## Hands On: Intercepting

### Step-by-Step
1.  Open Burp. Go to Proxy -> Intercept. Turn it **ON**.
2.  Open Browser. Go to `http://testphp.vulnweb.com/login.php`.
3.  Type `admin` / `admin` and hit Enter.
4.  Browser hangs (it is waiting).
5.  Look at Burp. You see the raw HTTP request:
    ```http
    POST /userinfo.php HTTP/1.1
    Host: testphp.vulnweb.com
    uname=admin&pass=admin
    ```
6.  Change `uname=admin` to `uname=' OR 1=1 --`.
7.  Click **Forward**.
8.  Check Browser. You are logged in! (SQL Injection).