Björn Kimminich — JuiceShop — 5 minute AppSec

0:00Chris RomeoWelcome to this second episode of 5 Minute AppSec, an experiment from the Application Security Podcast. This is Chris Romeo, CEO of Security Journey, and on this episode, we're joined by Björn Kimminich, and Björn answers the question, what is Juice Shop and why as a developer should I care about it?

0:19Björn KimminichThe Juice Shop is, well, its catchline is, or catchphrase is, it's probably the most modern and sophisticated insecure web application. It's an OWASP flagship project. Which was created out of desperation by myself some years ago because I needed something to use for developer security trainings. The main problem I had using old applications like the Budget Store or the Altoro Mutual Bank page and all that stuff that didn't really work any longer because it There was so much new technology, especially in the front end, and this whole REST API-based applications that just wasn't covered anymore. I decided to create my own vulnerable application for my company-driven security trainings. I initially started that as a private open-source project and then sometime later, made an OWASP project out of it. As a developer, you actually want the Juice Shop because I think you can learn almost every existing known security vulnerability in web applications from it, and not in a boring way, but by just trying out attacks and practicing. It's very strong in gamification. By offering a scoreboard which keeps track of your solved hacking attempts or your successful hacking attempts. We call those challenges and the Juice Shop at the moment has 87 different challenges. There's tons of cross-site scripting, SQL injection, and the usual stuff, but also many vulnerabilities in business logic and functional flaws and design problems. Missing or lacking validation and all kinds of things. So it's, it's full of interesting stuff. Um, yeah, so developers actually should take a look at it because I think it's the most sophisticated way to learn web application security. It's also interesting for, for management trainings. So if you want to raise the awareness of your IT management, then you can also use the Juice Shop More in a demonstration way. You can also tune it to, to run Capture the Flags with. So that's, that's a little side project that allows you to quickly set up a CTF server in 5 minutes with the Juice Shop challenges with no manual data entry, just a simple import feature. Yeah, you can also customize the Juice Shop look and feel to make it look like an application of your own company. So that's not necessarily useful for developers because they can also relate to an application which— or to a webshop that sells juice and related products even if they don't work in that business, but management sometimes can't. So for managers, it's I think quite helpful if the application they see and they get vulnerabilities demonstrated in actually see something that they that they know from their own world, from their own context. So you can basically completely change the entire look and feel of the application with some nice configuration mechanism. Yeah, so that's basically the core stuff. Personally, I'm using the JooShop also in university lectures. So for to actually bring across the important topics from OWASP Top 10 and everything beyond right away to new developers so that they don't make the same mistakes like today's developers might make.

4:20Chris RomeoThat's it for now for Juice Shop, but tune in to the next full episode of the Application Security Podcast to hear Björn continue about Juice Shop and discuss some of the new features in the 8.5 release and beyond, and hear how Juice Shop is involved in the Google Summer of Code and the upcoming Open Security Summit that OWASP is hosting just outside of London, England.