[Python] Python SQL Injection Script on WebGoat Always Redirects to Login Page

I'm trying to perform an SQL injection attack on WebGoat using Python with requests and BeautifulSoup. However, when I execute my script, instead of getting query results, I am always redirected to the login page with the message "Invalid username and password."

The Script:

import requests
from bs4 import BeautifulSoup

# URL of the WebGoat SQL Injection page
url = "http://localhost:8080/WebGoat/start.mvc?username=user12#lesson/SqlInjection.lesson/1"

# Create a session to maintain cookies and headers
session = requests.Session()

# Send a GET request to retrieve the page content
response = session.get(url)
soup = BeautifulSoup(response.text, 'html.parser')

# Find the form tag and extract its action URL
form = soup.find('form')
form_action = form['action'] if form else None

# Make sure the form action is found
if not form_action:
print("Form action not found.")
exit()

# Find the name of the input field for the query
input_name = form.find('input', {'name': True})['name']

# The SQL query to be injected
sql_query = "SELECT department FROM employees WHERE auth_tan='LO9S2V'"

# Prepare the data for submission
data = {
input_name: sql_query
}

# Construct the complete URL for the form action
post_url = f"http://localhost:8080{form_action}"

# Send a POST request to submit the form
submit_response = session.post(post_url, data=data)

# Print the response after submission
print(submit_response.text)


Regardless of what I try, the response I get is always the login page:

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Login Page</title>
<link rel="shortcut icon" href="/WebGoat/css/img/favicon.ico" type="image/x-icon"/>
<link rel="stylesheet" type="text/css" href="/WebGoat/css/main.css"/>
<link rel="stylesheet" type="text/css" href="/WebGoat/plugins/bootstrap/css/bootstrap.min.css"/>
<link rel="stylesheet" type="text/css" href="/WebGoat/css/font-awesome.min.css"/>
<link rel="stylesheet" type="text/css" href="/WebGoat/css/animate.css"/>
</head>
<body>
<section id="container">
<header id="header">
<div class="brand">
<a href="/WebGoat/start.mvc" class="logo"><span>Web</span>Goat</a>
</div>
<div class="lessonTitle">
</div>

</header>
<section class="main-content-wrapper">

<section id="main-content">
<div>
<p>Invalid username and password.</p>
</div>

<br/><br/>
<form action="/WebGoat/login" method='POST' style="width: 200px;">
<div class="form-group">
<label for="exampleInputEmail1">Username</label>
<input autofocus="dummy_for_thymeleaf_parser" type="text" class="form-control"
id="exampleInputEmail1" placeholder="Username" name='username' />
</div>
<div class="form-group">
<label for="exampleInputPassword1">Password</label>
<input type="password" class="form-control" id="exampleInputPassword1" placeholder="Password"
name='password' />
</div>
<button class="btn btn-primary btn-block" type="submit">Sign in</button>
<div class="text-center"><a href="/WebGoat/registration">or register yourself as a new user</a></div>
</form>
<br/><br/>

</section>
</section>
</section>


</body>
</html>


How do I need to authenticate before accessing the SQL Injection lesson? Am I missing any required headers or tokens in my request? Is WebGoat rejecting my request due to CSRF protection or some other security mechanism?

Any help would be appreciated!

Continue reading...