SQL Injections are scary!! (hacking tutorial for beginners)

About this video

NetworkChuck demonstrates a basic SQL injection attack against Altoro Mutual, a deliberately vulnerable practice banking site, claiming the login can be bypassed in about 30 seconds with nothing but a keyboard. He first explains the underlying login query, which checks whether the entered username and password both exist in a database, and shows that whatever is typed into the form lands inside single quotes as a string in that query. Typing a lone single quote after the username produces a syntax error, which he presents as the tell-tale sign a site is injectable, because the extra quote breaks out of the string and lets an attacker add their own SQL. His first payload appends an OR condition comparing one to one, which is always true; after removing a stray trailing quote that caused another syntax error, the login succeeds because the overall statement evaluates to true regardless of the password. A second, simpler payload appends the SQL comment marker (two dashes and a space) after the username, causing the database to ignore the password check entirely. He closes with defenses: prepared statements with parameterized queries, allow-list input validation, escaping user input, and stored procedures, and notes that despite being an old technique SQL injection still ranks number three on the top attacks list he cites. The video is sponsored by Dashlane, with a 50% off offer using the code he gives, networkchuck50.

Key takeaways

• A login form that inserts user input directly into a SQL query as a quoted string is injectable if an attacker can break out of those quotes with an extra single quote
• A syntax error after entering a lone quote is a practical first test for SQL injection vulnerability
• An OR payload with an always-true comparison (one equals one) can make the whole login check evaluate to true, provided the quotes are balanced
• Appending the SQL comment marker after a known username makes the database ignore the password portion of the query entirely
• Standard defenses are prepared statements with parameterized queries, allow-list validation, escaping user input, and stored procedures

Episode details: published October 5, 2022 · 10:14 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: 40 Windows Commands you NEED to know (in 10 Minutes) · Next: the challenge is over. →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube