PortSwiggerlabs: SQL injection attack, listing the database contents on non-Oracle databases

Information :

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application’s response so you can use a UNION attack to retrieve data from other tables.

The application has a login function, and the database contains a table that holds usernames and passwords. You need to determine the name of this table and the columns it contains, then retrieve the contents of the table to obtain the username and password of all users.

To solve the lab, log in as the administrator user.

Solution :

First we need to find where to inject , we find the category parameter , first check is to inject a simple ‘ payload and hope we get an internal error .

Now to confirm the SQLi , either add ‘ to fix the query and remove the error , or comment everything which will remove the error as well , if we are able to get the error removed by doing one of the two this will confirm the SQLi .

Perfect we confirm that the server is vulnerable to a SQLi .

Now we need to find the number of columns :

We can use order by for this :

'Order by 1-- -

Keep increasing the number until we get an error :

We get an error at 3 , checking 2 doesn’t return an error :

This confirms that the number of columns is 2 .

Now to determine the DB being used , we can use this list of payloads and based on which ones don’t return errors , we can tell the DB used.

Quick Checklist :

Eventually the payload that worked was version() which confirmed it was a POSTGRESQL .

Perfect , now let’s dump the Table names first :

Since this is a PostgreSQL db , We can use the information_schema.tables to list all table names .

'UNION SELECT NULL,table_name FROM information_schema.tables-- -

Perfect , we are able to dump the table names , now moving on , we find an interesting table which is ‘users_ewzhui’ which probably holds usernames and password :

To dump its content we first need to list the column names for this table , again this is PostgreSQL so we can use the information_schema.columns with WHERE operator :

'UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name='users_ewzhui'-- -

Perfect now that we know the column names and the table name , we can just dump them :

'UNION SELECT password_gvamsl,username_ogeext FROM users_ewzhui-- -

Let’s try to login in with this password :

Just like that we are able to solve the lab .

That was all for this lab, see you in the next one :)