References [](https://github.com/paragonie/awesome-appsec)

October 13, 2024 · View on GitHub

Did you write a blog post, magazine article or do a podcast about or mentioning OWASP Juice Shop? Add it to this file and open a PR! The same goes for conference or meetup talks, workshops or trainings you did where this project was mentioned or used!

:bulb: indicates resources that contain hints for solving challenges of the OWASP Juice Shop. These are supposed to be helpful whenever you get stuck. :godmode: indicates resources that spoiler entire challenge solutions, so you might not want to view them before tackling these challenges yourself! :mega: marks short friendly shout outs. Finally, the :dollar: bill marks commercial resources.

Awards
Web Links
- Pod- & Webcasts
- Blogs & Articles
Lectures and Trainings
Summits & Open Source Events
- Google Summer of Code
Conference and Meetup Appearances
- 2024
- 2023
- 2022
- 2021
- 2020
- 2019
- 2018
- 2017
- 2016
- 2015

Awards :trophy:

Heroku Button of the Month in November 2017 (:camera:)
Heroku Button of the Month in March 2019 (:camera:)

Web Links

Pod- & Webcasts

ZAP Chat 05 Modern Apps Part 1 on ZAP with Simon Bennetts
OWASP Spotlight - Project 25 - OWASP Juice Shop by Vandana Verma with Björn Kimminich
Visual application security testing with ZAP and Simon Bennetts #DemoDays by GitHub with Simon Bennetts :mega:
Exploiting an SSRF vulnerability by PinkDraconian :bulb:
OWASP Spotlight - Project 20 - OWASP Security Pin by Vandana Verma with Timo Pagel :mega:
People | Process | Technology Podcast (fka "OWASP 24/7 Podcast"):
- OWASP Flagship Projects - Episode 02
- Less than 10 Minutes Series: The Juice Shop Project
Learn Web App Security Penetration Testing with Juice Shop [Free] by Gerald Auger - Simply Cyber
Web security for web developers with Zaproxy by Simon Bennetts with Eddie Jaoude :mega:
ZAP in Ten with Simon Bennetts
15min video tutorial by Nick Malcolm: OWASP Juice Shop 101 :godmode:
Application Security Podcast:
- Björn Kimminich -- OWASP Juice Shop (YouTube)
- Episode 7.2: Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes (YouTube)
- Episode 5.21: Season 5 Finale — A cross section of #AppSec (S05E21) (contains 5 minute AppSec: Björn Kimminich — JuiceShop entirely)
- Episode 5.20: Ronnie Flathers - Security programs big and small :mega:
- Episode 5.9: The new JuiceShop, GSOC, and Open Security Summit
- 5 minute AppSec: Björn Kimminich — JuiceShop
- Episode 4.27: Season 4 Finale (S04E27) (snippet from 4.17)
- Episode 4.20: Security Culture Hacking: Disrupting the Security Status Quo (S04E20) :mega:
- Episode 4.17: The Joy of the Vulnerable Web: JuiceShop (S04E17)
Webcast recording on 7 Minute Security: DIY $500 Pentest Lab - Part 1 :mega:
Recorded live streams from the Twitch/Mixer OWASP DevSlop Show:
- OWASP DevSlop E12 - Juice Shop with Björn Kimminich (YouTube) :godmode:
Webcast recording on Signal Sciences: Secure Development Lessons from Purposely Insecure Applications
7 Minute Security Podcast:
- Episode #403: 7MOOMAMA - Juice Shop Song + Backdoors and Breaches Jingle
- Episode #318: Interview with Bjorn Kimminich of OWASP Juice Shop
- Shout outs in various episodes: #347, #342, #310, #309, #306 and #282 :mega:
Video tutorial about automating web application security scans with OWASP ZAP using Juice Shop as the tested app: All you need is Zaproxy - Security Testing for WebApps Made Easy
- Example integration as a Docker Compose script
- Scan results of the example integration

