Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Blind SQL injection with out-of-band data exfiltration exploitation

Adéla | Last updated: Aug 15, 2024 04:04PM UTC

Hello, I am wondering if the labs are really vulnerable or there are some other checks? I was trying to solve the Blind SQL injection with out-of-band data exfiltration lab and as a first step I just wanted to check the connection. I used the correct payload and replace "SELECT YOUR-QUERY-HERE" with a simple query, for example "SELECT username FROM users LIMIT 1" and did not get any answer. When I replaced only the SELECT for the suggested and let the rest of the payload unchanged, I did get the response and solved the lab. I tried several different SELECT statements before I used the suggested one and I am wondering if they were all wrong or if the labs are somehow limited and not every payload works (even if it is correct)?

Michelle, PortSwigger Agent | Last updated: Aug 16, 2024 11:51AM UTC