SQL INJECTION
1.LOW
-This level of SQL requires you to look for SQL injection by entering a single quote or a double quote on the user id to see if youll get an SQL error. But first make sure your difficulty is set to low.
-We can dump that error by entering a statement that is always true to in order to get every users 1st and last name in the database.
The Statement is (‘ or 1=1#, ‘ or 1=1 — -) it should look like this:
This after imputing either of the prompts I put earlier you will get all the usernames first and last names on the database as show above.
2.MEDIUM
-First set your security to medium.
You will find that the user id from low looks different and we are not able to type any payload
This is how it looks when you submit any of the user ids
Now we are required to intercept traffic using brute force.
Open brute force and turn the intercept on then submit the request again
This is how it look after the intercept
Get Nathanieljesse’s stories in your inbox
Join Medium for free to get updates from this writer.
Now change the Id=1 to “id= 1 or 1=1” but don’t add quotation marks then click on forward and this what you should get
Now we need to try to dump the username and the password. Do the same thing, turn on your intercept and intercept the page.
Then, we change the 1 to ( id=1 UNION SELECT user, password FROM users#) then click forward it should look like this:
Now we are going to try and hack one of this passwords using Crackstation.net, select one of them. In this case I chose Gordonb as first name then we try hack the code in the surname
Copy the surname and paste it on crackstation then crack hashes as shown below
After cracking the hashes, we can see that the result is “abc123” so now we know that when we go back to the login page, the username will be “Gordonb” and the password will be the result we just found which is “abc123”
3.HIGH
Switch the security level to hard.
This difficulty level is almost identical to the low level.
Click the link and open the dialogue. Type the same thing we typed in the low difficulty which was (‘ or 1=1#) it should look like this
After typing the command, submit and It should bring you something like this:
And there you have it, you have the users name and password.
Thank you.