Blogs & Articles

Blog post on A Tester's Journey by Lisi Hocke: Open Security Conference 2024 - A Memorable Beginning
Blog post on OWASP.org by Björn Kimminich: OWASP Juice Shop 2023 achievements and beyond
Article on Cobalt.io Developer Best Practices: Validate User Input
Blog post (:de:) on Dev-Insider: OWASP Juice Shop lädt zum Hacken ein :godmode:
Blog post on OWASP.org by Björn Kimminich: OWASP Juice Shop v10.0.0 released
20+ Free Resources To Legally Practice Your Ethical Hacking Skills on eLearnSecurity :mega:
Blog post on The Daily Swig - Cybersecurity news and views: OWASP security projects showcased at All Day DevOps conference
Blog post on klarsen.net - A Maker's Blog: OWASP Juice Shop SQLi
White paper by Kelley Bryant: OWASP: Application Security's Best Friend
Article (:es:) on Medium by Elzer Pineda: Null Byte Attack Juice Shop y algo mas!! :godmode:
Blog post on Omer Levi Hevroni's blog: Hacking Juice Shop, the DevSecOps Way
Blog post on Jannik Hollenbach's blog: Testing out ModSecurity CRS with OWASP JuiceShop
OWASP Portland Chapter meeting writeup on the Daylight Blog: Vulnerability Hunting Practice Using OWASP Juice Shop
Blog post on Security Boulevard: From Dev to InfoSec Part 1 – The Journey Begins
Blog post on Null Byte :: WonderHowTo: Beginner's Guide to OWASP Juice Shop, Your Practice Hacking Grounds for the 10 Most Common Web App Vulnerabilities :godmode:
Blog posts on DevelopSec - Developing Better Security:
- Installing OWASP JuiceShop with Docker (YouTube)
- Installing OWASP JuiceShop with Heroku (YouTube)
- Burp Extension – Juice Shop Routes (YouTube) :godmode:
Blog posts on Jason Haley - Ramblings from an Independent Consultant:
- How to Setup OWASP Juice Shop on Azure (Part 1 of 3)
- Setup OWASP Juice Shop in Web App for Containers (Part 2 of 3)
- Setup OWASP Juice Shop in Azure Container Instances (Part 3 of 3)
Blog post on Josh Grossman's blog: Setting up an OWASP Juice Shop CTF
Blog post on Mozilla Hacks: Hands-On Web Security: Capture the Flag with OWASP Juice Shop
Blog post (:de:) on heise Developer: Sicherheits-Etikette: Security in der Softwareentwicklung :mega:
Blog Post on Stuart Winter-Tear's Blog: OWASP Juice Shop Vulnerable Webapp (Peerlyst cross-post)
Blog posts on OWASP Summit 2017:
- Juice Shop v4.0.0 Live Release
- Juice Shop's call to pre-summit action
Vulnerable website collection on Bonkers About Tech: 40+ Intentionally Vulnerable Websites To (Legally) Practice Your Hacking Skills
Hacking-session writeup on Testhexen: Learning Application Security – Fun with the Juice Shop
Guest post (:de:) on Informatik Aktuell: Juice Shop - Der kleine Saftladen für Sicherheitstrainings
Guest post on The official Sauce Labs Blog: Proving that an application is as broken as intended
Teaser post on Björn Kimminich's Blog: Juice Shop

Lectures and Trainings

Introduction to OWASP Top 10 Security Risks course by Chris Jackson :dollar:
Courses on the freeCodeCamp.org YouTube channel
- Ethical Hacking 101: Web App Penetration Testing - a full course for beginners :godmode: by HackerSploit
- Web Application Ethical Hacking - Penetration Testing Course for Beginners :godmode: by The Cyber Mentor
Intro to Semgrep GitHub Learning Lab
Real World Web Penetration Testing course by Jason Gillam :dollar:
Brakeing Down Security Web App Sec Training #1 by Sunny Wear (YouTube)
Finding Website Vulnerabilities with Burp chapter :godmode: of the Mastering Kali Linux Network Scanning video course by Brian Johnson :dollar:
University lecture on "IT Security" as Open Educational Resources material by Björn Kimminich
Descargar aqui el taller OWASP Top 10 Hands On basado en OWASP Top 10 y Juice Shop (:es:) by Mateo Martinez, Gerardo Canedo and Maxiimiliano Alonzo, OWASP Uruguay Chapter
Security in Web Applications by Timo Pagel, Fachhochschule Kiel
Web Application Security Training by Björn Kimminich

