OWASP Juice Shop – Autostart on Kali Linux VM

Overview

This document describes how the OWASP Juice Shop is automatically started when a Kali Linux virtual machine boots. The setup uses a Bash script together with a systemd service to ensure the application starts reliably without manual interaction.

This configuration is intended for educational and lab environments only.

Prerequisites

Kali Linux VM
OWASP Juice Shop installed locally
Node.js and npm installed via NVM
User account: kali
Juice Shop directory:
```
/home/kali/juice-shop
```

Step 1: Create the Startup Script

Create a Bash script that prepares the environment and starts the Juice Shop.

File:

/home/kali/start-juice-shop.sh

Content:

#!/bin/bash

# Set NVM environment (required for systemd)
export NVM_DIR="/home/kali/.config/nvm"
export PATH="$NVM_DIR/versions/node/v24.12.0/bin:$PATH"

# Change to Juice Shop directory
cd /home/kali/juice-shop || exit 1

# Start OWASP Juice Shop
npm start

Make the script executable:

chmod +x /home/kali/start-juice-shop.sh

Step 2: Create a systemd Service

To ensure the script runs automatically during system startup, a systemd service is used.

File:

/etc/systemd/system/juice-shop.service

Content:

[Unit]
Description=OWASP Juice Shop
After=network.target

[Service]
Type=simple
User=kali
WorkingDirectory=/home/kali/juice-shop
ExecStart=/home/kali/start-juice-shop.sh
Restart=always
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

Step 3: Enable the Service

Reload systemd, enable the service, and start it manually for testing:

sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable juice-shop
sudo systemctl start juice-shop

Check the service status:

systemctl status juice-shop

The service should show:

Active: active (running)

Step 4: Verify Autostart

Reboot the VM:

sudo reboot

After login, open a browser and navigate to:

http://127.0.0.1:3000

The OWASP Juice Shop start page should be available immediately without any manual commands.

Notes

systemd does not load user shell profiles, which is why the NVM path must be set explicitly.
This setup is suitable for controlled lab environments and security training.
In production environments, container-based deployments are recommended instead.

Disclaimer

This setup and documentation are provided for educational purposes only.