Secure Testing: SQL Injection

👋 SureshKumar

Can I ask what payload(s) you're trying in the username and/or password fields of the application? I've just given it a go myself, and the lab is working as we would expect, but I'm happy to try and troubleshoot what you've tried so far :) 

Hi Robert_JOHN I wanted to follow up and check in to see if you were still working on this. Our team would be happy to assist you. As mentioned earlier, could you share which payload(s) you’re using in the username and/or password fields of the application? Looking forward to hearing from you. 

The only hint to give: Re-read the briefing section. The lab works fine.

I figured out what I was doing wrong.. You don't type the whole payload on the username, you use the suggestions.

I'm going to make this as easy as possible without actually giving you the answer. The reason being is because once people see the answer they will be able to better understand the problem in the future.

A variation of this will be used for the final 2 answers in the email field. This is the exact query that you have to edit in the lab.

SELECT * FROM users WHERE username='' or username='admin' --' and password='testing123'

All of the ' in this query are single quotes except 1. The 2nd ' after username in the initial query is a backtick the character that breaks the query. They try to help you understand this with the question prior with how they only needed the ` (backtick) to get the same error. I didn't know which one was the backtick originally. Once I knew it becomes more obvious that they are pointing you towards that character. The second piece of information that will wrap this up for you is the statement where it says sometimes it's useful to use the URL encoded equivalent. This information will get you the second to last question.

Adjust the second to last query with the specified username instead and you will have the final answer.

Hope that helps!

Hi SureshKumar, thanks for starting a discussion about this. I'll share this with the lab author to check and update you. 

In the meantime, I can see that tc234e has recently completed the lab, along with others. I wonder if they can offer any hints or speak of their experience with the lab?

I also cannot get this to work, Using the email field and using the example injections at the bottom of the lab