Hack a Juice Shop: Web Pen Test

Exploit SQL injection and XSS against a vulnerable web app using ZAP.

Introduction

30 Second Summary

Every time you log in to a website, you trust that nobody can sneak past the login page without a password. What if a few carefully placed characters in the email field could bypass that check entirely?

In this project, you will run your first penetration test against OWASP Juice Shop, a realistic online juice store that is intentionally full of security holes. You will use the same tools and methodology that professional security testers rely on.

What You'll Build

You type a strange string into a login form, press enter, and the page welcomes you as the store's administrator without you ever knowing the password.

By the end of this project, you'll have:

A running hacking lab where you launch a vulnerable web store in Docker and intercept every request using ZAP, a professional penetration testing proxy.
Hands-on proof you can hack the admin account using SQL injection and trigger a cross-site scripting attack that executes JavaScript in the browser.
A ZAP scan report showing discovered vulnerabilities organized by risk level, covering categories from the OWASP Top 10.
Secret Mission: Exploit broken access control to view another user's shopping basket and access the admin panel.

Are there any prerequisites?

This project is written for Windows and includes setup instructions for every tool you need. You just need Java 17 or higher already installed on your machine.

Before We Start

Before we start hacking, let's lock in what you are about to build and why it matters.

Set Up Your Hacking Lab

Every penetration test starts in the lab. Before you can probe for vulnerabilities or craft exploits, you need a safe, isolated environment where you can attack freely without putting real systems at risk.

In this step, you will build your lab from three pieces. Docker runs the vulnerable target app in an isolated container. OWASP Juice Shop is that target, a realistic online juice store intentionally filled with security holes. ZAP is the professional proxy that sits between your browser and the target, recording and analyzing every request.

In this step, get ready to:

Install Docker Desktop on your Windows machine.
Launch OWASP Juice Shop in a Docker container.
Install and launch ZAP.

Install Docker Desktop

Docker Desktop lets you run applications inside containers, which are lightweight, isolated environments on your machine. You need it to run the vulnerable Juice Shop app safely.

Press the Windows key to open your search bar.
Type PowerShell and press Enter to open it.
Check if Docker is already installed by running this command:

docker --version

✔️ I see a version number

Docker is already installed on your machine.

Check the system tray (bottom-right of your taskbar) for the Docker whale icon.
If the whale icon shows the engine is running, skip ahead to the next substep.
If Docker Desktop is not running, press the Windows key, type Docker Desktop, and press Enter to start it.
Wait for the whale icon in the system tray to show the engine is running before continuing.

ⓧ 'docker' is not recognized

Docker is not installed yet. Follow these steps to install it.

Open your browser and go to the Docker Desktop for Windows install page.
Download the Docker Desktop installer for Windows.
Run the downloaded installer.
When prompted, make sure Use WSL 2 instead of Hyper-V is selected.

What is WSL 2?

WSL 2 (Windows Subsystem for Linux) lets Docker run Linux containers natively on Windows. Enabling WSL 2 for the first time requires administrator privileges and may require a computer restart.

Complete the installation. If prompted to restart your computer for WSL 2, save your work and restart.
After installation (and any restart), press the Windows key, type Docker Desktop, and press Enter to launch it.
Wait for the Docker whale icon in the system tray (bottom-right of your taskbar) to show the engine is running.

Docker Desktop won't start?

Make sure your Windows version meets the requirements: Windows 10 version 22H2 (build 19045) or Windows 11 version 23H2 (build 22631) or higher.
Make sure hardware virtualization is enabled in your BIOS settings. Look for Intel VT-x or AMD-V.
If WSL 2 failed to install, open PowerShell as Administrator and run wsl --install, then restart your computer.

Still stuck? Help me troubleshoot Docker Desktop not starting on Windows.

What is Docker?

Docker packages applications into containers. A container bundles an app with everything it needs to run (code, libraries, settings) so it behaves the same on every machine.

