Question: A recent employment test prompted me to perform an SQL injection to gain access into their website.

Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable to SQL Injection attacks, but every time I tried to pass any payloads into the E-mail/username field 

> 
> (eg: admin' or '1'='1)
> 
> 
> 

it kept saying "Invalid email format".

Anyone know how to get around this? 
(I should mention the Company only allowed me to use manual methods and Burp, no other tools were allowed)

\*\*Note: The website wasn't their main website, it was a web app created for the sole purpose of exploiting vulnerabilities. \*\*

UPDATE: I'm still able to access the domain ( I thought they had taken it down after the test was over), but I won't be able to share the domain address because I'm unsure if it'll even be legal to publicize it. So, I'll add some screenshots of the issues.
this is the error and adding @something.com gives me the same output:

[![this is the error and adding @something.com gives me the same output](https://i.stack.imgur.com/lsqOt.png)](https://i.stack.imgur.com/lsqOt.png)

This is the intercepted request:
[![enter image description here](https://i.stack.imgur.com/Ipbvt.png)](https://i.stack.imgur.com/Ipbvt.png)

This is the error that's returned for certain inputs:
[![enter image description here](https://i.stack.imgur.com/wNDlB.png)](https://i.stack.imgur.com/wNDlB.png)

and this is the SQL injection vulnerability that Burp identified:
[![enter image description here](https://i.stack.imgur.com/gxZNx.png)](https://i.stack.imgur.com/gxZNx.png)

Answer: 
Since you're confident that the SQL vulnerability exists based on your Burp results, I'm going to assume that you got that error message from your web client.

Either your input has a type attribute set to `email`, either there's a JavaScript snippet which checks that your input matches an email address format.

The easiest way to bypass both of these checks is:

* Open the network panel of your browser's development tools.
* Submit the loin form with a valid email.
* Search the request in the log, and perform a "Copy as cURL" command.
* Open a terminal, paste your cURL command
* Replace the valid email by your injection
* Run the command!
It depends on the confidence of the issue reported by burp, when the confidence is certain, a complete payload for you to reproduce it is provided, usually a sleep command.

If the confidence of burp is 'tentative' that usually means the original command and the same command with a ' return different responses, you can manually check what happens when you add a second ' for example:

* input
* input'
* input''

If `input''` doesn't return a error message but `input'` does then probably there is a sql injection there. Burp is really good but usually needs manual testing after to check and verify valid issues.

EDIT: the reason why `admin' or '1'='1` and similar weren't working is because that is detected by some time of waf. To actually exploit it you will have to use the payload structure provided by burp suite that isn't blocked and similar payloads to get into the tables, columns, etc.

If you don't want manual testing you can try sqlmap... with a common payload like that it would take less than 15 min to download the whole databases of the website.