OWASP Juice Shop Scoreboard: Full Challenges List & Guide

The OWASP Juice Shop scoreboard is the heart of the application — a built-in mission control panel that lists every available security challenge, tracks your progress, and organizes over 100 vulnerabilities by category and difficulty. Finding the scoreboard is itself the very first challenge.

This guide explains how to find the scoreboard, what it contains, how the challenge difficulty system works, and the recommended order to work through the full challenges list — from one-star beginner exercises to six-star expert-level attacks.

How to Access the Juice Shop Scoreboard

Before you can use the scoreboard, you need a running Juice Shop instance. The fastest way:

docker run --rm -p 3000:3000 bkimminich/juice-shop

Open http://localhost:3000/ in your browser. The scoreboard is deliberately not linked from the navigation menu — finding it is the first challenge.

Direct URL:

http://localhost:3000/#/score-board

Navigate there directly. The scoreboard will appear and you’ll immediately earn your first solved challenge: “Find the Score Board.”

Why Finding the Scoreboard Is a Challenge

The scoreboard challenge teaches a fundamental security concept: security through obscurity is not security. The URL is not advertised, but it is included in the Angular application’s client-side JavaScript bundle. Any attacker who inspects the source code or reads the API response for navigation items discovers all routes — including hidden admin and management pages.

In production applications, sensitive pages frequently rely on “not being linked” as their only access control. This is wrong. If the server responds with the page when the URL is known, it is accessible.

Juice Shop Scoreboard: What’s on It

The scoreboard presents all challenges in a filterable table with four columns:

Challenge name — a short descriptor of what the challenge involves
Category — the vulnerability class (Injection, XSS, Broken Auth, etc.)
Difficulty — star rating from ⭐ to ⭐⭐⭐⭐⭐⭐
Status — solved (green checkmark) or unsolved (grey)

Each row has a hint icon (lightbulb) that reveals a partial hint if you’re stuck. For full solutions, the official companion book Pwning OWASP Juice Shop is available free at pwning.owasp-juice.shop.

Scoreboard Filters

You can filter the scoreboard by:

Difficulty — show only ⭐⭐ challenges, or only ⭐⭐⭐⭐⭐⭐, etc.
Category — focus on a specific vulnerability class
Status — show only unsolved challenges to see what’s left

Use these filters to build a structured curriculum rather than working through the list randomly.

All Juice Shop Challenge Categories

Juice Shop organizes its 100+ challenges into the following categories. Each maps to the OWASP Top 10 and to real vulnerability classes found in production applications.

Broken Access Control

OWASP A01:2021 — the most common web application vulnerability class. Juice Shop challenges include:

Accessing the administration section (/#/administration) without admin credentials
Viewing another user’s shopping basket (IDOR — Insecure Direct Object Reference)
Changing another user’s password or review
Accessing hidden routes not linked from navigation
Retrieving the support chat history of another user

Why it matters: IDOR (also called BOLA — Broken Object Level Authorization) is the #1 API security vulnerability in real-world assessments. These challenges build the pattern recognition to find it in production REST APIs.

Injection

SQL injection, NoSQL injection, log injection, and command injection. Juice Shop challenges include:

Login bypass via SQL injection (' OR '1'='1'-- in the email field)
Extracting the database schema using SQL injection in the search endpoint
NoSQL injection in MongoDB-backed query endpoints
Log injection — inserting malicious content into application logs

Why it matters: Injection vulnerabilities (CWE-89 for SQL, CWE-943 for NoSQL) are consistently in the OWASP Top 10 and are among the highest-severity findings in enterprise security assessments.

Cross-Site Scripting (XSS)

All three XSS types are represented:

Reflected XSS — search bar, order tracking URL parameter
Stored XSS — product reviews rendered to other users
DOM-based XSS — Angular processes URL fragments without sanitization

Why it matters: XSS vulnerabilities remain among the most common findings in web application security assessments. DOM-based XSS in particular is frequently missed by automated scanners and requires understanding of how client-side frameworks render data.

