SQL injection

Genrunic

4 min readSep 18, 2024

Sql Injection — TryhackMe WalkThrough

Task 1:

Task 2:

Task 3:

Task 4:

Task 5:

Start the machine

Add ‘ at the end of the link

This throws an error which proves the avaiability of sql vulnerabilty

The first thing we need to do is return data to the browser without displaying an error message. Firstly, we’ll try the UNION operator so we can receive an extra result if we choose it. Try setting the mock browsers id parameter to:

1 UNION SELECT 1

This statement should produce an error message informing you that the UNION SELECT statement has a different number of columns than the original SELECT query. So let’s try again but add another column:

1 UNION SELECT 1,2

Same error again, so let’s repeat by adding another column:

1 UNION SELECT 1,2,3

Success, the error message has gone, and the article is being displayed, but now we want to display our data instead of the article. The article is displayed because it takes the first returned result somewhere in the website’s code and shows that. To get around that, we need the first query to produce no results. This can simply be done by changing the article ID from 1 to 0.

0 UNION SELECT 1,2,3

You’ll now see the article is just made up of the result from the UNION select, returning the column values 1, 2, and 3. We can start using these returned values to retrieve more useful information. First, we’ll get the database name that we have access to:

0 UNION SELECT 1,2,database()

You’ll now see where the number 3 was previously displayed; it now shows the name of the database, which is sqli_one.

Our next query will gather a list of tables that are in this database.

0 UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables WHERE table_schema = ‘sqli_one’

The query results provide three columns for the staff_users table: id, password, and username. We can use the username and password columns for our following query to retrieve the user’s information.