SQL Injection 2 — Portswigger

Lab2

SQL injection vulnerability allowing login bypass

• First we accessed the lab
• Then we clicked “my account” .
• As given below we tried single quotation as username to check if sql injection is possible in this scenario.

• For this we get the internal error as below

• As we now know this vulnerability, we tried administrator’ — — to get into the administrator account by force commenting the password .

• After this we got into the administrator account and solved the lab.

Have a good day ;)