1

There is a form that I'm trying to crack it. It has two fields: username & password.

When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows this error. enter image description here

I get the same above error with other different inputs which tries to do SQL injection.

I think that form is vulnerable, Am I right ? How can I take advantage of it ?

The website is written in java as a backend language.

closed as off-topic by schroeder Jul 25 '18 at 15:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    See another of my answer about how these injections could be used. Even if I'm unsure this place is for teaching exploits to new comers. Still, that process often works well to spot real injectable fields while relying on "I got an error page when trying this/that" won't. – Xenos Jul 25 '18 at 14:10
  • 1
    apologies! I spotted another typo too - try ' OR 1=1; -- and see if that works, the -- comments out the rest of the SQL statement on the server side – Connor J Jul 25 '18 at 14:48
  • I'm getting the same result ==> The connection was reset – Youssef13 Jul 25 '18 at 14:51
  • 1
    Is this a blackbox or whitebox situation. You know what the website was written in. Do you have access to the code? – JimmyJames Jul 25 '18 at 15:27
  • 1
    @Youssef13 Then you've done about all you can without becoming a "malicious entity". Your best bet is to inform them of the suspected issue and only continue testing if they ask for more specifics and give you permissions to test (you don't want to accidentally be responsible for breaking their whole system). – Delioth Jul 25 '18 at 16:27

Browse other questions tagged or ask your own question.