SQL Injection - Lab #3 SQLi UNION attack determining the number of columns returned by the query

In this video, we cover Lab #3 in the SQL injection track of the Web Security Academy. This lab contains a SQL injection vulnerability in the product filter category field. This vulnerability can be exploited using a UNION attack to retrieve data from other tables. To solve the lab, we perform a SQL injection attack that determines the number of columns that are being returned by the query.This is the first step of a SQL injection UNION attack. We'll use this technique in subsequent labs to construct the full attack.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Contents of this video ▬▬▬▬▬▬▬▬▬▬
00:00​​​​ - Introduction
01:36​​​ - Understand the exercise and make notes about what is required to solve it
13:14​​​ - Exploit the lab manually
20:46​​​ - Script the exploit
33:27 - Summary
34:00​​​ - Thank You

▬ Links ▬▬▬▬▬▬▬▬▬▬

[yusrashaikh]

this is by far the most detailed course i have seen on SQL. love the detailed videos where you explain the scripts. i have never used python's sys, requests, or urllib3 libraries, but it was sooo easy to understand your code! Thank you!

[mstanford]

Thank you so much for your videos. Not only is your teaching clear and concise, I love that you also show us how to script the solutions using Python 3! You are a great instructor!

[RTN_Paul]

Your way of teaching and your code explanation are perfect. Thank you!

[Kinoti]

Wow just wow. You explained it so well Rana, can't wait to get my money up so I can buy the entire course. Amazing work.

[missclaptrap]

That was a fantastic video! Thank you for walking through it so in-depth. I also really appreciated the scripting part.

[mostafasayed]

جزاكى الله خيرا ونفعك وزادك من فضله فى الدنيا والاخرة بأذن الله

[pimentelrobert]

@Rana Khalil - God bless you, what an informative and well prepared, delivered and educative tutorial. You made me feel like I can do this too, I admire your succinctness.

[boneitch]

Thank you so much Rana for your amazing videos! You are really helping me grasp the theory, instead of just repeating the motions. This is truly making me excited to learn again!

[JeremyFiorese]

Thank you for all the great content, greetings from France

[valentyntukov]

Thank you, Rana! Impressed a lot with your

[luislla]

I literally love you, thank you very much for your efforts

[dukedud]

thanks for providing such a great content for us ^^

[UserMS]

I am learning python coding with the attacks. Can you explain why you did i-1 then i+1 then returned False. Otherwise thanks for the course as it is doing a fantastic job in teaching many about different web attacks.

[olusegunadejorin]

Thank you for your wonderful content, you are wonderful

[surojitmaity]

I have a doubt, why you put a single quote after Gifts' in burp, I mean how the final query is structured

[kusharora]

the 'i = i + 1' in the for loop is not required...

[siemens_c]

почему ты не используешь f strings они же удобнее

[zautt]

what is the point of make this scirpt if sqlmaop can do?(i think)

[yurilsaps]

Hello, I'm studying SQL injection, and it seems that every payload needs at least one of this characters " -, ', # ", if i filter this on the input I'm 100% safe?

[AleemKhan-limr]

hello i am interested in to become a pen tester but i don't know where to start can you please guide me. p.s i am noob.