SQL injection with filter bypass via XML encoding

This lab contains a SQL injection vulnerability in the stock check feature.
Because the query results are reflected directly in the application’s response, we can use a UNION-based SQL injection attack to retrieve arbitrary data from other tables.

The target database contains a table named users, with the standard fields:

• username
• password

The goal is simple:

1. Exploit the SQLi in the stock check function
2. Extract the administrator credentials
3. Log in to the admin account to solve the lab

🔍 Step 1 — Understanding the WAF Behavior

The moment I submitted a standard UNION payload, the app instantly blocked it:

This tells us:

• The WAF is actively scanning the input
• Classic keywords like UNION SELECT, --, /*, or even certain symbols will immediately trigger the block

🌀 Step 2 — Bypassing the WAF With Obfuscation

To dodge the WAF, I used HeckVector, which encodes SQL keywords using HTML entities or mixed case variations. This transforms the payload into something that still evaluates correctly but doesn’t look dangerous to the firewall.

The payload passed the WAF, but the backend responded with:

null

Meaning:

• The query executed
• But the returned columns/data did not match what the application prints

🏗️ Step 3 — Matching Column Count & Data Types

Payloads like:

' UNION SELECT NULL, NULL--

still returned:

null

So the column count was correct — but NULL does not display, so we need actual text.

🎯 Step 4 — Extracting Usernames & Passwords

Most labs use a users table containing username and password.
So we retrieve them:

' UNION SELECT username, password FROM users--

Or a cleaner format:

' UNION SELECT username || ':' || password, NULL FROM users--

Result:

✅ Step 5 — Log In as Administrator

With the password recovered, simply log in:

Lab solved.

🧩 Summary