In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs the data to 'connect.php. We don't have the source code available. How can I proceed to audit for SQL Injection vulnerabilities? What should my starting point be? I can use sqlmap, but I couldn't make it work with the web form POST-ing form details.

1 Answer 1


Did you google this? Here is your answer http://hackertarget.com/sqlmap-post-request-injection/

  • Yes, I did before even posting this.
    – sherlock
    Feb 2, 2015 at 10:23
  • Ok. Does this answer your question or does login not use post method?
    – Tim Jonas
    Feb 2, 2015 at 10:31
  • I executed sqlmap against thewebopsclub.org/crypto, but with no luck.
    – sherlock
    Feb 2, 2015 at 11:33
  • I preformed a legal passive scan on this website. I found multiple vulnerability's on this website including sql injection I will post back soon when I put all this together so you can understand it.
    – Tim Jonas
    Feb 2, 2015 at 12:55
  • Hi Tim, This is absolutely legal. Please let me how to approach methodically. I want to learn the art.
    – sherlock
    Feb 2, 2015 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .