OWASP Juice Shop
Run a deliberately broken web shop and hack it
OWASP Juice Shop is an online shop that is insecure on purpose. You run it, then attack it like a real web app to solve many hacking challenges. Finding the hidden score board, which tracks your progress, is one of the first challenges.
Free · No login · Server · Beginner
About OWASP Juice Shop
It covers flaws from the OWASP Top Ten and more, at many difficulty levels. It is used for training, awareness demos and CTF events, so it suits both beginners and experienced testers. The app uses Node.js, Express and Angular.
You host it yourself. You can run it with Docker, with Node.js and npm, or with Vagrant, then open it at localhost:3000. It is open source under the MIT License.
On Breakpoint since 23 Oct 2026.