A deliberately vulnerable REST API server
- Go 91.8%
- Shell 8.2%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| cmd/server | ||
| data | ||
| internal | ||
| scripts | ||
| .gitignore | ||
| go.mod | ||
| go.sum | ||
| README.md | ||
OWASP Juice Shop API (Go Edition for Karaxys)
A high-fidelity, deliberately vulnerable REST API server written in Golang, designed for security monitoring and active scanning evaluation with Karaxys.
Features & Endpoints
Implements the attack surface inventory and routes outlined in WEB APPLICATION SECURITY.pdf:
| Method | Path Pattern | Sensitivity | Vulnerability / Attack Pattern |
|---|---|---|---|
POST |
/rest/user/login |
High (Credentials) | SQL Injection (' OR 1=1--), Weak JWT, Database Error Leakage |
POST |
/api/Users/ |
High (PII) | Mass Assignment (role: admin), Password Hash Leaks |
GET |
/api/Users/ |
High (PII) | Sensitive Data Exposure (leaks all users with password hashes) |
GET |
/api/Users/{id} |
High (PII) | PII Profile retrieval |
GET |
/rest/products/search |
Low (Product Catalog) | SQL Injection (?q=apple')) UNION SELECT ...), Reflected XSS |
GET |
/api/Products/ |
Low (Catalog) | Product listing |
GET |
/api/Products/{id} |
Low (Catalog) | Single product details |
GET |
/api/BasketItems/ |
Medium (Cart Contents) | BOLA / IDOR (view arbitrary baskets via ?BasketId=X) |
POST |
/api/BasketItems/ |
Medium (Cart) | BOLA / IDOR, Negative Quantity & Price Tampering |
DELETE |
/api/BasketItems/{id} |
Medium (Cart) | BOLA / IDOR (delete any user's item) |
POST |
/rest/basket/{id}/checkout |
Medium (Checkout) | Order processing |
GET |
/rest/wallet/balance |
High (Financial) | BOLA / IDOR (view arbitrary balances via ?userId=X) |
POST |
/rest/wallet/balance |
High (Financial) | Balance manipulation / top-up bypass |
GET |
/api/Addresss/ |
High (PII) | BOLA / IDOR & Bulk PII Exposure |
POST |
/api/Addresss/ |
High (PII) | Mass Assignment / Address manipulation |
GET |
/api/Addresss/{id} |
High (PII) | Individual address inspection / deletion |
GET |
/api/Deliverys/ |
Low (Delivery) | Delivery methods catalog |
GET |
/api/Feedbacks/ |
Low (Feedback) | Unauthenticated feedback leak, Stored XSS sink |
POST |
/api/Feedbacks/ |
Low (Feedback) | Stored XSS, Blind SQLi, Missing rate limits |
GET |
/api/SecurityQuestions/ |
Low (Questions) | Security recovery questions |
POST |
/api/SecurityAnswers/ |
Medium (Auth) | Broken Authentication / Security question brute force |
GET |
/api/Challenges/ |
Medium (Security) | Juice Shop challenge tracking list |
GET |
/rest/languages |
Low (Metadata) | Language configuration list |
GET |
/api/Cards/ |
High (Financial) | Stored payment cards (PII / Card details) |
Getting Started
Prerequisites
- Go 1.22+
Building & Running
# Build the binary
go build -o bin/juiceshop ./cmd/server
# Run the server (default port: 3000)
./bin/juiceshop
Or run directly with go run:
go run ./cmd/server/main.go
Custom configuration via environment variables:
PORT: Server port (default:3000)DB_PATH: SQLite database file path (default:./data/juiceshop.db)JWT_SECRET: JWT signing secret (default:custom-jwt-secret-key-12345)
Testing & Verification
1. Automated Exploit & Route Verification Suite
Runs 12 test suites confirming SQL injection, BOLA/IDOR, Mass Assignment, PII exposure, and all endpoints:
chmod +x scripts/test_exploits.sh
./scripts/test_exploits.sh
2. Traffic Generator for Karaxys eBPF Capture
Simulates continuous user traffic across all API routes to let Karaxys discover the API inventory:
go run ./scripts/traffic_generator.go
Seed Accounts
| Role | Password | |
|---|---|---|
| Administrator | admin@juice-sh.op |
admin123 |
| Customer | jim@juice-sh.op |
ncc-1701 |
| Customer | bender@juice-sh.op |
killallhumans |
| Customer | test@juice-sh.op |
password123 |