When the injectable parameter is the login field, you do not extract the password, you rewrite the question so the password stops mattering.
Logging in without a password
A normal login asks the database one question: is there a row where the username and the password both match? Watch a real attempt travel through the stack.
You
Login page
Database
- user=admin pass=hunter2
- You → Login page: user=admin pass=hunter2
You submit the login form.
1 sur 4