A recent employment test prompted me to perform an SQL injection to gain access into their website.
Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable to SQL Injection attacks, but every time I tried to pass any payloads into the E-mail/username field
(eg: admin' or '1'='1)
it kept saying "Invalid email format".
Anyone know how to get around this? (I should mention the Company only allowed me to use manual methods and Burp, no other tools were allowed)
**Note: The website wasn't their main website, it was a web app created for the sole purpose of exploiting vulnerabilities. **
UPDATE: I'm still able to access the domain ( I thought they had taken it down after the test was over), but I won't be able to share the domain address because I'm unsure if it'll even be legal to publicize it. So, I'll add some screenshots of the issues. this is the error and adding @something.com gives me the same output:
This is the intercepted request:
This is the error that's returned for certain inputs:
and this is the SQL injection vulnerability that Burp identified: