4 ms·

OWASP Juice Shop

144 points by hyperific 4y ago

thunderbong 4y ago
From the TFA - OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications! Juice Shop is written in Node.js, Express and Angular. It was the first application written entirely in JavaScript listed in the OWASP VWA Directory.
dieselgate 4y ago
This is awesome! Convenient for folks who use the Express/Angular stack but conceptual stuff should be pretty universal regardless. Wasn't aware of this project at all but found the following links useful for context: The actual Juice Shop website can be found at https://juice-shop.herokuapp.com/#/ https://juice-shop.herokuapp.com/#/ and the github link for viewing code is https://github.com/juice-shop/juice-shop/releases/ https://github.com/juice-shop/juice-shop/releases/
japanman425 4y ago
Can you edit prices client side? If not, I’ve seen worse in the wild.
todotask 4y ago
I hope OWASP can fix their janky toaster/banner when I open the site.
- deleted 4y ago
  [deleted]
kramerger 4y ago
Are there any similar CTF projects that you can download and run offline?
- beefield 4y ago
  I think https://www.vulnhub.com/ https://www.vulnhub.com/ has quite a few.
- raesene9 4y ago
  If you look at https://owasp.org/www-project-vulnerable-web-applications-directory/ https://owasp.org/www-project-vulnerable-web-applications-di... and click the "offline" tab you'll see a load of apps there.
- BeefWellington 4y ago
  You can download and run Juice Shop offline locally.
freeqaz 4y ago
We've been working on an example vulnerable app to showcase vulnerable dependencies in web apps. (Think a CVE in an NPM package.) I've been wanting that so that I can test out different security scanning and patching tools, but also actually build a test playground to exploit vulnerable dependencies. (I want to accelerate exploit development for CVEs by making it more standardized.) If you have a CVE that you'd like to write a POC exploit scenario for, you can add it to this project quickly and easily with pre-built templates[1]! (Wasp[2] is an awesome project that simplifies web dev tooling complexity.) Are there any other projects with similar goals that anybody is aware of? Asking because I couldn't find any, but I'd love to merge efforts if somebody is already doing this! 0: https://github.com/lunasec-io/damn-vulnerable-js-sca https://github.com/lunasec-io/damn-vulnerable-js-sca 1: https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/master/wasp/template https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/ma... 2: https://wasp-lang.dev/ https://wasp-lang.dev/
- sally_glance 4y ago
  I just want to say thanks for this, we used it for an internal workshop for our webdev department with very limited prior netsec experience and it was a big hit. The AIO character and a little bit of gamification through the leaderboard made it an easy to setup but really fun event! Edit: Damn, I should read before posting - was talking about the juice shop. Your project might be nice follow-up though!
sureglymop 4y ago
On mobile, I only see an "Accept" button for the cookie banner. How can I dismiss it?
- KronisLV 4y ago
  > On mobile, I only see an "Accept" button for the cookie banner. Seems like there is an "X" button to close the dialog, but the element (#close-disclaimer) is only visible on screens approx. over 700px in width and it gets pushed off screen on anything smaller. > How can I dismiss it? Personally I didn't even see it on my phone, perhaps due to any of the following: - browser: Firefox - setting: tracking protection turned on - addon: uBlock Origin - something else? Well, either it was one of those, or it broke in a way that it wasn't shown altogether.
avg_dev 4y ago
At a job I had, we had a big CTF event where people broke into groups and attempted to capture flags in the Juice Shop. I thought it was a lot of fun.
davidg109 4y ago
This been around a while, but I used it with success teaching students all about pesky web app vulns. There's one thing reading about them in a book, it's a whole other level getting students to find them.

144 points by hyperific 4y ago

From the TFA - OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications! Juice Shop is written in Node.js, Express and Angular. It was the first application written entirely in JavaScript listed in the OWASP VWA Directory.

dieselgate 4y ago

This is awesome! Convenient for folks who use the Express/Angular stack but conceptual stuff should be pretty universal regardless. Wasn't aware of this project at all but found the following links useful for context: The actual Juice Shop website can be found at https://juice-shop.herokuapp.com/#/ https://juice-shop.herokuapp.com/#/ and the github link for viewing code is https://github.com/juice-shop/juice-shop/releases/ https://github.com/juice-shop/juice-shop/releases/

japanman425 4y ago

Can you edit prices client side? If not, I’ve seen worse in the wild.

todotask 4y ago

I hope OWASP can fix their janky toaster/banner when I open the site.

deleted 4y ago
[deleted]

kramerger 4y ago

Are there any similar CTF projects that you can download and run offline?

beefield 4y ago
I think https://www.vulnhub.com/ https://www.vulnhub.com/ has quite a few.
raesene9 4y ago
If you look at https://owasp.org/www-project-vulnerable-web-applications-directory/ https://owasp.org/www-project-vulnerable-web-applications-di... and click the "offline" tab you'll see a load of apps there.
BeefWellington 4y ago
You can download and run Juice Shop offline locally.

freeqaz 4y ago

We've been working on an example vulnerable app to showcase vulnerable dependencies in web apps. (Think a CVE in an NPM package.) I've been wanting that so that I can test out different security scanning and patching tools, but also actually build a test playground to exploit vulnerable dependencies. (I want to accelerate exploit development for CVEs by making it more standardized.) If you have a CVE that you'd like to write a POC exploit scenario for, you can add it to this project quickly and easily with pre-built templates[1]! (Wasp[2] is an awesome project that simplifies web dev tooling complexity.) Are there any other projects with similar goals that anybody is aware of? Asking because I couldn't find any, but I'd love to merge efforts if somebody is already doing this! 0: https://github.com/lunasec-io/damn-vulnerable-js-sca https://github.com/lunasec-io/damn-vulnerable-js-sca 1: https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/master/wasp/template https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/ma... 2: https://wasp-lang.dev/ https://wasp-lang.dev/

sally_glance 4y ago
I just want to say thanks for this, we used it for an internal workshop for our webdev department with very limited prior netsec experience and it was a big hit. The AIO character and a little bit of gamification through the leaderboard made it an easy to setup but really fun event! Edit: Damn, I should read before posting - was talking about the juice shop. Your project might be nice follow-up though!

sureglymop 4y ago

On mobile, I only see an "Accept" button for the cookie banner. How can I dismiss it?

KronisLV 4y ago
> On mobile, I only see an "Accept" button for the cookie banner. Seems like there is an "X" button to close the dialog, but the element (#close-disclaimer) is only visible on screens approx. over 700px in width and it gets pushed off screen on anything smaller. > How can I dismiss it? Personally I didn't even see it on my phone, perhaps due to any of the following: - browser: Firefox - setting: tracking protection turned on - addon: uBlock Origin - something else? Well, either it was one of those, or it broke in a way that it wasn't shown altogether.

avg_dev 4y ago

At a job I had, we had a big CTF event where people broke into groups and attempted to capture flags in the Juice Shop. I thought it was a lot of fun.

davidg109 4y ago

This been around a while, but I used it with success teaching students all about pesky web app vulns. There's one thing reading about them in a book, it's a whole other level getting students to find them.