SQL injection UNION attack, retrieving multiple values in a single column

Let's filter for Accessories.

Since we are proxying the traffic through Burp Suite, we can go to the Proxy > HTTP History tab to view this request.

Let's forward this request to the Repeater for further modification.

Once in the Repeater, let's set the category parameter to the following:

' UNION SELECT NULL--

Since the application returns an error, we know that the number of columns in the current query is more than 1.

Let's set the category parameter to the following:

' UNION SELECT NULL,NULL--

Now that we know the current query has two columns, we can retrieve the usernames and password from the username and password columns respectively.

' UNION SELECT NULL,username||':'||password FROM users--

The || characters are used to concatenate strings together. So we are essentially dumping the username and password in the same column in the following format:

username:password

We can now login as the admin using the following credentials:

Username	Password
administrator	fq4yq6966ve3gff4iz65

We have solved the lab.