PortSwiggerlabs: SQL injection vulnerability allowing login bypass

Information :

This lab contains a SQL injection vulnerability in the login function.

To solve the lab, perform a SQL injection attack that logs in to the application as the administrator user.

Solution :

Let’s try login in :

Whenever we find a Login page , we can always test for Login Bypass via SQLi , here is a list of payloads i like to use :

We can either use Intruder to test all of these , but since there aren’t that many , we’ll do it manually :

' or 1=1--

This one worked for me :

Looking back at our Dashbaord , we should see that the lab was solved :

That was all for this lab, See you in the next one :)