PortSwiggerlabs: SQL injection UNION attack, retrieving data from other tables

Information :

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application’s response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you need to combine some of the techniques you learned in previous labs.

To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user.

Solution :

First we need to find the vulnerable parameter , luckily for us , there is only the category parameter that we can test :

First i injected a simple payload : ‘ , since this returned an internal server error , this is a huge indicator that there might be a SQLi .

Now to confirm the sqli , either add another ‘ which will fix the query and remove the Error , or simply just comment what comes after the ‘ we injected , this way we can get rid of the error , and if we don’t haver the error this confirms the SQLi .

Perfect the error is gone , this confirms the SQLi .

Now we start by identifying the column numbers , i used order by for this one , but you can use UNION SELECT with NULLs .

Detailed method on how to identify the columns number:

https://elmehdilaassiri.github.io/posts/PortSwiggerLabs-SQLi-LAB7/

If we specify the number of columns to be 2 we don’t get any errors , but if we try 3 we immediately get an error :

This confirms that the number of columns is 2 , now to identify the DB i used this Cheat Sheet :

https://portswigger.net/web-security/sql-injection/cheat-sheet

This confirms the DB isn’t MySQL nor Microsoft .

This one worked :

SELECT version()

Which is specific to PostgreSQL .

Now we need to list the table names , since this is a POSTGRESQL , we will be using the information_schema.tables :

'UNION SELECT NULL,table_name FROM information_schema.tables-- -

Perfect , we find a custom Table called users :

Now to list the column names for this table , we can use the ‘information_schema.columns’ :

'UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name=users-- -

Now that we got the column name as well as the table name , retrieving the content should be pretty easy :

'UNION SELECT username,password FROM users-- -

Make sure you comment the rest , and URL encode everything if you’re using Burp :

Perfect we got the administrator password , we can use it to login and solve the lab .

Once we login as the admin , we should see lab Solved .

That was all for this lab, see you in the next one :)