I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST request with CURL but I don't know why it return always all the html source code of the page. The command I use is this:

curl -X POST --data 'username=\'%20or%20\'1=1&password=\''  http://myinternalip/mutillidae/index.php?page=login.php

Thanks for everyone who'll answer.

edit: i've tried to change the command to:

curl --data "username=\'%20or%201=1%20--" http://myinternalip/mutillidae/index.php?page=login.php
  • use sqlmap to exploit this.
    – rook
    Commented Sep 6, 2014 at 18:09
  • The purpose is not exploitation,is learning. If i use an automated tool how i can learn something?
    – Azazel
    Commented Sep 6, 2014 at 18:29
  • You can learn a lot of sqlmap, its verbose settings shows you what it is doing. Also if you are serious about learning how to hack, download BURP, or OWASP's ZAP.
    – rook
    Commented Sep 6, 2014 at 18:51
  • Yes,sqlmap tell you what is doing but this is not different than read a paper. Only doing i can learn better. Anyway, thanks for the ZAP hint : )
    – Azazel
    Commented Sep 6, 2014 at 19:09

1 Answer 1


cURL will display exactly what the server provides as response, by default. In this case, the server is responding with a full HTML page. This doesn't mean that the SQL injection did not work, merely that the output even from the injected request was a full HTML page.

It is common for the response from an injection attack to appear in part of a page, perhaps a table which is drawn from a database in some way, or in a field loaded from a database query. Tools like SQLmap perform automatic comparison between "legitimate" requests and injected requests, looking for differences. It is possible to do the same manually, but the key in most injection attacks is the input string, rather than analysing the differences in the output.

Using a proxy such as Burp or ZAP allows you to edit post requests directly, and see the responses in a browser, bypassing any client side protection that may be in place. You can also extract specific parts of the page which are of interest using Burp's Intruder module's extract function - by injecting an uncommon string, it is possible to quickly zoom into the changed part of a page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .