OWASP Juice Shop Walkthrough: Beginner and Intermediate Challenges Solved

Part of our free Tools & Targets series. Hands-on guides to the vulnerable practice apps and the security tools you will use on the job. Pair it with our Build Your Own Cyber Lab series for the lab to run them in.

1. Vulnerable practice apps: DVWA, bWAPP, Juice Shop, WebGoat, AI Goat and more
2. DVWA walkthrough: every module solved at Low, Medium and High
3. OWASP Juice Shop: beginner and intermediate challenges solved (you are here)
4. WebGoat and bWAPP: key lessons solved
5. Threat modeling your lab with OWASP Threat Dragon
6. Nessus Essentials: vulnerability scanning your lab
7. Snort and Suricata: network IDS and your first rules
8. Splunk in your lab: install, forward Windows logs, search with SPL
9. Wazuh deep dive: file integrity, vulnerability detection and custom rules

Before you start

Run Juice Shop locally (part 1), open it in a browser with Burp Suite or OWASP ZAP proxying, and keep the browser developer tools open - many challenges are solved by reading the JavaScript the app ships to you. Challenges are added and renamed between releases, so if one below is missing or different, check the official companion guide, which is the authoritative solutions source. A green banner confirms each solved challenge.

1. Score Board (1 star)

The Score Board is hidden from the menu. Search the main JavaScript bundle in developer tools (Sources tab) for "score" and you will find the client-side route. Browse to http://localhost:3000/#/score-board. Lesson: hiding a link is not access control - the client ships every route to every user.

2. Error Handling (1 star)

Request an API path that does not exist, for example http://localhost:3000/rest/qwertz. The app returns a detailed stack trace. Fix: generic error pages for users, detailed errors only in server logs.

3. Confidential Document (1 star)

The About Us page links to a file under /ftp/. Browse to http://localhost:3000/ftp - directory listing is on - and open acquisitions.md. Lesson: sensitive data exposure through a forgotten public folder. Fix: disable directory listing and never store internal documents in a web-served path.

4. Login Admin (2 stars) - SQL injection

In the login form, enter the email ' OR 1=1-- and any password. The query returns every user and you are logged in as the first one - the administrator. Fix: parameterised queries.

5. Login Jim and Login Bender (3 stars)

Same injection, but targeted: jim@juice-sh.op'-- comments out the password check for Jim's account (find his email in product reviews). Do the same for Bender. Lesson: SQL injection does not need OR 1=1; commenting out the rest of the query is enough.

6. Password Strength (2 stars)

The administrator's email is admin@juice-sh.op (visible in reviews). Brute-force the password with Burp Intruder and a common-passwords list - it is admin123. Fix: password policy, breached-password checks, rate limiting and MFA.

7. DOM XSS (1 star)

Paste this into the search box:

<iframe src="javascript:alert(`xss`)">

The search term is written into the page unsafely. Bonus Payload (1 star) uses the same field with an embedded SoundCloud iframe given in the challenge description. Fix: Angular's built-in sanitisation was deliberately bypassed here - never mark untrusted input as trusted HTML.

8. Zero Stars (1 star) - improper input validation

The feedback form will not let you submit without choosing a rating. Fill in the form, intercept the POST to /api/Feedbacks in Burp and change "rating" to 0. Lesson: client-side validation is a usability feature, not a security control.

9. Repetitive Registration (1 star)

Register with a password and a matching repeat, then edit the first password field after the repeat field - the form does not re-check. Or intercept the request and change passwordRepeat. Fix: validate on the server.

10. View Basket (2 stars) - broken access control (IDOR)

Log in as any user and open your basket. In developer tools, the basket id is stored in session storage (bid) and used in /rest/basket/<id>. Change it to another number and reload. You see someone else's basket. Fix: authorise every object access server-side against the logged-in user.

11. Forged Feedback (3 stars)

Submit feedback and intercept the request: it contains a UserId. Change it to another user's id. Fix: take the identity from the session, never from the request body.

12. Admin Section (2 stars)

Search the JavaScript bundle for "admin" to find the route #/administration. Logged in as the admin (challenge 4), browse to it. Five-Star Feedback (2 stars) is then solved by deleting all five-star reviews from that page.

13. Exposed Metrics (1 star)

Monitoring endpoints are often left public. Browse to http://localhost:3000/metrics to see the app's Prometheus metrics. Fix: authenticate or network-restrict monitoring endpoints.

14. Poison Null Byte (4 stars)

Back in /ftp, files such as package.json.bak are blocked: only .md and .pdf are allowed. Append an encoded null byte and an allowed extension: /ftp/package.json.bak%2500.md. The check sees .md; the file system stops at the null byte. Fix: canonicalise the path before validating it, and use an allow-list of exact files.

15. Privacy Policy and Missing Encoding (1 star each)

Small but realistic: read the privacy policy while logged in, and find the photo in the Photo Wall whose filename contains a # character that the app failed to URL-encode (encode it as %23). Lesson: encoding bugs break features as well as security.

How to keep going

• Turn on hints in the Score Board and filter by difficulty.
• Group challenges by category (Injection, Broken Access Control, XSS, Sensitive Data Exposure) and map each one to the OWASP Top 10.
• Write a short finding for each: title, steps to reproduce, impact, fix. That is exactly what a pentest report looks like.

Keep it in the lab

These apps are deliberately vulnerable. Run them only on an isolated lab network or bound to localhost, never on a server reachable from the internet, and only use these techniques against systems you own or are authorised to test.

Next step

Part 4 covers WebGoat's guided lessons and bWAPP.