Juice Shop: probably, the most vulnerable web application

Project #3 of 5 in "Web Security" progression
Juice Shop: probably, the most vulnerable web application thumbnail

Updated: Jul 01, 2026

In this project

Find your first website breaches, test the system with this poor-UX, but rich in bugs, web security project!

Project Stages

  1. Finding a scoreboard
  2. First 3 easy bugs

Lessons

  1. #1.Welcome to Juice Shop challenge series! #1
  2. #2.The Architect of Juices! #2
  3. #3.Installing Juice Shop locally #3
  4. #4.The most famous vulnerabilities in the world! #4
  5. #5.Common piece of wisdom before we start #5
  6. #6.Finding a Score Board #6
  7. #7.Hidden routes and pages #7
  8. #8.Lost Privacy Policy page found! #8
  9. #9.Mass Dispell: close all achievements at a time (wait, what?) #9
  10. #10.Act like a white hat #10
  11. #11.A zero-star review #11
  12. #12.Directory Listing Challenge: hidden server files #12
  13. #13.Forged feedback (pretend you are not yourself) #13
  14. #14.Logged in as an Admin! #14
  15. #15.Bjorn account break-in #15
  16. #16.Rest Emma's password #16
  17. #17.View the basket of... Wait, who are you? (basket forgery) #17
  18. #18.OS Command Line injection (a tricky one) #18
  19. #19.Place the order with an unknown adress #19
Juice Shop: probably, the most vulnerable web application