1

There is a form that I'm trying to crack it. It has two fields: username & password.

When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows this error. enter image description here

I get the same above error with other different inputs which tries to do SQL injection.

I think that form is vulnerable, Am I right ? How can I take advantage of it ?

The website is written in java as a backend language.

Improve this question
9
  • 1
    See another of my answer about how these injections could be used. Even if I'm unsure this place is for teaching exploits to new comers. Still, that process often works well to spot real injectable fields while relying on "I got an error page when trying this/that" won't.
    – Xenos
    Jul 25, 2018 at 14:10
  • 1
    apologies! I spotted another typo too - try ' OR 1=1; -- and see if that works, the -- comments out the rest of the SQL statement on the server side
    – Connor J
    Jul 25, 2018 at 14:48
  • I'm getting the same result ==> The connection was reset
    – Youssef13
    Jul 25, 2018 at 14:51
  • 1
    Is this a blackbox or whitebox situation. You know what the website was written in. Do you have access to the code?
    – JimmyJames
    Jul 25, 2018 at 15:27
  • 1
    @Youssef13 Then you've done about all you can without becoming a "malicious entity". Your best bet is to inform them of the suspected issue and only continue testing if they ask for more specifics and give you permissions to test (you don't want to accidentally be responsible for breaking their whole system).
    – Delioth
    Jul 25, 2018 at 16:27

0

Reset to default

Browse other questions tagged .