Deploy and Host OWASP Juice Shop on Railway

OWASP Juice Shop is a deliberately insecure web application: an online juice shop that contains vulnerabilities from the whole OWASP Top Ten and many more flaws found in real-world applications. It is built for security training, awareness demos, CTFs and as a target for security tools.

About Hosting OWASP Juice Shop

This application is vulnerable on purpose. Use it only as a training target. Do not put real data, real credentials or anything of value in it, and do not connect it to your other systems.

This template runs the official bkimminich/juice-shop image. There are no accounts to set up: open the URL and the shop is ready, with the challenge scoreboard available inside the app. The app keeps its data inside the container, so the shop resets to a fresh state on every redeploy, which is what you want for a training target.

Common Use Cases

Learn web application security by finding and exploiting the built-in flaws
Run a CTF or a security workshop for a team or class
Test scanners and other security tools against a known vulnerable target

Dependencies for OWASP Juice Shop Hosting

One service; no volume or database

Deployment Dependencies

Why Deploy OWASP Juice Shop on Railway?

Railway gives you a public HTTPS URL and a disposable environment, so a whole group can attack the same target from their own browsers without anyone installing anything. Remember that the URL is open to anyone who has it.