Broken Authentication

Authentication vulnerabilities including:

Password brute-force (no rate limiting on login endpoint)
JWT algorithm confusion (RS256 → HS256 forgery)
Password reset via guessable security questions
Changing another user’s password using the reset flow
Bypassing the two-factor authentication flow

Why it matters: Authentication bypass vulnerabilities are critical-severity findings. JWT algorithm confusion in particular has been found in production APIs used by major platforms.

Sensitive Data Exposure

Challenges around finding data that should not be accessible:

Accessing confidential documents in the FTP directory
Finding the administrator’s email through API enumeration
Discovering developer backup files (null byte path traversal to bypass extension filter)
Reading the application’s source map files

Why it matters: APIs frequently expose more data than intended. The discipline of looking at what data is accessible — not just what authentication exists — is a core penetration testing skill.

Security Misconfiguration

Missing security headers, verbose error messages, and misconfigured server behavior:

Triggering unhandled errors that expose stack traces
Finding the application without a Content-Security-Policy header
Discovering misconfigured CORS policy
Accessing administrative functions without proper authorization

Why it matters: Security misconfigurations account for a significant percentage of findings in any web application security assessment, particularly missing security headers and verbose error disclosure.

Vulnerable Components / Outdated Dependencies

Juice Shop intentionally uses outdated npm packages with known CVEs. Challenges include:

Identifying which dependencies have known vulnerabilities
Exploiting a known vulnerability in a specific outdated library

Why it matters: Software Composition Analysis (SCA) — scanning your dependency tree for packages with known CVEs — is now a standard part of application security programs. This challenge makes the concept concrete.

Cryptographic Failures

Weak cryptography, insecure storage, and poor key management:

Forged coupon codes via base64 manipulation (insecure deserialization)
Brute-forcing weak JWT secrets
Finding encrypted data that uses an easily reversible encoding

Why it matters: Cryptographic failures (OWASP A02:2021) include both weak algorithms and incorrect implementation. These challenges teach the difference between encoding (not secure) and encryption (requires a key), and between correct and incorrect JWT implementation.

Improper Input Validation / Business Logic

Challenges that require manipulating business logic:

Placing an order with a negative item quantity (negative total)
Giving a zero-star feedback rating by bypassing client-side validation
Uploading a file larger than the allowed limit by bypassing browser restrictions
Changing the price of an item by intercepting and modifying API requests

Why it matters: Business logic flaws are among the hardest vulnerability classes to detect with automated tools — SAST and DAST cannot understand what the application is supposed to do. These challenges build the manual testing mindset.

XXE (XML External Entity Injection)

The B2B order functionality accepts XML, enabling:

Reading /etc/passwd via XXE external entity injection
Using XXE for server-side request forgery (SSRF via XML)

Why it matters: Any application that processes XML is potentially vulnerable to XXE unless the parser is explicitly configured to disable external entity processing. XXE vulnerabilities have been found in enterprise SOAP APIs, document processing services, and B2B integrations.

Server-Side Request Forgery (SSRF)

Challenges where the server makes outbound requests based on user-controlled input:

Triggering SSRF via the profile image URL upload
Making the server contact internal infrastructure through a URL input

Why it matters: SSRF is OWASP A10:2021 and is used to access cloud metadata services (AWS instance metadata), internal services, and resources behind firewalls. It has been used in high-profile cloud environment compromises.

Juice Shop Difficulty Levels: What Each Star Means

Stars	Level	What It Requires
⭐	Beginner	Basic navigation, reading browser DevTools, simple payload injection
⭐⭐	Easy	First exploitation: SQL injection, simple IDOR, client-side bypass
⭐⭐⭐	Medium	Multi-step attacks, JWT token manipulation, chained exploitation
⭐⭐⭐⭐	Hard	Advanced techniques: JWT algorithm confusion, XXE, blind injection
⭐⭐⭐⭐⭐	Expert	Application internals knowledge, complex chained attacks
⭐⭐⭐⭐⭐⭐	Nightmare	Master-level: deep understanding of Node.js internals, novel techniques

Approximate Challenge Distribution

Juice Shop’s 100+ challenges are roughly distributed as:

One-star: ~15 challenges — accessible to complete beginners
Two-star: ~20 challenges — first real exploitation techniques
Three-star: ~25 challenges — requires intercepting and modifying requests
Four-star: ~20 challenges — advanced exploitation
Five-star: ~15 challenges — expert level
Six-star: ~5–10 challenges — specialized knowledge required

Exact counts change with each major release.

