SQL Injection - Lab #10 SQL injection attack, listing the database contents on Oracle

In this video, we cover Lab #10 in the SQL injection track of the Web Security Academy. This lab contains a SQL injection vulnerability in the product category field. To solve the lab, we perform a UNION based SQL injection attack on a Oracle database that retrieves the usernames and passwords of all users of the application.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Links ▬▬▬▬▬▬▬▬▬▬

[bellazzidavid]

Hello, my name is David and I am writing to you from Argentina. I wanted to tell you that all the content of your channel is super useful and interesting. Also everything is very well explained. I wanted to thank you for providing your conociminetos, I can imagine all the work behind that must be done to upload all this content.
I am preparing for the BSCP with your videos and they are very helpful.
Thank you very much for your work, Greetings!

[TimHerbert]

I swear the first real bug bounty I get for sql injection I will donate some money. That trick for 'order by x-- is such a time saver!

[bigkaspi]

Rana, thank you for this video. Helped me work through a box in OSCP labs and I have a much deeper knowledge of SQLi and Oracle syntax now. Much appreciated!🤘🤘🤘

[richkell]

Hi Rana, just enrolled in your course. I was going through the Web Academy by myself however it just wasn't melding with my ageing brain ha. So am going back to the start again with your course. Why did I buy your course? 1 minute in and your very pleasant voice convinced me that I could listen to you for hours on end whilst learning :) Good luck to you Rana and thanks for the course.

[eye]

10:41 can we inject [select *] query directly then manupilate the data?

[watchlistsclips]

Keep making videos on hackthebox oneday.Ur medium hackthebox writeups are awesome.

[MidnightSpecter]

1) is there any way in which we can combine multiple row result in one row ?? 2) how to get all database name or schema name in oracle ??

[aungkyawminnaing]

I am facing bad request error although i added same query. Whatever thanks u ! Your explaining style and video quality are so good...

[mustaquemsheikh]

Love you sister always support you #i_stand_with_palestine

[mohdsadamainasara]

Can you please make a Video demo on Oracle SQLi in POST form not GET, SQLi to RCE, Thank you

[DrGenius]

I found that the SQL injection labs investigating DBs where harder than the UNION attack labs. Anyone else ?

[ayushgoyal]

Can we use union with knowing the column, like
' union select * from users limit 1, in username section,
Its a pico ctf question web gauntlet, pls answer