I am using a vulnerable webpage for practicing OWASP attacks. In the current scenario I have a login page which I am trying to bypass. I have tried Burp suite and manual cheat sheets but couldn't bypass it even though it is vulnerable. I am attaching a screenshot of the login page.

How do I bypass the login?

Screenshot of login page.

closed as too broad by Steffen Ullrich, S.L. Barth, Anders, schroeder Oct 23 '17 at 11:34

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'd suggest learning more of SQL's syntax. For testing and toying around, cheat sheets are fine, but for learning they will make you dependant and unimaginative. Also, -- can remove the AND clause, which you definitely need to do here. – Alpha Oct 23 '17 at 2:59
  • on which web application you are practicing OWASP attack ? – elsadek Oct 23 '17 at 7:30
  • its some private server – zubair malik Oct 23 '17 at 7:48
  • 1
    @AsimLiaqat this looks like a pre-made vulnerable web app for practice. Elsadek was asking which one it was. – schroeder Oct 23 '17 at 8:39
  • it is not available online, it is made by one of my neighbor. – zubair malik Oct 23 '17 at 9:16

Check my answer here.

From the sql statement displayed in the image above "and" has precedence on "or", so if the password value doesn't exists in the database, the statement will returns nothing.

What I can suggest is injecting comment symbol in the username field like this:

 1' or 1 = 1  --
  • I tried 1' or 1 = 1 -- in username field but it didn't work – zubair malik Oct 23 '17 at 6:28

in the picture above, all the string got escaped. try encoding and double encoding

Alternative Expression of 'or 1 = 1'

OR 'SQLi' = 'SQL'+'i'
OR 'SQLi' > 'S'
or 20 > 1
OR 2 between 3 and 1
OR 'SQLi' = N'SQLi'
1 and 1 = 1
1 || 1 = 1
1 && 1 = 1

You can read more here OWASP sql injection testing sheet

also, practice in known application like WebGoat it has hints and the solution and explain it to you

Not the answer you're looking for? Browse other questions tagged or ask your own question.