New answers tagged injection
It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it. So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.
The answer is "no" it can't be done, at least not with a directory traversal attack by itself. There are several issues here. 1) Directory traversal attacks should be blocked by the Web server to begin with. Of course, since you set up a lab environment, you have control and may have defeated the protection against it. 2) Directory traversal attacks like ...
Top 50 recent answers are included