Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Alomancy | Last updated: Apr 15, 2021 01:50AM UTC

When entering the payload in a browser you need to exclude the ' category='UNION+SELECT+null,@@version# will not work, however: category=UNION+SELECT+null,@@version# Will work. Further testing shows that either of these strings work when using burp. ' included or not. If you do want to use the browser with ' you need to use the --+ escape: category='UNION+SELECT+null,@@version--+ Encoding ' has no effect and will not work in the browser. I feel this is not intentional and a bug within the lab itself as executing SQLi without using ' could teach new learners bad practice and furthermore entering the correct payload and it not working is not productive and frustrating. If you need more information or screenshots, I am happy to provide.

Uthman, PortSwigger Agent | Last updated: Apr 15, 2021 12:46PM UTC

Hi, Thanks for your feedback. Can you share some further feedback or screenshots with support@portswigger.net? You would not always be pasting the payload directly in the browser. In general, most people would be using a proxy tool to bypass any browser protection and see if the SQL injection exists and is exploitable. Does the solution allow you to complete the lab?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.