The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How do I solve SQL Injection Lab #11?

Zephyr | Last updated: Aug 20, 2021 02:29AM UTC

Hi, I am working through lab #11: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses After finding out how many characters there are in the admin's password, the final stage is to crack the password one character at a time. I am using Burp Suite, but for some reason none of my SQL injections are working when I put them through the intruder. I know this because the webpage is not returning any "Welcome back!" messages. Below is my SQL statement, but I cannot see anything wrong with it. 'x' is a placeholder. I use the intruder to test characters from 0-9 and a-z and get no results. ' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='x'--

Michelle, PortSwigger Agent | Last updated: Aug 23, 2021 08:49AM UTC