PortSwiggerlabs: SQL injection attack, querying the database type and version on MySQL and Microsoft

Information :

This lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.

To solve the lab, display the database version string.

Solution :

First we need to find the injection spot , just navigate the app like a normal user , check for Parameters in URLs or POST Requests .

We first inject a simple payload to see if we can get an internal error .

Perfect we got our internal server error . Now to confirm the SQLi , either add ‘ to fix the query and remove the error , or comment everything which will remove the error as well , if we are able to get the error removed by doing one of the two this will confirm the SQLi .

If we comment the rest , we get the error removed , perfect :) This confirms the SQLi , we just need to find the number of columns now . Use order by for this :

'Order by 1-- -

Keep increasing the number until we get an error :

We get an error at 3 , checking 2 doesn’t return an error :

This confirms that the number of columns is 2 .

Now to determine the DB being used , we can use this list of payloads and based on which ones don’t return errors , we can tell the DB used.

Quick Checklist :

Starting with the first one :

An internal error which confirms it’s not Oracle .

Perfect , we get the version , as well as the OS :)

Going back to our app , we should see that the lab was solved .

Just make sure you always URL encode everything and comment the rest to avoid errors .

That’s all for this lab , see you in the next one :)