OR ## Basic Attack The first way to check whether an input field is vulnerable for an SQL attack is by sending an escape character. For example, if we have an input field as follow, we can include a string like `' OR 1=1#` to check whether it's vulnerable. Also you can try with a different terminator such as `' OR 1=1-- -` The `#` acts as a terminator to ignore the rest of the query after the symbol. ![[Input Field.png]] If the attack is successful, we should see all entries in a given table as follow. ![[Successful Attack.png]] Once we know a field is susceptible for an attack, we can use few techniques to exploit it and extract data from the database. ## UNION If we find an application is vulnerable to an SQL Injection attack, the most basic attack we can perform is an **UNION** based injection. With UNION we can include information from other resources such as tables and columns in to our output. ### Identifying the Number of Fields However, in order for UNION to work, the extracted number of fields should match the number in the original query. We can use the `null` parameter to first identify how many items are returned by the original query. ![[NULL try1.png]] Since we know `jeremy` is a valid input, this indicated we have the wrong number of fields in the union query. After few attempts, we arrive at the following output. This indicates that the original query is returning 3 fields. ![[UNION Success.png]] ### Verify Attack Next we can try to get the version number of the database to verify that our attack is working. ![[SQL Version.png]] ### Dumping Table Names Since we now know the attack is working, we can dump the table names in the database from the `information_schema.tables` table. ![[Table Names 1.png]] ![[Table Names 2.png]]