Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Alomancy | Last updated: Apr 15, 2021 01:50AM UTC

When entering the payload in a browser you need to exclude the ' category='UNION+SELECT+null,@@version# will not work, however: category=UNION+SELECT+null,@@version# Will work. Further testing shows that either of these strings work when using burp. ' included or not. If you do want to use the browser with ' you need to use the --+ escape: category='UNION+SELECT+null,@@version--+ Encoding ' has no effect and will not work in the browser. I feel this is not intentional and a bug within the lab itself as executing SQLi without using ' could teach new learners bad practice and furthermore entering the correct payload and it not working is not productive and frustrating. If you need more information or screenshots, I am happy to provide.

Uthman, PortSwigger Agent | Last updated: Apr 15, 2021 12:46PM UTC