Writeups
-
Easy
SQL injection UNION attack, retrieving multiple values in a single column
Two values, one column that takes text - so we glue username and password together with || and a ~ separator, and read every credential out of a single field
SQL Injection (SQLi) 4 min -
Easy
SQL injection UNION attack, retrieving data from other tables
Table and columns are given, so it's straight to the payoff - one UNION SELECT pulls every username and password, and the admin's creds log us in
SQL Injection (SQLi) 3 min -
Easy
SQL injection UNION attack, finding a column containing text
Counting columns was the warmup. Now we test each one with a string to find the slot that holds text, and prove it by echoing the lab's random value back
SQL Injection (SQLi) 3 min -
Easy
SQL injection UNION attack, determining the number of columns returned by the query
No data stolen here, just the column count - the first thing every UNION attack needs, found by stacking NULLs until the query balances
SQL Injection (SQLi) 3 min -
Easy
SQL injection attack, listing the database contents on Oracle
Oracle has no information_schema, so we dig through its data dictionary instead all_tables for the tables, all_tab_columns for the columns, and dual to keep every SELECT legal, right up to the admin creds
SQL Injection (SQLi) 7 min -
Easy
SQL injection attack, listing the database contents on non-Oracle databases
UNION-based SQL injection from a single broken quote all the way to the admin login - fingerprinting columns, digging table and column names out of information_schema, and dumping the credentials
SQL Injection (SQLi) 6 min -
Easy
SQL Injection Attack, Querying the Database Type and Version on MySQL and Microsoft
category filter takes instructions it shouldn't. We slip it a UNION SELECT with @@VERSION and walk away with the database version
SQL Injection (SQLi) 4 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters