SQL-Injection Stage II - Parameterized Query

Parameterized Query

Task:
Implement a fix to block SQL injection into the fields in question on the Login page. Repeat stage 1. Verify that the attack is no longer effective.


Problem
1.Password max size
2.Code is parametarized

Parameteried code would be like below

// prepare and bind$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);

// set parameters and execute$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();

$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";

Read more

SQL-Injection Stage I - String SQL injection

String SQL injection

Task:
Stage 1: Use String SQL Injection to bypass authentication. Use SQL injection to log in as the boss ('Neville') without using the correct password. Verify that Neville's profile can be viewed and that all functions are available (including Search, Create, and Delete)

Problems
1. I have the correct username bout I dont have the password.
2. I cant type more than 8 chars.

Solution

1.      I have to remove the input restriction for password so I can type whatever I need to type.

2.      Try SQL injection for password field.

How to remove input restriction?

Write click on the web browser and select ‘Inspect element(Q)’

 

Now we can see the  restriction. 

 

Doble click and remove the maxlength. Now we can type whatever we need. 

Now for the password try below command

X'OR'1'='1


 Its done. 

Read more