Attack OWASP Juice Shop Locally With Docker
0 / 7 steps
The goal
Run OWASP Juice Shop — the most popular deliberately-vulnerable web app in the world — on your own machine, then safely learn real web attacks on it. You will find its hidden Score Board, pull off a classic SQL-injection login bypass, and — just as important — see the fix for each. This is the hands-on companion to the OWASP reference material.
Attack only your own copy. Juice Shop is built to be broken, but the only system you are authorised to attack here is this local instance. You will bind it to 127.0.0.1 so nothing else can reach it. Using these same techniques against any site you do not own is illegal — full stop. This lab is for learning to attack so you can learn to defend.
New to Docker? Do Build a Security Lab With Docker first — this lab assumes you can run and stop a container.
Steps
01Confirm Docker is running
Check that Docker is installed and responding:
$ docker --version
A version string means you are good. If not, install Docker Desktop (Windows/macOS) or Docker Engine (Linux) first.
Why Docker for this. Juice Shop is a full Node.js app. The container bundles the exact runtime and data it needs, so you get an identical, disposable target in one command — and you can throw it away just as fast.
02Run Juice Shop — bound to localhost
Start the official image, publishing it only on the loopback address so it is reachable from your machine and nowhere else:
$ docker run -d --name juice -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Docker pulls the image the first time (a minute or two), then runs it in the background.
Why the 127.0.0.1: prefix matters. A plain -p 3000:3000 would expose a deliberately-vulnerable app on every network interface. Binding to 127.0.0.1 keeps your intentionally-hackable target off the network entirely.
03Open the shop
Point your browser at the app:
http://localhost:3000
You should see the Juice Shop storefront. Click around — register an account, browse products, read reviews. Every one of those features hides a vulnerability.
Recon first. Real testing starts by using the app normally to map its features. The search box, login form and product reviews you see now are the exact surfaces you will attack.
04Find the hidden Score Board
Juice Shop grades your progress on a Score Board that is deliberately not linked anywhere — finding it is challenge number one. Try browsing to the route directly:
http://localhost:3000/#/score-board
The board appears, listing every challenge by difficulty. Leave it open in a tab — solved challenges light up here as you go.
Why it is hidden. This teaches a real habit: interesting routes and endpoints are rarely in the menu. You find them by guessing, by reading the app’s JavaScript, or with a content-discovery tool — the same skill as enumerating any real target.
05Log in as admin with SQL injection
On the Login page, put this into the Email field and type anything at all in the password field:
' OR 1=1--
Submit, and you are logged in as the first account in the database — the administrator — without knowing any password. The Score Board ticks over.
Why it works — and the fix. The app builds its login query by pasting your input straight into SQL, so ' OR 1=1-- turns the condition always-true and comments out the password check. The defence is parameterised queries (prepared statements): the database treats your input as data, never as code, and the same payload becomes a harmless failed login. That single pattern kills the entire class of bug.
06Reset your progress when you want a clean slate
Challenge progress lives inside the container. To wipe it and start the Score Board fresh, just restart:
$ docker restart juice
Give it a few seconds, then reload http://localhost:3000. Everything is back to zero.
Disposable targets. Being able to reset instantly is why containerised labs beat a hand-built VM — break it, learn, reset, repeat, with no cleanup.
07Stop and remove the app
When you are finished, tear it down:
$ docker stop juice && docker rm juice
The container and its data are gone. Re-run step 2 any time to get a spotless instance back.
Leave nothing running. A vulnerable app has no business sitting idle on your machine — spin it up to practise, take it down when you stop.
You ran a deliberately-vulnerable app safely, found a hidden endpoint, bypassed a login with SQL injection, and learned the one-line fix. That exploit-then-defend loop is exactly how application security is learned.
What you learned
- Running a target safely — localhost-only binding for a vulnerable app.
- Content discovery — finding routes like the Score Board that are not in the menu.
- SQL injection — a login bypass, and why string-built queries are the root cause.
- The fix that matters — parameterised queries end the whole bug class.
- Disposable labs — restart to reset, remove to clean up.
NextKeep going — work the Score Board challenge by challenge→
Go deeper
- Prerequisite: Build a Security Lab With Docker.
- Attacking AI apps instead? The LLMVault lab runs the same exploit-then-defend loop for the OWASP LLM Top 10.
- Map what you find to the attacker’s workflow with the Cyber Kill Chain.
- Official: the OWASP Juice Shop project and its companion guide — every challenge, explained.
Part of the StashGrid Docker lab track. Juice Shop changes fast — if a step drifts from the current release, tell me and I will fix it.