Kali Linux Ethical Hacking, Part 3: Web App Testing Basics on OWASP Juice Shop
Series: Kali Linux Ethical Hacking, Part 3. Previous: Part 2, Nmap recon on your own lab. Next: Part 4, thinking like a defender with Kali.
You learn web app testing safely by running OWASP Juice Shop on your own machine, bound to localhost, and watching its traffic through Burp Suite Community Edition. You pick challenges from the built in Score Board, work through hints instead of copied solutions, and keep every request inside your own lab.
First, the legal bit
Disclaimer: This post is for education and authorized security testing only. Testing, attacking or accessing a website, app, network or account without permission is illegal, including under India’s Information Technology Act, 2000 and similar laws in other countries. Only test systems you own, or systems where you have clear written permission from the owner before you start.
Juice Shop is built to be attacked, but only your own copy of it. Never point these tools at a live shop, a friend’s site or any service you don’t control. If you want online targets, use legal platforms such as TryHackMe or Hack The Box, and stick to their rules.
Why is Juice Shop the right sparring partner?
In Part 1 we built an isolated lab, and in Part 2 we used Nmap to find what was listening in it. One of those open ports was a web app. Now we look inside it.
Built to be broken, on purpose
The project’s README (checked 21 Oct 2026) calls OWASP Juice Shop “probably the most modern and sophisticated insecure web application”, and says it covers vulnerabilities from the entire OWASP Top Ten along with many other flaws found in real world apps. It is meant for training, awareness demos, CTFs and testing security tools.
Current and maintained
The latest release on GitHub is v20.3.0, published on 11 October 2026 (UTC), according to the GitHub API, checked on 21 Oct 2026. The project is MIT licensed. A maintained target matters, because you want practice on an app that keeps up with how web software is built today.
It tracks your learning
Most practice apps leave you guessing whether you got something right. Juice Shop has a Score Board that tells you, which we’ll come to below.
How do you run Juice Shop locally and keep it local?
The README lists a few ways to run it: from source with Node.js, from a packaged download, or as a Docker container. For a Kali lab, Docker is the tidiest.
The Docker route
The README’s Docker steps are short (Juice Shop README, checked 21 Oct 2026):
docker pull bkimminich/juice-shop
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Then browse to http://localhost:3000. If Docker isn’t installed on your Kali VM yet, install it from the Kali repositories first.
Why 127.0.0.1 matters
Look closely at the -p 127.0.0.1:3000:3000 part. It publishes the app on the loopback address only, so the shop answers to your own machine and nothing else on the network. That is exactly what you want for a deliberately vulnerable app. If you run Juice Shop on a separate target VM instead, keep that VM on the host only network from Part 1.
Stop it when you’re done
The --rm flag removes the container when it stops. Close the terminal or press Ctrl+C and the shop disappears, along with any changes you made. A fresh start every session is a nice property for learning.
What is Burp Suite Community and which version should you use?
Burp Suite is an intercepting proxy. It sits between your browser and the web app and shows you every request and response, so you can see what the app really sends and receives.
Current versions
On PortSwigger’s release notes page (checked 21 Oct 2026), the newest Professional and Community release is 2026.10, dated 12 October 2026, and it is labelled Early Adopter. The previous Professional and Community release listed is 2026.9.2, dated 9 October 2026. The 2026.10 notes (12 Oct 2026) mention reintroduced HTTP Digest authentication support, better notifications and an updated built in browser.
Kali packages Burp too. On the Kali package tracker (checked 21 Oct 2026), kali-rolling has 2026.9-0kali1, with 2026.10-0kali1 in kali-dev. For learning, the Kali package is fine. Early Adopter builds bring new features sooner but are less settled, so beginners can stay on the regular channel.
Community is enough to start
Community Edition is PortSwigger’s free edition, described on its own site as the manual tools to start web security testing. Everything in this part works with it.
How do you map the app with an intercepting proxy?
Mapping means building a picture of the app before you test anything: its pages, its API calls and how it handles your session.
Use Burp’s browser
Burp ships with its own built in browser that is already set to send traffic through the proxy. Open it from the Proxy tab and browse to http://localhost:3000. This avoids fiddly proxy and certificate settings in your normal browser.
Browse like a customer first
With interception switched off, simply use the shop. Look at products, search, create an account, add something to the basket. Every click lands in Burp’s HTTP history. You are not attacking anything yet. You are learning how a normal user’s journey looks on the wire.
Read the history
Go through the HTTP history one request at a time. Note which requests load pages and which call an API. Look at the methods, the paths, the parameters and the headers. Look at how the app keeps you logged in after you sign in. A page in your notes that lists each feature and the requests behind it is the real output of this step.
Use scope to stay focused
In Burp’s target settings, add http://localhost:3000 to scope and hide out of scope items. It keeps your view clean, and it builds the habit of defining scope that real engagements depend on.
How do you learn from the Score Board without shortcuts?
Juice Shop’s Score Board is the heart of this part.
What the Score Board shows
The official companion guide (checked 21 Oct 2026) says the Score Board lists every available challenge with a short description. Some descriptions are explicit, others are vague hints. Challenges are rated from one to six stars, and you can filter by difficulty and by solved or unsolved status. A progress bar shows how far you’ve come.
Start with one and two stars
The guide makes a useful point: if a one or two star challenge is taking a very long time, you are probably on the wrong track. Start at the bottom, finish a few, and move up only when the easy ones feel easy.
