Hack Security Pro.pdf - Index of

We then obtain a valid request:
SELECT * from writers where $login='' OR '1'='1'
There are other types of SQL injections used not to bypass an authentication but to recover, insert,
update or delete data in the base. Let us imagine a site onto which Crashfr has logged in and been
authenticated... Very often a site where we can create an account will associate several things... For
example a login/pass, name, given name, email and more importantly a level of rights. In our example,
the level of rights is in the “level” field of the “users” table. Level 1 indicates the user is an administrator
and level 2 indicates that the user is a member. When functioning normally, the profile.php script does
not allow you to modify your level of rights, but as you will see, by using SQL injection, we are going to
increase our level of privileges to become an administrator. Here is the script to create our table:
#
# Table structure for table `users`
#
CREATE TABLE `users` (
`id` int(10) NOT NULL auto_increment,
`login` varchar(25) NOT NULL default '',
`password` varchar(25) NOT NULL default '',
`name` varchar(25) NOT NULL default '',
`given name` varchar(25) NOT NULL default '',
`email` varchar(25) NOT NULL default '',
`level` int(1) NOT NULL default '0',
PRIMARY KEY (`id`)
) TYPE=MyISAM AUTO_INCREMENT=2 ;
#
# Dumping data for table `users`
#
INSERT INTO `users` VALUES (1, 'CrashFr', '378b243e220ca493', 'Crash', 'Fr',
'crashfr@thehackademy.net', 2);
And here is our PHP script with which we can modify our profile: