SQL Injection - Lab #5 SQL injection UNION attack, retrieving data from other tables

In this video, we cover Lab #5 in the SQL injection track of the Web Security Academy. This lab contains a SQL injection vulnerability in the product category field. To solve the lab, we perform a UNION based SQL injection attack that retrieves the usernames and passwords of the users of the application.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Links ▬▬▬▬▬▬▬▬▬▬

[mohmino]

i noticed that women most clearly more than men in explaining thx so much Rana

[peasantlettuce]

You are Amazing Rana! You explain everything in Fine detail so anyone can understand! :) We need more women in Security! :)

[cybersec-radar]

Finally found few ways to handle two or more parameters.

[samarjan]

Thanks you Rana khalil best tutorials good luck

[ibrahimhussain]

That's awesome. No sane person would ever put a string password in a database though

[周敏之]

I've set up a MySQL environment and executed the query "select userid, username from user where username='admin' union select 1, 2-- '". In the "union select" part, the value 2 is of type int, but the second field in the preceding select statement is of type varchar. Surprisingly, instead of encountering an error, the query was executed successfully. Why did this happen?

[aem]

for: 'UNION select username, password from users --
Did you guess the column name or does the column name not matter?

[vasumudiraj]

how did we know thwat there is a table called users

[toumorokoshi]

I'm not sure if anyone can help me understand, but when I used burpsuite, using 'UNION+SELECT+username, +password+FROM+users-- returned a 404. When I saw this video, I noticed that Rana just copied that into the url. Why does it return a 404 on burpsuite but loads correctly if placed in url?

Edit: Nvm. I'm not sure what happened, but I'm doing the lab again and it does not display 404. Although if there is something that can commonly cause an error, like a misspelling, please let me know so I can understand and watch more closely next time.

[al-rayyanmicrogarden]

In reality every password is encrypted with some key stored in config folder that's mean whenever we use that password from this query will fail to attemp login because normaly login system use decrypted() to validate password match. let's say we can grab credential password, but I think still there misssink link to complete perfectly our penetration testing until credential cracked .and finaly the bigest isue for this technique is how to find proper encrcyption method and it's key.
anyone can give me some advice from this isue?