|
|
| (15 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| − | =Main=
| + | We have fully migrated to the new OWASP Website! Please visit our new project page at |
| − | | + | = https://www2.owasp.org/www-project-juice-shop = |
| − | <div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div>
| |
| − | | |
| − | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| |
| − | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
| |
| − | | |
| − | == OWASP Juice Shop Tool Project ==
| |
| − | | |
| − | ''The most trustworthy online shop out there.'' ([https://twitter.com/dschadow/status/706781693504589824 dschadow])
| |
| − | — ''The best juice shop on the whole internet!'' ([https://twitter.com/shehackspurple/status/907335357775085568 shehackspurple])
| |
| − | — ''Actually the most bug-free vulnerable application in existence!'' ([https://youtu.be/TXAztSpYpvE?t=26m35s vanderaj])
| |
| − | — ''First you'' 😂😂''then you'' 😢 ([https://twitter.com/kramse/status/1073168529405472768 kramse])
| |
| − | | |
| − | OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire [[OWASP Top Ten]] along with many other security flaws found in real-world applications!
| |
| − | | |
| − | ==Description==
| |
| − | | |
| − | [[File:JuiceShop_Logo.png|200px|left]]
| |
| − | | |
| − | Juice Shop is written in Node.js, Express and Angular. It was the first application written entirely in JavaScript listed in the [[OWASP_Vulnerable_Web_Applications_Directory_Project|OWASP VWA Directory]].
| |
| − | | |
| − | The application contains a vast number of hacking challenges of varying difficulty where the user is supposed to exploit the underlying vulnerabilities. The hacking progress is tracked on a score board. Finding this score board is actually one of the (easy) challenges!
| |
| − | | |
| − | Apart from the hacker and awareness training use case, pentesting proxies or security scanners can use Juice Shop as a "guinea pig"-application to check how well their tools cope with JavaScript-heavy application frontends and REST APIs.
| |
| − | | |
| − | ''Translating "dump" or "useless outfit" into German yields "Saftladen" which can be reverse-translated word by word into "juice shop". Hence the project name. That the initials "JS" match with those of "JavaScript" was purely coincidental!''
| |
| − | | |
| − | == Main Selling Points ==
| |
| − | | |
| − | * Free and Open source: Licensed under the [https://github.com/bkimminich/juice-shop/blob/master/LICENSE MIT license] with no hidden costs or caveats
| |
| − | * [https://github.com/bkimminich/juice-shop#setup Easy-to-install]: Choose between [http://nodejs.org node.js], [https://www.docker.com Docker] and [https://www.vagrantup.com/downloads.html Vagrant] to run on Windows/Mac/Linux
| |
| − | * Self-contained: Additional dependencies are pre-packaged or will be resolved and downloaded automatically
| |
| − | * Self-healing: The simple SQLite and MarsDB databases are wiped and repopulated from scratch on every server startup
| |
| − | * Gamification: The application notifies you on solved challenges and keeps track of successfully exploited vulnerabilities on a Score Board
| |
| − | * Re-branding: Fully customizable in business context and look & feel to your own corporate or customer requirements
| |
| − | * CTF-support: Challenge notifications optionally contain a flag code for your own [https://github.com/bkimminich/juice-shop-ctf Capture-The-Flag events]
| |
| − | | |
| − | == Application Architecture ==
| |
| − | | |
| − | [[File:Architektur_JuiceShop.png]]
| |
| − | | |
| − | == Introduction Video ==
| |
| − | | |
| − | This recording from [[OWASP BeNeLux-Days 2018]] gives a complete introduction to the OWASP Juice Shop including a live demonstration of the application and how to hack it.
| |
| − | | |
| − | {{#ev:youtube|Lu0-kDdtVf4}}
| |
| − | | |
| − | ''Spoiler warning: The video contains some live hacking including mild spoilers for a few of the easiest challenges!''
