In a standard authentication mechanism, users provide a username and password. The application typically checks these credentials against a database. For example, a SQL query might look something like this:
SELECT * FROM users WHERE username = 'user' AND password = 'pass';An attacker can attempt to inject malicious SQL code into the username or password fields. For instance, if the attacker types the following in the username field:
' OR '1'='1'--This payload is injecting an always true statement into the username field and comment the rest SQL query. The attacker can write anything in the password field because the resulting SQL query will not check it anymore.
SELECT * FROM users WHERE username = '' OR '1'='1'--' AND password = '';Here, `'1'='1'` is always true, which means the query could return a valid user, effectively bypassing the authentication check. :warning: In this case, the database will return an array of results because it will match every users in the table. This will produce an error in the server side since it was expecting only one result. By adding a `LIMIT` clause, you can restrict the number of rows returned by the query. By submitting the following payload in the username field, you will log in as the first user in the database. Additionally, you can inject a payload in the password field while using the correct username to target a specific user.
' or 1=1 limit 1 --:warning: Avoid using this payload indiscriminately, as it always returns true. It could interact with endpoints that may inadvertently delete sessions, files, configurations, or database data. * [PayloadsAllTheThings/SQL Injection/Intruder/Auth_Bypass.txt](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/Intruder/Auth_Bypass.txt)
Source: SQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.