POST request in curl return all the source code of the page

Question

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST request with CURL but I don't know why it return always all the html source code of the page. The command I use is this:

curl -X POST --data 'username=\'%20or%20\'1=1&password=\''  http://myinternalip/mutillidae/index.php?page=login.php

Thanks for everyone who'll answer.

edit: i've tried to change the command to:

curl --data "username=\'%20or%201=1%20--" http://myinternalip/mutillidae/index.php?page=login.php

Answer 1

cURL will display exactly what the server provides as response, by default. In this case, the server is responding with a full HTML page. This doesn't mean that the SQL injection did not work, merely that the output even from the injected request was a full HTML page.

It is common for the response from an injection attack to appear in part of a page, perhaps a table which is drawn from a database in some way, or in a field loaded from a database query. Tools like SQLmap perform automatic comparison between "legitimate" requests and injected requests, looking for differences. It is possible to do the same manually, but the key in most injection attacks is the input string, rather than analysing the differences in the output.

Using a proxy such as Burp or ZAP allows you to edit post requests directly, and see the responses in a browser, bypassing any client side protection that may be in place. You can also extract specific parts of the page which are of interest using Burp's Intruder module's extract function - by injecting an uncommon string, it is possible to quickly zoom into the changed part of a page.