Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

LAB: SQL injection attack, querying the database type and version on MySQL and Microsoft

Antonio | Last updated: Apr 03, 2020 09:13AM UTC

There's a bug in the solution (at least trying it out with latest chrome): # is understood as a url delimiter for anchor. It needs to be escaped. A correct solution is: ' UNION SELECT @@version, NULL%23

Ben, PortSwigger Agent | Last updated: Apr 03, 2020 10:51AM UTC

Hi, As noted in the solution, we are assuming that you are using Burp to intercept and modify the requests within this lab. If you are using this method to deliver the payloads then you do not to alter the described solution. If, however, you are simply entering the payloads in the address bar of your browser then yes, you do need to carry out some extra work to get this to work.

Sebastião | Last updated: Apr 06, 2020 07:47PM UTC

Hi,Ben. I also have this problem.

Ben, PortSwigger Agent | Last updated: Apr 07, 2020 07:10AM UTC