For this project, Docker means you can run a vulnerable web app without installing Node.js, configuring databases, or worrying about it affecting your own system. One command and the app is running.

Pull and run OWASP Juice Shop

With Docker running, you can now download and launch the target application. Juice Shop is a fake online juice store that looks and behaves like a real e-commerce site, but it is intentionally riddled with security vulnerabilities for you to exploit.

Pull the Juice Shop Docker image by running this command:

docker pull bkimminich/juice-shop

What does this command do?

docker pull downloads a pre-built application image from Docker Hub. bkimminich/juice-shop is the official Juice Shop image maintained by the OWASP project.

You should see download progress bars as Docker pulls each layer of the image.

Once the pull finishes, start the Juice Shop container by running this command:

docker run --rm -p 3000:3000 bkimminich/juice-shop

What does this command do?

docker run creates and starts a new container from the image.
--rm automatically removes the container when you stop it, keeping your system clean.
-p 3000:3000 maps port 3000 on your machine to port 3000 inside the container.
bkimminich/juice-shop is the image you just pulled.

This command takes over your terminal

The container runs in the foreground, so your PowerShell window will show startup logs and stay occupied. Leave it running. You will open a new terminal window later when you need to install ZAP.

To stop the container later, press Ctrl+C in this terminal.

You will see startup logs scrolling in the terminal. Once the output settles, the app is ready.

Before you open the browser, what do you think the Juice Shop looks like? It is an online store built for hacking practice. Take a guess at what you will see.

Open your browser and navigate to http://localhost:3000.

You should see the Juice Shop storefront displaying products like Apple Juice and Orange Juice. This is your target for the rest of the project.

What is OWASP Juice Shop?

OWASP Juice Shop is an intentionally vulnerable web application built with Node.js and Angular. It simulates a real online store complete with user accounts, a shopping cart, and product reviews.

It contains over 100 hacking challenges organized by difficulty and category. The app tracks your progress on a hidden Score Board that you will discover in the next step.

Don't see the storefront?

Make sure the terminal running the docker run command is still active. If you closed it, run the command again.
Check that Docker Desktop is still running (whale icon in the system tray).
If you see a "port already in use" error, another application may be using port 3000. Close that application and try again.

Still stuck? Help me troubleshoot Juice Shop not loading at localhost:3000.

Install and launch ZAP

The last piece of your lab is ZAP (Zed Attack Proxy). ZAP is a free, open-source penetration testing tool that acts as a proxy between your browser and a web application, intercepting and analyzing every request and response.

Press the Windows key, type ZAP, and check the search results.

✔️ I see ZAP in the results

ZAP is already installed on your machine.

Click on ZAP in the search results to launch it.

ⓧ I don't see ZAP

ZAP is not installed yet. Since your first terminal is running Juice Shop, you need to open a new one.

Press the Windows key, type PowerShell, and press Enter to open a new PowerShell window.
Install ZAP by running this command:

winget install --id=ZAP.ZAP -e

What does this command do?

winget is the Windows package manager. This command installs ZAP from the official package registry. The -e flag ensures an exact ID match so you get the right application.

Wait for the installation to complete.
Press the Windows key, type ZAP, and press Enter to launch it.

Install failed?

Make sure you have Java 17 or higher installed. ZAP requires it. Run java -version in PowerShell to check.
If winget is not recognized, make sure you are running Windows 10 version 1809 or later. You can also download ZAP directly from zaproxy.org/download.

Still stuck? Help me troubleshoot installing ZAP on Windows.

When ZAP asks about persisting the session, select No, I do not want to persist this session at this moment in time.
Click Start.

ZAP opens its main desktop interface with the Quick Start tab visible. This is the control center you will use to scan and intercept traffic throughout this project.

What is ZAP?

ZAP (Zed Attack Proxy) by Checkmarx is a free, open-source penetration testing tool designed specifically for testing web applications. It works as a proxy that sits between your browser and the target app.

