SQL Injection – UNION attack | PortSwigger Lab Note #3

target：

• Lab URL:

https://portswigger.net/web-security/learning-paths/sql-injection/sql-injection-determining-the-number-of-columns-required/sql-injection/union-attacks/lab-determine-number-of-columns

• Tools Used:

1. browser

2. Burp suite

Vulnerability Summary：

• Type: SQL Injection

• Description:

To solve the lab, determine the number of columns returned by the query by performing a SQL injection UNION attack

Steps to Exploit：

1.Click any category to send a request to the server and check the query.

2.Modify the parameter multiple times, then try to determine the number of columns returned by the query.

3.If there are no errors, you have found the number of columns.

Remediation：

• Use parameterized queries (prepared statements) instead of dynamic SQL.

• Apply strict input validation on user-supplied data.

• Use least-privileged database accounts to reduce impact.

Lessons Learned：