OWASP Juice Shop lab: a vulnerable web shop to attack in your own copy

What students learn

How weaknesses work, so that they build and defend software that does not have them. A Score Board lists every challenge by difficulty and turns each green when it is solved. It is not linked from anywhere: finding it is the first challenge. The hints in the lab are the habits of a tester: look at what the browser sends and receives, read what the page’s own code does, and ask of every input what the program trusts about it.

Run it in your browser

The shop starts in a few seconds and forgets its state when the lab stops, so a student who will carry on tomorrow copies the continue code the Score Board offers.

1. Open the Container page. Open Build on the bar and choose Run a container. Anybody may open it, and the Git lab and the SQL lab start with no account. Every other lab needs a free account: create one, sign in, then press Start.
2. Find the lab. The Sample labs card lists every sample. Find OWASP Juice Shop.
3. Press Start. Start runs it as it is, in one press. Edit the file first opens the compose file so you can change it before you start.
4. Open it. On the lab’s page, press Open to see the shop. Find the Score Board and work through the challenges by difficulty.

What to ask students to hand in

Evidence in two halves. First, a screenshot of the solved challenges on the Score Board, with the lab’s own address visible in the browser so it is clearly their copy. Second, for each, a written explanation in their own words of what the weakness is, the exact input they used and why it worked, what an attacker could do with it, and how the code should have been written. The second half tells you whether it was understood or copied from a walkthrough.

Nothing here is marked automatically, and a copy is private to the student, though staff who teach the module can open it, which is written to the access log the student can read.

The code on GitHub

The compose file runs the project’s own public image, pinned to a version so the lab does not change under a class between lessons, as an unprivileged account in under 512 MB. Juice Shop is MIT licensed and is not distributed by us. A few challenges that need the internet or an AI service cannot be solved in a lab, which has no way out.

• The repository on GitHub
• compose.yaml, the whole lab
• The README, with the lesson
• The licence (MIT)

A basic lesson on this lab

Juice Shop Basics and Juice Shop Basics 2 are small lessons worked in this lab, each starting with the rule that a student attacks their own copy and nothing else. In the first they find the Score Board and solve three of the easiest challenges, two of them with a Run button that types a curl command into their terminal. In the second they find a page meant for the owner and try cross-site scripting.

A free personal account is given them on the Basics module, which is on Home, every college can copy them from the Library’s Basics folder, and a new college opens with them in a module called Lab Basics (Sample). They are deliberately small: they show a teacher what a lesson worked in a lab is, and the lab does the rest. Copy one into a module of your own to change it.

Set it as work

Say in the task which challenges to complete and what to hand in.

1. Make the lab. In your module add a task and choose the Container lab card, then In a GitHub repository. Give https://github.com/mitsurutech/lab-juice-shop with the branch main. The compose file is the default, compose.yaml. Fork the repository first if you want to change it.
2. Publish and try it. Publish pins the commit you were shown, so a later change in the repository does not alter a lab you have already set. Start your own copy first.
3. Hand it out. Assign it like any task, with a due date if you want one, and say in the task what to do and what to hand in.
4. Mark what is handed in. Open a student’s copy and the work they handed in, mark it, and send it back with a reason if it needs more.

Questions people ask

Can students attack a real website with this?

No. A lab copy has no route to the internet and none to another student’s copy, so the only target is the shop the lab started.

Which topics does Juice Shop cover?

The OWASP Top 10 in a realistic application: injection, authentication and session weaknesses, access control, cryptographic failures, security misconfiguration and cross-site scripting, and vulnerability assessment as a method.

What should students hand in for Juice Shop?

Evidence in two halves: a screenshot of the solved challenges on the Score Board with the lab’s own address visible, and for each a written explanation in their own words of the weakness, the exact input used, why it worked and how the code should have been written. Nothing is marked automatically, so the written half is what shows whether it was understood.