Every request your browser sends and every response the server returns passes through ZAP first. This lets ZAP record traffic, flag potential vulnerabilities, and even modify requests on the fly.

ZAP won't launch?

Confirm Java 17 or higher is installed by running java -version in PowerShell. ZAP needs Java to run.
If ZAP opens but immediately closes, try launching it as Administrator. Right-click ZAP in the Start menu and select Run as administrator.

Still stuck? Help me troubleshoot ZAP not launching on Windows.

Your hacking lab is up and running. Next up, you will explore the Juice Shop like a real penetration tester, mapping out pages and hunting for hidden content that the app does not want you to find.

Reconnaissance - Explore the Target

Your hacking lab is up and running. Juice Shop is live at http://localhost:3000, and ZAP is standing by to intercept traffic.

A real penetration test never starts with an attack. Testers explore first, mapping out every page, form, and feature before trying to break anything.

In this step, get ready to:

Browse Juice Shop like a regular user to map its features and forms.
Discover a hidden Score Board page by inspecting the application's JavaScript source code.
Launch ZAP's proxied browser to start capturing traffic for later analysis.

Browse the store manually

Reconnaissance is the first phase of any penetration test. Before trying to break anything, you need to understand what the application does, what inputs it accepts, and what pages it exposes.

Switch to your browser tab with Juice Shop at http://localhost:3000.
Click on a few product cards in the storefront to see how the shop displays items.
Find and open the login page through the site's navigation.
Browse other pages like the About page and the Contact form through the navigation menus.

Now it is time to go beyond what a regular user can see. Juice Shop is built with Angular, and its JavaScript source files contain route definitions for every page. Some of those routes point to pages that are not linked anywhere in the navigation.

Press F12 to open your browser's Developer Tools.
Click the Sources tab (in Chrome) or the Debugger tab (in Firefox).
Press Ctrl+Shift+F to open the search panel that searches across all loaded files.
Type score in the search field and press Enter.

You should see search results highlighting a route definition that includes score-board. This is a hidden page that is not linked anywhere in Juice Shop's navigation.

Why inspect the JavaScript source?

Modern web applications bundle all of their route definitions into JavaScript files that the browser downloads. By searching through these files, you can discover pages the developers built but never linked in the UI.

This is a classic reconnaissance technique. If a page exists in the code, you can navigate to it directly, even if the application never shows you the link.

Not finding any results for score?

Make sure you are using the cross-file search panel (Ctrl+Shift+F), not the single-file search bar (Ctrl+F). The single-file search only looks inside whichever file is currently open.
Try refreshing the Juice Shop page and reopening Developer Tools. The JavaScript files need to fully load before search can find them.

Still stuck? Help me find the score-board route in Juice Shop's JavaScript source files using Developer Tools.

Find the hidden Score Board

You found a route called score-board hiding in the JavaScript source. Before you navigate to it, what do you think a hidden Score Board on a deliberately vulnerable hacking site would show?

In your browser's address bar, navigate to http://localhost:3000/#/score-board.

The Score Board page loads, listing over 100 hacking challenges organized by difficulty (1-star to 6-star). A green notification banner pops up at the top, confirming you solved your first challenge by finding this hidden page.

Scroll through the challenge list. Notice categories like Injection, Broken Authentication, and XSS.

What is the OWASP Top 10?

The categories on the Score Board map to the OWASP Top 10, the industry-standard list of the most critical web security risks. It is maintained by the Open Web Application Security Project and updated regularly based on real-world attack data.

In this project, you will attack three of these categories by hand: Injection, XSS, and Broken Access Control.

Score Board not loading?

Make sure the URL includes the # character. The full URL is http://localhost:3000/#/score-board. Without the #, Angular cannot route to the correct page.
Confirm the Juice Shop container is still running. Check the terminal where you started it. If you see an error or the process stopped, run docker run --rm -p 3000:3000 bkimminich/juice-shop again.

