SQL injection: UNION-based data extraction
A product category filter builds its SQL by string concatenation. Use a UNION SELECT to read the application's user credentials.
Scenario
The shop lists products by category:
GET /filter?category=Accessories
The category value is concatenated straight into a SQL query against a MySQL
database. The results of that query render on the page, so a UNION-based
attack will pull data back in the same response.
Your objective
Recover the password for the administrator account from the users table and use it to sign in. The lab is solved when you reach the admin area.
Capture 2 flag(s) and record the exact technique for each step.
Getting started
- Add
'to thecategoryvalue and confirm the query breaks. - Use
ORDER BY 1--,ORDER BY 2--, … to count the columns the query returns. - Use
UNION SELECT 'a','b'--to find which columns are printed on the page. - Query
information_schema.columnsto confirm theuserstable columns, thenUNION SELECT username, password FROM users--. - Submit the two flags: the number of columns, and the recovered admin password.
Connecting
Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.
Credentials: No login needed to start — the filter is public.
Hints
Tip
In MySQL, -- must be followed by a space. URL-encode it as --+ or use # (%23).
How to connect
Connect to the lab VPN first
Lab machines sit on an isolated network with no public address. Connect to the VPN once — the same config works for every lab.
1 · Get your config
Download rooted-labs.ovpn2 · Connect
Linux / macOS — from a terminal:
Windows / mobile — import the file into OpenVPN Connect, Tunnelblick, or the OpenVPN GUI.
3 · Reach the machine
Once connected, the address shown below (SSH command / lab link / RDP command) is reachable. Only lab traffic is routed through the VPN — your normal internet is untouched.
Step 2 — reach the machine
Open the lab in your browser:
Open labCredentials: No login needed to start — the filter is public.
The app can take a few more seconds to finish booting after the link appears.
Starting the container — your link will appear here automatically.
Launch the lab (sidebar) to get your link.
SSH into the machine:
Password for rabbit:
Log in as rabbit (has sudo). First login may take a few seconds while SSH finishes starting.
Provisioning — the SSH command will appear here when the machine is ready.
Launch the lab (sidebar) to get the SSH command.
Challenge questions
0 / 2 correct- Submit the initial flag you recovered while solving this lab.
- Which vulnerability class does this lab cover? (a few words)
On this page
Access
FREEAt a glance
- Operating system
- Web application
- Connection
- Browser / HTTP
- Questions
- 0 / 2 solved
- Launched by
- 0 hackers
- Maintained by
- Tutor Demo
Your machine
Status
Booting your machine — this takes about a minute. Connection details appear in the brief below when it's ready.
Ready — see How to connect below.
Provisioning failed. Hit Relaunch to try again.