Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection.
Lets say your backpack has only 2 crafted queries by you which is admin' --
and '=' 'OR'
.
Your past experience on a test site where its back-end SQL code is as simple as belows
select * from users where username = '$username' and password = '$pass';
Yes! This 2 admin' --
and '=' 'OR'
cheat-sheet in your backpack works for bypassing for the above SQL statement.
Okay! Now! Here comes the real live website for you to pentest.
But only this '=' 'OR'
cheat-sheet in your backpack works instead of this admin' --
So best guess is this live website you are authorized to pentest on is having a different back-end SQL code implementation than the one I stated above and only is able to be bypassed by 1 crafted cheat-sheet in your backpack which is '=' 'OR'
and not admin' --
My question now is how do you picture this back-end SQL query code? Assuming you do not have access to the back-end code at all!
How do you make a report out of this? Saying this cheat-sheet '=' 'OR'
works but what about the back-end code that is vulnerable to it? Since you do not know how the back-end code is implemented that is vulnerable and you can't come up with a migitation or prevention approach report for it?