SQL Injection on an's security blog

SQL injection with filter bypass via XML encoding | Practitioner

Thu, 16 Jul 2026 16:17:16 +0800

This lab contains a SQLi vulnerability in the stock check feature, in which the results from the query are returned in the application’s response. So we can probably use UNION attacks to retrieve data from other tables:

Let’s try inserting a UNION SELECT to see what’s up, just for fun:

Looks like there is a WAF in place that filters out possible injection attempts, which is kinda bad. But is it bulletproof? Can it detect an injected query that is encoded once? Twice? Thrice? For this lab, I will be using the Hackvertor extension which is a Swiss knife for everything data, decoding, encryption, encoding, the whole shabang.

Blind SQL injection with out-of-band data exfiltration | Practitioner

Thu, 16 Jul 2026 15:24:16 +0800

(lab requires Burp Pro)

The application’s tracking cookie is still vulnerable to SQLi. But unlike previous labs, the SQL query is executed asynchronously and has no effect on the application’s response. So all our methods previously will fail to yield results.

However, we can trigger out-of-band interactions with an external domain. There are quite a lot of network protocols that we can use but the most likely to succeed is DNS, since almost all networks should allow outbound DNS resolution (or it will break duh). The syntax for data exfil can be found in this cheat sheet here, quite complex syntax so I won’t dive too deep into that for this writeup.

Blind SQL injection with time delays and information retrieval | Practitioner

Thu, 16 Jul 2026 14:02:16 +0800

Similar to this lab, an SQLi vulnerability exists within trackingId. But the results of the SQL query are not returned, and the application does not respond any differently based on whether the query returns any rows or causes an error.

But the problem statement does mention that it’s possible to trigger time delays (duh), we are going to do just that. Let’s start by finding out which database type we are dealing with first, and after some trials and errors we should be able to determine that this is a PostgreSQL database - evident by the pg_sleep() syntax:

Visible error-based SQL injection | Practitioner

Thu, 16 Jul 2026 10:57:16 +0800

Similar to this lab, an SQLi vulnerability exists within trackingId. But this time, the server returns “helpful” error messages in its response. Take a look at the response when I tried to inject ' AND 1=1 (ending single quote deliberately excluded):

The server literally hands out the entire server-side query being executed. Since we know there is an users table, we can just perform a SELECT query for the administrator user right? Turns out there’s actually a character limit, and if our injected query gets too long then it will be truncated:

Blind SQL injection with conditional errors | Practitioner

Thu, 16 Jul 2026 10:02:16 +0800

This lab is quite similar to last lab, with an SQLi present in the tracking cookie. But this time there is no Welcome back! message or the like, so we cannot rely on the server to hand out freebies for us (rip). Notice that the server still processes nonsense injected SQL query inside trackingId, evident by this 500:

This gives us an idea, if the server does not reflect invalid query in the response, perhaps we can make it does? We can instead modify the query so that it causes a database error only if some conditions are satisfied, for example:

Blind SQL injection with conditional responses | Practitioner

Wed, 15 Jul 2026 15:15:16 +0800

The problem statement states that there is a tracking cookie used, and the server performs SQL queries containing the value of the submitted cookie. The results of the SQL query are not returned, and no error messages are displayed. But the application includes a Welcome back message in the page if the query returns any rows.

And the database contains a different table called users, with columns called username and password. So no need for database type and version fingerprinting.

SQL injection attack, listing the database contents on non-Oracle databases | Practitioner

Wed, 15 Jul 2026 13:01:16 +0800

Unlike previous labs where we are given the table names and its columns names already, this time we have to find them ourselves. Thankfully, every database contains what are called schemas - metadata about every other database. On non-Oracle databases, it’s usually information_schema.tables.

But before extracting data, we will need to find out the number of columns in the filter table. In this case, there are two columns:

Since injection is possible, one may think to query for everything inside the schema right? But since we are only given two columns to work with, and the schema table may contain more than two, it’s not possible to extract every data using UNION SELECT this way:

SQL injection attack, querying the database type and version on Oracle | Practitioner

Wed, 15 Jul 2026 10:01:16 +0800

In this lab, we are tasked with finding the version of an Oracle database. The query syntax is as follow:

SELECT banner FROM v$version
SELECT version FROM v$instance

First, we will need to find out how many columns there are. One thing about Oracle is that every SELECT must use the FROM keyword and specify a valid table. Since we are probing for NULLs, we should query from the built-in table DUAL otherwise our injected query will return 500: We now know that there are two columns in the filter table, we can then use either query syntax above to probe for the Oracle version as follow:

SQL injection UNION attack, retrieving multiple values in a single column | Practitioner

Wed, 15 Jul 2026 09:30:16 +0800

Similar to this lab, our goal is to extract data from the table users, with username and password stored in plaintext.

