Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

PRACTITIONER

This lab contains an SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.

To solve the lab, display the database version string.

SQL injection cheat sheet

Access the lab

Solution

Use Burp Suite to intercept and modify the request that sets the product category filter.
Determine the number of columns that are being returned by the query and which columns contain text data. Verify that the query is returning two columns, both of which contain text, using a payload like the following in the category parameter: '+UNION+SELECT+'abc','def'#
Use the following payload to display the database version: '+UNION+SELECT+@@version,+NULL#

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

SQL injection UNION attacks Examining the database Blind SQL injection SQL injection cheat sheet

All topics

SQL injection XSS CSRF Clickjacking DOM-based CORS XXE SSRF Request smuggling Command injection Server-side template injection Insecure deserialization Directory traversal Access control Authentication Business logic vulnerabilities Web cache poisoning WebSockets Information disclosure

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Read more

Solution

In this topic

All topics

Find SQL injection vulnerabilities using Burp Suite