SQL Injection - login bypass [closed]

Question

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button.

Info on what I have and was able to find out:

• it is obviously vulnerable being a task to log in into a system, while having forgotten the password (classic form with to input fields: name: INPUT , password: INPUT )
• a hint is provided that my Login-ID for the tasks page is always being accepted, therefore only the password should be missing (form: name: "my ID", password: INPUT (?))
• the server runs/emulates MySQL, I found this due to errors I received while trying different inputs (e.g. "' OR 1=1"-Tricks, Union-Commands, Outcommenting, etc.):
• -> the structure is showed through MySQL syntax errors: SELECT name,password FROM login WHERE name='xyz' and password='xyz'
• -> Union-commands work due to e.g. column number errors
• Magic quotes are off (?) or I wouldn't be able to evoke SQL-commands, I guess
• Using GBK characters to bypass the manipulation through ' didn't work either, it seems like they are not being recognized
• No PHP code available
• Server returns 'task solved' when the login is successful

Question: What possibilities are left for me to try in order to finally log into the system successfully via sql injection?

Examples for inputs I tried:

name: myID [which is the ID that the hint suggests]

password: ' OR '1'='1

• server returns 'wrong answer' (login not successful), no mysql errors

name: myID' OR '1'='1' --

password: whatever

• same result

name: myID' AND NOT ('1'='2

password: foo') AND name='myID' LIMIT 1 #

• same result

Errors for example, when:

name: myID' OR 1=1

password: whatever

• server returns 'wrong answer' (login not successful), results in syntax error, because input is put into ' '

Answer 1

The authentication mechanism is implemented at the back-end and hence, there are two key services which many security professionals offer:

• White-box security assessments
• Black-box security assessments
• Gray-box security assessments
• Glass-box security assessments

I won't go into details of each of these service offerings as it's plainly business model of the company, organization and the way these key services are offered but for the technical understanding, one would need to consider that it depends on the type of services the test cases have to be prepared.

For an example, one might not have access to the source code, and this must not stop an attacker given the time & resources to attack a certain entry point i.e. in this case - a login entry. What you'd need to input depends on the source code but as a black-box security consultant, you would need to figure out trial and error basis of approach of what must be the back-end and accordingly prepare your attempts.

This approach is highly time-taking but could be automated by Burp Suite 'Intruder' and a list of possible inputs could be fed to the intruder in order to automate the task for you. Additional authentication bypass have been described here. As for the errors you've received, check all of these following items:

1. Make sure you aren't tapped into a back-end login honeypot.
2. Make sure when automating, the application hasn't employed rate limits.
3. If the above is true, make sure, you have adjusted timing at Intruder.
4. If howsoever, the rate limitation measures are Geo-location based, try pivots.
5. If system returns 'task solved', you'd require to grep the output from the results of the intruder and hence investigate that particular HTTP responses. Or, you can go through the 'response codes' and select 302 responses provided system doesn't throw 200 on every attempts (if login successful or not) or 500 at an error stage.

Sometimes, many testers over-estimate and never try simpler methods which is to see if admin/admin works or the list provided here works. It again would depend on trial and error approaches without having to know the exact source code but attempting to enumerate from all errors that you trigger and then construct your bypass. Try admin' or '1'='1'-- on both fields for an example along with others mentioned on the list.