In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs the data to 'connect.php. We don't have the source code available. How can I proceed to audit for SQL Injection vulnerabilities? What should my starting point be? I can use sqlmap, but I couldn't make it work with the web form POST-ing form details.


Did you google this? Here is your answer http://hackertarget.com/sqlmap-post-request-injection/

  • Yes, I did before even posting this. – Holmes.Sherlock Feb 2 '15 at 10:23
  • Ok. Does this answer your question or does login not use post method? – Tim Jonas Feb 2 '15 at 10:31
  • I executed sqlmap against thewebopsclub.org/crypto, but with no luck. – Holmes.Sherlock Feb 2 '15 at 11:33
  • I preformed a legal passive scan on this website. I found multiple vulnerability's on this website including sql injection I will post back soon when I put all this together so you can understand it. – Tim Jonas Feb 2 '15 at 12:55
  • Hi Tim, This is absolutely legal. Please let me how to approach methodically. I want to learn the art. – Holmes.Sherlock Feb 2 '15 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.