Apparently there are some vulnerabilities in Juiceshop that won't work if you use install it with docker and some other methods. XXE Data Access is one that doesn't work with the docker installation. I install Juiceshop form sources with nodejs so every vulnerability is supported. I also use fish shell and there is a little extra setup for fish.
Instead of installing nodejs with apt, it's better to use nvm. With nvm you can install multiple versions of node and switch back and forth between versions. Check the github for the latest version.
github.com/nvm-sh/nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.2/install.sh | bash
After it's installed you need to make sure it adds these lines to .zshrc or .bashrc, whichever one you are using.
"Running either of the above commands downloads a script and runs it. The script clones the nvm repository to ~/.nvm, and attempts to add the source lines from the snippet below to the correct profile file (~/.bash_profile, ~/.zshrc, ~/.profile, or ~/.bashrc)."
export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm
If you are using fish (github.com/fish-shell/fish-shell), you'll need to install a few more things and create a config file.
Install fisher: github.com/jorgebucaran/fisher
curl -sL https://raw.githubusercontent.com/jorgebucaran/fisher/main/functions/fisher.fish | source && fisher install jorgebucaran/fisher
Install bass: github.com/edc/bass
fisher install edc/bass
Create nvm.fish config file:
~/.config/fish/functions/nvm.fish
Add a function to the config file:
function nvm
bass source ~/.nvm/nvm.sh --no-use ';' nvm $argv
end
Now you should be able to start using nvm to install node.
List remote versions:
nvm ls-remote
Install a specific version number (at the time I posted this):
nvm install 18.11.0
It should automatically set the version you're using to the one you just installed, but you can switch to the version you installed. You'll need to do this when you reboot Kali:
nvm use 18.11.0
List local versions
nvm ls
See the nvm github page for more commands.
nodejs 18.11.0 should be ready to use now along with npm.
Now it's time to install Juiceshop.
github.com/juice-shop/juice-shop#from-sources
1. Install node.js (Done. Using the nvm version that was just installed)
2. Run git clone https://github.com/juice-shop/juice-shop.git --depth 1 (or clone your own fork of the repository)
A. I created a directory called Scripts and cloned it in there.
3. Go into the cloned folder with cd juice-shop
4. Run npm install (only has to be done before first start or when you change the source code)
5. Run npm start
6. Browse to http://localhost:3000
Juiceshop should be up and running. Now you can perform an attack on any vulnerability and it will work.