The Basics of Web Hacking by Pauli Josh

Author:Pauli, Josh [Pauli, Josh]
Language: eng
Format: epub, pdf, mobi
ISBN: 9780124166592
Publisher: Elsevier Science
Published: 2013-06-20T14:00:00+00:00

Bypassing Authentication

We can now construct a valid SQL statement that will execute gracefully and retrieve information that we have no right to retrieve. We know we are dealing with a string column because of the quotes being applied to our input, so we can use either the 1=1 or ‘a’=’a clause that were introduced earlier in the chapter to exploit this SQL injection vulnerability. Here is the exact syntax to use the a=a clause where the appended quotes are used against the application. One of them will be at the very beginning and one will be at the very end, which results in a balanced query. Type this in the User ID: textbox.

Rel1k' or 'a'='a

This query successfully executes and produces some useful results retrieved from the database as shown in Figure 4.2.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.