Summits & Open Source Events

Juice Shop Track at Open Security Summit 2020
- OWASP Juice Shop Cocktail Party: Ask us anything! with Björn Kimminich, Jannik Hollenbach & Timo Pagel 15.06.2020 (YouTube)
- OWASP Juice Shop Deep Dive: MultiJuicer with Jannik Hollenbach & Robert Seedorf, 15.06.2020 (YouTube)
- OWASP Juice Shop Deep Dive: Integration with Björn Kimminich, 15.06.2020 (YouTube)
- OWASP Juice Shop Deep Dive: Theming with Björn Kimminich, 15.06.2020 (YouTube)
- OWASP Juice Shop Introduction with Björn Kimminich, 11.06.2020 (YouTube)
- MultiJuicer Introduction with Jannik Hollenbach and Robert Seedorf, 02.06.2020 (YouTube)
- OWASP Juice Shop Introduction with Björn Kimminich, 02.06.2020 (YouTube)
Drinks with Adversaries: Creating Adversary Trading Cards with Mark Miller at Open Security Summit 2020, 01.06.2020 (YouTube) :mega:
Selected Project at OWASP Projects Summit - Winter 2020 with Björn Kimminich, Jannik Hollenbach and Marc Rüttler collaborating on prepared working packages and the v10.0.0 release, 27.-29.02.2020
OWASP Juice Shop track and related working sessions organized by Björn Kimminich, Open Security Summit 2019, 03.-07.06.2019
Juice Shop related working sessions organized by Jannik Hollenbach and Timo Pagel in OWASP Projects track, Open Security Summit 2018, 04.-08.06.2018
Outcome of the Juice Shop track and related working sessions organized by Björn Kimminich and Timo Pagel, OWASP Summit 2017, 12.-16.06.2017

Google Summer of Code

Student projects from Google Summer of Code 2023
- Companion Guide Tech Stack by Parth Nanda (mentored by Jannik Hollenbach, Björn Kimminich and Shubham Palriwala)
- Hacking the Blockchain: Building Web3 Challenges for OWASP Juice Shop by Rishabh Keshan (mentored by Shubham Palriwala and Björn Kimminich)
Student project from Google Summer of Code 2022
- Replacement for Protractor end-to-end & Frisby API test suite to Cypress by Shubham Palriwala (mentored by Jannik Hollenbach and Björn Kimminich)
Student project from Google Summer of Code 2021
- Extending the features of the vulnerable code snippets by Ayas Behera (mentored by Jannik Hollenbach and Björn Kimminich)
Student project from Google Summer of Code 2020
- Juice-Shop ChatBot and general fixes by Mohit Sharma (mentored by Jannik Hollenbach, Björn Kimminich and Timo Pagel)
Student project from Google Summer of Code 2019
- OWASP Juice Shop: Feature Pack 2019 by Arpit Agrawal (mentored by Jannik Hollenbach, Björn Kimminich and Shoeb Patel)
Student projects from Google Summer of Code 2018
- OWASP Juice Shop : Challenge Pack 2018 by Shoeb Patel (mentored by Jannik Hollenbach and Timo Pagel)
- OWASP Juice Shop : Frontend Technology Update by Aashish Singh (mentored by Björn Kimminich)

Conference and Meetup Appearances

Upcoming events are marked with :date:. The availability of link destinations for past events cannot be guaranteed.

Usage in Tools & Products

How to try GitHub Advanced Security with your team uses Juice Shop as an example for CI/CD integration in Code scanning in action with Juice Shop