OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!
from the project README
Formats
app
License
MIT
Added
2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
shell
$ docker pull bkimminich/juice-shop
shell
$ docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Then browse to http://localhost:3000. It's bound to localhost on purpose; never expose it.
Contents
1,300 files297.6 MB repository
.ts633
.json108
.yml97
.scss83
.html82
.jpg56
.png54
.md50
Use it with
Commands are curated, not yet run by us.
nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).
sample.app
$ nuclei -u http://127.0.0.1:3000
OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.
sample.app
$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000