Infinity - SQL Injection - Opengate

Infinity — SQL Injection: Opengate

Overview

A walkthrough of exploiting SQL Injection in a login form on Infinity platform. By injecting a boolean condition and switching comment syntax from – to #, we bypassed authentication and gained access to the application.

Vulnerability: Authentication Bypass via SQLi

---

Step 1: Identify the Input Field

Open the challenge and locate the Login form input field.

---

Step 2: Test for SQL Injection

I try user name admin and it’s taken and tried to inject ' and i have an error :

first let’s imagine sql query :

SELECT * FROM users WHERE username='User_input' AND password='User Input';

we can inject boolean condition admin' or 1=1-- and try to login with it and i got a new error :

I tried to use # instead of -- and it worked :

---

Key Takeaways

• Comment syntax varies by database — -- works on MSSQL and PostgreSQL, # works on MySQL. If one fails, try the other.
• Always test different comment styles before assuming the injection failed.
• Boolean-based login bypass is one of the simplest and most impactful SQLi attacks — one payload gives full access.

---

Happy Hacking!

Follow me: LinkedIn · X