I'm having some fun with SQL injection attacks, and I'm currently attempting to bypass a login using SQLi.
I think I've figured out the SQL query just fine, however this module also implemented an extra password check, to verify that the password input matches the query.
The webpage is served using Python and FLASK
query = "SELECT * FROM users WHERE username='admin' UNION SELECT null, password, null FROM users where username='admin' -- AND password='[User Input]some_password'"
result = db.execute(query).fetchallI()
# Then checks if the password input is equal to query output
row = result[0]
if row["password"] == password: # Problematic password check
try:
session["user_id"] = int(row["id"])
session["username"] = row["username"]
return redirect(url_for("bank.index"))
I'll probably be able to figure out the rest of the SQLi if I'm able to bypass the password check.
Any ideas?
row["password"]
andpassword
, so what is the problem?