SQL injection attack, querying the database type and version on MySQL and Microsoft - Lab#08
This lab contains a SQL injection vulnerability in the product category filter. Our goal is to exploit this vulnerability using a UNION-based SQL injection to retrieve the database version string from a MySQL or Microsoft SQL Server backend.
🎯 Lab Objective:
Perform a UNION SQL injection.
Retrieve and display the database version string in the response.
Solve the lab by proving you can query backend DBMS metadata.
🛠️ Steps:
Determine the number of columns and locate a string-compatible one (covered in earlier labs).
Inject a UNION SELECT query using the correct number of columns.
Replace one column with the version function @@version and fill others with NULL or placeholders.
✅ Example Payload (if there are 2 columns, and column 2 is string-compatible):
' UNION SELECT NULL, @@version--
📘 What You Learn:
How to extract environment metadata via SQLi.
Identify target DBMS based on version string output.
Fundamental reconnaissance step before crafting deeper injection chains.
#SQLInjection #DatabaseVersion #UNIONSQLi #WebSecurityAcademy #PortSwigger #MySQL #MSSQL #EthicalHacking #PenTesting #CyberSecurity #Infosec #Reconnaissance