---
description: >-
  https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text
---

# SQL injection UNION attack, finding a column containing text

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FzrJ7up1jOKNcwY5tieKe%2F1.png?alt=media&#x26;token=5a55d07a-6e1c-4295-a079-826bbdaf5e4d" alt=""><figcaption></figcaption></figure>

Let's filter for `Accessories`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FR728r0w2k2xOcSLN0ZoG%2F2.png?alt=media&#x26;token=e88f1027-585d-4587-b8bb-4add857e8948" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to the `Proxy > HTTP History` tab to view this request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FrcggnfZHTXtO70NWWIbv%2F3.png?alt=media&#x26;token=5c8e4b5e-b320-4185-95b5-043b9bed0b91" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater`, let's set the `category` parameter to the following:

```
UNION SELECT NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FhHqWpdEkXCyX2Zv2N5gH%2F4.png?alt=media&#x26;token=8a575d0b-e4f9-4d0e-aaf0-efea03083433" alt=""><figcaption></figcaption></figure>

Since the application returns an error, we know that the number of columns in the current query is more than 1.

Let's try for two columns:

```
UNION SELECT NULL,NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FodFyC9KARd093uoEAJ5V%2F5.png?alt=media&#x26;token=001b2cc7-ad53-41fe-984f-e5e2a511f1e0" alt=""><figcaption></figcaption></figure>

The application again returns an error.

Let's try for three columns:

```
UNION SELECT NULL,NULL,NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F6bnl3nWDlsKhokKLnJhs%2F6.png?alt=media&#x26;token=ea1caf58-c743-4b18-a2e5-2e1529506b64" alt=""><figcaption></figcaption></figure>

The application no longer throws an error which means that there are 3 columns in the current query.

Now let's change one column to a string instead of `NULL` and observe the behaviour.

```
UNION SELECT 'test',NULL,NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FDkGxgr3Q8MLvTeHeerKN%2F7.png?alt=media&#x26;token=a119d411-9ad1-489d-a0b6-72e9a467f32f" alt=""><figcaption></figcaption></figure>

That tells us that the first column is not compatible with string data.

Let's move on to the next column.

```
UNION SELECT NULL,'test',NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FSPC2ICofjZozmAvHECn3%2F8.png?alt=media&#x26;token=5b356ea0-d977-499a-85b8-523eaa8c4296" alt=""><figcaption></figcaption></figure>

We can see that the second column is compatible with string data.

Now all we have to do is replace `test` with the string that we have to make the database retrieve.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FuW1KzN2xmDvlijUiqrUT%2F9.png?alt=media&#x26;token=8d85e26d-db40-47e4-8664-8ab45aafedba" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FBYLaQwbIIGZMocMaOSXE%2F10.png?alt=media&#x26;token=f5f0b237-c8f5-4ea8-8524-7036ae0eec05" alt=""><figcaption></figcaption></figure>
