# juice-shop: Practice Web Application Security with OWASP This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/juice-shop-juice-shop Generated for open source discovery and AI-assisted research. OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws. GitHub: https://github.com/juice-shop/juice-shop OSRepos URL: https://osrepos.com/repo/juice-shop-juice-shop ## Summary OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws. ## Topics - typescript - web-app - security - education - web-security-training - ctf - vulnerable-web-app ## Repository Information Last analyzed by OSRepos: Sat Oct 24 2026 21:30:20 GMT+0100 (Western European Summer Time) Detail views: 4 GitHub clicks: 0 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview OWASP Juice Shop is a deliberately insecure web application built with TypeScript. It gives security learners and practitioners a realistic target for exploring vulnerabilities across the OWASP Top Ten and other flaws found in real-world applications. The project is intended for security training, awareness demonstrations, CTFs, and testing security tools. It can run locally from source, as a packaged application, or in Docker, and includes an official companion guide with vulnerability explanations and challenge solutions. ## Key Features - Covers vulnerabilities from the OWASP Top Ten alongside other application security flaws. - Provides challenges for hands-on security practice and CTFs. - Supports local setup from source with Node.js, packaged distributions, and Docker. - Offers an official companion guide with hints, explanations, and challenge solutions. - Documents CTF support, trainer guidance, and custom rebranding. - Includes some challenges that require configuration of an AI/LLM provider. ## Use Cases - Security trainers can use it for guided exercises and awareness demonstrations. - CTF organizers can use its challenge environment for hands-on events. - Learners can practice finding and understanding web application vulnerabilities in a purpose-built target. - Security-tool developers can use it as a test application when evaluating their tools. ## Our Take Juice Shop is an actively maintained, MIT-licensed training target with regular commits and releases, but its contributor activity is heavily concentrated in one person. **Good fit if:** - You need a deliberately vulnerable web application for security training, CTFs, or tool testing. - Your team can run a Node.js application or Docker container and wants an accompanying guide to the challenges. - You want an MIT-licensed project with recent releases and responsive issue and pull-request handling. **Look elsewhere if:** - You need a production-safe storefront rather than an intentionally insecure training application. - Your environment cannot support Node.js 22–26 or Docker-based deployment. - Your project requires maintainer activity to be broadly distributed, since most contributions come from one person. ## Project Health | Signal | Value | |---|---| | Status | **Active**: regular commits and releases | | Last commit | 2026-10-23 (1 day ago) | | Commits, last 90 days | 100+ | | Releases, last 12 months | 9 (latest v20.3.0, 2026-10-11) | | Contributors | 100+ (top contributor: 86% of commits) | | Issues closed, last 90 days | 14+ (typically closed in 2 days) | | Pull requests merged, last 90 days | 14 (typically merged in 2 days) | | Project age | 12 years | Checked on 2026-10-24 with the GitHub API. ## Project Facts - Language: TypeScript - License: MIT - Stars: 14.2k - Forks: 20.2k - Topics: 24pullrequests, application-security, appsec, ctf, hacking, hacktoberfest, javascript, owasp - Website: https://owasp-juice.shop - Archived: no ## What You Need Detected in the repository: - Node.js 22 - 26 (from package.json) - A Dockerfile, so it can run in a container - A test suite and automated checks on GitHub Actions ## Getting Started With Node.js installed, clone the repository, install dependencies, and start the app: ```sh git clone https://github.com/juice-shop/juice-shop.git --depth 1 cd juice-shop npm install npm start ``` Open `http://localhost:3000`. See the [README](https://github.com/juice-shop/juice-shop) for packaged, Docker, and other setup options. ## License in Plain Words **MIT** (permissive). - Commercial use: yes - Modify and redistribute: yes - You must keep: the copyright and license notice - Share your changes: no A summary, not legal advice: the LICENSE file is what applies. ## Alternatives - [DVWA](https://osrepos.com/repo/digininja-dvwa): DVWA is a PHP/MariaDB app focused on common vulnerabilities with selectable difficulty levels, while Juice Shop is built with TypeScript and spans broader challenges. - [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank): Vuln Bank centers on banking scenarios across web, API, GraphQL, and AI features, while Juice Shop covers a broader range of application security challenges. | Project | Language | License | Stars | Status | |---|---|---|---|---| | **juice-shop** | TypeScript | MIT | 14.2k | Active | | [DVWA](https://osrepos.com/repo/digininja-dvwa) | PHP | GPL-3.0 | 13.9k | Active | | [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank) | HTML | MIT | 960 | Maintained | ## Considerations This is intentionally insecure software. Treat it as a training target, not as a production shop, and avoid exposing it as a public hacking target. The project documents Node.js 22–26 as supported; some challenges also depend on configuring an AI/LLM provider. Although the project has regular releases and active issue handling, its contributor activity is concentrated in one person, which is a continuity risk to consider. The application is under the MIT license; the companion guide has a separate CC BY-NC-ND 4.0 license.