A login built from strings

The member login

The target has a member area at /app/login. It takes a username and password as POST fields; send them with curl's -d:

curl -s -d 'username=bob&password=wrong' http://127.0.0.1:8080/app/login

In the terminal

student@vulntech:~$ curl -s -d 'username=bob&password=wrong' http://127.0.0.1:8080/app/login
Invalid credentials

Wrong credentials get Invalid credentials. Behind the scenes the app builds a SQL query by pasting your input straight into a string, roughly:

SELECT username, secret FROM users WHERE username='<you>' AND password='<you>'

Your input lands inside the quotes of a query the database will run. If you can break out of those quotes, you control the query.