How aravind56565657/juice-shop-vulnerable works
OWASP Juice Shop is an intentionally vulnerable e-commerce web application used for security training, demonstrations, and CTFs. A shopper or learner uses the Angular interface, which calls the Express server for shop and account operations; the server exposes routes backed by Sequelize models and SQLite. Learners can also explore and track security challenges through the scoreboard and hacking-instructor features. The tree, README, and sampled files support this broad map, but many route-to-model and challenge-evaluation details were not sampled, so uncertain connections are omitted.
Main entry points: server.ts Express server · app.routing.ts App routing · main.ts Angular app · basket.component.ts Shop interface
Components 17
Web client
- Angular app
frontend/src/main.ts - App routing
frontend/src/app/app.routing.ts
Shop workflows
- Shop interface
frontend/src/app/basket/basket.component.ts - Product reviews
frontend/src/app/Services/product-review.service.ts - Two-factor UI service
frontend/src/app/Services/two-factor-auth-service.ts - Web3 features
frontend/src/app/wallet-web3/wallet-web3.module.ts - Chatbot feature
routes/chatbot.ts
Security training
- Challenge scoreboard
frontend/src/app/score-board/score-board.component.ts - Hacking instructor
frontend/src/hacking-instructor/index.ts
Application server
- Challenge API
routes/continueCode.ts - Review routes
routes/showProductReviews.ts - Two-factor routes
routes/2fa.ts - Express server
server.ts
Persistent state
- Challenge data
data/datacache.ts - Domain models
models/index.ts - SQLite database
models/index.ts
Other components
- Shopper / learner
Connections 16
- Shopper / learner → Angular app: uses
- Angular app → App routing: loads routes
- App routing → Shop interface: routes to
- Shop interface → Product reviews: uses reviews
- Product reviews → Review routes: HTTP requests
- Shopper / learner → Challenge scoreboard: explores challenges
- Challenge scoreboard → Challenge API: challenge requests
- Hacking instructor → Challenge data: uses challenge content
- Express server → Review routes: registers API
- Express server → Two-factor routes: registers API
- Express server → Challenge API: registers API
- Express server → Domain models: initializes models
- Domain models → SQLite database: stores records
- Two-factor UI service → Two-factor routes: HTTP requests
- App routing → Web3 features: loads module
- Shopper / learner → Chatbot feature: uses chatbot