Description

A login form accepts a username and password. The source code reveals the SQL query used for authentication. The goal is to log in without valid credentials.

Overview

• The login query is SELECT * FROM users WHERE username="{user}" AND password="{pass}".
• User input is inserted directly into the query string without sanitization.
• Injecting " or 1=1 # as the username makes the WHERE clause always true and comments out the password check.
• The server logs us in and reveals the password.

Background: SQL Injection Auth Bypass

• In MySQL, # begins a single-line comment; everything after it is ignored.
• OR 1=1 is always true, so the entire WHERE clause evaluates to true for every row.
• The query effectively becomes SELECT * FROM users which returns all rows; the application treats any non-empty result as a successful login.
• Parameterised queries prevent this by keeping data separate from SQL syntax.

Solution

Step 1: Identify the Query

• View the page source; the PHP code shows the exact query template.
• The username and password are interpolated directly into the SQL string.

Step 2: Craft the Injection

• Username: 1" or 1=1 #
• Password: anything (it is commented out)

r = requests.post(
    url,
    auth=HTTPBasicAuth("natas14", password),
    data={"username": '1" or 1=1 #', "password": "NULL"},
)

Step 3: Extract the Password

• The response body contains the password for natas15 as the last word of the success message.

Password

TTkaI7AWG4iDERztBcEyKV7kRXH1EZRB