| |
| − | | |
| − | == Official Companion Guide ==
| |
| − | | |
| − | [https://leanpub.com/juice-shop Pwning OWASP Juice Shop] is the official companion guide for this project. It will give you a complete overview of the vulnerabilities found in the application including hints how to spot and exploit them. In the appendix you will even find complete step-by-step solutions to every challenge. The ebook is published under [https://creativecommons.org/licenses/by-nc-nd/4.0/ CC BY-NC-ND 4.0] and is available '''for free''' as work-in-progress in [https://www.gitbook.com/book/bkimminich/pwning-owasp-juice-shop HTML, PDF, Kindle and ePub format on GitBook]. The latest officially released edition is [https://leanpub.com/juice-shop available '''for free''' on LeanPub in PDF, Kindle and ePub format].
| |
| − | | |
| − | [[File:PwningOWASPJuiceShop_Cover.jpg|link=https://leanpub.com/juice-shop]]
| |
| − | | |
| − | ==Licensing==
| |
| − | This program is free software: you can redistribute it and/or modify it under the terms of the [https://github.com/bkimminich/juice-shop/blob/master/LICENSE MIT License]. OWASP Juice Shop and any contributions are Copyright © by [[User:Bjoern Kimminich|Bjoern Kimminich]] 2014-2019.
| |
| − | | |
| − | | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
| |
| − | | |
| − | {{#widget:PayPal Donation
| |
| − | |target=_blank
| |
| − | |currency=USD
| |
| − | |budget=OWASP Juice Shop Project
| |
| − | }}
| |
| − | | |
| − | == News ==
| |
| − | [05.08.19] juice-shop [https://github.com/bkimminich/juice-shop/releases/tag/v8.7.3 v8.7.3]
| |
| − | | |
| − | [17.06.19] juice-shop-ctf [https://github.com/bkimminich/juice-shop-ctf/releases/tag/v6.1.1 v6.1.1]
| |
| − | | |
| − | [13.06.19] juice-shop [https://github.com/bkimminich/juice-shop/releases/tag/v8.7.2 v8.7.2]
| |
| − | | |
| − | [07.06.19] juice-shop [https://github.com/bkimminich/juice-shop/releases/tag/v8.7.1 v8.7.1]
| |
| − | | |
| − | [07.06.19] juice-shop [https://github.com/bkimminich/juice-shop/releases/tag/v8.7.0 v8.7.0]
| |
| − | | |
| − | [28.05.19] juice-shop [https://github.com/bkimminich/juice-shop/releases/tag/v8.6.2 v8.6.2]
| |
| − | | |
| − | == Installation ==
| |
| − | | |
| − | [https://github.com/bkimminich/juice-shop/releases/latest Packaged Distributions]
| |
| − | | |
| − | [https://registry.hub.docker.com/u/bkimminich/juice-shop/ Docker Image]
| |
| − | | |
| − | [https://juice-shop.herokuapp.com/ Online Demo (Heroku)]
| |
| − | | |
| − | == Source Code ==
| |
| − | | |
| − | [https://github.com/bkimminich/juice-shop GitHub Project]
| |
| − | | |
| − | [https://github.com/bkimminich/juice-shop/commits/master Revision History]
| |
| − | | |
| − | [https://crowdin.com/project/owasp-juice-shop Crowdin I18N]
| |
| − | | |
| − | [https://github.com/bkimminich/juice-shop-ctf CTF-Extension]
| |
| − | | |
| − | == Documentation ==
| |
| − | | |
| − | Introduction Slide Deck ([http://bkimminich.github.io/juice-shop HTML5]/[https://github.com/bkimminich/juice-shop/raw/master/docs/OWASP%20Juice%20Shop%20-%20An%20intentionally%20insecure%20JavaScript%20Web%20Application.pdf PDF])
| |
| − | | |
| − | Companion Guide ([https://leanpub.com/juice-shop LeanPub]/[https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content GitBook])
| |
| − | | |
| − | == Support ==
| |
| − | | |
| − | [https://gitter.im/bkimminich/juice-shop Community Chat]
| |
| − | | |
| − | [https://www.reddit.com/r/owasp_juiceshop Official Subreddit]
| |
| − | | |
| − | == Collaboration ==
| |
| − | | |
| − | [https://owasp.slack.com/messages/project-juiceshop Slack Channel]
| |
| − | | |
| − | [https://groups.google.com/a/owasp.org/forum/#!forum/juice-shop-project Mailing List]
| |
| − | | |
| − | == Social Media ==
| |
| − | | |
| − | [https://twitter.com/owasp_juiceshop Twitter (@owasp_juiceshop)]
| |
| − | | |
| − | [https://www.facebook.com/owasp.juiceshop Facebook-Page]
| |
| − | | |
| − | [http://www.youtube.com/playlist?list=PLV9O4rIovHhO1y8_78GZfMbH6oznyx2g2 YouTube Playlist]
| |
| − | | |
| − | == Merchandise ==
| |
| − | | |
| − | [https://www.stickeryou.com/products/owasp-juice-shop/794 Stickers, Magnets etc.]