Still not working? Help me access the Juice Shop Score Board page.

Launch ZAP's proxy browser

You have explored Juice Shop and found your first flag. Now you need ZAP to start recording your traffic so you can analyze requests and responses later.

Switch back to ZAP.
Click the Quick Start tab in the main workspace.
Click Manual Explore.
Enter http://localhost:3000 in the URL field.
Select your preferred browser (Firefox or Chrome) from the browser dropdown.
Click Launch Browser.

A new browser window opens. This browser is pre-configured to route all its traffic through ZAP, so every request you make is recorded for analysis.

In the ZAP-launched browser, click through a few Juice Shop pages: the storefront, a product page, and the login page.
Switch back to ZAP and look at the Sites tree in the left panel.

What do you expect to see in the Sites tree after browsing?

The Sites tree now shows every URL and resource your browsing session loaded. ZAP is passively scanning every request and response in the background, quietly looking for security issues without sending any attack traffic.

What is passive scanning?

ZAP has two scanning modes. Passive scanning analyzes requests and responses as they flow through the proxy. It does not modify anything or send extra traffic, so it is completely safe.

Active scanning sends attack payloads to the target to probe for vulnerabilities. You will use active scanning in the next step.

Sites tree still empty?

Make sure you are browsing Juice Shop in the ZAP-launched browser window, not your regular browser. Only traffic from the proxied browser appears in ZAP's Sites tree.
Confirm Juice Shop is still running at http://localhost:3000. If the ZAP-launched browser shows a connection error, restart the Juice Shop container.

Need a hand? Help me get ZAP's proxy browser working with Juice Shop.

You have mapped out Juice Shop's features and uncovered its hidden Score Board. ZAP is now passively recording every request in the background. Next up, you will let ZAP's automated scanner loose on the entire site to hunt for vulnerabilities.

Automated Scanning - Let ZAP Do the Work

In the last step, you explored Juice Shop like a regular user and uncovered its hidden Score Board. You also got ZAP intercepting every request flowing between your browser and the app.

Automated vulnerability scanners can probe hundreds of endpoints in minutes, catching issues that would take hours to spot by hand. You are about to launch ZAP's scanner against Juice Shop and see what it turns up.

In this step, get ready to:

Run ZAP's automated scanner against Juice Shop.
Review the vulnerability alerts ZAP discovers.

Run an automated scan

So far ZAP has been passively watching traffic in the background. Now you will switch it to active mode, where it sends real attack payloads to the target application to probe for vulnerabilities.

Switch back to ZAP.
Click the Quick Start tab.
Click Automated Scan.

Enter http://localhost:3000 in the URL to attack field.
Select Client Spider as the spider option.
Click Attack.

What is the difference between passive and active scanning?

Passive scanning observes traffic without modifying anything. It only reads what is already flowing through the proxy, so it is completely safe.

Active scanning sends attack payloads to the target, probing for real vulnerabilities. It can put a target at risk, which is why you only run it against applications you have permission to test. Juice Shop is designed for exactly this.

Why use the Client Spider?

Juice Shop is a modern JavaScript app built with Angular. The Client Spider uses a real browser to crawl the site, which means it can discover pages and routes that are loaded dynamically by JavaScript. The traditional spider only reads raw HTML and would miss most of Juice Shop's content.

Watch ZAP's progress bar in the bottom panel. The spider crawls the site first, then the active scanner probes each discovered page for vulnerabilities.

The scan may take several minutes to complete. You will see the Alerts count in the footer increase as ZAP discovers findings.

Scan seems stuck or shows no alerts?

Make sure Juice Shop is still running. Check that http://localhost:3000 loads in your regular browser.
Confirm you entered the full URL including http:// in the URL to attack field.
The Client Spider is slower than the traditional spider because it launches a real browser. Give it a few minutes before assuming it is stuck.

