Apprentice
← all rooms
SQL Injection Hard

SQL Injection

Dump secrets with error-based UNION injection, then extract data blindly.

Mission briefing

NewsDesk runs a small article archive backed by a database. Editors can pull articles by numeric id and filter archives by publish date. The backend builds queries from request parameters—find out whether data can leak.

0 / 2 tasks 0 / 25 pts

Objectives

  • Recover the admin password via UNION SELECT
  • Confirm a boolean blind injection on the count endpoint
Task 1 Error-Based / UNION SQLi Medium 10 pts

Scenario

NewsDesk's article viewer looks up rows by id from the query string. Errors from the database sometimes echo back to the page. Recover credential material stored in the users table.

Your approach

  1. Request a valid article id, then probe with a quote to trigger an error.
  2. Count columns with ORDER BY or UNION probes until the query succeeds.
  3. Union-select username and password fields from the users table.
  4. Read the admin password or flag value from the rendered result.
  5. Submit that recovered secret as your answer.

The article id is concatenated into the query. Dump the users table.

Open lab →
Hint

?id=-1 UNION SELECT 1,username,password,4 FROM users

Task 2 Blind SQLi Hard 15 pts

Scenario

The archive filter accepts a date and returns only how many articles matched—no row details. Different inputs change the count in predictable ways. Prove you can distinguish true from false conditions blindly.

Your approach

  1. Submit a normal date and note the numeric count returned.
  2. Append a always-true condition and confirm the count stays the same.
  3. Append an always-false condition and confirm the count drops.
  4. Use that behaviour to show boolean inference works on this endpoint.
  5. Submit the task flag once the lab registers a successful blind test.

The count endpoint only returns how many rows matched.

Open lab →
Hint

?date=2020' AND '1'='1 vs ' AND '1'='2