Let's say my username is theusername and my password is thepassword. If use those credentials I login as expected. However if I add whatever at the END of the username, say theusername.random.stuff.at.the.end, I still get to login to my account. Doesn't work if I do that at the beginning.

Also, if I put an odd number of single quotes at the end whether I add the other random stuff or not (Example: theusername' or theusername.random'''), it won't let me in. Won't match any username in the DB. It will let me in if the number of single quotes is even though.

And lastly, if the username ends with a single quote and double dash (Example: theusername'--) it will take it as a valid username (It matches the username in the DB) but will say the password is wrong even if I submit the actual password.

I know when a submitted username matches an username in the DB because the page shows a different error for when the username is bad and when the password is bad.

My question is... Knowing they are using T-SQL, what query string are they possibly using?

Thanks in advance.

  • Does whatever you add at the end of the valid username have to begin with a dot? – Mike Poole Oct 15 '19 at 16:24
  • It is also worth noting that some companies allow users to be a bit fluffy with their usernames and passwords e.g. Facebook announced that they allow users to have spelling mistakes at the start and end of their username or password. – Mike Poole Oct 16 '19 at 15:54
  • @MikePoole It's not a company. It's my schools website.They have a few other bad practices sprinkled around the website. They trust the client with sensible information. I guess they don't expect anyone to be that curious. – Pedro Rodriguez Oct 16 '19 at 17:20
  • Hi Pedro. I am not surprised to hear that schools do a similar thing. It is worth noting that such fuzziness does not necessarily make the security much less secure. It is also worth noting that your school would not like you hacking them unless they have given you permission to do so. Stay curious, but stay legal. – Mike Poole Oct 16 '19 at 17:41
  • @MikePoole I know it's been months but only now I'm seeing your first question. No, whatever I add at the end of the valid username doesn't have to begin with a dot. – Pedro Rodriguez Feb 18 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.