhost:3000`. See the [README](https://github.com/juice-shop/juice-shop) for packaged, Docker, and other setup options.\n\n## License in Plain Words\n\n**MIT** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the copyright and license notice\n- Share your changes: no\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Alternatives\n\n- [DVWA](https://osrepos.com/repo/digininja-dvwa): DVWA is a PHP/MariaDB app focused on common vulnerabilities with selectable difficulty levels, while Juice Shop is built with TypeScript and spans broader challenges.\n- [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank): Vuln Bank centers on banking scenarios across web, API, GraphQL, and AI features, while Juice Shop covers a broader range of application security challenges.\n\n| Project | Language | License | Stars | Status |\n|---|---|---|---|---|\n| **juice-shop** | TypeScript | MIT | 14.2k | Active |\n| [DVWA](https://osrepos.com/repo/digininja-dvwa) | PHP | GPL-3.0 | 13.9k | Active |\n| [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank) | HTML | MIT | 960 | Maintained |\n\n## Considerations\n\nThis is intentionally insecure software. Treat it as a training target, not as a production shop, and avoid exposing it as a public hacking target. The project documents Node.js 22–26 as supported; some challenges also depend on configuring an AI/LLM provider. Although the project has regular releases and active issue handling, its contributor activity is concentrated in one person, which is a continuity risk to consider. The application is under the MIT license; the companion guide has a separate CC BY-NC-ND 4.0 license.","metrics":{"detailViews":4,"githubClicks":0},"dates":{"published":null,"modified":"2026-10-24T20:30:20.000Z"}}