SQL Injection

In the Lecture Materials we have looked at SQL Injection

Here we will dig deeper and try to find more information.

Getting Started: The Web Trainer

You can find the web trainer in the Lab Github Repo

Tasks:

Login Bypass

• Try the login bypass example in Login Bypass

Stretch Goal

So we can login as Admin. Can you think of a way we could maipulate the query to login as someone else?

Database Enumeration

• Try the Database Enumaation Example in Database Enumeration

Extra Tasks

In the SQL Injection Challenges folder there is a second set of challenges to try This includes example of blind SQL injection.

Try to leak the usernames and passwords using Blind SQLi