Hands on Threat Modeling Juice Shop (Architecture)

Get together to create models (diagrams) of Juice Shop to help us find problems with it, learn threat modelling, and deliver examples. This is all about answering the question of what Juice Shop is and building models of it.


Dinis proposed a set of evening sessions to create threat model artefacts & examples for the Juice Shop vulnerable app.


  • Create models/diagrams that show various aspects of Juice Shop
  • Apply various techniques to answer the question “what are we working on?”
  • Through the course of the day, we will look at various ways to slice and model Juice Shop, with a goal of being aligned with other sessions, so you can pop in for a part of the day, and learn a bit of threat modeling.


Synopsis and Takeaways

The Session was very productive. A live copy of Juice shop was demonstrated to the room and shared via Google Hangouts, from which valuable input was given. Insight to how Juice shop functions was exhibited from code on the local server. During this demo, as a group, a model was created of the Juice Shop application in real-time. Architecture diagrams from the session were compared to the current official architecture that contrasted differences of opinion. These diagrams spanned information from the browser, server, and file system. Injection processes that function with Juice shop were discussed.

The group moved from the question of “what is Juice Shop?” to “what can go wrong with Juice Shop?”. It was decided that the first session would be a bigger group session to bring everyone up to speed, with the later sessions being smaller dedicated teams.


  • Demonstrated that professionals can work from different points of view on this core topic
  • Decided that a threat model diagram can be created on Juice Shop in great detail
  • A useful architecture mapping diagram was created.


The target audience for this Working Session is:

  • Participants in the threat modeling track
  • Participants interested in Juice Shop
  • Those who want to learn to threat model

Working materials


Related Working Session(s)

Back to list of all Working Sessions and Tracks

Edit this page here