Web benchmark

Web app pentest benchmark: OWASP Juice Shop

Web app pentest benchmark on OWASP Juice Shop: an autonomous AI pentest that escalated from 14 to 57 findings across six black-box campaigns on a local model, with proof of exploitation for every finding. Real results, published and reproducible.

Darkmoon, the open source autonomous AI penetration testing tool, found 57 vulnerabilities on a black-box OWASP Juice Shop in the final campaign, each with a working proof, in 28.5 minutes on a local model.

Result

The headline run

Lab / targetFindingsSeverityExploitedModelEvidence
OWASP Juice Shopcamp_20260426_3d2f578C24H21M4Lproof per findingLocal (Ollama / llama.cpp)Write-up Report
Escalation

Six campaigns on the same target

CampaignDateDurationFindingsRisk
camp_20260322_e7f82026-03-2212 min14MEDIUM
camp_20260329_a3b42026-03-2916.33 min28HIGH
camp_20260405_c9d02026-04-0522 min38HIGH
camp_20260412_e5f62026-04-1225.67 min44CRITICAL
camp_20260419_a1b22026-04-1932 min49CRITICAL
camp_20260426_3d2f2026-04-2628.5 min57CRITICAL

Full run file: juice-shop-2026-04-26.md in the Darkmoon-Benchmarks repository.

From finding to fix on the same target (Pro)

The offensive run above is the open source CLI. On the same OWASP Juice Shop, the paid Pro remediation engine turned 57 findings into 57 pull requests and demonstrated 42 end to end, with every excluded case disclosed.

Read the remediation benchmark (Pro): 42 of 57 fix PRs

Keep exploring the benchmarks

FAQ

Web benchmark questions

What is the OWASP Juice Shop autonomous pentest benchmark?

It is a web app pentest benchmark where Darkmoon, run autonomously and black-box against a default OWASP Juice Shop image, escalated from 14 findings to 57 across six weekly campaigns on the same target, with proof of exploitation per finding. The final run took 28.5 minutes on a local model.

How many vulnerabilities did the Juice Shop run find?

The final campaign found 57 findings on OWASP Juice Shop, split 8 critical, 24 high, 21 medium and 4 low, each proven individually. Earlier campaigns on the same target found 14, 28, 38, 44 and 49, so the run improves as it learns the target.

Was the web benchmark run on a local model?

Yes. The OWASP Juice Shop run used a local model (Ollama or llama.cpp) through the open source Darkmoon CLI, black-box. The web dashboard and the remediation-to-PR loop are paid Pro capabilities.

Can Darkmoon also fix the findings it proves?

On the same OWASP Juice Shop target, the paid Pro remediation engine turned 57 findings into 57 pull requests and demonstrated 42 of them end to end (fix, compile, live exploit-retest, human-reviewed PR), with the excluded cases disclosed in full. Nothing is auto-merged.

Darkmoon's own benchmark on the public OWASP Juice Shop lab. The offensive run is produced by the open source Darkmoon CLI; the web dashboard and the remediation-to-PR loop are paid Pro. The run file and the per-campaign escalation are published in the Darkmoon-Benchmarks repository.

Run the Juice Shop benchmark yourself

Open source, self hosted and local first. Spin up OWASP Juice Shop, point Darkmoon at it, and read every proof. A star helps other teams find it.

Star Darkmoon on GitHubRemediation benchmark (Pro)