Writeups
-
Medium
Blind SQL injection with conditional errors
Blind SQL injection exploited through conditional errors - fingerprinting an Oracle database with dual, turning divide-by-zero into a true/false oracle, and automating Burp Intruder to extract the administrator's password one character at a time
SQL Injection (SQLi) 6 min -
Medium
Blind SQL injection with conditional responses
Blind SQLi through the TrackingId cookie a single conditional message drives length checks and a SUBSTRING brute force until all 20 characters of the password fall out
SQL Injection (SQLi) 8 min -
Easy
SQL injection UNION attack, retrieving multiple values in a single column
Two values, one column that takes text - so we glue username and password together with || and a ~ separator, and read every credential out of a single field
SQL Injection (SQLi) 4 min -
Easy
SQL injection UNION attack, retrieving data from other tables
Table and columns are given, so it's straight to the payoff - one UNION SELECT pulls every username and password, and the admin's creds log us in
SQL Injection (SQLi) 3 min -
Easy
SQL injection UNION attack, finding a column containing text
Counting columns was the warmup. Now we test each one with a string to find the slot that holds text, and prove it by echoing the lab's random value back
SQL Injection (SQLi) 3 min -
Easy
SQL injection UNION attack, determining the number of columns returned by the query
No data stolen here, just the column count - the first thing every UNION attack needs, found by stacking NULLs until the query balances
SQL Injection (SQLi) 3 min -
Easy
SQL injection attack, listing the database contents on Oracle
Oracle has no information_schema, so we dig through its data dictionary instead all_tables for the tables, all_tab_columns for the columns, and dual to keep every SELECT legal, right up to the admin creds
SQL Injection (SQLi) 7 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters