PortSwiggerlabs: SQL injection attack, querying the database type and version on Oracle

Information :

This lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.

To solve the lab, display the database version string.

Solution :

First we need to identify the vulnerable parameter :

We find this categrory parameter , now we start by injecting a simple payload to see if we can break the query and cause an internal server error .

Perfect , we get our internal error .

Now to confirm the SQLi , either add ‘ to fix the query and remove the error , or comment everything which will remove the error as well , if we are able to get the error removed by doing one of the two this will confirm the SQLi .

Perfect Our SQLi is confirmed .

Now first test will be to check for UNION based SQLi . First we need to know how many columns exist :

We can do that by using the order by operator , we keep adding numbers until we get an error , the moment we get an error we know the number of columns is the number before causing the error .

'order by X-- -

2 doesn’t return an error , but if we try 3 , we get an internal error :

This confirms that only 2 collumns exist .

Now to determine the DB used we can try many payloads and depending on which one doesn’t return errors we should know the DB being used .

https://portswigger.net/web-security/sql-injection/cheat-sheet

I Kept trying these payloads but they didn’t work :

Then i realised, maybe the v$version table doesn’t allow numbers which means if we do UNION with a number it crashes , always use NULL since it will always work since it is compatible with any Data Type avoiding type mismatch errors that would crash the query.

'UNION SELECT banner,NULL FROM v$version-- -

Make sure you URL encode everything , and comment the rest always to avoid errors :

This one worked perfectly which confirms this is actually an ORACLE DB and we get the version for it in our response .

Upon retrieving the version , we will see that the lab is Solved now .

That was all for this lab, See you in the next one :)