Build your own practice range

By CLR-6 the fastest way to keep growing is to practise on a target you control. This lab builds one: a deliberately vulnerable web app running only on your machine, plus an automated scanner to probe it. No shared server, no risk to anyone else.

Rules of engagement. Run this only on a computer you own. Never point Juice Shop or the scanner at any system you do not own and have explicit permission to test. The setup keeps the app bound to localhost.

You need: Docker (Docker Desktop on Windows/macOS, or Docker Engine on Linux).

1. Get the files

docker-compose.yml · README.md

The whole compose file is short:

services:
  juice-shop:
    image: bkimminich/juice-shop:v20.3.0
    container_name: zenaro-juice-shop
    ports:
      - "127.0.0.1:3000:3000"
    restart: unless-stopped

2. Start the app

In the folder with the compose file:

docker compose up

Wait for Server listening on port 3000, then open it in your browser. Your first task inside Juice Shop is to find its hidden Score Board, which lists the training challenges.

3. Scan it with OWASP ZAP

Run the packaged baseline scan (passive and quick) from the ZAP image:

docker run --rm --network host ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://localhost:3000

On macOS/Windows, replace the target with http://host.docker.internal:3000. The scan ends with a line like FAIL: 0 WARN: 4 IGNORE: 0 PASS: 22, and each finding above it names a rule and the URLs it affects.

The four questions below are answered by doing the three steps. The README.md has the full details and the clean-up command.