I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST request with CURL but I don't know why it return always all the html source code of the page. The command I use is this:
curl -X POST --data 'username=\'%20or%20\'1=1&password=\'' http://myinternalip/mutillidae/index.php?page=login.php
Thanks for everyone who'll answer.
edit: i've tried to change the command to:
curl --data "username=\'%20or%201=1%20--" http://myinternalip/mutillidae/index.php?page=login.php