Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

LAB: SQL injection attack, querying the database type and version on MySQL and Microsoft

Antonio | Last updated: Apr 03, 2020 09:13AM UTC

There's a bug in the solution (at least trying it out with latest chrome): # is understood as a url delimiter for anchor. It needs to be escaped. A correct solution is: ' UNION SELECT @@version, NULL%23

Ben, PortSwigger Agent | Last updated: Apr 03, 2020 10:51AM UTC

Hi, As noted in the solution, we are assuming that you are using Burp to intercept and modify the requests within this lab. If you are using this method to deliver the payloads then you do not to alter the described solution. If, however, you are simply entering the payloads in the address bar of your browser then yes, you do need to carry out some extra work to get this to work.

Sebastião | Last updated: Apr 06, 2020 07:47PM UTC

Hi,Ben. I also have this problem.

Ben, PortSwigger Agent | Last updated: Apr 07, 2020 07:10AM UTC

Hi, Have you tried using Burp to deliver the payload as i noted in my previous message?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.