SQL Injection - Tautological Statement Injection

In this tutorial, I will address the use of tautological statements in SQL injection. I will demonstrate how to perform this technique by attacking a Fedora web server hosting DVWA (Damn Vulnerable Web App) with a copy of Backtrack 5 R3. DVWA is a web application developed with PHP server-side scripting and MySQL as a backend database server. It is built intentionally with a number of common web app vulnerabilities to be used for PenTesting exercises. I will not only show how to perform the SQL injection, but I will also display the source code for the PHP script and show how the SQL queries are passed to the back-end MySQL server. References: www.sqlcourse.com - An interactive course that introduces SQL (Structured Query Language) basics. http://www.dvwa.co.uk/ - Damn Vulnerable Web App project homepage.