Building a legal practice lab with OWASP Juice Shop

Practising security testing requires a target, and the only acceptable target is one you own or have explicit written permission to test. Testing a website without permission is illegal in most countries, under laws such as the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act in the United Kingdom and equivalent laws across the EU. "I was only learning" is not a defence.

The good news is that the security community builds applications that are deliberately vulnerable and meant to be run locally for training.

OWASP Juice Shop

OWASP Juice Shop is a modern online shop written in JavaScript with Node.js and Angular. It contains a large set of intentional vulnerabilities covering every OWASP Top 10 category, and a built in score board that tracks which challenges you have solved. It is actively maintained and used in university courses and company training.

The simplest way to run it is with Docker, bound only to your own machine:

docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop

Then open http://127.0.0.1:3000 in your browser. Binding to 127.0.0.1 matters: it keeps the vulnerable application reachable only from your computer, not from everyone on your network.

Other training targets

• DVWA (Damn Vulnerable Web Application), a simple PHP application with adjustable difficulty levels.
• OWASP WebGoat, a Java application with guided lessons.
• PortSwigger Web Security Academy, free online labs hosted by the makers of Burp Suite, where testing is explicitly permitted within each lab.

Lab hygiene

• Run vulnerable applications in containers or virtual machines, never on a server exposed to the internet.
• Stop them when you are done. The --rm flag removes the container when it stops.
• Keep your lab browser profile separate from your everyday browsing, so that proxy settings and test certificates do not affect your normal accounts.
• Take notes as you go. Good notes are the raw material of a good report.

A rule for the rest of the course

Every technique you learn here is used only against your local lab or a platform that grants permission in writing. When you later test for an employer or client, the same techniques require a signed authorisation that names the application, the environment and the time window.