OWASP Juice Shop で学ぶ Web 脆弱性 ― WSL 新CLI「wslc」で建てて、Defender / GitHub で裏取りするThis article demonstrates how to quickly spin up an OWASP Juice Shop…

OWASP Juice Shop remains one of the most widely used training grounds for learning web application security, and pairing it with modern tooling on Windows makes hands-on practice more accessible than ever. This walkthrough centers on spinning up a Juice Shop instance through a new Windows Subsystem for Linux command-line tool referred to as "wslc," then using Microsoft Defender and GitHub as reference points to verify and reinforce what each vulnerability actually does. For anyone building practical security skills, the value lies in combining a deliberately broken target with the same platform tooling many developers already have installed.

Juice Shop, maintained as an OWASP flagship project, is an intentionally insecure Node.js and Angular application that maps to the OWASP Top 10 and a broad catalog of additional weaknesses. It is designed for legitimate learning, capture-the-flag exercises, and security awareness training, and it ships with a built-in scoreboard that tracks solved challenges. Because it is safe to attack only in an isolated environment, running it inside WSL is a sensible choice: the container-like separation keeps experimental exploitation away from the host system while still allowing quick iteration.

The "wslc" tool appears to be positioned as a more streamlined command-line front end for managing WSL distributions and workloads, complementing the long-standing "wsl" command that ships with Windows. Traditionally, users provision a distribution, install Node.js or Docker, and then launch Juice Shop either through npm or a container image. A dedicated CLI that abstracts some of that setup would lower the barrier for learners who are less comfortable with manual environment configuration. Readers should confirm the exact command syntax against current documentation, since tooling in the WSL ecosystem evolves quickly and naming or flags may differ between releases.

Once Juice Shop is running, the article's core idea is to treat exploitation as only half the exercise. Reproducing an attack such as SQL injection on the login form, cross-site scripting in a search field, or broken access control on hidden endpoints teaches the mechanics, but understanding why the payload works is where lasting knowledge forms. This is where the "cross-checking" workflow comes in. Microsoft Defender, depending on which edition is in use, can surface suspicious process behavior, flagged network activity, or script execution, giving a defender's-eye view of what an attack looks like from the monitoring side. Observing whether Defender reacts, and how, helps connect the offensive action to the telemetry a real security operations team would see.

GitHub serves as the second verification layer. The Juice Shop source code is public, so learners can trace a specific challenge back to the exact route handler or database query that makes it exploitable. Reading the code that intentionally omits input validation or mishandles authorization turns an abstract vulnerability class into a concrete, line-level lesson. GitHub also hosts extensive companion material, including the official "Pwning OWASP Juice Shop" guide, issue discussions, and community write-ups, which can confirm whether an approach matches the intended solution or represents an alternative path.

This combination reflects a broader industry trend toward blending development and security tooling on a single workstation. WSL has become a common bridge for developers who want Linux workflows without leaving Windows, and Microsoft has steadily expanded Defender from a consumer antivirus into a family of products spanning endpoint, cloud, and code security. Adjacent tools worth knowing include Docker Desktop, which many people still use to run Juice Shop; interception proxies such as OWASP ZAP or Burp Suite for inspecting and modifying traffic; and GitHub's own code scanning and Dependabot features, which illustrate how vulnerability detection is increasingly automated within the software supply chain.

A few prerequisites make the exercise smoother. Familiarity with basic HTTP, browser developer tools, and the OWASP Top 10 categories provides the vocabulary needed to interpret results. It is also important to stress the ethical boundary: Juice Shop is explicitly built for practice against your own instance, and the same techniques applied to systems without authorization are illegal. Used responsibly, this workflow offers a repeatable way to learn attacking, defending, and code review together, which is likely more effective than studying any one of those disciplines in isolation.