Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
OWASP's deliberately broken web shop. A perfect first target.
Juice Shop is the most popular deliberately insecure web application in the world, maintained by OWASP. It is a real Angular and application with a SQLite backend, seeded with dozens of vulnerabilities that map to the OWASP Top 10. It is the ideal place to build web instincts.
Your two objectives here: find the hidden Score Board (user), then in as the by abusing the login query ().
You are running this on your own machine. That is the only reason it is legal to attack it. Never point these techniques at an application you do not own or have written permission to test.
Docker and bring-your-own-VM boxes use proof revealed through the hints once you have genuinely completed the objective. Capture a flag by doing the work, then submitting the token. Phase B hosted machines will issue real per-instance flags planted on the target.
Spin the container up, confirm the shop loads in your browser, then work the objectives below. Use the hints if you stall; each one costs a few points, so try on your own first.
Spin this up locally with Docker, then attack it from your Kali box.
$docker run --rm -p 3000:3000 bkimminich/juice-shopThen hit it at http://localhost:3000/