Tutorial 9: Exploiting SQL Injection (OWASP Top 10 — Part 1)
Lesson notes
Welcome to Tutorial 9 of the Ethical Hacking & Cybersecurity Masterclass at ONICastro Digital Intelligence. This guide focuses on Exploiting SQL Injection, one of the most critical and devastating vulnerabilities in web application security. Mastering the art of Exploiting SQL Injection is a rite of passage for every ethical hacker.
Table of Contents
We are ready to start active exploitation.
Web applications are dynamic; they take user input (like a search query, username, or department ID), process it, and talk to databases or the host operating system.
If the developer fails to validate or sanitize this input before passing it to interpreters, the application becomes vulnerable to Injection. In this tutorial, we will exploit two of the most dangerous injection flaws: SQL Injection (SQLi) and Command Injection, targeting our vulnerable bWAPP instance. Our primary focus will be on Exploiting SQL Injection to its fullest potential.
1. Understanding SQL Injection Fundamentals
SQL Injection occurs when user input is concatenated directly into an SQL query, allowing the attacker to manipulate the structure of the query. Before Exploiting SQL Injection, you must understand why it works.
The Vulnerable Backend Code
The backend PHP code for a vulnerable login typically looks like this:
$user = DB::first("SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . $password . "'");Notice how the $username variable is dropped directly into the SQL string with no sanitization. This is the fundamental flaw that makes Exploiting SQL Injection possible.
When you understand this vulnerability, Exploiting SQL Injection becomes a matter of creative string manipulation rather than magic.
2. Exploiting SQL Injection – Bypassing Authentication
In bWAPP, navigate to the SQL Injection (Login Form/Hero) module. This module simulates a vulnerable login portal and is the perfect starting point for Exploiting SQL Injection.
Let’s exploit it.
- In the Login field, type:
neo' OR 1=1 -- - Type anything in the Password field, and click Login.
Why did this work?
The server compiles your input directly into the SQL string:
SELECT * FROM users WHERE username = 'neo' OR 1=1 -- ' AND password = ...In SQL, the double-dash -- tells the database that everything following it is a comment and should be ignored. The query effectively becomes:
SELECT * FROM users WHERE username = 'neo' OR 1=1Since 1=1 is always true, the database returns the first record found (which is almost always the administrator account), completely bypassing the password check. This is the most classic example of Exploiting SQL Injection.
Alternative Authentication Bypass Payloads
When Exploiting SQL Injection on login forms, different payloads work on different database types. Here are several to try:
admin' --admin' #' OR '1'='1' --' OR 1=1 LIMIT 1 --') OR ('1'='1
Each of these achieves the same goal: making the WHERE clause always evaluate to true.
3. Exploiting SQL Injection – Union-Based Database Dumping
If a search bar or filter displays database records on the screen and is vulnerable, you can use the UNION operator to force the database to display records from other tables. This is a more advanced form of Exploiting SQL Injection.
Navigate to the SQL Injection (Search/GET) module in bWAPP. This module allows you to search for movies.
Assume the target application has a search query like:SELECT id, title, release_year, genre, character FROM movies WHERE title LIKE '%[INPUT]%'
Step 1: Find the Number of Columns
Unlock the Remaining 60%
Join the ONICastro Intelligence Hub — completely free.
Get full access to every tutorial and never lose your place.
- Learning Paths synced to your account
- Continue exactly where you stopped
- Completed badges & next recommended step
- Priority access to speedy consultancy
