Lab: SQL injection vulnerability allowing login bypass

Lab: SQL injection vulnerability allowing login bypass

Solution:

administrator'-- -

This lab contains an SQL injection vulnerability in the login function.

To solve the lab, perform an SQL injection attack that logs in to the application as the administrator user.

Steps:

1. Visit: https://YOUR-SESSION.web-security-academy.net/login

2. try to inject test' and test' in the user and password.

3. 
4. so try to inject in username with administrator and ignore the password field

5. 
6. 

What happened in the backend:

SELECT * FROM users WHERE username = 'administrator'--' AND password = 'P@$$w0rd'