My ZAP automated scan is not finding any alerts. What could be wrong?

Review the scan results

Once the scan completes, the bottom panel of ZAP will be filled with everything the scanner found. Time to dig in.

Click the Alerts tab in the bottom panel of ZAP.

ZAP groups its findings by risk level. You will see colored flags in the footer showing the count at each level.

High (red): critical vulnerabilities that could lead to data breaches or system compromise.
Medium (orange): significant issues that weaken the application's security posture.
Low (yellow): minor issues with limited impact.
Informational (blue): observations that are not vulnerabilities but are worth noting.

Click on any individual alert to expand it.
Review the details ZAP provides: the vulnerable URL, the attack string it used, the risk description, and a suggested fix.

What kind of issues does ZAP find automatically?

Automated scanners excel at catching broad, pattern-based issues. You will see findings like missing security headers, insecure cookie flags, and information disclosure. These are real findings that matter in a production application.

The Alerts tab looks impressive. ZAP found real issues across multiple risk levels. But here is the critical question: before you search through the alerts, do you think the automated scanner found a way to hack the admin account?

Scroll through the alerts and search for anything related to the login form or SQL injection.
Also look for any alerts mentioning the search bar or cross-site scripting (XSS).

You will not find them. The scanner discovered generic issues like missing headers and cookie flags, but it did not find the SQL injection vulnerability in the login form. It also missed the XSS vulnerability in the search bar.

Why did the scanner miss these vulnerabilities?

Automated scanners work by sending known attack patterns to every input they find. The login form needs a very specific payload in the email field to exploit the SQL injection. ZAP does not know that the email field accepts SQL syntax, or that a particular payload would bypass authentication entirely.

This is the most important lesson in penetration testing. Scanners find breadth. Manual testing finds depth. Professional pentesters always use both.

The automated scanner caught real issues, but it completely missed the most dangerous vulnerability in the app. In the next step, you will do what the scanner could not: manually craft a SQL injection payload to hack the admin account.

SQL Injection - Hack the Admin Account

Your automated scan uncovered generic issues like missing security headers and cookie flags. But it completely missed the most dangerous vulnerability hiding in the application.

The login form is vulnerable to SQL injection. In this step, you will manually craft an attack payload that bypasses authentication entirely, logging in as the store's administrator without knowing the password.

In this step, get ready to:

Exploit the login form with a SQL injection payload to bypass authentication.
Log in as the Juice Shop administrator without knowing the password.
Document the attack in ZAP's History tab for a professional audit trail.

Understand how SQL injection works

The login form takes your email and password and plugs them directly into a database query. What happens when you type something that changes the query itself?

Navigate to the Juice Shop login page by entering http://localhost:3000/#/login in your browser's address bar.

You should see the login form with Email and Password fields.

What happens when you log in?

When you submit the login form, the server takes your email and password and drops them straight into a SQL query:

SELECT * FROM Users WHERE email = '...' AND password = '...'

The app does not sanitize your input before inserting it into the query. This means you can type SQL code into the email field that rewrites what the query does.

Exploit the login form

Now you know the query structure. Time to break it.

In the Email field, type: ' or 1=1--.
In the Password field, type anything (e.g., test).

Before you click Log in, predict: do you think the app will actually let you in with that gibberish in the email field and a fake password?

Click Log in.

You are now logged in as the administrator. The page shows admin@juice-sh.op in the top-right corner of the navigation bar.

How does this payload work?

The apostrophe ' closes the email string in the SQL query.
or 1=1 makes the WHERE condition always true, matching every user in the database.
-- comments out the rest of the query, including the password check.
The first user in the database is the administrator, so you get logged in as admin@juice-sh.op.

Return to the Score Board at http://localhost:3000/#/score-board.
Find the Login Admin challenge. It now shows as solved with a green indicator.

Still seeing invalid credentials?