| |
| − | | |
| − | Apparel ([http://shop.spreadshirt.com/juiceshop US]/[http://shop.spreadshirt.de/juiceshop EU])
| |
| − | | |
| − | == Project Leader ==
| |
| − | | |
| − | | |
| − | == Related Projects ==
| |
| − | | |
| − | [[OWASP WebGoat Project|OWASP WebGoat Project]]
| |
| − | | |
| − | [[OWASP DevSlop Project|OWASP DevSlop Project]]
| |
| − | | |
| − | [[OWASP SamuraiWTF Project|OWASP SamuraiWTF Project]]
| |
| − | | |
| − | ==Miscellaneous==
| |
| − | | |
| − | [https://www.openhub.net/p/juice-shop OpenHub Project]
| |
| − | | |
| − | ==Classifications==
| |
| − | | |
| − | {| width="200" cellpadding="2"
| |
| − | |-
| |
| − | | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
| |
| − | |-
| |
| − | | align="center" valign="top" width="50%" rowspan="3"| [[File:Mature_projects.png|130px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#Flagship_Projects|Flagship Project]]
| |
| − | | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
| |
| − | |-
| |
| − | | align="center" valign="top" width="50%"| [[File:Owasp-breakers-small.png|link=Breakers]]
| |
| − | |-
| |
| − | | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=Defenders]]
| |
| − | |}
| |
| − | | |
| − | |}
| |
| − | | |
| − | = Acknowledgements =
| |
| − | ==Contributors==
| |
| − | | |
| − | The OWASP Juice Shop has been created by [[User:Bjoern Kimminich|Bjoern Kimminich]] and is developed and maintained by [https://github.com/bkimminich/juice-shop#contributors a team of volunteers]. A live update of the project [https://github.com/bkimminich/juice-shop/graphs/contributors contributors is found here].
