1. Web Security Academy
  2. SQL injection
  3. UNION attacks
  4. Lab

Lab: SQL injection UNION attack, determining the number of columns returned by the query


This lab contains an SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response so you can use a UNION attack to retrieve data from other tables. To do this, you first need to determine the number of columns that are being returned by the query.

To solve the lab, perform an SQL injection UNION attack that returns an additional row containing null values.