juice-shop/juice-shop

Health v2 · maintenance only

Adoption not part of the score

13726 stars · 19339 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OWASP Juice Shop is an intentionally insecure web application written in Node.js, Express, and Angular that covers vulnerabilities from the entire OWASP Top Ten plus many other real-world flaws. It is used for security training, awareness demos, CTFs, and as a test target for security tools, with hacking challenges tracked on a scoreboard.

Use cases

• practice exploiting owasp top 10 vulnerabilities
• set up a ctf hacking challenge platform
• train developers in secure coding
• test security scanners against a javascript-heavy app
• demo web application security flaws
• learn penetration testing on a legal target

When to choose

• you need a realistic, modern vulnerable app for security training or CTFs
• you want to benchmark pentesting proxies or scanners against REST APIs and SPAs
• you teach application security and want gamified challenges

When to avoid

• you need a secure production e-commerce application
• you want a minimal vulnerable target rather than a full-featured shop
• you cannot host a deliberately insecure application safely

Facets

application · maturity active

security penetration-testing web-framework developer-tools security penetration-testing web-development education self-hosted cross-platform vulnerable-web-application owasp-top-ten ctf security-training hacking-challenges scoreboard appsec intentionally-insecure nodejs web-server docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="juice-shop/juice-shop")