First, we will need to find out how many columns does the “filter table” contain: Again, there are two columns which is convenient for us as users also has two columns. What about the data types hold by those two columns? Unfortunately, not all columns can hold string data which is kinda bad news for us. Though it does return a 500 which means it’s processing our injected query server-side. Let’s find out which of the two columns holds those strings: So the silver lining is that one column can hold strings. However, users has two values to be fetched, meaning we will have to somehow combine two entries into one. This can be done by string concatenation, whereas username and password will be added together, separated by an unique symbol.

SQL injection UNION attack, retrieving data from other tables | Practitioner

Wed, 15 Jul 2026 09:06:16 +0800

The problem statement hints at the existence of an users table, with columns username and password (surprisingly stored in plaintext). So now our job is to fetch its content and log in as administrator.

First, we need to find how many columns in the “filter table”. Refer to this lab if you are not familiar with the technique:

There are two columns in this table, which is quite convenient for us as users also has two columns. What about the data type stored? Again, both columns can hold strings which is even more convenient for us as the two columns in users are also of string data type. Since we know what the columns’ names in users are, retrieving the credentials is trivial with the following injected query:

SQL injection UNION attack, finding a column containing text | Practitioner

Wed, 15 Jul 2026 08:41:16 +0800

The problem statement hints at the filter functionality has an SQLi vulnerability, and similar to last lab we have to find how many columns are there first, then find out which column holds string data.

Finding the number of columns is trivial, either use order by index or union select with NULL:

We now know that there are 3 columns in the table. However our goal is to make the backend returns a certain canary, but we don’t know which column is compatible with string data yet. This is quite simple, all we have to do is place some string value into each column in turn:

SQL injection UNION attack, determining the number of columns returned by the query | Practitioner

Tue, 14 Jul 2026 14:19:16 +0800

The most glaring functionality present is filtering products by category, as shown here:

As reflected in the lab’s name, the first step of a UNION-based SQLi is to determine the number of columns. We can either union order by index or select by NULL, whatever floats your boat.

Note that NULL works because it’s convertible to every common data type, thus makes our payload more likely to succeed.

Assuming there is no WAF nor client-side filters in place (which there aren’t), we can apply our elementary payload:

SQL injection vulnerability allowing login bypass | Apprentice

Wed, 03 Jun 2026 15:22:16 +0800

Very straightforward lab. Since we are trying to login as administrator, we can simply bypass the password check by having our payload as follow:

administrator'--

The trailing -- will comment out everything proceeding it, thus skipping the password check

Alternatively, we can solve this with a Python script:

import webbrowser
import requests
import sys
import urllib.parse

def inject(url):
 # Remove trailing slash
 url = url.rstrip("/")
 
 # Preparing payload
 url = f"{url}/login"
 params = {"username": "administrator'--", "password": "qwerty"}
 
 # Initiate request
 response = requests.post(url, data=params, allow_redirects=True)
 
 # Verify status code and open the webpage
 if response.status_code == 200:
 if "Log out" in response.text:
 print("Log in as administrator!")
 else:
 print("Failed to log in. Try again")
 else:
 print("Cannot initiate request") 
 
if __name__ == "__main__":
 if len(sys.argv) != 2:
 print(f"Usage: python3 {sys.argv[0]} <url>")
 sys.exit(1)
 inject(sys.argv[1])

SQL injection vulnerability in WHERE clause allowing retrieval of hidden data | Apprentice

Wed, 03 Jun 2026 14:31:16 +0800

We know that the application carry out the following query:

SELECT * FROM products WHERE category = 'Gifts' AND released = 1

To view all the unreleased product, my payload is:

Pets' OR 1=1 AND released = 0--

The 1=1 expression ensures the application displays every category. Thus the query shall be:

SELECT * FROM products WHERE category = 'Pets' OR 1=1 AND released = 0--' AND released = 1

Alternatively, we can “automate” this with the following Python script. This can serve as a barebone template for future use: