HACKING JULY DAY 4: JUICE-SHOP INJECTION(Part IV)

Welcome back.

This is the final Juice-shop injection challenge for the Hacking July, 2026. Check the preceding articles at Hacking July Day 1, Hacking July Day 2 and Hacking July Day 3.

From the previous injection challenges, we discovered that Juice-shop uses SQLite database. We also discovered that querying the sql column of sqlite_master displays the tables and their ‘structure’ — columns.

Alternatively, you can run the command below on your terminal(if you are using Kali Linux).

sqlmap -u "http://127.0.0.1:3000/rest/products/search?q=test" --batch --tables --dump --dbms=sqlite --level=5

The result will be similar

Today’s Challenge

Challenge

User Credentials - 4 stars

Tools used:

Burp suite
The frontend of juice-shop web application

User Credentials

In this challenge, I used the information above to exploit the vulnerability.

The challenge here is to find a way to retrieve user credentials via SQL injection

I used an API endpoint that queries the database and a curated SQL injection payload to retrieve data from the Users table in the database.

/* The URL */
/rest/products/search?q=...../* the payload */

From the previous challenges (and from the Burp suite screenshot above) we know that we need to retrieve nine columns from the Users table since the Products table (which the endpoint is meant for) has nine columns.

The payload is a UNION-based SQL injection payload.

I captured a request with the endpoint and sent it to repeater. Because of this, we will input our payload with URI-encoded characters — especially for ‘space’ — so that our payload will be one, not separated by anything.

The payload must have nine columns — as mentioned above — and the correct table.

#The payload(with URI-encoded characters)
apple'))UNION%20SELECT%20id,username,email,password,role,6,7,8,9%20FROM%20Users--

The request looks more like

The result will look more like

The challenge is solved

In-case of any question, feel free to drop it in the responses.

I appreciate your time, feel free to check the recon guide here