Authors: Nathan Yam, Jonathan Kartawidjaja
Once we first get access to the web page, we are met with the following login portal:
You can try using tools like hydra, gobuster, nikto, and much more, but they will not yield results. You may also try viewing the page source, but that will not reveal anything either. Lastly, you may wish to attempt default credentials admin:admin or admin:password, but those will not yield results either.
Fuzzing is the process of inputting special characters or specific input and examining how the web server responds.
In this case, we can attempt fuzzing the username and password fields of the login portal. We’ll the following fuzzing payload and place it in the username field:
'"!*;-
Low and behold once we attempt to login, we get the following error, indicating that the website uses SQL for authentication.
