Exploit SQL injection To Bypass Login

Login bypass is one the impacts of SQL Injection where an attacker can login into the vulnerable web application without valid credentials.
During this Video we look at a scenario where an attacker exploits SQL injection Vulnerability to bypass login function and access the admin account without having a valid password.
Web Security Academy | Lab: SQL injection vulnerability allowing login bypass.
portswigger.net/web-security/...
NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to enhance their security knowledge. Therefore, allowing them to identify and remediate potential vulnerabilities in their OWN applications.
Twitter: / tracethecode

[@detective5253]

i liked your deeply explanation, please provide more like this contents! Thanks

[@TraceTheCode]

Thanks! more to come.

[@bird271828]

This was nice. Thank you 🙏👏👏👏👏

[@user-qn1ri4zy5f]

lol...now a days firewalls and sniffers are more powerful and normally thwarts this kind of attacks. However, good explanation.

[@ferasalfarsi897]

Thank you for this useful video

[@TraceTheCode]

You're very welcome!

[@siddharthareddypagilla9019]

Bro, I have some suggestion for you, make a playlist for all web attacks. Like a injections in sql injections, xss and many more. Bro there are no great resources for students to learn web exploitation for ctfs .if you solve that it would be a great help

[@opensearch-]

this is prob the only video i understanded

[@nouaimmebarki8885]

thanks a lot

[@gambaboyallin]

great content

[@AcidKeyn]

really good explanation! keep up the good work

[@TraceTheCode]

Thanks!

[@Atropin4ik]

Nice video. What will be the approach when we don`t know the login? how to build queries then?

[@bishnuthapa-dg5po]

what if there is comment filter applied and password is taken after converting to hash?

[@dietrichdietrich7763]

interesting things

[@shafeeqrahman6135]

Good explanation sir

[@TraceTheCode]

Thanks and welcome!

[@nishiko-crackz4407]

how do i look what the sql query is?

[@dim_1074]

Hello, I tried doing this via sqlmap, however I don't seem to be able to do that. Would you mind telling me what command is needed to be used to perform the sqli with sqlmap?

[@TraceTheCode]

This is a simple scenario which suppose to help you learn how to manually detect and exploit SQL injection. If you like to work with sqlmap I suggest that you take time and take a look at the below link. github.com/sqlmapproject/sqlmap/wiki/Usage

[@dim_1074]

@@TraceTheCode Thank you for your answer, but the reason I am asking this is because I am unable to reproduce this SQLi with the tool, even though it is very simple (as you can also use the classic 'or 1=1--). I have already read all of the documentation yet still can't figure out why sqlmap can't figure it out.

[@Lucasmoses7]

Reach out the name 👆above they can help you out,he's the best 💯💯 Without stress he helped delivered mine...

[@dontreadthis888]

@@dim_1074 Its because the site detects tools, it gives 500 Internal error when detecting

[@sforstatus9319]

0:18

[@ebmpingu]

this dude looks familiar is he the no.1 rank on hackerone

[@ActualVital]

Okay but what if filtering is involved and filters out the - - or other commands?

[@L0G1C4LLY]

thats the solution for developers to make logins safe. This only works as shown in the video when this is not prevented by devs

[@textreverb1983]

@@L0G1C4LLY better learn how to bypass character escaping 🤔

[@weniweedeewiki.6237]

Nice work bro .....subd....

[@TraceTheCode]

Thanks!

[@weniweedeewiki.6237]

@@TraceTheCode hope you are well ... are you uploading soon?

[@TraceTheCode]

New videos will be published in January!

[@weniweedeewiki.6237]

@@TraceTheCode looking forward to it....