Recommended Challenge Completion Order

For Beginners (No Prior Security Experience)

Find the Score Board (⭐) — navigate to /#/score-board
Privacy Policy (⭐) — teaches you to explore the application thoroughly
Error Handling (⭐) — trigger an unhandled error, observe verbose stack trace
DOM XSS (⭐) — search for <iframe src="javascript:alert('xss')">
Zero Stars (⭐) — bypass the feedback form’s star rating minimum with DevTools
View Basket (⭐⭐) — IDOR on another user’s shopping basket
Login Admin via SQL Injection (⭐⭐) — ' OR '1'='1'-- in the email field
Reflected XSS (⭐⭐) — XSS via the order tracking URL parameter
Password Strength (⭐⭐) — find and use the admin’s weak password
Confidential Document (⭐) — discover /ftp/ directory listing

This sequence introduces fundamental concepts (XSS, SQL injection, IDOR, error disclosure) in the most accessible way.

For Intermediate Practitioners

After completing all one- and two-star challenges:

Payback Time (⭐⭐⭐) — negative cart quantity via API parameter manipulation
Forged Feedback (⭐⭐⭐) — post a review under another user’s name
Admin Section (⭐⭐⭐) — discover and access /#/administration
Upload Size (⭐⭐⭐) — bypass the file upload size limit
Login Bender / Jim / Bjoern (⭐⭐⭐) — targeted SQL injection for specific accounts
JWT Issues (⭐⭐⭐⭐) — begin working through JWT-related challenges
XXE Tier 1 (⭐⭐⭐⭐) — XXE file read via the B2B XML endpoint

For Advanced Practitioners

Once all three-star challenges are complete:

JWT Algorithm Confusion (⭐⭐⭐⭐) — RS256 → HS256 forgery to create admin token
Blockchain Hype (⭐⭐⭐⭐) — locate the wallet file via log analysis
Forgotten Developer Backup (⭐⭐⭐⭐) — null byte injection to bypass extension filter
SSRF (⭐⭐⭐⭐⭐) — trigger the server to make outbound requests
NoSQL Manipulation (⭐⭐⭐⭐⭐) — MongoDB operator injection
Six-star challenges — requires deep Juice Shop internals knowledge

Tips for Using the Scoreboard Effectively

Use the Difficulty Filter First

Don’t start at the top of the list — filter by difficulty and work through one-star challenges completely before moving to two-star. The scoreboard’s filter dropdown is in the top-right of the challenge table.

Track Your Progress Methodically

The scoreboard shows your completion percentage at the top. Sort by category to find where your knowledge gaps are: if you’ve solved all SQL injection challenges but none of the JWT challenges, you know where to focus next.

Hints Are Not Cheating

Each challenge has a lightbulb hint icon. Using hints is encouraged — the point is to learn, not to guess. If you’re stuck for more than 30 minutes on a one- or two-star challenge, read the hint.

Use Browser DevTools Constantly

Almost every Juice Shop challenge requires browser DevTools. Have the Network tab open while you use the application — watch every request and response. The Application tab (for LocalStorage and cookies) and Console tab (for JavaScript errors) are also frequently necessary.

The Scoreboard Is the Challenge List — It’s Always Current

The scoreboard you see in your running instance is always accurate for that Juice Shop version. If you’re working from a challenge list you found elsewhere and a challenge doesn’t appear in your scoreboard, it may have been added or renamed in a newer version.

