Hello and welcome, everyone.
So in this video, we are going to see a log-in bypass onto a life of application so long we have seen
log-in bypass on to the lab exercise, but now we have moved to the life of our application.
So here is an application, which is technical traders, dot com login, not BHB.
And this is an admin login, which we are going to buy.
So here we are also going to try with default credentials, which is admin and admin, and let's see
if it works for us auto.
And you can see and give a letter to us which is around username and password.
Let's try with admin and password as password this time and log in and you can see it still gives the
error, which means that we are not able to bypass this with the default credentials.
So let's try to do some indication and we will see some Esequiel queries to bypass the login.
So we wish login as admin.
So I'm going to write admin and in the password field I'm going to write a script query and which is
this we have already discussed about this query and have done a breakdown.
So let's copy paste this over here and hit on login and let's see if we are able to login.
And you can see we are successfully able to login into the application and you can see welcome admin
and yet is allowed.
But now I can go on to inventory, sales, history, etc etc. and see a lot of sensitive information
which is only visible to the admin account.
But we will not move to any of these buttons or go onto any places because it may leak some of the sensitive
information off the target application.
So I'll just log out and I hope you guys understood how you can also identify login bypassed with vulnerabilities
on the Web applications by using the query under the homepage.
Where is the login details and the username feel?
You can try with different usernames that you want, but if you try admin, it contains the highest
privilege.
So if you get logged in using admin, it is going to give you more rate which will contain more criticality
and severity if you are going to report it to anybody program.
So I would recommend always try to login with first the default credentials and then you can try to
login with the bypass query that we have seen on the multiple web application.
It works most of the time for poorly developed websites in which there are Escorial issues and it will
work for you for most of the applications.
So I hope you guys understood.
In case you have any issues or you have any doubts or queries, you can always ask it into the Q&A section.
Thank you.