Make sure you typed the payload exactly as ' or 1=1-- in the Email field. The leading apostrophe is essential.
The Password field must not be empty. Type any value like test.
Check that you are on the login page at http://localhost:3000/#/login and not the registration page.

Help me troubleshoot my SQL injection payload in Juice Shop.

Inspect the attack in ZAP

Finding a vulnerability is only half the job. A professional penetration tester documents every finding with the exact request, payload, and evidence of exploitation.

Switch back to ZAP.
Click the History tab in the bottom panel.
Find the POST request to /rest/user/login. It should be one of the most recent entries.
Click on it and examine the Request tab.

You can see your SQL injection payload ' or 1=1-- in the request body. This is the evidence trail: the vulnerable endpoint, the payload, and proof that it worked.

Why document attacks in ZAP?

Professional pentesters do not just find vulnerabilities. They document everything: the exact request, the payload, and the server's response.

ZAP's History tab builds that audit trail automatically as you test. When you write up a report later, the raw request and response are already captured.

You just hacked the admin account using SQL injection, proving that automated scanners miss the most critical vulnerabilities. Next up, you will attack the browser itself with cross-site scripting.

Cross-Site Scripting - Execute Code in the Browser

You just broke into the admin account by injecting SQL code into the server's database query. That attack targeted the server side of the application.

Now you will attack from the other direction. Cross-site scripting (XSS) targets the user's browser instead. When an application reflects your input back into the page without sanitizing it, you can inject JavaScript that the browser executes as if it were part of the legitimate site. Together, SQL injection and XSS cover two of the most dangerous categories in the OWASP Top 10.

In this step, get ready to:

Find a search field that reflects user input back into the page without sanitizing it.
Inject a JavaScript payload through the search bar and watch the browser execute it.
Review the XSS attack in ZAP to document how the payload traveled from request to response.

Find the vulnerable input

The first thing a pentester looks for when testing for XSS is any place where user input appears back on the page. If the app renders your text directly into the HTML, it might also render injected code.

Return to the Juice Shop home page at http://localhost:3000.
Click the search icon (magnifying glass) in the navigation bar at the top of the screen.
Type apple in the search bar and press Enter.

You should see search results appear, and your search term reflected back on the page as something like "Search Results - apple".

Why does reflected input matter?

When your search term shows up on the results page, it means the app is taking your input and inserting it directly into the HTML. If it does not sanitize that input first, you can inject HTML or JavaScript that the browser treats as part of the page.

This is a classic indicator of potential XSS. Juice Shop's Angular frontend uses a function called bypassSecurityTrustHtml() on the search value, which explicitly tells Angular to skip its built-in sanitization. That is the gap you are about to exploit.

Inject a script

Now you know the search bar reflects input. Time to test whether it will also execute code.

Before you try this, what do you think will happen if you type an HTML tag into the search bar instead of plain text? Will the browser display it as text, or treat it as real HTML?

Click the search icon in the navigation bar again.
Type the following payload into the search bar and press Enter:

<iframe src="javascript:alert('XSS')">

An alert box pops up in your browser displaying "XSS". The browser executed the JavaScript you injected through the search bar.

How does this payload work?

The <iframe> tag tells the browser to embed another page inside the current one.
The src="javascript:alert('XSS')" attribute uses a JavaScript URI instead of a normal URL. The browser executes this JavaScript when it renders the iframe.
Because the search bar reflects your input without sanitizing it, the browser renders the <iframe> as real HTML and runs the JavaScript inside it.

Navigate to the Score Board at http://localhost:3000/#/score-board.
Find the "DOM XSS" challenge. It now shows as solved with a green checkmark.

What could a real attacker do with XSS?

In a real attack scenario, instead of a harmless alert box, an attacker could steal session cookies, redirect users to phishing pages, or inject fake login forms. XSS is dangerous because it runs code in the victim's browser with the same permissions as the legitimate site.

