August 2018
Intermediate to advanced
404 pages
10h 22m
English
From our first injection, 1' order by 1 -- ' through 1' order by 3 -- ', we are using a feature in SQL that allows us to order the results of a query by a certain field or column using its number in the order it is declared in the query. We used this to generate an error so that we could find out how many columns the query has, and so that we can use them to create a union query.
The union statement is used to concatenate two queries that have the same number of columns. By injecting this, we are able to query almost anything to the database. In this recipe, we first checked whether it was working as expected. After that, we set our objective in the users' table and did the following to get it:
Read now
Unlock full access