PostSwigger SQL Injection Lab Walkthrough

Introduction:

SQL Injection (SQLI) is a critical vulnerability that allows attackers to manipulate database queries. In this blog, we will explore an SQL injection attack on a product filtering system where the WHERE clause is vulnerable.

Understanding the Vulnerability

A typical login form verifies user credentials using a SQL query like this:

SELECT * FROM users WHERE username = ‘admin’ AND password = ‘password’ ;

If the query returns a result, access is granted. Otherwise, access is denied.

Step-by-Step Solution

step 1: Accessing the Lab

1. Go to PortSwigger Web Security Academy.

2. Open the “SQL Injection vulnerability allowing login bypass” lab.

3. Click “Access the Lab” to launch the target application.

step 2: Testing for SQL Injection

1. Enter a random username and password.

2. If authentication fails, the app is checking credentials via SQL queries.

3. Test for SQL Injection using this payload in the username field:

admin’ --

step 3: Executing the Exploit

1. Use the following payload in the username field:

   admin’ --

2. Leave the password empty and click Login.

step 4: Understanding the Exploit

This modifies the SQL query:

SELECT * FROM users WHERE username = ‘admin’ -- ‘ AND password = ‘ ‘ ;

Since -- comments out the password check, the attacker is logged in as admin.

step 5: Alternative Exploits

1. Using OR to always return true:

   ‘ OR ‘1’=’1’ --

2. Using # as a comment:

   admin’ #

Before login :

It shows invalid username or password:

Replace the username with administrator’-- :

Now It’s login with the payload

Mitigations

To protect applications, developers should:

1. Use Prepared Statements

2. Implement Input Validation

3. Use Web Application Firewalls(WAF).

4. Limit Database Permissions.

Conclusion

This lab highlights the dangers of poorly secured authentication systems and the importance of secure coding practices.