Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: SQL injection attack, querying the database type and version on Oracle

I | Last updated: Sep 04, 2023 06:45PM UTC

Hello there, I don't know if this legal but I'm going to write exactly what I did and the error I encountered (It doesn't say I have solved the lab). So I determined the number of columns required for the Query and determined which one is of the string data type. Having done that, I queried the database and retrieved the string (database type and version on Oracle) and it returned successfully in the application response. However it doesn't say I have solved the lab. The following is/are the commands I used which will reproduce the error I faced: 'UNION SELECT 'Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production, PL/SQL Release 11.2.0.2.0 - Production, CORE 11.2.0.2.0 Production, TNS for Linux: Version 11.2.0.2.0 - Production, NLSRTL Version 11.2.0.2.0 - Production', NULL FROM dual --

Ben, PortSwigger Agent | Last updated: Sep 05, 2023 09:05AM UTC