---
title: "Deploy OWASP Juice Shop"
description: "Deliberately vulnerable web app for security training and CTFs"
category: "Other"
url: https://railway.com/deploy/owasp-juice-shop
---

# Deploy OWASP Juice Shop

Deliberately vulnerable web app for security training and CTFs

**[Deploy OWASP Juice Shop on Railway](https://railway.com/template/owasp-juice-shop)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/owasp-juice-shop/manifest.json

- **Creator:** zer0person's Projects
- **Category:** Other
- **Total deploys:** 1

## Template content

### OWASP Juice Shop

- **Image:** bkimminich/juice-shop:latest
- **Public domain:** Yes

## Documentation

# Deploy and Host OWASP Juice Shop on Railway

[OWASP Juice Shop](https://github.com/juice-shop/juice-shop) is a deliberately insecure web application: an online juice shop that contains vulnerabilities from the whole OWASP Top Ten and many more flaws found in real-world applications. It is built for security training, awareness demos, CTFs and as a target for security tools.

## About Hosting OWASP Juice Shop

**This application is vulnerable on purpose.** Use it only as a training target. Do not put real data, real credentials or anything of value in it, and do not connect it to your other systems.

This template runs the official `bkimminich/juice-shop` image. There are no accounts to set up: open the URL and the shop is ready, with the challenge scoreboard available inside the app. The app keeps its data inside the container, so the shop resets to a fresh state on every redeploy, which is what you want for a training target.

## Common Use Cases

- Learn web application security by finding and exploiting the built-in flaws
- Run a CTF or a security workshop for a team or class
- Test scanners and other security tools against a known vulnerable target

## Dependencies for OWASP Juice Shop Hosting

- One service; no volume or database

### Deployment Dependencies

- [Juice Shop on GitHub](https://github.com/juice-shop/juice-shop)
- [Docker image](https://hub.docker.com/r/bkimminich/juice-shop)
- [Official project page](https://owasp-juice.shop)

## Why Deploy OWASP Juice Shop on Railway?

Railway gives you a public HTTPS URL and a disposable environment, so a whole group can attack the same target from their own browsers without anyone installing anything. Remember that the URL is open to anyone who has it.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/owasp-juice-shop