Lab: Bypassing Login authentication with SQL Injection

Login authentication is often plagued with SQL Injection vulnerabilities and thus sanitisation of input from a webpage is all the more important. Such attacks can often lead to compromise of privileged accounts.

I load the lab website and navigate to the login page and input the username 'administrator' with a random password:

And as you can see I had intercepted the request and modified the value for username to be `'administrator'--` so it ignores the password check condition and directs me to the account of the site admin.

 

And just like that I have now access to the admin account.