Lab: SQL injection vulnerability allowing login bypass | Web Security Academy

This lab contains a SQL injection vulnerability in the login function. To solve the lab, perform a SQL injection attack…

portswigger.net

ในการแก้ไขห้องปฏิบัติการนี้ ให้ดำเนินการโจมตี SQL Injection ที่ช่วยให้สามารถเข้าสู่ระบบของแอปพลิเคชันในฐานะผู้ดูแลระบบ

User ที่เราโจมตี คือadministrator

None

After typing the username administrator, we added a quote ' and double hyphens — — as below

administrator'--

Here, an attacker can log in as any user without a password simply by using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query

SELECT * FROM users WHERE username = 'administrator'--' AND password =''

This query returns the user whose username administrator and successfully logs the attacker in as that user

None