Alert box did not appear?

Make sure you typed the payload exactly, including the angle brackets and the quotes around javascript:alert('XSS'). A missing character will break the HTML tag.
Check that your browser is not blocking pop-ups. Some browsers suppress alert() dialogs by default. Try using Chrome or Firefox without pop-up blockers enabled.
If you accidentally dismissed the alert, search again with the same payload. It triggers every time.

Why isn't the XSS payload triggering an alert in Juice Shop?

Review the attack in ZAP

Just like the SQL injection attack, you can document this exploit by reviewing it in ZAP. Selecting any request in ZAP's History tab shows the data your browser sent in the Request tab and the data the server returned in the Response tab.

Switch to ZAP and click the History tab in the bottom panel.
Look for a GET request to a URL containing /#/search or a request whose URL includes your payload.
Click on the request and examine the Request tab in the workspace window (top right). You can see the payload you sent.
Click the Response tab to see how the server reflected your payload back in the response body without escaping it.

Why did the automated scanner miss this?

This is the second vulnerability you found by hand that ZAP's automated scan missed. The scanner checked the search endpoint for generic issues but did not craft a context-specific XSS payload for the search bar.

This is also a different category of attack from the SQL injection in the previous step. SQL injection targets the server's database. XSS targets the user's browser. Manual testing fills the gaps that automated tools leave behind.

Secret mission

Broken Access Control

You have proven you can bypass authentication with SQL injection and attack browsers with XSS. Now try a third category from the OWASP Top 10: Broken Access Control. Can you view another customer's shopping basket and access the hidden admin panel?

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing cloud costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

Juice Shop Docker container running at http://localhost:3000.
Juice Shop Docker image (bkimminich/juice-shop).
Docker Desktop installed with WSL 2 enabled.
ZAP (Zed Attack Proxy) installed locally.

Keep everything running

No action needed. Choose this if you want to keep practising Juice Shop challenges or exploring ZAP.

Juice Shop resets its database every time you restart the container, so you can always start fresh.
Docker Desktop and ZAP remain installed and ready to use for future projects.
To restart Juice Shop after stopping it, run docker run --rm -p 3000:3000 bkimminich/juice-shop again.

Pause - I'll come back to this later

Shut down running processes to free up memory. Your tools stay installed so you can pick up where you left off.

Stop the Juice Shop container by pressing Ctrl+C in the terminal where it is running.
Close Docker Desktop from the system tray. Right-click the whale icon and select Quit Docker Desktop.
Close ZAP. Nothing is using resources until you start them again.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow each step below to fully clean up.

Stop the Juice Shop container by pressing Ctrl+C in the terminal where it is running.
Remove the Juice Shop Docker image by running this command in your terminal:

docker rmi bkimminich/juice-shop

Uninstall ZAP by running this command in your terminal:

winget uninstall --id=ZAP.ZAP -e

Uninstall Docker Desktop. Open Windows Settings, then select Apps, then Apps & features.
Find Docker Desktop in the list, select it, and click Uninstall. Confirm when prompted.
No cloud resources were created, so there is nothing else to clean up.

Nice Work!

Nice work! You just completed a full web penetration test against a real application using the same tools and methodology professional pentesters use.

You've learned how to:

Set up a professional hacking lab with Docker, OWASP Juice Shop, and ZAP, then performed reconnaissance to discover hidden pages by inspecting the application's JavaScript source code.
Manually exploited a SQL injection in the login form to bypass authentication and log in as admin, proving that automated scanners find breadth but miss context-dependent vulnerabilities that require manual testing.
Executed a DOM-based cross-site scripting (XSS) attack through the search bar, demonstrating how unsanitized user input leads to arbitrary code execution in the browser.
Secret Mission: Exploited Broken Access Control to view another user's basket and access the admin panel, completing three of the OWASP Top 10 vulnerability categories in a single project.

Ready to quiz yourself?