OWASP Juice Shop

This article will show you how to scan the OWASP Juice Shop app with Qwiet AI by Harness.

OWASP Juice Shop is a JavaScript/TypeScript app, and analyzing it is similar to analyzing most other JavaScript/TypeScript apps.

Prerequisites

You must have Qwiet AI by Harness installed and authenticated.

You must have a copy of the OWASP Juice Shop; you can obtain the latest OWASP Juice Shop app via GitHub. You can clone the repo to your workstation and run Qwiet AI by Harness locally, or you can fork the repo and create a GitHub Action that calls Qwiet AI by Harness.

Analyzing the application

To begin the code analysis, run:

sl analyze --app juice-shop-training --jssrc .

Alternatively, you can use something like GitHub Actions to automate the process

See sl analyze for more information about sl analyze and its options.

Please note that the OWASP Juice Shop app analysis can take 20-30 minutes (or more) to complete.