← All scenarios
bas-001 — External web → SQLi → DB data exposure
critical · risk 92 · Web
Login form on online.keensafeglobalbank.com is vulnerable to SQL injection. The injected query exfiltrates rows from the users table.
MITRE & OWASP
TA0001 Initial AccessT1190 Exploit Public-Facing ApplicationT1213 Data from Information Repositories A03:2021 InjectionAPI3:2023 Excessive Data ExposurePreconditions
- online.keensafeglobalbank.com reachable
- lab DB seeded
Attack path
- attacker — POST /login with email=' OR 1=1 --
- app — Concatenated query returns first user row
- attacker — Authenticated as customer1@keensafeglobalbank.com
- attacker — Iterate UNION SELECT to enumerate other users
Run
Running emits evidence JSON; no real exploitation runs.
(no output yet — click Simulate)
Remediation
Use parameterised queries; rate-limit /login; alert on SQL errors.