OWASP Practice Lab

Reading about security builds knowledge. Practicing builds skill. A practice lab gives you a safe place to see weaknesses, watch them behave, and test fixes without harming anyone. You build the lab on your own computer, so every experiment stays private and legal.

Why You Need a Lab

Security testing against systems you do not own can break laws and harm real people. A lab removes that risk. You own the target, you control the network, and you can reset everything with one command.

Picture a driving school with an empty parking lot. Students learn to steer, brake, and park before they join real traffic. A security lab plays the same role for new learners.

Safe Targets Built for Learning

OWASP Juice Shop

Juice Shop is a modern online store that hides dozens of deliberate weaknesses. A score board tracks your progress through challenges that range from easy to expert. It suits complete beginners and experienced testers alike.

OWASP WebGoat

WebGoat works as a guided course. Each lesson explains a weakness, lets you explore it, and then shows how to fix it. The step-by-step format helps learners who prefer structure.

Lab Layout

+----------------------------------------------+
|              Your Own Computer               |
|                                              |
|   +-----------+          +----------------+  |
|   |  Browser  |  ←————→  |  Container     |  |
|   | (learner) |  local   |  Juice Shop    |  |
|   +-----------+  only    |  port 3000     |  |
|                          +----------------+  |
|                                              |
|          No internet target involved         |
+----------------------------------------------+

Setting Up the Lab

1. Install Docker Desktop from the official Docker website.
2. Open a terminal window.
3. Run the command below to download and start Juice Shop.
4. Open a browser and visit the local address shown below.

docker run --rm -p 3000:3000 bkimminich/juice-shop

http://localhost:3000

The shop appears in your browser. Press Ctrl+C in the terminal to stop it. The --rm flag removes the container afterward, which gives you a clean start every time.

Ground Rules for Ethical Practice

• Test only systems you own or systems where the owner gave you written permission.
• Keep the lab bound to your local machine. Avoid exposing it to the internet.
• Record what you learn in a notebook. Writing reinforces memory.
• Report any real weakness you find in a live service through the owner's official disclosure channel.

A Simple Practice Routine

Step	Action	Goal
1	Pick one challenge from the score board	Stay focused on a single idea
2	Read the matching OWASP topic	Understand the risk before you explore
3	Explore the weakness in the lab	See how the flaw behaves
4	Write down the fix a developer would apply	Think like a defender

Common Beginner Problems

• The container fails to start when another program already uses port 3000. Change the left number in the command, for example -p 3001:3000.
• Docker commands fail when the Docker engine is not running. Start Docker Desktop and retry.
• Slow downloads on the first run are normal. Docker caches the image for later runs.

Key Takeaways

• A local lab gives safe, legal practice.
• Juice Shop offers hands-on challenges, and WebGoat offers guided lessons.
• Docker starts and removes the lab in seconds.
• Ethical rules protect you and everyone else.