| |
| − | | |
| − | == Project Sponsors ==
| |
| − | | |
| − | === Top Sponsors ===
| |
| − | | |
| − | {|
| |
| − | |style="padding: 50px 50px 50px 50px" | [[Image:xing_logo.png|link=https://corporate.xing.com/en/about-xing/security/|www.xing.com]]
| |
| − | |style="padding: 50px 50px 50px 50px" | [[Image:eSailors_Logo.png|300px|link=https://www.esailors.de/|www.esailors.de]]
| |
| − | |--
| |
| − | |style="padding: 50px 50px 50px 50px" | [[Image:Iteratec-sponsor_logo.png|300px|link=https://www.iteratec.de/|www.iteratec.de]]
| |
| − | |style="padding: 50px 50px 50px 50px" | [[Image:denim-group_trans.png|300px|link=http://www.denimgroup.com/|www.denimgroup.com]]
| |
| − | |}
| |
| − | | |
| − | === Other Corporate Sponsors ===
| |
| − | | |
| − | {|
| |
| − | |style="text-align:center; padding-left: 0px;"|[https://plextrac.com PlexTrac]
| |
| − | |style="text-align:center; padding-left: 50px;"|[https://silpion.de Silpion]
| |
| − | |}
| |
| − | | |
| − | === Other Individual Sponsors ===
| |
| − | | |
| − | {|
| |
| − | |style="text-align:center; padding-left: 0px;"|Jeroen Willemsen
| |
| − | |style="text-align:center; padding-left: 50px;"|Soron Foster
| |
| − | |-
| |
| − | |style="text-align:center; padding-left: 0px;"|Bendik Mjaaland
| |
| − | |style="text-align:center; padding-left: 50px;"|Timo Pagel
| |
| − | |-
| |
| − | |style="text-align:center; padding-left: 0px;"|Benjamin Pfänder
| |
| − | |style="text-align:center; padding-left: 50px;"|[https://twitter.com/bkimminich Björn Kimminich]
| |
| − | |-
| |
| − | |style="text-align:center; padding-left: 0px;"|[https://twitter.com/kchungco Kevin Chung]
| |
| − | |style="text-align:center; padding-left: 50px;"|[http://www.7minsec.com Brian Johnson]
| |
| − | |}
| |
| − | | |
| − | === LeanPub Royalties ===
| |
| − | | |
| − | [[File:PwningOWASPJuiceShop_Cover.jpg|200px|link=https://leanpub.com/juice-shop]]
| |
| − | | |
| − | All royalties of [https://twitter.com/bkimminich Björn Kimminich]'s eBook are donated to the project!
| |
| − | | |
| − | ----
| |
| − | | |
| − | You can find the current project balance along with a history of all donations and spendings in the [https://docs.google.com/spreadsheets/d/14UWhT7SbJAmNBES1ZYdRk8N5f8S2jVkbQbLZz26eM0I/edit#gid=1346179950&range=C323 Chapter and Project Transactions] spreadsheet.
| |
| − | | |
| − | = Road Map and Getting Involved =
| |
| − | | |
| − | Juice Shop is already implemented, properly tested and [https://github.com/bkimminich/juice-shop/blob/master/REFERENCES.md#web-links has been promoted] and [https://github.com/bkimminich/juice-shop/blob/master/REFERENCES.md#conference-and-meetup-appearances demonstrated or live-hacked on various occasions including OWASP events]. It has been successfully used by different companies for inhouse security trainings as well as [https://github.com/bkimminich/juice-shop/blob/master/REFERENCES.md#lectures-and-trainings in university lectures or published training slides].
| |
| − | | |
| − | ==Roadmap==
| |
| − | | |
| − | ===Long-term Goals===
| |
| − | | |
| − | * [https://github.com/bkimminich/juice-shop/labels/design%2Flayout Design/Facelifting] of the Angular Material UI
| |
| − | * [https://github.com/bkimminich/juice-shop/issues/440 Hacking Instructor] to guide beginners through the challenges
| |
| − | | |
| − | [[File:Architektur_JuiceShop_8.0.png]]
| |
| − | | |
| − | ==Getting Involved==
| |
| − | | |
| − | Involvement in the development and promotion of OWASP Juice Shop is actively encouraged!
| |
| − | You do not have to be a security expert or a programmer to contribute. Some of the ways you can help are as follows:
| |
| − | | |
| − | * use Juice Shop in your own hacker or awareness trainings
| |
| − | * use Juice Shop as a "guinea pig" for your security tools
| |
| − | * provide ideas for new vulnerabilities and challenges
| |
| − | * provide feedback via [mailto:[email protected] email], [https://gitter.im/bkimminich/juice-shop chat] or by [https://github.com/bkimminich/juice-shop/issues opening an issue] | |
| − | * help translating the user interface on [https://crowdin.com/project/owasp-juice-shop Crowdin]
| |
| − | | |
| − | __NOTOC__ <headertabs />
| |
| − | | |
| − | [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]
| |
We have fully migrated to the new OWASP Website! Please visit our new project page at
