Subverting Query Logic - Basic Auth Bypass

HTB Content Academy
1

I’m trying to complete the task in the HTB Academy SQL Injection module for Suberting Query Logic, where you need to bypass a login form with simple SQL injection. I was able to pass it using the comment method (which wasn’t taught yet), but I can’t get passed it using the method it wanted me to. This is the query I’m constructing:

SELECT * FROM logins WHERE username='tom' AND password = '' or '1'='1';

It almost works, but the result I get is " Login successful as user: admin ". I’m trying to login as tom, though, which is what I need to get the flag. Any idea where I’m going wrong?

2

i’m having the same problem. I can only login as tom using comments but really want to figure out how this was intended to be solved. Did you ever find the solution?

3

I used tom’ #
the executing query should look like this:

SELECT * FROM logins WHERE username='tom' #' AND password = 'something' or '1'='1';