PortSwiggerlabs: SQL injection UNION attack, finding a column containing text

Information :

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application’s response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you first need to determine the number of columns returned by the query. You can do this using a technique you learned in a previous lab. The next step is to identify a column that is compatible with string data.

The lab will provide a random value that you need to make appear within the query results. To solve the lab, perform a SQL injection UNION attack that returns an additional row containing the value provided. This technique helps you determine which columns are compatible with string data.

Solution :

We first start by injecting the category parameter to see if we get an internal server error :

And we do , now to confirm the SQLi , either add another ‘ or just comment the rest of the query , this will make sure the query isn’t broken and it should remove the error we got earlier , both of them will confirm that we have a SQLi.

Perfect now that our SQLi is confirmed , we can start by getting the column number , for this i will use Order by .

2 doesn’t return errors . We will keep incrementing until we get an error .

We get it at 4 , this means there are 3 columns . now we should check which DB is being used .

Quick Checklist :

'UNION SELECT banner,NULL,NULL FROM v$version-- - : ORACLE .
'UNION SELECT version,NULL,NULL FROM v$instance-- - : ORACLE .
'UNION SELECT @@version,NULL,NULL-- - : Microsoft / MySQL . 
'UNION SELECT NULL,,NULL,version()-- - : PostgreSQL . 

None of these worked sadly , so i couldn’t determine the DB used .

Back to our lab , we need to find a field that can take Strings : Now since we are doing a UNION Select attack , we need to match both the column number as well as the data type , otherwise we will get an error .

So first we will use NULL for all of them then for each iteration we will modify a field to a string and see which one doesn’t return an error .

'UNION SELECT NULL,NULL,NULL-- - : This is the first one = shouldn't return an error .

We’re using 3 NULL since we already know the column number is 3 .

'UNION SELECT 'aaaa',NULL,NULL-- - : Checking if the first column allows strings
'UNION SELECT NULL,'aaaa',NULL-- - : checking if 2nd field allows strings 
'UNION SELECT NULL,NULL,'aaaa'-- - ; Same thing for the last field 

The First and Third one and returned an error .

But the second one didn’t which means the Second column contains strings .

Now to solve the Lab we need to retrieve this String : DHLSOd

That was all for this lab , see you in the next one :)