PortSwiggerlabs: SQL injection attack, listing the database contents on Oracle

Information :

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application’s response so you can use a UNION attack to retrieve data from other tables.

The application has a login function, and the database contains a table that holds usernames and passwords. You need to determine the name of this table and the columns it contains, then retrieve the contents of the table to obtain the username and password of all users.

To solve the lab, log in as the administrator user.

Solution :

If we check the category parameter :

We first can check if the parameter is vulnerable by injecting a simple payload and see if we get an internal server error .

Now to confirm the SQLi , either add ‘ to fix the query and remove the error , or comment everything which will remove the error as well , if we are able to get the error removed by doing one of the two this will confirm the SQLi .

Perfect we confirm that the server is vulnerable to a SQLi .

Now we need to find the number of columns :

We can use order by for this :

'Order by 1-- -

Still no errors , which means it’s probably 2 or higher .

The moment we try 3 we get an error, this confirms that the number of columns is 2 . Now let’s try and see which DB is used .

Now to determine the DB being used , we can use this list of payloads and based on which ones don’t return errors , we can tell the DB used.

Quick Checklist :

https://portswigger.net/web-security/sql-injection/cheat-sheet

'UNION SELECT banner,NULL FROM v$version-- -

This worked perfectly and we get the version of the DB , which means it is an oracle DB , now let’s list all the table names :

Looking at the CheatSheet , we see that to get the table names we can query the all_tables which is a standard data dictionary view.

'UNION SELECT table_name,NULL FROM all_tables-- -

We find the ‘APP_USERS_AND_ROLES’ to be quiet interesting , let’s list the columns for this table .

Again we can follow the CheatSheet , we see that we can query the all_tabs_columns :

'UNION SELECT column_name,NULL FROM all_tab_columns WHERE table_name = 'APP_USERS_AND_ROLES'-- -

I don’t think this is the one we’re looking for, specailly that this is a default one, role and names doesn’t contain passwords or anything like that .

We find this one : ‘USERS_PHOCZD’ this is a custom DB so it can be useful .

'UNION SELECT column_name,NULL FROM all_tab_columns WHERE table_name = 'USERS_PHOCZD'-- -

Keep in mind we have to URL encode everything if we’re on Burp and don’t forget to comment the rest .

This is the one we’re looking for , now that we know the column names as well as the table we want to get data from , the rest is pretty easy :

'UNION SELECT PASSWORD_HWROIQ,USERNAME_QJSWNE From USERS_PHOCZD-- -

Just like that we get the admin’s password .

Once we login using the admin’s creds the lab will be solved .

That was it for this lab. See you in the next one :)