Portswigger SQLi-Lab 2

ARZ101
3 min readJun 4, 2021

--

Hello everyone , I hope you are doing well , in this post I will be sharing my solution for portswigger SQL Injection Lab 2 which involves continuation from the previous lab so let’s do it

SQL injection UNION attack, finding a column containing text

So in this lab following the previous one , we know that the category parameter is vulnerable to sqli and we know the exact number of columns so we can perform union based sqli . Here we need to show a random string using union sqli so let's begin

We can see the random string that we need to retrieve so selecting any category will make the url appear with the GET parameter category

Performing union based sqli

The reason we used null is because we don't know yet the data type of the columns being used in the table so by supplying null data type it's convertible to every data type that is why used it so it can increase our chances that column count is correct we won't get any errors

Now to retrieve the random string we first need to identify which column is using data type string or varchar in DBMS terms. We can use version() which returns the version of database being used as string so we can use it to identify which column is using string data type

The first column is not compatible , let’s try the second column

Neat , we now know the second column uses string data type so we can just add random string like this

Gifts' union select null,'hXl2ys',null --

The reason we are using single quotes is because this is a string

With this we have solved this lab

--

--