Authentication Bypass
When a login form is present, an authentication bypass may occur due to improper sanitization of user input before processing. If a lockdown policy is not enforced for login, you can use the payload below to test its efficacy with the Burp Suite Intruder tool.
One of the example:
offsec' OR 1=1 -- //By forcing the closing quote on the username value and adding the statement `OR 1=1`, followed by a comment separator (two consecutive dashes followed by at least one whitespace character), we can prematurely terminate the SQL statement. The inclusion of two forward slashes (//) serves as additional protection for our payload against any potential whitespace truncation that the web application might implement.
Running command
If there is SQLi present we can enumerate the database by running command.
Below are some examples:
Last updated