OWASP Juice Shop Web App Security Medium

OWASP Juice Shop — SQL Injection & Authentication Bypass

Detailed walkthrough of identifying and exploiting SQL injection vulnerabilities in login forms and search functions, leading to authentication bypass and unauthorized data access.

View on GitHub
Date

2025

Tools

3

Skills

3

Platform

OWASP Juice Shop

Overview

This writeup documents the discovery and exploitation of SQL injection vulnerabilities in OWASP Juice Shop’s authentication and search functionality.

Discovery

Manual testing of login form with single quotes revealed SQL error messages, indicating a vulnerable query structure.

Exploitation

  • Union-based SQL injection for data extraction
  • Authentication bypass via OR-based injection
  • Blind SQL injection for boolean-based extraction

Remediation

  • Use parameterized queries/prepared statements
  • Input validation and sanitization
  • Principle of least privilege for database accounts
  • Web Application Firewall (WAF) rules