SQL Injection – querying the database type and version | PortSwigger Lab Note #6

target：

• Lab URL:

https://portswigger.net/web-security/learning-paths/sql-injection/sql-injection-examining-the-database-in-sql-injection-attacks/sql-injection/examining-the-database/lab-querying-database-version-mysql-microsoft

• Tools Used:

1. browser

2. Burp suite

Vulnerability Summary：

• Type: SQL Injection

• Description:

Steps to Exploit：

1.Determine the number of columns and which columns contain string data.

2.If the error-based payload fails, try changing the comment format.

3.According to the cheat sheet, determine that the database version is
MySQL, and note the space after the double dash.

4.Solve the lab with the correct payload to disclose the MySQL version information.

Remediation：

• Use parameterized queries / prepared statements

• Use server‑side input validation

• Escape and sanitize user input

Lessons Learned：