This document records a completed ethical hacking engagement conducted against an instance of OWASP Juice Shop. The engagement focus was practical exploration of SQL injection vulnerabilities within authentication and search functionality. The goal was to validate the presence of exploitable SQL injection, demonstrate account compromise paths, and extract sensitive data in a controlled environment.
The primary issue explored was improper input handling that allowed SQL injection affecting authentication and application search features. The objectives were to gain authenticated access to privileged accounts, discover additional user accounts through crafted queries, and enumerate database content through application functionality that accepted user input without sufficient validation.
Burp Suite for interception, payload crafting, and request replay
Docker image of OWASP Juice Shop used to provide an isolated, reproducible target environment.
Browser for manual interaction and verification of application behavior.
Local logging and note taking for chain of custody of findings.
Environment bring up
I launched the Juice Shop container on the local loopback and bound it to port 3000 with the following command.
docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop
First contact with the target
I navigated to the application at http://localhost:3000 using the Chromium instance attached to Burp. I performed a quick manual browse to identify visible input points.
Intercepting the login flow
I attempted a normal login with arbitrary credentials and captured the HTTP request in Burp proxy. The request was sent to Repeater to facilitate rapid payload testing.
Proving the presence of SQL injection
As an initial probe I injected a single quote character ' to observe application reaction. The single quote produced a database error revealing a SQLite backend. This confirmed that unsanitized input reached SQL parsing.
Authentication bypass to a privileged account
With confirmation that injection was possible I crafted a payload that forces the condition to evaluate as true and commented out the rest of the original clause using a block comment. This caused the authentication query to return a usable row and resulted in a login as the administrative user.
#Payload used:-
' or 1=1-- -
Discovery of additional account credentials in application content
While exploring the application I examined product reviews and found an email address used by another account.
Reuse of injection for account takeover
I attempted to authenticate as the discovered account by injecting into the username field and neutralizing the password check with a comment. The attack succeeded and I authenticated as that user.
#Discovered email used:-
bender@juice_sh.op'-- -
Attack surface expansion via the search feature
I located a search input and performed a search for the term banana to observe the request pattern. The search term appeared in the URL as a parameter which made it convenient to craft and replay requests from Burp.
Confirming injection in the search parameter
The search request was sent to Repeater and since it was a search function I suspected it would use a LIKE ‘%’) query so I tried injecting ') which produced an error that exposed how the application built the underlying query.
Crafting an escape and comment technique for the search query
Inspection showed the application used a LIKE clause wrapped in parentheses together with an AND deletedAt expression also wrapped in outer parentheses. To break out of that context I supplied a closing quote and two closing parentheses then added a block comment marker (URL encoded) to ignore the remainder of the original SQL which returns all the items list as JSON which confirmed complete control of the query result set.
'))-- -
