Authentication is how an application answers the question "who are you?" When you submit a username and password on a login form, the server checks those credentials against its stored records. If the check passes, it issues a session token that identifies you on every request you make afterwards. Every authorization decision the application makes — what you may read, what you may change — flows from that identity. If an attacker can bypass the check, they inherit your identity entirely.
The login form is the application's front door. Every authorization decision the application makes afterwards depends on the identity that the login established, which makes the login handler one of the highest-value targets in any web application. The OWASP Top 10 places this class of finding at A07:2021 - Identification and Authentication Failures.
In this lesson you will:
- Observe how a normal login request flows from the browser to the server.
- Recognize an authentication bypass via SQL injection by constructing a payload that signs you in as the administrator without knowing the password.
- Distinguish brute force from injection, and understand why an account lockout policy does not defend against the bypass you are about to demonstrate.
Estimated time: 10 to 15 minutes.
Prerequisites: browser-recon for observing the login request in DevTools and databases-sql-fundamentals for the SQL query shape. You do not need an existing account for this lesson, and you will not be using the administrator's real password because you do not know it.
Scope reminder: the payloads in this lesson are powerful and would constitute unauthorized access if used against a system you do not own. Restrict your practice to the embedded NovaCart application provided by this course.
When you are ready, send the Continue signal.