Testing for SQL injection
A SQL injection attack involves an attacker providing input to the database, which is received and used without any validation or sanitization. The result is divulging sensitive data, modifying data, or even bypassing authentication mechanisms.
Getting ready
Using the OWASP Mutillidae II Login page, let’s determine whether the application is vulnerable to SQL injection (SQLi) attacks.
How to do it...
- From the OWASP Mutillidae II menu, select Login by navigating to OWASP 2013 | A1-Injection (SQL) | SQLi – Bypass Authentication | Login:
Figure 8.25 – Navigate to the SQL injection authentication bypass lesson
- On the Login screen, place invalid credentials in the Username and Password textboxes. For example, the username is
' or 1=1--with no password. Click the Login button.
Figure 8.26 – Login using SQLi payload
