1.7 KiB
Portswigger SQLi-Lab 6
SQL injection attack, querying the database type and version on MySQL and Microsoft
This lab is similar to the lab#5 which invloved query version of oracle database , so this also involves the GET parameter category vulnerable to sqli
Here the blind sqli didn't work although I have it right but it's just not working so I launched burpsuite and intercepted the request and send it to burp repeater
Now on your keyboard press CTRL+R this will send the request to brup repeater
Our blind sqli works with burp don't know why but let's roll with it and identify the number of columns
Notice that I used -- , well in mysql both # and -- works for comments but -- works if we supply a space afterwards that's why I included + which tells it's a space in url encoding
So second column exists as well , let's try for the third column
Here only 2 columns exists so now we can use union based sqli to know the version of mysql database
With this we completed this lab
In the end I noticed that all we wanted to do was to url encode our sqli payload
Accessories'+union+select+@@version,null+--+
