I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use sql injection to login. The login form is php script, the login page consists of 2 boxes: username and password. I tried adding the "'" sign at the end of password and i do get sql error, so it is probably injectable. Then I tried adding the "' OR 1=1" and "' OR 'a'=a'" at the end of the password, but with not much success. So now I need some help! Any ideas or suggestions will be helpful. The partial php login code is below:
// Sanitization is present
if (isset($_POST['user']))
{
$user = sanitizeString($_POST['user']);
$pass = sanitizeStringSQL1($_POST['pass']);
if ($user == "" || $pass == "")
$error = "Not all fields were entered<br>";
else
{
$result = queryMySQL("SELECT user,pass FROM members WHERE user='$user' AND pass='$pass'");
if ($result->num_rows == 0)
Call to undefined function sanitizeString()
what function are you using for sanitation? also you are missing some brackets in code afterif ($user == "" || $pass == "")
include sanitize.php;
however I can't see this in your code. If you are running linux you could run a command like thisgrep -rnw '/var/www' -e "sanitizeString"
in your terminal. This will search and display all files that contain "sanitizeString" text in them.