Hmm wouldn't you know right after I didn't think I could figure it out an d posted the question, I think I might understand now..

Is it to make sure the last AND is not executed, as we don't want it to return blank passwords.. just all users? Or one user is we specify one.. ?

Thanks again!!

Hey All,

I've been trying to work more on learning SQL syntax to better understand injection statements.  I came across an example, and I'm not sure I understand it completely.

They are detailing a sample authentication bypass, initially they put a purposefully wrong statement of:

SELECT * FROM admins WHERE (user = '' OR '1'='1') AND (pass = '')

They said it was wrong, as it would only match user's with blank passwords and I can see that, the parentheses change the order of operation.

This is what they suggested as the correct statement:

SELECT * FROM admins WHERE user = '' OR 1=1 OR '1'='1' AND pass = ''

Why are the two true conditions in there.. not sure why that fixes it?

If anyone could explain that, I would really appreciate it - it's stuck in my head, so I've been trying to find an answer!

Thanks in advance for all the help!

-DV

Congratulations! Catalyst256! =)

Welcome!  I've been reading up on some Computer Forensics items recently, I think the subject is fascinating.

-DV

Congratulations! What an awesome prize

-DV

My friend had an Atari, I believe it was an XL too.. not sure though its been quite a while.. was pretty sweet  

Thanks for all the welcome's!

I've been in the Information Tech. field for 10+ years, but computers have always been a hobby/passion.  The subject of Ethical Hacking has always been my greatest interest, even before I knew that's what it was called..

My favorite Christmas is still the one where I got a Trash 80 =D !

I have a few certifications under my belt, and I'm trying to transition into the Info Sec field, hopefully to work as a pen. tester.

I love reading this forum - so keep up the good work!!

-DV

I have to be honest, I've been something of a watch only member for a while..!  Everyone does such a good job of asking/answering questions, I can usually find it on here

Just thought I would say hi, before posting officially

Thanks for all the great information!

-DV