Juice Shop Scoreboard in CTF Mode

For competitive team exercises, Juice Shop supports CTF mode where each solved challenge generates a unique flag string. Enable it by setting a secret key:

docker run -d -p 3000:3000 \
  -e CTF_KEY=your_shared_secret_here \
  bkimminich/juice-shop

In CTF mode, the scoreboard still shows all challenges and tracks progress — but instead of a congratulatory popup, each solved challenge displays a flag (e.g., juice_shop{abc123_...}). Teams submit these flags to a CTF platform (CTFd is standard) to score points.

The Juice Shop CTF CLI generates the corresponding CTFd challenge configuration from your CTF_KEY automatically.

Using the Scoreboard to Benchmark DAST Scanners

The Juice Shop scoreboard has a secondary professional use: as a checklist for verifying DAST scanner coverage. Before deploying a DAST scanner against production code, run it against Juice Shop and check which scoreboard challenges it detects automatically.

Minimum scanner benchmark: A production-ready DAST scanner should automatically detect the vulnerabilities corresponding to these challenges:

Scoreboard Challenge	Vulnerability	Expected DAST Detection
Login Admin	SQL injection — login form	✅ Should auto-detect
DOM XSS	XSS — search bar	✅ Should auto-detect
Missing Security Headers	CSP, X-Content-Type, X-Frame	✅ Should auto-detect
Confidential Document	Directory listing, sensitive file	✅ Should auto-detect
CORS Misconfiguration	Permissive CORS policy	✅ Should auto-detect
View Basket	IDOR — requires auth	⚠️ Requires authenticated scan
Reflected XSS	XSS — order tracking	✅ Should auto-detect

A scanner that misses the login SQL injection — the most basic SQL injection test case in existence — is not ready for production use.

Offensive360 DAST is benchmarked against the Juice Shop scoreboard on every release. Book a demo to see authenticated DAST scanning against Juice Shop or your own application.

Frequently Asked Questions

How many challenges are on the Juice Shop scoreboard?

The current stable release of OWASP Juice Shop has over 100 challenges. The exact count changes with each major release as new challenges are added. The scoreboard in your running instance always reflects the accurate current count for your version.

Does the scoreboard reset when I restart Juice Shop?

If you started Juice Shop with --rm (Docker removes the container on stop), your progress is lost. To keep progress across restarts, run with a named container without --rm:

docker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop
docker stop juice-shop   # stop but keep data
docker start juice-shop  # resume with your progress

Can I see the scoreboard without running Juice Shop locally?

The scoreboard is a feature of the running application. You can browse it on the public OWASP demo server (find the current URL at github.com/juice-shop/juice-shop#demo), but the demo instance is shared and periodically reset. For real practice, run your own local instance.

Are there any challenges that require two accounts?

Yes. Several challenges — particularly around IDOR and social engineering — require having two separate user accounts logged in simultaneously. Use two different browsers (or a regular browser and a private/incognito window) to maintain two separate sessions. The IDOR basket challenge, for example, requires that you can view Account A’s basket while logged in as Account B.

What is the hardest Juice Shop challenge?

Six-star challenges are widely considered the most difficult. They require deep understanding of Juice Shop’s Node.js/TypeScript internals, creative multi-step exploitation, and specialized knowledge. Completing all six-star challenges is a meaningful technical achievement — few practitioners solve all of them.

Summary

The OWASP Juice Shop scoreboard is your complete curriculum for modern web application security:

Access it at http://localhost:3000/#/score-board — finding it is the first challenge
100+ challenges across every OWASP Top 10 category, from ⭐ beginner to ⭐⭐⭐⭐⭐⭐ expert
Filter by difficulty and category to build a structured learning path
Use it as a DAST benchmark checklist — verify your scanner finds the well-known vulnerabilities
Enable CTF mode for competitive team exercises with CTF_KEY environment variable

Start Juice Shop in 60 seconds, open the scoreboard, and begin with one-star challenges:

docker run --rm -p 3000:3000 bkimminich/juice-shop
# Then open: http://localhost:3000/#/score-board

For detailed walkthroughs of specific challenges, see our complete Juice Shop solutions guide. For DAST scanner benchmarking methodology, see how to benchmark a DAST scanner with Juice Shop.