OWASP Security Shepherd Project - SQL Injection Lesson

What is Injection Vulnerability/Threat?

    Injection occur when malicious data is sent to server and server trust the data without proper examination. Under this condition, the malicious data would be treat as normal command and be executed with the privilege of corresponding server side application.
    Injection attacks are high severity attacks. An injection vulnerability could lead to confidential data leakage, directory traversal, execute arbitrary file, and even fully controlled by attackers. This kind of attack make your system wide open to attackers, because they could be initiated by anyone who connect to the system through the data they pass to the application.

Lesson

    Here in this lesson we are ask to practice on a simple SQL Injection:

Our purpose is to change the boolean result of the query's WHERE clause to return true for every row in the table.

Let's input 1' OR '1' = '1 to see if we could trick the application by leveraging OR operator.

 

Great! We finished the task!