Juice Shop Write-up: Two Factor Authentication Challenge

The goal of this challenge is to bypass the 2FA mechanism by retrieving a user’s TOTP secret from the database and using it to generate valid one-time passwords. The challenge demonstrates how exposing sensitive authentication data completely undermines multi-factor authentication.

Challenge Overview

Title: Two Factor Authentication Category: Broken Authentication Difficulty: ⭐⭐⭐⭐⭐ (5/6)

Tools Used

Web browser Burp Suite - for intercepting and modifying HTTP requests SQLite payloads guide

Methodology

Analyzing the application shows that sensitive user data, including TOTP secrets, is stored in the database and can be accessed through SQL Injection. Extracting this secret allows generation of valid one-time passwords, effectively bypassing 2FA. Steps to exploit the vulnerability:

• Perform SQL Injection to dump user data from the database (as demonstrated in the **User Credentials** challenge):

/rest/products/search?q=apple%'))+union+SELECT+group_concat(id),group_concat(username),group_concat(email),group_concat(password),null,null,null,null,null+FROM+Users--

• Extend the query to extract the totpSecret column:

apple%'))+union+SELECT+group_concat(id),group_concat(username),group_concat(email),group_concat(password),group_concat(totpSecret),null,null,null,null+FROM+Users--

• Identify the TOTP secret associated with the user wurstbrot.

• Copy the extracted secret and import it into a TOTP authenticator application (e.g., Google Authenticator).

• After adding the TOTP Secret, observe that the authenticator generates valid one-time passwords for the account.

• Log in to the wurstbrot account using SQL Injection to bypass password verification.

• When prompted for 2FA, enter the generated 6-digit OTP.

• Observe that authentication is successful and access to the account is granted.

Solution Explained

The solution relies on extracting the TOTP secret from the database using SQL Injection. Since the application stores this secret in plaintext and exposes it through a vulnerable endpoint, it becomes possible to replicate the 2FA mechanism externally.

Once the secret is obtained, any standard authenticator can generate valid one-time passwords, completely bypassing the intended protection of two-factor authentication. This demonstrates that 2FA is ineffective if its underlying secrets are not properly secured.

Remediation

• Prevent SQL Injection by using parameterized queries or ORMs such as Prisma or Drizzle to safely handle database interactions.
• Never expose or store TOTP secrets in plaintext. Encrypt them at rest using strong encryption mechanisms.
• Restrict database access and ensure sensitive fields are never returned in application responses.
• Implement strict access controls and input validation on all endpoints.
• Use secure key management practices to protect authentication secrets.
• Monitor and log suspicious authentication activity to detect potential abuse.
• Apply defense-in-depth by combining 2FA with additional security controls such as device verification or risk-based authentication.