Hysen Labsjuice-shop-walkthrough
Complete solution for intentionally vulnerable webshop: "Juice Shop"
A walkthrough of the vulnerable Juice Shop webshop
A complete, task by task solution guide to Juice Shop, the intentionally vulnerable webshop, with the reasoning behind each exploit and what to learn from it.
What this guide is
This is a complete walkthrough of Juice Shop, Björn Kimminich's intentionally vulnerable webshop, built for educational purposes. It collects several vulnerabilities and tasks with a solution for each, and the README is honest about the trade-off: if you cannot solve a task, the guide will help, but it is a kind of cheating, and you must choose whether to use it. The solutions target JuiceShop version 1.5.
How the tasks are solved
Each task gets its own section, and the README notes there may be other ways to reach the goal, especially where SQL injection is involved. Explanations walk through how each flaw works, from where the scoreboard hides in the HTML source to how user input lands 1:1 in an otherwise constant SQL command. Some solutions chain together, like one task revealing credentials that later tasks reuse.
The lessons it draws
Every vulnerability comes with a takeaway. Commented-out code from debugging should be removed before deployment, especially when the application returns it externally. User input needs server-side sanitizing and validation, using established functions rather than in-house regexes, and error handling should not hand users technical errors. Unsalted hashes are reversible with rainbow tables, MD5 is optimized for speed rather than security, and the README points to bcrypt, scrypt, or PBKDF2 instead. The admin interface should stay internal, and the lesson about redirects warns that NULL bytes can slip through a whitelist.
A few of the tricks inside
The walkthrough covers a broad set of techniques. The coupon task stands out: invalid coupons live in the FTP directory, their IDs are z85 encoded, and decoding reveals a format like SEP13-10, where the last two digits are the percent discount. The solution shows how to craft your own coupon for the current date. Elsewhere, a cookie holds a Base64-encoded JSON token with a password hash, and the README's broader point is that security by obscurity is not a strategy.
Community notes