This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity  #ndcconferences  #security  #developer   #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndc-security.com/

Subscribe to our YouTube channel and learn every day:     @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences

#applicationsecurity #owasp 

OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications

In this talk, the project leaders Björn Kimminich and Jannik Hollenbach will introduce you to the project, its core features and a lot of interesting use cases. We will cover at least the following:

Happy path shopping tour through the OWASP Juice Shop
Hacking some security challenges within Juice Shop
How you can run Juice Shop for yourself very easily
Hosting team events or CTFs with the help of MultiJuicer
How Juice Shop and MultiJuicer work behind the scenes
Helping the project with coding, challenges, and translations
We will close with an look into the OWASP Juice Shop roadmap and maybe even talk about the challenges of managing open source projects in the age of ever-present AI slop. To end on a positive note, we will hopefully have a chance to listen to the official Juice Shop song.

NDC Conferences

OWASP Juice Shop is an intentionally vulnerable web application with 110+ hacking challenges covering SQL injection, XSS, and many other real-world vulnerabilities. The talk covers a live demo of the shop's normal functionality followed by demonstrations of exploiting SQL injection and XSS vulnerabilities. Key ecosystem features include: a hacking instructor for guided learning, a scoreboard, full rebranding support via YAML config, Cypress-based end-to-end tests that exploit all challenges, a Grafana monitoring dashboard, and MultiJuicer — a Kubernetes-based platform for running isolated Juice Shop instances per team in workshops. A new 3D animated globe CTF scoreboard visualization is previewed. The maintainers also discuss the growing problem of AI-generated spam pull requests threatening open source sustainability. The tech stack is Node.js/Express/Angular with SQLite, and MultiJuicer is written in Go.

OWASP Juice Shop: Take your security vitamins! - Jannik Hollenbach & Björn Kimminich