Use hints, not solutions
Each challenge has a Hints button, unless it has been switched off, and most challenges offer several hints that unlock one at a time, the guide explains. Use them. The companion guide also has an appendix with full solutions. Resist it. If you read the answer first, you learn the answer. If you struggle, read a hint, and then find it yourself, you learn the method, and the method is what carries over to authorized work later.
Map each challenge to a category
The guide groups challenges into categories such as Injection, Broken Access Control, Security Misconfiguration and Cross Site Scripting. After each solve, write one line in your notes: which category it was, what the app did wrong, and how a developer would fix it. That last part is the one employers and clients care about most.
Think like the defender, too
My day job sits close to network detection and response, so I always find it useful to look at the other side. After a solve, go back to Burp’s history and ask: what in these requests would look odd to a defender watching the logs? That habit makes you a better tester and a better colleague. For more open source tools on the defensive side, my roundup of security GitHub repos for October 2026 is a good companion.
How do you set up Juice Shop and Burp, step by step?
Here is the full hands on run. Everything happens on your Kali VM, and Juice Shop listens on 127.0.0.1 only, so nothing outside the VM can reach it. Versions are as checked on 21 October 2026.
What you need before you start
- A Kali 2026.2 VM from Part 1, updated and rebooted, with at least 4 GB of RAM given to it.
- Internet through the NAT adapter for the installs. You can switch it off once the image is pulled.
- A notes folder:
mkdir -p ~/lab-notes/$(date +%F).
Step 1: Install Docker from the Kali repositories
Kali’s Docker docs (checked 21 Oct 2026) use the docker.io package:
sudo apt update
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo docker --version
Expected output: a line starting with Docker version and a number.
Step 2: Pull and start Juice Shop on localhost
sudo docker pull bkimminich/juice-shop
sudo docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Expected output: the pull downloads several layers. The run prints startup log lines and ends with a message that the server is listening on port 3000. Leave this terminal open. The current release is v20.3.0 (11 Oct 2026, GitHub API, checked 21 Oct 2026).
Step 3: Confirm it answers only on localhost
In a second terminal:
curl -sI http://127.0.0.1:3000 | head -1
ss -ltn | grep 3000
Expected output:
HTTP/1.1 200 OK
LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:*
The important part is 127.0.0.1:3000. If you see 0.0.0.0:3000, stop the container and check the -p option.
If a tool here throws odd errors, your Kali packages may be out of date, so run my routine to update Kali Linux safely first.
Step 4: Install and start Burp Suite Community
sudo apt install -y burpsuite
apt policy burpsuite | head -3
burpsuite &
Expected output: apt policy shows the installed version, 2026.9 from kali-rolling on 21 Oct 2026, according to the Kali package tracker. Burp then opens. Choose Temporary project and Use Burp defaults, then Start Burp.
Step 5: Open Burp’s browser and load the shop
- Go to the Proxy tab, then Intercept, and make sure intercept is off.
- Click Open browser.
- In that browser, go to
http://127.0.0.1:3000.
Expected result: the Juice Shop home page loads with a product list, and requests start appearing under Proxy, then HTTP history.
Step 6: Set the scope
- Go to Target, then Scope settings, and add
http://127.0.0.1:3000. - In HTTP history, open the filter and tick Show only in scope items.
Expected result: the history list shows only requests to 127.0.0.1:3000.
Step 7: Map the app as a normal customer
Using Burp’s browser, do these five actions in order and nothing else yet:
- Open three products.
- Search for
apple. - Register an account with a made up email such as
student@juice-sh.opand a test password. - Log in with it.
- Add one item to the basket.
Then write a short map in your notes:
cat >> ~/lab-notes/$(date +%F)/juice-shop-map.txt <<'MAP'
Feature | Method and path seen in Burp | Notes
Product view | |
Search | |
Register | |
Login | |
Basket | |
MAP
Expected result: you can fill in every row from Burp’s history. Most actions will show requests to paths starting with /rest/ or /api/.
Step 8: Find the Score Board and pick your first challenges
Finding the Score Board is part of the learning. Look through the app and the requests you just captured, and use the in app hints if you get stuck. Once it’s open:
- Set the Difficulty filter to one star only.
- Pick one challenge and read its description.
- Click Hints only after ten minutes of trying on your own.
Expected result: when you solve a challenge on your local copy, a green notification appears and the progress bar moves. Record each solve:
echo "$(date '+%F %R') solved: <challenge name> | category: <category> | cause: <what the app did wrong> | fix: <how a developer would fix it>" >> ~/lab-notes/$(date +%F)/solves.txt
Step 9: Shut everything down
Close Burp, then press Ctrl+C in the Juice Shop terminal.
sudo docker ps
Expected output: only the header line, meaning no container is running. Because of --rm, the container and your progress are gone, so your notes file is your record.
What to do next
Your plan for this week:
- Run Juice Shop with the Docker command above, bound to
127.0.0.1, and open it athttp://localhost:3000. - Install or update Burp Suite Community and check the version you have against PortSwigger’s release notes.
- Browse the shop through Burp’s built in browser with interception off, and write a one page map of features and their requests.
- Find the Score Board, filter it to one star challenges, and solve two using hints only.
- For each solve, note the category, the cause and the fix.
- Stop the container at the end of each session so nothing vulnerable stays running.
In Part 4, I turn these same skills around and show you how I check my own machines: thinking like a defender with Kali.
Leave a comment