--- title: "Björn Kimminich — JuiceShop — 5 minute AppSec" url: https://appsecpodcast.com/bjorn-kimminich-juiceshop-5-minute-appsec/ date: 2019-05-26 duration_seconds: 285 guests: ["Björn Kimminich"] topics: ["OWASP Projects"] audio: https://www.buzzsprout.com/1730684/episodes/8122643-bjorn-kimminich-juiceshop-5-minute-appsec.mp3 transcript: true --- # Björn Kimminich — JuiceShop — 5 minute AppSec *May 26, 2019 · 5 min* with [Björn Kimminich](https://appsecpodcast.com/guests/bjorn-kimminich/) on [OWASP Projects](https://appsecpodcast.com/topics/owasp-projects/) [Audio](https://www.buzzsprout.com/1730684/episodes/8122643-bjorn-kimminich-juiceshop-5-minute-appsec.mp3) ## Show notes What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated? Project creator Björn Kimminich explains that he built Juice Shop because older training targets did not represent modern front ends, REST APIs, or the technologies his students used. The project turns web vulnerabilities, business-logic flaws, validation failures, and design problems into hands-on challenges with a scoreboard and gamification. Teams can use it for developer training, awareness demonstrations, capture-the-flag events, security-tool testing, and customized management exercises. This short introduction shows why learning through a realistic application can make the OWASP Top 10 and other security weaknesses more concrete, memorable, and relevant to everyday development work. The Application Security Podcast is brought to you by [Security Journey](https://www.securityjourney.com/). About Security Journey Security Journey provides application security education for developers and everyone in the software development lifecycle. → [Learn more about Security Journey](https://www.securityjourney.com/) Connect with Björn Kimminich: → [Björn Kimminich on LinkedIn](https://de.linkedin.com/in/bkimminich) → [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) Mentioned in this episode: → [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) → [OWASP Top 10](https://owasp.org/www-project-top-ten/) → [Open Security Summit](https://open-security-summit.org/) Chapters: 00:00 What is OWASP Juice Shop? 00:19 A modern vulnerable application for developers 01:36 Challenges, gamification, and hands-on learning 03:01 Training, CTFs, and management demonstrations 04:20 Continue with the full Juice Shop interview ## Transcript *636 words · assemblyai* **0:00 Chris Romeo:** Welcome to this second episode of 5 Minute AppSec, an experiment from the Application Security Podcast. This is Chris Romeo, CEO of Security Journey, and on this episode, we're joined by Björn Kimminich, and Björn answers the question, what is Juice Shop and why as a developer should I care about it? **0:19 Björn Kimminich:** The Juice Shop is, well, its catchline is, or catchphrase is, it's probably the most modern and sophisticated insecure web application. It's an OWASP flagship project. Which was created out of desperation by myself some years ago because I needed something to use for developer security trainings. The main problem I had using old applications like the Budget Store or the Altoro Mutual Bank page and all that stuff that didn't really work any longer because it There was so much new technology, especially in the front end, and this whole REST API-based applications that just wasn't covered anymore. I decided to create my own vulnerable application for my company-driven security trainings. I initially started that as a private open-source project and then sometime later, made an OWASP project out of it. As a developer, you actually want the Juice Shop because I think you can learn almost every existing known security vulnerability in web applications from it, and not in a boring way, but by just trying out attacks and practicing. It's very strong in gamification. By offering a scoreboard which keeps track of your solved hacking attempts or your successful hacking attempts. We call those challenges and the Juice Shop at the moment has 87 different challenges. There's tons of cross-site scripting, SQL injection, and the usual stuff, but also many vulnerabilities in business logic and functional flaws and design problems. Missing or lacking validation and all kinds of things. So it's, it's full of interesting stuff. Um, yeah, so developers actually should take a look at it because I think it's the most sophisticated way to learn web application security. It's also interesting for, for management trainings. So if you want to raise the awareness of your IT management, then you can also use the Juice Shop More in a demonstration way. You can also tune it to, to run Capture the Flags with. So that's, that's a little side project that allows you to quickly set up a CTF server in 5 minutes with the Juice Shop challenges with no manual data entry, just a simple import feature. Yeah, you can also customize the Juice Shop look and feel to make it look like an application of your own company. So that's not necessarily useful for developers because they can also relate to an application which— or to a webshop that sells juice and related products even if they don't work in that business, but management sometimes can't. So for managers, it's I think quite helpful if the application they see and they get vulnerabilities demonstrated in actually see something that they that they know from their own world, from their own context. So you can basically completely change the entire look and feel of the application with some nice configuration mechanism. Yeah, so that's basically the core stuff. Personally, I'm using the JooShop also in university lectures. So for to actually bring across the important topics from OWASP Top 10 and everything beyond right away to new developers so that they don't make the same mistakes like today's developers might make. **4:20 Chris Romeo:** That's it for now for Juice Shop, but tune in to the next full episode of the Application Security Podcast to hear Björn continue about Juice Shop and discuss some of the new features in the 8.5 release and beyond, and hear how Juice Shop is involved in the Google Summer of Code and the upcoming Open Security Summit that OWASP is hosting just outside of London, England. --- Source: https://appsecpodcast.com/bjorn-kimminich-juiceshop-5-minute-appsec/