PortSwigger SQL Injection Lab: Login Bypass — Write-up

We will solve an SQL injection lab from the Portswigger platform,this lab focuses on login bypass.

To begin, open the lab and navigate to the login page. To determine whether the application is vulnerable, inject a single quote character (') into the input field — whether for the username or password — and check for errors or other anomalies.

• Some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and look for systematic differences in the application responses.
• Boolean conditions such as OR 1=1 and OR 1=2, and look for differences in the application's responses.

We observed an anomaly in the response, confirming that the site was vulnerable. We then performed an SQL injection by entering the payload: administrator ' OR 1=1 —

Using this payload, we were able to discover the administrator's password and extract the data stored on the server.

This problem was easy and fun; we didn't face any difficulty solving it.