[pythonthing]

Brute force login pages with SQL Injection queries with URL it's possible?

[PurpleMoss]

Depends how the form details are sent. Most are sent (and if they aren't then they should be) as POST requests which means the login data will be in the body, therefore sending an SQLi query in the URL won't do anything, you'd need to send it in the body.

If the application sends it as a GET (which is a big no no) then SQLi could be possible by injecting the payloads into the correct parameters within the URL.

All this is based on if the application is susceptible to SQLi, if they use parameterized queries then you're out of luck.

[DebianBash]

Brute force login pages with SQL Injection queries with URL it's possible?

If you mean the login page, then yes.

[Zgh600]

Depends how the form details are sent. Most are sent (and if they aren't then they should be) as POST requests which means the login data will be in the body, therefore sending an SQLi query in the URL won't do anything, you'd need to send it in the body.

If the application sends it as a GET (which is a big no no) then SQLi could be possible by injecting the payloads into the correct parameters within the URL.

All this is based on if the application is susceptible to SQLi, if they use parameterized queries then you're out of luck.

Can't wait until i start doing things like this firsthand myself.