# PostSwigger SQL Injection Lab Walkthrough

**Introduction:**

SQL Injection (SQLI) is a critical vulnerability that allows attackers to manipulate database queries. In this blog, we will explore an SQL injection attack on a product filtering system where the WHERE clause is vulnerable.

**Understanding the Vulnerability**

A typical login form verifies user credentials using a SQL query like this:

<mark>SELECT * FROM users WHERE username = ‘admin’ AND password = ‘password’ ;</mark>

If the query returns a result, access is granted. Otherwise, access is denied.

**Step-by-Step Solution**

**step 1: Accessing the Lab**

1. Go to [PortSwigger Web Security Academy](https://portswigger.net/web-security/sql-injection/lab-login-bypass).
    
2. Open the “**SQL Injection vulnerability allowing login bypass**” lab.
    
3. Click “**Access the Lab**” to launch the target application.
    

**step 2: Testing for SQL Injection**

1. Enter a random username and password.
    
2. If authentication fails, the app is checking credentials via SQL queries.
    
3. Test for SQL Injection using this payload in the **username field**:
    

[admin’ --](https://github.com/Likhitha-152/SQL-Injection-payloads)

**step 3: Executing the Exploit**

1. Use the following **payload** in the **username** field:
    
    **admin’ --**
    
2. Leave the password **empty** and click **Login**.
    

**step 4: Understanding the Exploit**

This modifies the SQL query:

<mark>SELECT * FROM users WHERE username = ‘admin’ -- ‘ AND password = ‘ ‘ ;</mark>

Since -- comments out the password check, the attacker is logged in as **admin**.

**step 5: Alternative Exploits**

1. Using OR to always return true:
    
    **‘ OR ‘1’=’1’ --**
    
2. Using # as a comment:
    
    **admin’ #**
    

Before login :

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741419667655/f5c8a413-bd09-46fe-82a4-916d75c9088f.png align="center")

It shows invalid username or password:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741419727937/14f6804b-4a6e-43ca-93db-ac7f64ed2f39.png align="center")

Replace the username with **administrator’-- :**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741419823742/e314d57b-1c44-45bc-80f8-2925a377fde6.png align="center")

Now It’s login with the payload

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741419937474/2cdc419d-a900-47ce-bc32-1c9a5e75be07.png align="center")

**Mitigations**

To protect applications, developers should:

1. Use Prepared Statements
    
2. Implement Input Validation
    
3. Use Web Application Firewalls(WAF).
    
4. Limit Database Permissions.
    

**Conclusion**

This lab highlights the dangers of **poorly secured authentication systems** and the importance of **secure coding practices**.